This is a true story. 

Several years ago the audit firm finished the exam of a mid size food wholesaler and issued a clean audit opinion.  There was one comment in the internal control letter to the owners:  the same employee receives cash payments, prepares and posts billings and accounts receivable, and sends out past due notices.  She had been doing it for years.  The owners ignored the comment, concluding separating those duties would be too costly in additional payroll expense.  Besides, they trusted her.

The auditors contacted the company about 10 months later to schedule the interim field work for the next year’s exam.  The compromised employee left.  Subsequent police investigation concluded she probably left the country.

Forensic audit work by a different audit firm, which was hired by the insurance company at risk on the errors, omissions and theft insurance policy, showed that she had begun taking cash and underposting the sales receipts within a couple of weeks from the conclusion of the prior year audit.  The forensic audit ended once $50,000 in losses were proven, although informed estimates placed the loss likely in the hundreds of thousands of dollars.  The company was extraordinarily profitable, so the owners never missed the money.  It only showed up when the audit firm asked to schedule the next exam.  That’s when the employee disappeared. 

Subsequently, the company hired an additional bookkeeper to separate the transaction and posting duties.  Eventually, upon the long standing recommendation of the original audit firm, the company hired a full time controller.

The point is not to be so profitable that you don’t miss the dollars stolen.  The point is that following some simple accounting control rules is critical.  Separate duties. Have checks and balances.  Have someone supervising and reviewing the activity.  That can be a full time controller, or a part time CFO.  But there must be oversight.

Even small companies, where the owner is hands on, need to at least address the internal control issue.  Unless the owner is truly processing all of the transactions, doing all of the postings and financial statement preparation, personally reconciling the accounts and signing the checks, separation of duties is critical.  If there is just one other person involved, besides the sole owner (that includes partners, married couples, long time friends, and family) prudence requires that proper internal accounting controls be put in place.  It does not require lots of expense, often just a reassignment of duties and proper supervision.

Sometimes, the internal controls will still fail to prevent theft or fraud.  The procedures might not be followed, there might be collusion among employees, the checks and balances might be poorly designed.  But, without any separation of duties in critical cash processing, billings, payments and posting, the business has no protection at all.  You might as well change your logo to a big bulls eye  because the temptations are high, and you are a target.

Oh, and I would recommend theft loss limits higher than $50,000.