Are You Using Internal Controls ?

During the last several years we have seen an increase in the number of embezzlement cases. Embezzlement can occur at any time whether the economy is up or down. In the majority of cases, embezzlement occurs when there is a lack of internal control.

The goal of internal control is as follows:

  • Safeguard an organizations assets
  • Remove temptation
  • Provide Proper Documentation of Financial Activities


One effective internal control technique to compare a financial budget to actual activities monthly. If deviations from the budget are carefully followed up by the treasurer or executive director, the likelihood of a large misappropriation taking place without being detected fairly quickly is reduced considerably. This type of overall review of the financial statements is very important, and every member of the board should ask questions about any item that appears out of line either with the budget or with what would have been expected in the actual figures.

The American Institute of Certified Public Accountants has issued the following Internal Control guidelines:

Pre numbered receipts should be issued for all money (cash and checks) at the time it is first received. A duplicate copy should be accounted for and a comparison eventually made between the aggregate of the receipts issued and the amount deposited in the bank. The purpose of this control is to create a written record of the cash (and checks) received. The original of the receipt should be given to the person from whom the money was received; the duplicate copy should be kept permanently. Eventually a comparison should be made between the aggregate of the receipts issued and the amount deposited in the bank.

Cash collections should be done by two people whenever possible, particularly where it is not practicable to issue receipts, or it is not appropriate to give a receipt. The cash should be counted by both people and a summary made and signed by both parties. It should then follow the proper channels to be deposited. All money counting, deposit preparation, and depositing at the bank, should always be done by 2 people. This is to insure the money equals the deposit and the deposit makes it to the bank intact.

All receipts should be deposited in the bank, intact and on a timely basis. The purpose of this control is to insure that there is a complete record of all receipts and disbursements. If an organization receives cash receipts, no part of this cash should be used to pay its bills. The receipts should be deposited, and checks issued to pay expenses. In this way, there will be a record of the total receipts and expenses of the organization on the bank statements. The procedure does not prevent someone from stealing money but it does mean that a check must be used to get access to the money.

Two persons should open the mail and make a list of all receipts for each day. This list should be compared to the bank deposit by someone not handling the money. Receipts in the form of checks should be restrictively endorsed with the organizations bank stamp promptly upon receipt. Two persons should open the mail; otherwise there is a risk that the mail opener may misappropriate part of the receipts. This can impose a heavy burden on a small organization with only one or a few employees but it is necessary if good internal control is desired. The other purpose of making a list of all checks received is to ensure that a record is made of the amount that was received. This makes it possible for a supervisor to later check to see whether the bookkeeper has deposited all amounts promptly.

All disbursements should be made by check and supporting documentation kept for each disbursement. This control is to insure that there will be a permanent record of how much and to whom money was paid. No amounts should be paid by cash, with the exception of minor petty cash items. For the same reason, no checks should be made payable to "cash." Checks should always be made to a specific person or organization, including checks for petty cash reimbursement. All check requests should be authorized and signed by someone other than the bookkeeper, or the person who issues the checks.

Two signatures should be required on all checks especially if the bookkeeper is one of the check signers. This control is to insure that no one person is in a position to disburse funds and then cover up an improper disbursement in the records. Ideally, bookkeepers should not be one of the check signers. Just like the person going to the bank to make a deposit should not be a check signer. Try to keep the accounting separate from the actual money handling. They should be different people.

A person other than the bookkeeper should receive the bank statements directly from the bank and reconcile them. This control is to prevent the bookkeeper from fraudulently issuing a check for personal use and, as bookkeeper, covering up this disbursement in the books.

Someone other than the bookkeeper should authorize all write offs of accounts receivable or other assets. This control is to insure that a bookkeeper who has embezzled accounts receivable or some other assets will not also be in a position to cover up the theft by writing off the receivable or asset.

Marketable securities should be kept in a bank safe deposit box or held by a custodian in an account in the name of the organization. This control is to insure that securities are protected against loss by fire or theft or from bankruptcy of a brokerage house. This is also a good place to keep a tape backup of your accounting on a monthly/yearly basis. Off site storage.

Fixed asset records should be maintained and an inventory taken periodically. These procedures insure that the organization has a complete record of its assets. The permanent record should contain a description of the asset, cost, date acquired, location, serial number, and similar information. It is also a good way to provide information for fire insurance/theft claims.

Excess cash should be maintained in a separate bank or investment account. Withdrawals from this account should require two signatures along with the proper requested and signed documentation.

It is also recommend to hold fidelity insurance. Fidelity insurance protects an organization from embezzlement loss. This insurance does not cover theft or burglary by an outside person, it provides protection only against an employees or volunteers dishonesty.

Every organization is unique and thus should draft unique internal controls. It is imperative for internal controls to be documented through a written procedure manual.