Performing Internal Audits

What is an internal audit?

The Institute of Internal Auditors defines an internal audit as "... an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes."

Put another way, an internal audit reviews and evaluates current processes, looks for areas of risk, and makes sure financial and operational information is accurate and reliable. An internal audit helps make sure your assets are safe and your business is free from fraud or other illegal activity.

As you can tell, an internal audit can be a thorough, in-depth, comprehensive look at all of your business documents, records, processes, and accounts. What if you run a small business and just want to make sure you're not the victim of fraud? Focus on these key areas:

• Bank accounts. Pull your last three bank statements. Match deposit slips with deposits. Match canceled checks and other debits with account debits. Look for missing or inaccurately recorded transactions. And make sure your processes are being followed. For example, you may require one employee to prepare and make deposits while another employee is responsible for reconciling sales and bank statements. Make sure any internal control processes are being followed.
• Revenue. This step is especially important if you run a retail or multi-transaction business, but it also applies to any type of business. At random, pull three or four days' worth of sales receipts. Match those receipts to bank deposits made. Ensure that what came into your business stayed in your business.
• Purchase orders and invoices. Purchase order totals should match the corresponding invoice for the goods and services you agree to purchase. If you authorize a purchase order for $1,500 and when the invoice is paid the total is $2,000, what caused the increase in spending? Did you authorize that increase? Did you receive the goods or services you actually paid for? Especially check long-term or recurring spending; in some cases you may no longer need what you have grown accustomed to paying for.
• Employees. If you have hourly employees, match time cards or attendance data with wages paid. Especially check on overtime or bonus pay; make sure that expense was not only authorized but that the work did in fact take place. Also verify that wage levels have not changed without your – or an authorized party's – permission. Finally, make sure no "phantom" employees exist; while relatively rare, in larger companies it's possible for a fictitious person to be on the payroll (especially if you use direct deposit) with another employee pocketing the money. An easy way to catch phantom employees is simply to occasionally hand out the paychecks yourself; it's hard to give a paycheck or pay stub to an employee who doesn't exist.
• Inventory. Periodically check inventory levels, matching what is on hand with what should be on hand. Also, don't forget incoming items; set up a process where two people are responsible for receiving and storing incoming inventory. One easy way to prevent inventory theft is to post check-off sheets showing the inventory on hand, what is removed from inventory, and by whom. An employee might be more tempted to steal items if they feel no one will notice right away; posting current inventory totals makes theft less tempting.
• Assets. Pull out your current list of assets and review it. Verify all assets are accounted for (and hopefully in use). If items are missing, find out why. If items are no longer in use, see if they can be returned to use, sold, or written off the books.
• Review the books. Embezzling is easier when your bookkeeping is sloppy or, worse, unsupervised. While you don't need to be an accountant, you do need to understand the basics of your accounting system. Ask your accountant for guidance or take a class. Where bookkeeping is concerned, the phrase "trust but verify" definitely applies.

Take the process a step farther and bring in an outside auditor. The process doesn't have to be expensive or too time-consuming. Have an accounting professional audit your books and your basic financial processes. Ask for what some people call a "fraud audit" instead of a general audit; let the auditor know you specifically want to ensure that no illegal or fraudulent activity is taking place. A fraud audit is much less expensive and takes a lot less time than a general, comprehensive audit.

Perform your external audits on an annual but irregular basis; that way no one will know exactly when the auditor might show up -- and won't be able to take steps to cover up fraudulent activity. Employees may be tempted to steal from your company if they feel no one is looking – or will look. An external audit could be the ounce of prevention that creates a pound of cure.

Don't just leave it to external auditors – perform your own internal audits as well. Not only will you avoid fraudulent activity, but you'll also gain a better understanding of and day-to-day feel for the operation of your business.