Most everyone knows the story of David and Goliath (1 Samuel 17). The fight was between two men. David, the youngest of eight sons, had no training or experience in battle and only a few stones and a sling. Goliath was a huge man in heavy armor who was the champion of his nation. He was hardened by battle and showed no mercy to any man who decided to face him.
As they walked onto the battlefield and Goliath peered at his opponent, he surely was confident he would win the battle. David was dressed in a tunic with no armor, and, as best as Goliath could see no sword, spear, javelin, nor shield. Goliath shouted insults at his opponent and David returned fire with words of defiance confidently because he had God on his side.
Goliath moved toward David to slay him, and David in turn ran toward Goliath. He slung one stone that struck Goliath on the forehead. The giant fell to the ground and David finished the man with Goliath’s own sword. I believe the moral to this story is that you can accomplish anything with God on your side.
However, it’s probably naïve to think God will protect your business from fraudsters without putting forth come effort. Small businesses (fewer than 100 employees) have a higher risk of fraud occurring than larger companies. Lack of internal controls is one of the contributing factors. Small business owners often feel they can’t implement segregation of duties (SOD) because they don’t have enough employees.
While this may be true, SOD is a preventative control and can still be used by small companies. Here are four recommendations to help small business owners enhance the control structure within their organization:
- Include employees outside of accounting. A common mistake is to assume that accounting employees are the only people responsible for maintaining internal controls. Owners should include other department personnel in the control process, which means there are more people available to properly implement SOD. For example, rather than limiting these procedures to the accounting employees, a project superintendent could enter purchase orders, the invoice could be approved by the project manager, and the check could be cut by someone in accounting. The more people and departments involved in the process, the stronger the controls.
- Partially implement SOD. The purpose of SOD is to separate duties so that multiple people are involved in a single transaction. Usually companies throw in the towel if they can’t separate all three duties (access, authorization, and accounting), but separating two is better than separating none. This requires some creative thinking and proper planning, but it isn’t impossible for the small business owner.
- Outsource some or all of the accounting processes. There are outsourcing services available which can provide an additional option for small business owners trying to implement SOD. The outsourcing firm can provide additional resources and knowledge to enhance the control environment and make implementing SOD fairly easy.
- SOD is not the only internal control available to business owners. Business owners should be actively involved in monitoring the accounting activities of their company. Successful business owners are very good at the operations side of the business, but a lot of times, they are oblivious to the accounting process. Monitoring the detailed banking transactions (not just the daily cash balance) on a periodic basis is a great way to stay involved, and business owners should always have some training and willingness to explore the transactions recorded in the accounting system. Outside professionals can also advise an owner of the types of information they should review and how frequently they should review it.
Just like David and Goliath, size isn’t important when it comes to having a sound internal control structure. It is all about an owner’s commitment to implementing SOD and having a zero tolerance for fraud. Next week, I will provide an update on the sod in my new yard and wrap up this SOD series.