for misappropriation of assets. The reference
might not elaborate or even disclose
the true nature of the termination, but the
potential employer might discern hesitance
or negativity in regard to the applicant.
Separation of duties requires that no single
person handles a transaction from its
beginning (authorization) to end (recording
in the financial statements). It
involves having different personnel responsible
for the authorization, safeguarding,
and recording of transactions. One example
is having one employee open the mail
and prepare a listing of the customer payments
received (perhaps a deposit slip in
a small organization), as well as stamping
each check for deposit only (restrictive
endorsement); another employee recording
the payments against customer accounts;
and a third reconciling the bank account.
Separation of duties is a powerful tool
against error and fraud; however, owners
and managers should be aware that collusion—that
is, when two or more individuals
work together to circumvent controls—could
occur when individuals are
able to bypass processes and procedures
for their own benefit. Often, many elements
of separation of duties can be achieved with
little additional expense by dividing job
duties among current employees or even
having the CPA firm cover one set of
duties (e.g., reconciling the bank statement).
Entities must determine the cost of
controls versus the benefit received.
Lastly, information technology controls
cannot be forgotten. As per the Trust
Services Framework, developed by the
AICPA and the Canadian Institute of
Chartered Accountants, reliable information
systems have security as their underlying
foundation. Secure systems provide
the environment in which the other four
categories of the framework for reliable
information systems are upheld: confidentiality,
privacy, processing integrity, and
availability. These areas are crucial,
because technology and integrated accounting
systems are increasingly being utilized.
These internal controls include both general
controls and application controls.
General controls include controls to limit
access, such as passwords or locks, as well
as disaster recovery controls; application
controls include limiting access to certain
programs, as well as automated controls,
such as data validity checks and sequence,