Although CPAs are uniquely qualified
to assist small and
entrepreneurial businesses in
improving their internal control systems,
their recommendations are often quickly
dismissed as costly or unnecessary bureaucracy.
Many smaller entities associate internal
control with a simple separation of
duties—a powerful internal control itself—
but it is much more than just maintaining
security. CPAs should reframe the discussions
they have on internal control in accordance
with the newly updated Committee
of Sponsoring Organizations (COSO)
Internal Control–—Integrated Framework
(http://www.coso.org/documents/990025P_
Executive_Summary_final_may20_e.pdf).
Internal Control Discussions
COSO’s definition of internal control is
“a process, affected by an entity’s board of
directors, management, and other personnel,
designed to provide reasonable assurance
regarding the achievement of objectives relating
to operations, reporting, and compliance.”
It also identifies five components of internal
control: the control environment, risk
assessment, control activities, information
and communication, and monitoring. CPAs
can use the framework and its underlying
directions on operational, reporting, and compliance
objectives to advise small and
entrepreneurial organizations on how they
can improve both their business operations
and bottom line.
Achieving entity objectives relating to
the efficiency and effectiveness of operations
includes suggestions to minimize
errors, as well as the time spent correcting
errors that may occur (e.g., automation
of business processes). Financial reporting
objectives include controls that ensure
all conducted transactions are reported in
the proper period. For example, if a sales
order is inadvertently not closed and billed,
the revenue is not likely to be collected;
however, the company will have incurred
the related expense. Examples of compliance
objectives includes activities to ensure
the proper sales taxes are remitted to the
taxing authority, as well as collected
when due. The failure to properly invoice
and remit sales taxes can result in a significant
liability, including penalties and
interest. In fact, any one of the above transactions
can be significant for a smaller
organization if not properly handled.
When approaching owners of small and
entrepreneurial organizations about the
importance of strong internal controls, CPAs
should not begin by discussing the role of
internal controls in reducing the risk of
misappropriation of assets; rather, they
should introduce the topic using the COSO
framework’s control environment comp