Many steps can be taken to safeguard both information and physical assets from theft, unauthorized use, and vandalism. Chapters 7 and 8 discuss the many computer theft based controls that can be put into place to safeguard assets. In addition, it is important to
Maintain accurate records of all assets. Periodically reconcile the recorded amounts of company asset such as inventory, equipment, cash, and securities to physical counts of those assets.
Restricted access to assets. Restricted storage areas are used to protect inventories and equipment. Cash registers, safes, lockboxes, and safety deposit boxes limit access to cash, securities, and paper assets. Over $1 million was embezzled from Perini Corp. because of poor controls. Blank checks were kept in an unlocked storeroom. Employees simply took a check, made it out to a fictitious vendor, ran it through the check-signing machine, which was left unlocked, and cashed the check.
Protect records and documents. Fireproof storage areas, locked filing cabinets. backup files, and off-site backup locations are effective means of protecting records and documents. Access to blank checks and documents should be limited to authorized personnel. In Inglewood, California, a janitor was charged with stealing 34 blank checks while cleaning the city finance office. He forged the names of city officials on the checks and cashed them in amounts ranging from $50,000 to $470,000.
Independent Checks on Performance
Internal checks to ensure that transactions are processed accurately are another important control element. These checks should be independent, because they are more effective if performed by someone other than the person who is responsible for the original operation. The following independent checks are typically used in businesses:
-Top-level reviews. Management at all levels should monitor company results and periodically compare actual company performance to (a) planned performance, as shown in budgets, targets, and forecasts; (b) prior period performance: and (c) the performance of competitors.
-Analytical review. An analytical review is an examination of the relationships between different sets of data. For example, as credit sales increase, so should accounts receivable. In addition. there are relationships between sales and other accounts such as cost of goods sold, inventory, and freight out. Management should periodically analyze and review these relationships to detect fraud and other business problems.
-Reconciliation of two independently maintained sets of records. One way to check the accuracy and completeness of records is to reconcile them with other that should have the same balance. For example, a bank reconciliation verifies that company checking accounts agree with bank statements. Another example is comparing the accounts receivable subsidiary ledger total with the accounts receivable total in the general ledger.
-Comparison of actual quantities with recorded amounts. Periodically count significant assets and reconcile the count to company records. The cash in a cash register drawer at the end of each clerk's shift should be the same as the amount recorded on the cash register tape. All inventories should be counted at least annually and the results compared with inventory records. High-dollar-value items, such as jewelry, should be counted more frequently.
-Double-entry accounting. The maxim that debits must equal credits provides numerous opportunities for internal checks. For example, debits in a payroll entry may be allocated to numerous inventory and/or expense accounts by the cost accounting department. Credits are allocated to several liability accounts for wages and salaries payable, taxes withheld, employee insurance, union dues, and so on by the payroll department. At the conclusion of these two complex operations, the comparison of total debits with total credits provides a powerful check on the accuracy of both processes. Any discrepancy indicates the presence of one or more errors.
-Independent review. After one person processes a transaction, a second person sometimes reviews the work of the first. The second person checks for proper authorization signatures, reviews supporting documents, and checks the accuracy of crucial data items such as prices, quantities, and extensions.
Information and Communication
The seventh component of COSO's ERM model is information and communication. The primary purpose of an AIS is to gather, record, process, store, summarize, and communicate information about an organization. This means accountants must understand how(1) transactions are initiated,(2) data are captured in machine-readable form or converted from source documents to machine-readable form, (3) computer files are accessed and updated, (4) data are processed, and (5) information is reported to internal users and external parties. Accountants must also understand the accounting records and procedures, supporting documents, and specific financial statement involved in processing and reporting transactions. These items make it possible for the system to have an audit trail. An audit trail exists when individual company transactions can be traced through the system from where they originate to where they end up on the financial statements. Likewise, the numbers on the financial statements can be traced back through the system the individual transactions making up the balance