In a recentNEWS’column titled “Fraud and Theft Prevention Need Attention” (July 16, 2007), the topic of risks that businesses take was discussed and it concluded with the mention of a Q&A document from the Dwyer Group, Waco, Texas, that provides ‘yes’ and ‘no’ answers to questions on safeguarding a business from internal and external theft. This document has been made available toThe NEWSfor publication by the Dwyer Group. The questions appear below in italics before the correct ‘yes’ or ‘no’ answers and explanations.

For those who dispatch from the office, do you have a system in place to check your service vans out at the start of the day, and check them back in at the end of the day?

YES- By having a “check-in and check-out” program in place and utilized on a daily basis, you will be able to: protect your physical assets (service vans and equipment); control your inventory and consumables; and reduce the opportunities for your technicians to be doing side jobs. Each morning before a tech is dispatched to his jobs, a designated person should at least:

• Inspect the physical condition and cleanliness of the vehicle.

• Verify the mileage.

• Compare the tech’s work orders to the parts on the van.

• Check for blank invoices or other unauthorized paperwork.

A similar process should be followed at the end of the day. Besides providing a strong deterrent to potential fraudulent work, having a check-out procedure in place will also benefit customer service by reducing the chance that a technician would arrive at the job site without the necessary parts or supplies.

Do you have a procedure to record the daily mileage on each of your service vehicles and compare it to the jobs they were dispatched to that day?

YES- The service technician should have a log in his service vehicle to record the starting and ending mileage each day. It is also recommended that the mileage to each job site also be called back by the tech to the dispatcher and be recorded onto the dispatch sheet.

Do you conduct regular inventory counts and audits on a surprise basis?

YES- If you keep an inventory of parts and products in your business, you need to have a system to keep track of them by part number and quantity. If possible, any high dollar parts should be kept in a secure, locked area. In order to maintain accurate financial reports, you will have to do a monthly count by part number and quantity and then cost it out in order to get an opening/closing inventory value each month.

It is also advisable to do a “bulk count” or “inventory audit” (where you just count the quantities of each part) on a more frequent basis. If you do not conduct the inventory yourself, you should at least review the results. Besides taking the inventories (and make it visible so that your employees know that you are doing it), it’s also important that you have a process to resolve any discrepancies.

It is also beneficial to maintain records of your primary operating supplies and consumables. If you have employees who are going to do side jobs, they will most likely also be trying to use these supplies also.

By having control of your parts and supplies, you have put in place a strong deterrent for employees who might be tempted to do side jobs.

Do you get monthly balance sheets, P&L’s and cash flow statements on your business?

YES- A key aspect of a good internal controls program is having accurate and timely financial records on a regular basis. In order to get a comprehensive picture of your business, you should get more than just an Income Statement (P&L). You will also benefit from a Balance Sheet and a Cash Flow Statement. Having these statements is important, but understanding what they are telling you about the status and condition of your business is equally vital. Your outside accountant can assist you in understanding how to read and interpret these statements.

If you have an employee bookkeeper that prepares these monthly statements and helps you understand them, you have to be conscious of the integrity of this bookkeeper. It is always advisable to have your outside accountant also review these statements.

Do you regularly review canceled work orders and reasons given?

YES- Most customers do not know the difference between the work order and an invoice. A dishonest technician who tries to do a side job can take advantage of a situation where canceled work orders are not tracked and followed up upon. Particularly if it is a smaller, labor only job, and the customer is paying cash, the tech could give the work order to the customer instead of an invoice, and later report back that the customer changed their mind and the appointment was canceled.

A canceled work order represents not just a lost opportunity, but also a potential fraud situation. You should have a system in your business that identifies all canceled work orders and then a process to follow up with the customers on the reasons for the cancellation. As part of your control procedures, it is recommended that you rotate the people that do the follow-up calls with the customers. If there are certain techs, or ISR’s, that appear to have more cancelled work orders than the others, this should also be an early-warning sign of potential problems.

Do you rely upon a long-time, trusted employee to write your checks and reconcile your bank accounts?

NO- A key aspect of a strong internal controls program is the separation of duties. You should never allow the person who writes the checks to reconcile the checking accounts. It is strongly recommended that the owner of the business sign all checks and also be personally involved in at least reviewing all paid checks on the bank statement each month. History has shown that often it is the “trusted,” long-term employee who commits fraud in a small business.

You should also make your bookkeeper take a vacation every year. While they are away have someone else review your books and look for discrepancies.

Do you fully understand what your books are telling you?

YES- The purpose of producing financial statements (or books) is to allow a business owner to have an overview of how the business is doing on a regular basis and also what may need to be done to improve its financial viability.

By reviewing your books you should be able to answer such questions as: “Is my business generating a profit?”; “Is there enough liquidity in the business to pay my bills next month?”; and “Do we generate more cash than we spend each month?” In order to know this, you have to do more than a quick review of your profit and loss statement each month. Even though the income statement might show you are making a profit, the business could be on the path to bankruptcy. In addition to regular financial statements, as a business owner you will also benefit from having various management reports that allow you to track trends, identify expenses which may be out of line, and to measure the business’s progress against last year and your plan.

The ability to identify trends, and to spot inconsistencies, are components of a good internal controls program. To be successful you want to be proactive, rather than a reactive owner that waits for problems to develop and then solves them by crisis management.

As an added precaution, you should never allow an employee to take your books home to work on them. You have to monitor your bookkeeping records carefully. The accounting software on your computer system should be password protected with very limited access. Change the password frequently in order to keep out unauthorized users.

Do you have your accountant or another independent party audit your books at least annually?

YES- Having an accountant prepare your books and financial statements is not the same as an audit. An audit involves checking the integrity of the source documents, such as accounts receivables records, accounts payable statements, etc., that were used to generate the financial records in order to ensure accuracy and completeness and also the completeness of the various financial processes employed in the business.

As the business owner, you need to stay close enough to the business transactions to be able to spot unusual problems with receivables, payables, refunds, etc. Ask questions about accounts receivable balances from time to time.

There are various levels of audits available. The cost depends upon how in-depth it is. These may be done by your accountant or another accounting or auditing firm. Having an audit on an annual basis is required of public companies. However, having audits on a regular basis is advisable in order to verify that you have adequate internal controls and practices in place. Audits should be unscheduled and by surprise and should not happen at the same time every year. If you suspect fraud, consider requesting a fraud audit instead of a general audit.

Do you reconcile your checking accounts and merchant credit card accounts at least monthly?

YES- Probably the biggest risks that small business owners face is from the failure to reconcile their checking and credit card accounts on a regular basis - at least monthly. The risk is not only from fraudulent transactions but also from the inability to identify cash flow problems. Reconciling involves the verifying of the checks written, and the deposits made, per the check register (electronic or paper) with the checks paid and deposits received according to the bank’s monthly statements. The objective is to ensure that what is shown on the register is in agreement with what the bank has on their records. Having accurate information regarding the business’s current cash position is an essential component of managing payables.

Besides its necessity for cash management, doing bank reconciliations is a key internal control requirement to identify any unauthorized payments out of the business that the owner might not be aware of.

Although an employee could prepare the reconciliation records, it is extremely important that the business owner thoroughly review them. This would include reviewing the signature on each check, looking at the payees to see if they are recognizable, and also checking the supporting documents that authorize each check (in order to verify that invoices are not paid twice.) Any missing checks, checks out of sequence, or canceled checks should be investigated.

If you do not do it yourself, the person you have do the reconciliations should not be the same person who handles and records the cash receipts and disbursement functions.

Do you have a daily close-out procedure which is followed and which you verify regularly for compliance?

YES- At the end of each business day, there should be established and written procedures that the employees follow regarding closing out the POS system, recording the sales, depositing the proceeds, filing the paperwork, etc. The process should clearly spell out the closing tasks by each job position. The purpose is to verify that the sales recorded on the invoices match the proceeds (i.e., cash, checks, credit cards, accounts receivables, electronic deposits, etc.). Any shortage or overage should be reconciled.

Besides this financial closeout, there also needs to be a physical closeout. This would involve such things as turning in the paperwork, checking in the service technicians and service vehicles for completed work orders, returned parts, etc. Additionally, there needs to be a system for making the bank deposits for the day’s proceeds.

And, finally, procedures to secure any undeposited cash, inventory, equipment, and the building premises for the evening.

As another internal control, it is recommended that, as a check and balance, there be two people involved in the daily close-out.

Do you have an established system for receiving and tracking all payments received in your business?

YES- All cash receipts should be recorded and then deposited promptly. Any cash receipts not deposited at the end of the day should be kept in a secure place overnight. If you receive payments in the mail from accounts receivable customers, the person who opens the mail and records these incoming receipts should not be the same person responsible for management of the accounts receivable bookkeeping. Any incoming check needs to be properly endorsed and should be immediately stamped “for deposit only”. (This will prevent an employee from cashing them.)

Do you have a designated employee, and an established procedure, for making daily deposits of your cash and checks?

YES- Making deposits of the day’s receipts needs to be a part of the regular daily business routine. A specific employee, along with a backup, should be designated to perform this responsibility. If the deposit is not made, you then know who to turn to and find out why it was not done. Depending upon when and where the deposits are made, you should want to see a stamped deposit receipt from the bank that reconciles with the deposit shown on the daily close-out sheet.

Whenever you receive a check from a customer, or in the mail from an account, do you have them stamped “for deposit only?”

YES- This is a simple internal control that will prevent fraud. All incoming checks need to be recorded with the name of the payer, check number, and amount. These checks should be deposited daily.

Do you have a procedure to call customers to verify the work performed was to their satisfaction?

YES- This is recommended both for improving customer service and also for preventing employee theft and side jobs. When you make these calls, you should have a copy of the customer invoice so that you may ask them specific questions about the products or services you sold them. By so doing you might discover that your technician sold the customer additional work on a cash basis.

Do you have a written policy regarding doing work for “friends and family?”

YES- An employee (or one of their family members) may occasionally have a need for one of your services. Rather than put a technician in the position of considering handling this as a side job, you should have a written policy of how you will handle situations such as this. Make it an employee benefit. Specify who is eligible, how frequently, what can be done, and what the discount (if any) off of the posted price will be.

Does your employee manual contain a section regarding technicians doing side jobs?

YES- Write and post an ethical conduct policy which lays out “the rules of the road” for your business. Give a copy to all employees, and have them read it and sign it. When hiring a new employee, review this policy before they are hired. Spell out specifically what your expectations are, what you consider stealing, and what you consider unethical behavior. And most importantly, have zero tolerance and enforce your rules across the board.

Before you sign a disbursement check, do you review all the supporting documentation?

YES- First of all, don’t be careless with your company checks. Keep them in a locked drawer. Use only pre-numbered checks and check frequently for missing check numbers. Have a “voided check” procedure in place that requires you personally to validate all voided items. Never, ever sign a blank check. That is asking for problems.

Checks should only be prepared after proper matching of supporting documentation (vendors’ invoices, receiving report, purchase orders, etc.). This supporting documentation should be canceled when the check is prepared and marked with the check number. The issued checks then have to be accurately recorded in the register. The person who signs the checks should carefully review all the supporting documentation before signing.

Although it is recommended that the owner sign all the checks, if the size of your business makes this impossible, you should still personally take some time to spot inspect checks that are being written to verify that the supporting documentation is in order and that established procedures are being followed.

Do you regularly look inside your trash dumpster to see what is in there?

YES- This is a part of internal controls. If you have employees who are tempted to do side jobs or are considering stealing some inventory, the trash dumpster can become a convenient hiding place for materials they are trying to steal from your business. Or if they are doing side jobs, they might dump the old parts, or waste, from the job into your trash.

Is every customer provided an invoice which is produced by your POS system?

YES- The customer should be given a printed invoice generated by your POS system. Work orders are for internal use and not for the customers. If the technician sells additional services while at the customer’s site, you need a procedure to add this to the original work order. Providing the techs with blank invoices for them to complete by hand is asking for trouble and is an invitation for side jobs. It is also recommended that you inspect the service vans to verify that the techs do not have their own stock of blank invoices.

Do you personally open the envelope from your bank with your statements and canceled checks and have your bank statements mailed to your home address?

YES- If you have a thief in your business, most likely they do not want you to see or review the bank statements. The best first line of defense is to have the statements mailed to your home address or to your accountant. You should open them personally and conduct a quick scan for any obvious irregularities. If you do not personally reconcile the checking account, you should still open the bank envelopes and do the quick scans before you give it to the employee that does the reconciliation.

Have you personally reviewed your accounts receivables within the last 30 days?

YES- If your accounts receivables are increasing each month but your sales are not, the employee who handles your accounts receivables may be using later receipts from other customers to cover earlier thefts. Have more than one employee involved in counting and verifying incoming receipts. Have a system to ensure all incoming checks are properly endorsed as soon as they are received. If a customer complains that they have not received credit for a payment they sent in, personally investigate the situation. Request copies of the front and back of the customer’s check to verify that it was deposited into your business account.

Do you personally sign every payroll check?

YES- This may take some time but it is usually worth it. Review the checks to make sure you recognize the names. Keep a current count of the number of employees you have, and verify this number against the number of checks you have.

Besides providing another level of control, personally signing the checks sends a positive message to your employees.

Is the person responsible for your accounts receivables also responsible for maintaining your cash receipts record?

NO- This is another example where you have to separate duties among your employees. The person who opens the mail, and processes and records the receipts, should not be the same individual that is responsible for managing the receivables and collecting the payments. If this is difficult because you have only a few employees, then rotate responsibilities so that more than one person is involved with accounts receivables.

Do you do reference checks and background investigations on your employees prior to bringing them on board?

YES- Effective internal controls start with careful hiring. Do your legwork on checking references. Don’t just ask for references - check them out. Although some employers will only confirm dates of employment, if you persist in your questioning, they will reveal more and possibly point out integrity warning flags. It’s worth the time and expense to run a criminal records search on potential new hires. There are companies that will do this for you. It is also advisable to drug test new hires where legally permissible.

If you don’t hire competent employees and provide them with the proper training, having the best internal controls will not help. Your staff must fully understand their responsibilities, and the importance of those responsibilities, in the success of your business. As the business owner, it is your responsibility to lead by example and reward those who follow the rules.

Publication date:10/22/2007