An Overview of Internal Controls

Bill Wiles, Treasurer, Synod of the Sun

In the world of accounting, the term “internal controls” refers to policies, procedures, and structures which organizations put in place to provide accurate information; comply with rules and regulations; safeguard assets; and make fraud or embezzlement more difficult.  The term internal controls broadly includes preventive measures (such as segregation of duties and levels of authorization), detective measures (such as financial review by auditors and financial reports given to a Session), and physical controls (such as locked file cabinets, locked bank deposit bags, and surveillance cameras).

The church Session is responsible for designing, implementing, and monitoring the internal control mechanisms.  If a Session lacks the expertise to carry out these responsibilities, they should engage an outside accounting firm (preferably a CPA firm) to assist them.  It should also be noted the Book of Order sets forth specific guidelines in G.3.0113 and G.3.0205 that should be followed by church councils (Session, Presbytery, Synod, General Assembly).

Every church organization should maintain approved internal control policies or a financial and accounting procedures manual.

Most acts of employee dishonesty start out small and grow over time. When a church finally discovers the problem, it is often faced with unexpected financial difficulty caused by trusted employees. Why do these losses occur? A review of numerous employee dishonesty losses reveals that financial pressure, opportunity to commit and conceal theft, and a rationalization of the behavior are three contributing factors.

Employee dishonesty is a real threat to an organization when these three factors are combined. However, potential losses can be lessened by a strict "Code of Ethics" and a sound system of internal controls.

The following notes are intended to be instructive but not exhaustive.  Every church system has its own peculiarities, so the following is meant to be a starting point for discussions.

Internal Controls Include:

1.   Separation of Duties

Separation of duties is one of the most important control issues that should be addressed. Active involvement by the appropriate church officers is critical when staff is small and segregation of duties is not feasible. Duties such as check writing, deposit functions, and account reconciliation should be kept separate.

Beware of:

• The bookkeeper who issues checks, posts transactions and reconciles the bank statement on his/her own authority.

• An administrative person who is solely responsible for hiring personnel and placing them in the payroll system.

• A situation in which an individual has the ability to purchase merchandise at their own discretion, and submits both voucher and check stub to the bookkeeper.

• Officers who fail to review the accounting records frequently.

• An operation that is in a major growth mode, resulting in more staff and less attention to details by the Session.

2.   Physical Safeguards

Access to checks or petty cash should be limited, secured, and documented when funds are used. A written "Code of Ethics" should be established and reviewed with all employees. Enforcement of the Code for employees, members and officers is critical.

Beware of:

• A church checkbook that is stored in a unlocked file cabinet.  File cabinets should be locked or a safe used.

• When documentation of check numbers and reasons for expenditures are not consistent.

• Petty cash that is not restricted and does not require a voucher or other explanation funds used.

• Rules that are bent in favor of cost containment or familiarity with staff.

• The church that does not prosecute offenders in the name of forgiveness.

3.    Proper Authority

Individuals having access to church accounting records or purchasing/paying duties should be limited, monitored and documented. Countersignature of checks over a designated amount should be required.

Beware of:

• Check-signing privileges not restricted to specified individuals

• Purchasing authorities not limited to specific individuals

• Counter signatures or executive reviews not required

4.    Detailed, Consistent Documentation

Descriptions of transactions must be scrutinized. Transactions should correlate to the church's scope of operation. Verify the entities involved in each transaction to make sure they are not bogus.

Beware of:

• Missing original documents.

• Excessive voiding or crediting activities.

• Similarities in accounting entries.

• Transactions made to entities that are not related to the church's operations or location.

• Unexplained "past due" notices.

• Duplicate invoices and payments.

5.    Vacation / Job Rotation

Require individuals in financial activity areas to take mandatory annual vacations of at least 10 consecutive working days.

Job rotation or independent audit of financial functions should be implemented when two-week vacations are not practical.

Beware of:

• Individuals in sensitive positions who are workaholics: never take vacations or only take long weekends.

• A payroll supervisor who has held a job for several years and has not been audited by internal or external sources.

6.    Heed Warning Signs

Employee dishonesty can result in financial disasters for a church. For that reason, a church should enforce a "Code of Ethics" and implement sound internal controls. In addition, officers and directors should be on the lookout for the following warning signs:

Behavior of Employees:

• Alcohol, drug, gambling abuse

• Inability to relax

• Defensive/argumentative moods

• Disgruntled feeling toward management

• High/low mood swings

Warning signs in financial statements:

• Revenue up, cash flow down

• Purchases greater than normal

• Unreasonable or unexpected increases in expenses

The above, in part, adapted from information provided by the Maryland Association of non-profit Organizations and information previously included in a workbook compiled by William M. Wiles.