With the holiday season upon us, we are reminded just how much can be accomplished in 12 days (cue catchy 12 Days of Christmas holiday tune). There’s no better time than now to relook at your organization’s internal controls. We’ve broken up the daunting task of updating and maintaining proper internal controls into our own, slightly more focused and productive, version of that beloved 12 Days Christmas carol. Playing holiday music while executing these tasks is highly encouraged, but not required.
First Day: Map out your current processes and workflows. Detail out internal accounting procedures with a simple step-by-step checklist or list of rules. Clearly identify how long each step of authorization should take to process.
Second Day: Identify clear separation of duties. Open your workflow documentation back up and assign owners for each procedure, and other process owners who may be involved in authorizations, approvals, or reviews.
Third Day: Bring in an outside expert to review your current processes. Leverage outside expertise like certified fraud examiners (CFEs) or attorneys specialized in evaluating and improving internal controls. They can help identify any gaps or vulnerabilities.
Fourth Day: Find a new home for your documentation. You’ll want to maintain documentation of your processes in a commonly-used location that is easily accessible by staff. It will need to be continually updated as needs shift throughout the year.
Fifth Day: Review security permissions in your fund accounting system. Your technology should fully support your desired workflows encompassing your separation of duties. Update your security settings to limit system access, based on defined roles and security groups.
Sixth Day: Set up monitoring alerts. Ideally, your fund accounting system can be set up with active monitoring alerts to quickly notify other staff about key activities, such as when checks are printed, but not recorded, or vendor hold payment status is changed.
Seventh Day: Create a digital audit file. Here you’ll organize and maintain artifacts for future audits, including bank statements and reconciliations, investment summaries, fixed asset and depreciation schedules, documentation of donor pledges and grant funds received, and year-end accounts payable and expenses.
Eighth Day: Update your employee onboarding. Now that your documentation is up to date, you’ll need to update your new employee onboarding to reflect the changes. It’s important to promote a shared commitment of financial responsibility from the start with a new employee.
Ninth Day: Set a reoccurring monthly budget review. The budget is not just a planning tool – this is a key internal control. Schedule monthly budget reviews for reconciliation, explaining variances to the budget keeps proper checks and balances across departments.
Tenth Day: Recruit for an audit committee. You’ll want to institute a strong audit committee of independent members (typically from the board) who are familiar with finance and accounting. They should select and review the independent external auditors and help monitor for fraud.
Eleventh Day: Schedule an internal audit. The best prepared organizations perform internal audits to ensure key control activities are being followed, and to identify any reconciliation discrepancies. Find an appropriate time for your team and stick to the date.
Twelfth Day: Set up quarterly staff trainings. You must reinforce your controls with periodic trainings. Take the time now to get these on the calendar and build into the agenda time to discuss any shifting accounting standards for which you may need to adjust.
Remember, the objective of internal controls is to put “checks and balances” in place to help manage and preserve the charitable assets of the organization. It builds a foundation of policies and procedures that ensures employees act responsibly and ethically, and prepares the organization for expected scrutiny (for example, audits and budget reviews) and tough to predict events (for example, staff turnover).
Here are a few resources to help you get through the 12 Days to Better Internal Controls: