COVID-19: How strong are your company’s internal controls?
The COVID-19 pandemic has led to an unprecedented number of Canadians working remotely. With this shift, an organization’s internal controls can become lax either intentionally or unintentionally. Softening employee oversight or granting sweeping authority can result in fraud. It is now more important than ever to keep an eye on your organization’s internal controls.
You can start by reviewing your organization’s main processes to assess for fraud risk. These processes may include:
- Supply management – purchases, payables, production, receiving, inventory and R&D
- Sales and delivery – sales/receivables/shipping
- Human resources – payroll, benefits administration
- Marketing – digital channels, brand reputation
- Technology – IT security, controls, insurance, disaster contingency plans
- Management – finance and management
The process may have a control weakness, or it may be that controls have not been formalized and therefore, subject to manipulation. For example, when bonuses are based on the profitability of a division, divisional management may attempt to make the financial statements look healthier by recording expenses on the balance sheet in the prepaid expense category. Further, the COVID-19 crisis may have created risk in control areas that did not previously exist.
With many employees currently working remotely, business processes may have inadvertently changed. It is imperative to review each process to determine if there are any weaknesses in control. Here are some examples of increased risk factors and the potential fraud risk:
| Be alert for changes that have resulted in one employee now handling an entire control process with no other employee involved. | ||
|---|---|---|
| Internal control before COVID-19 | The purchasing agent is responsible to obtain three competitive pricing quotes which are vetted by a second employee. | |
| Impact on process due to COVID-19 | The second employee no longer performs the oversight process due to working remotely and lack of supervision. | |
| Potential fraud risk | The purchasing agent no longer obtains competitive quotes and begins receiving kickback payments from a supplier for goods purchased. | |
| Be alert for processes that have a control that allows an employee to manually intervene and override the control. | ||
| Internal control before COVID-19 | The purchasing agent is required to obtain a manager’s approval for any new vendor entered into the system. | |
| Impact on process due to COVID-19 | The purchasing manager allows the employee to manually sign-off on the approval without any secondary review when the manager is not available online. | |
| Potential fraud risk | The purchasing agent establishes a fictitious vendor and then submits invoices for payment. | |
| Be alert for processes that have no management oversight. | ||
| Internal control before COVID-19 | Two signatures are required on all cheques with scrutiny of invoices and supporting documentation. | |
| Impact on process due to COVID-19 | Due to impediments of working in different locations, management no longer reviews the supporting invoices and documentation when signing cheques. | |
| Potential fraud risk | Payments are made to a fictitious company set up by the bookkeeper. | |
In normal times, there may be a push to introduce new technology platforms in order to increase efficiencies or to add a digital presence requiring the appropriate processes and controls. With the COVID-19 crisis, your IT team now must also support the organization’s technology infrastructure to ensure all of your employees can work remotely. Simultaneously, the risk of cyberattacks is increasing. It is critical to evaluate all technology policies including:
- procedures and controls
- secure passwords/login, malicious emails, and cybersecurity
- insurance
- contingency disaster plans
In these unprecedented times, the risk of fraud is heightened. Management oversight and segregation of duties are fundamental internal control practices that must be implemented and followed while your employees are working remotely. A proper review of all processes and controls will identify opportunities for improvement and a reduction in the risk of employee fraud or error.
Should you require assistance with the review or formalization of your company’s processes or controls, please reach out to your advisor or the forensic accounting team at Fuller Landau. You can also visit our COVID-19 Resources hub for more information on Canadian and US government programs as well as helpful information for business owners.
About the Author
Bruce Roher CPA, CA•IFA, CBV, CFE, CFF is a Partner and leader of our Forensic Accounting and Valuations team. He can be reached at 416-645-6526 or broher@fullerllp.com.