Key takeaways
- Segregating duties, tiered approvals and independent reconciliation are the core of internal control
- Checklists are organised by frequency: check high-risk areas more often
- The evidence used for checking must come from third parties
- Record the answers in writing as evidence of the directors' oversight
The examples in this article are written to illustrate risk patterns and do not identify or accuse any person or entity. Warning signs are grounds for further review, not a conclusion that wrongdoing has occurred.
The five pillars of internal control
Good internal control is designed so that fraud is hard to commit and is caught quickly, without slowing the business down.
| Pillar | Key elements | Example controls |
|---|---|---|
| Documentation system | Every transaction is supported by evidence that is complete and easy to retrieve | Document policy, retention for at least 5 years under the Accounting Act 2000, document numbering system |
| Approval system | Tiered approval authority by amount | Delegation of authority (DOA) table and two signatures for high-value amounts |
| Cash control system | Separate the people who receive, pay, record and reconcile | Monthly bank reconciliation, limits on cash on hand, payment by transfer |
| Tax control system | File on time, file accurately and reconcile | Tax calendar, VAT and WHT reconciliation, review before filing |
| Fraud prevention system | Remove opportunity, detect and provide a whistleblowing channel | Segregation of duties, job rotation or mandatory leave, whistleblower channel, spot checks |
Illustrative example: one employee controls the entire cycle
A single accounting clerk issued invoices, received payments, posted entries and reconciled the bank accounts. The clerk misappropriated customer receipts and concealed it by adjusting balances in the system. Losses accumulated over several years and were detected only when the clerk went on sick leave and the substitute could not get the reconciliation to agree.
Lesson: Segregation of duties and mandatory leave or job rotation are low-cost, effective controls.
Internal auditor's corner: checkpoints
- Assess the design and operating effectiveness of the controls
- Test segregation of duties through access rights in the system and walkthroughs of the process
Owner Checklist
Weekly
- Cash and bank balances, and any unusual inflows or outflows
- Receivables that are due or overdue, and follow-up
- Payables and expenses due this week: is there enough cash?
- High-value approvals awaiting signature
Monthly
- Reconcile every bank account and be able to explain any differences
- The three financial statements compared with the previous month and the budget, with explanations of variances
- Latest adjusted ageing of receivables and payables, with a collection plan and the high-risk doubtful debts
- Revenue in the books, PP 30 and cash received all agree
- VAT, WHT and social security filed and paid on time
- Transactions with directors and related parties are documented and approved
- Count petty cash and spot-count high-risk inventory
- Unusual or large adjusting entries are reviewed
- Ask the 20 questions and record the answers
Quarterly
- Review the Red-Flag Register and risk scores
- Run one Case Lab: sample a high-risk transaction and trace it end to end
- Count inventory and key assets
- Review unusual expenses and costs, and the quality of earnings
- Half-year tax estimate (PND 51) and tax planning
Annual
- Close the accounts and prepare documents for the auditor
- Review the full-year tax risks before filing PND 50
- Review delegation of authority (DOA) and segregation of duties
- Assess internal control and make improvements
- Review related-party transactions and transfer pricing for the full year
- Check that documents are retained as required by the Accounting Act (at least 5 years)
When carried out consistently, this checklist helps reduce the likelihood of back taxes, fraud or misappropriation, disputes with partners, rejected loan applications, uncertified financial statements, and civil, criminal or money-laundering cases. It does not, however, guarantee that problems will not occur.
Checklist for overseeing the outsourced accounting provider
Use this in addition to the owner checklist when accounting and fund transfers are handled outside the company
One-off check at the start
| # | What to check | Supporting evidence |
|---|---|---|
| 1 | The owner or a director gives final approval in the bank system; the provider only sets up transactions | List of users and permissions in the corporate banking system, issued by the bank |
| 2 | The company owns the usernames for the Revenue Department e-Filing system and for social security | Registration confirmation letters, and the e-mail address linked to the account belongs to the company |
| 3 | Bank statements for every account are sent directly to the owner's e-mail | e-Statement set up at the bank |
| 4 | The payee register is locked, and any addition or change needs separate approval | The bank's prescribed procedure and the list of register approvers |
| 5 | The engagement contract covers all required topics; see the clauses a contract should include | Signed engagement contract |
Monthly
| # | What to check | Supporting evidence |
|---|---|---|
| 1 | Every bank account is reconciled, and the reconciliation is reviewed by someone other than the provider | Reconciliation report and original statements from the bank |
| 2 | Sample 5 payments and trace each back to its approval and the payee's identity | Approval, invoice and transfer page showing the destination account name |
| 3 | All additions or changes to the payee register this month | Change report from the bank system |
| 4 | Register of suspense accounts and adjusting entries, with an explanation for each item | Report from the provider |
| 5 | Tax payment receipts for every return filed in the month, pulled by the owner personally from the Revenue Department system | e-Payment receipt |
| 6 | The full trial balance, not only the three financial statements | Trial balance with opening balances |
| 7 | Outstanding balances with group companies and directors, and how they moved this month | Account-by-account movement report |
Quarterly and annual
| Frequency | What to check |
|---|---|
| Quarterly | Reconcile customer advances to the unit-level sales contract register, and review the contract cancellation rate |
| Quarterly | Compare cumulative payments to contractors with construction progress certified by the engineer |
| Quarterly | Review the cost to complete and the funding sources to be used |
| Year | Have an independent reviewer who is not the provider review the controls over payments and account closing |
| Year | Review the engagement contract, system access rights and the handover plan |
| Year | Review the transfer pricing documentation and related-party transactions for the full year before filing PND 50 |
Three iron rules
- Evidence used for checking must always come from third parties. The owner must pull bank statements and tax payment receipts personally.
- The person who transfers money must not be the person who reconciles it
- Customer money may leave the project only where there is a written contract, interest and a repayment date
Red-Flag Register for internal auditors
Use this as a quarterly review form: rate the risk of each account as high, medium or low, and record what you find
| Account | Warning signs | Test method | Linked risk |
|---|---|---|---|
| Trade receivables | Long ageing, concentrated in a few customers, growing faster than sales | Ageing, AR confirmation and review of receipts after period-end | Fictitious revenue, bad debts, tax |
| Trade payables | Long overdue, incomplete documents, duplicate payments | 3-way match and AP confirmation | Fictitious suppliers, sham purchases |
| Loans to directors | Growing continuously, with no contract or interest | Check resolutions, contracts and market-rate interest | Tax, misappropriation, directors' duties |
| Amounts due to directors | Large loans with no known source | Source of funds and loan documents | Revenue avoidance, money laundering |
| Cash | Unusually high balance that does not agree with the statement | Cash count and bank reconciliation | Misappropriation, off-book payments |
| Inventory | Long DIO, never counted, value out of line with sales | Stock count and NRV test | Fictitious inventory, window dressing of the accounts |
| Accrued expenses | Round-sum accruals booked at period-end and reversed at the start of the next period | Document review and cut-off test | Profit manipulation, fictitious expenses |
| Input VAT | Unusually high; new or non-existent vendors | Check actual tax invoices and vendor due diligence | Fake tax invoices, claiming refunds beyond entitlement |
| Output VAT | Revenue in the books does not agree with PP 30 | VAT Reconciliation | VAT avoidance, incomplete revenue |
| Retained earnings | Unexplained retrospective adjustments | Check adjusting journal entries and dividend resolutions | Covering tracks, dividend tax |
20 questions owners should ask every month
Designed so that vague answers become warning signs immediately. Ask them regularly and the accounting team will come prepared.
Set for general businesses
| # | Questions | If the answer is vague, watch for |
|---|---|---|
| 1 | Is any legal or tax filing still outstanding this month? | Legal and tax compliance |
| 2 | Which taxes fall due in the next 7 or 15 days? | Unpaid tax, penalties |
| 3 | What percentage of receivables was collected against target? | Liquidity |
| 4 | Which customers are starting to look like bad debts? | Bad debts |
| 5 | Which creditors are nearing their due date, and is there enough cash to pay them? | Liquidity |
| 6 | Do cash and bank balances agree with the report? Have they been reconciled yet? | Misappropriation, cash |
| 7 | Are there any unusual transfers or transactions? | Fraud, money laundering |
| 8 | How do this month's statements differ from last month's, and why? | Quality of earnings |
| 9 | Why did profit increase? Is it real, or the result of adjusting entries? | Window dressing |
| 10 | Why did cash fall? | Cash flow |
| 11 | Are any expenses unusual or unusually high? | Fictitious expenses |
| 12 | Are there items the Revenue Department might question? | Tax risk |
| 13 | Which items is the auditor likely to ask about? | Financial statement risk |
| 14 | Are any documents still incomplete? | Incomplete documents |
| 15 | Are there any receivables or payables that need special follow-up? | Credit, bad debts |
| 16 | Is there any unusual, obsolete or long-outstanding inventory? | Fictitious inventory |
| 17 | Are there tax risks that should be fixed quickly? | Back taxes |
| 18 | Are there legal risks we should know about? | Litigation |
| 19 | If a bank asked to see the financial statements today, what would need explaining? | Creditworthiness |
| 20 | If the Revenue Department came to audit today, would the company be ready? | Audit readiness |
Set for condominium project owners who use outsourced accounting
| # | Questions | If the answer is vague, watch for |
|---|---|---|
| 1 | How much cash is in each account this month? Does it match the statements I received directly from the bank? | Misappropriation, accuracy of the accounts |
| 2 | How much in customer advances has accumulated? Does it match the unit-level sales contract register? | Fictitious revenue, refund obligations |
| 3 | What was customers' money used for this month? How much was project cost, and how much left the project? | Diversion of funds, project liquidity |
| 4 | What percentage of actual construction progress does cumulative project cost represent? | Cost overruns, payments ahead of progress payments |
| 5 | How much more money is needed to complete construction and transfer all units? | Stalled-project risk |
| 6 | How many units can be transferred in the next 6 months, and what is their value? | Revenue pipeline, cash flow |
| 7 | How many contracts were cancelled this month, and how much must be refunded? | Quality of sales, liquidity |
| 8 | How much have the balances with group companies and directors changed, and why? | Cash extraction, tax |
| 9 | How much interest income was received from group companies this month? Was it received in actual cash or only accrued? | Quality of profit, tax on revenue not received in cash |
| 10 | For interest already paid, has the payer withheld and remitted WHT? | Back taxes |
| 11 | Were any payments made abroad this month? Was WHT withheld and PP 36 filed in full? | Back taxes, money laundering |
| 12 | How many suspense accounts or accounts with no counterparty name still carry a balance, and what is the total? | Covering tracks, unreliable financial statements |
| 13 | How many adjusting entries were made this month? What was the largest, and who approved it? | Window dressing |
| 14 | How many payee bank account numbers were added or amended in the banking system, and who approved them? | Payment fraud |
| 15 | What is the remaining balance of expenses without supporting documents, and how far has the document chase progressed? | Non-deductible expenses, embezzlement |
| 16 | Have all taxes for this month been filed and paid? Ask to see the payment receipts. | Unpaid tax, penalties |
| 17 | Which expense items were recorded in project cost this month, and on what basis? | Window-dressing of the financial statements, CIT issues |
| 18 | What is the remaining balance of foreign-currency liabilities, and what is this month's exchange rate difference? | Currency risk |
| 19 | If a bank asked to review the financial statements today to consider a project loan, what issues would we have to explain? | Creditworthiness |
| 20 | If the Revenue Department came for an audit today, which documents could we still not find? | Audit readiness |
How to use it effectively
Send the questions to the service provider 5 working days before each monthly meeting, and require written answers rather than verbal ones. This set of documents serves as evidence of the directors' oversight and can be used when explaining matters to the auditor, the bank, the Revenue Department or partners. The last 2 questions are a rehearsal for an inspection: whenever you cannot answer, you know what needs fixing.
This content is management and internal audit guidance, not a legal or tax opinion for a specific case. Check the current law and consult an auditor, tax adviser or lawyer before making decisions in a real case.