Establishing Internal Controls & Risk Management for SME Busineses

As business owners, significant time can be dedicated to growing your organisation and shaping it for the future. However, often neglected can be the time taken to ensure that proper protections are put in place, which can combat against potential risks that may arise both internally and externally.

You may be wondering how this is possible or even if it is necessary in the first place, especially where doing so can take time away from important day-to-day management duties. Your business is an asset, therefore securing it against a combination of business risks is essential and should be considered regularly throughout its lifecycle.

Simply put, you wouldn’t leave your car unlocked or open to theft, and the same should go for your business. Taking simples steps to prevent any wrongdoing in your business will pay off many times over and help provide you with peace of mind moving forward.

Risk Management / Internal Controls

A potential business risk can be defined as an "event or circumstance that has a negative effect on your business" and as mentioned previously, can arise internally or externally.

Often business risk can be associated with one or more of the following categories

Therefore, implementing an effective risk management strategy is essential in understanding how your business addresses any potential risk, especially where moving quickly is vitally important.

As part of risk management planning, preventative steps to implement and consider may include the following:

• Identifying risk areas
• Putting in place effective Policies & Procedures
• Creating Separation of Duties, involving –
  • IT controls
  • Cash payment & receipt authorisations
• Reviewing financial data on a regular basis
• Implementing a safeguard of assets
• Monitoring and on-going evaluation

Similarly, internal controls are also important in creating an effective risk management framework for SMEs. Internal controls are processes and procedures put into place by a business to prevent fraud, promote accountability and ensure the integrity of financial data.

Establishing these safeguards can ensure compliance with financial and regulatory requirements and assist businesses to achieve their objectives.

Separation of Duties

For SME businesses, it may be beneficial for owners to consider implementing a Separation of Duties, ensuring certain business functions are kept segregated as a form of potential mitigation against fraud and other internal risks.

There are a number of ways to reduce the risk of fraud by separation of duties. For example, not having the same person entering supplier invoices and bank account details as the person who is creating the payment authorisations. Where possible, it would be preferred to have different people entering data than those that are making payment authorisations.

Similarly, you can safeguard assets:

• Implementing and reviewing effective processes and procedures.
• Assigning responsibility for who can create or alter financial data
• Regular reconciliation of accounts
• Procedures for authorisation of payments
• Independent checks

Other effective ways are through IT controls, such as only give employees access to what they need to perform their job duties, only allowing certain employees to alter financial information, or the ability to change supplier bank account details.

Understandably, it may not be efficient for an SME to have separation of duties on all payment authorisations, therefore you could create approval processes where the staff are entering data, but larger transactions are approved by the business owner.

Some businesses may question the need for internal controls or consider them to be useful only in larger businesses, however, many controls can be modified for small businesses. Even a sole trader can regularly reconcile their bank statement and cheque book or check budgets against actual. Personal observation and routine checks can detect errors before they have an effect in another part of the business.

Additionally, in today's technology-driven environment, businesses have significant access to systems providing security against business risk and managing segregation of duties within an organisation. Many cloud-based accounting software and online provide have built 'audit trail' processes to help business owners track changes within their systems - identifying where people are potential changing information or editing important financial data.

If you are uncertain how or if this is set-up correctly within your business software, it is best to approach your provider to ask and who would be happy to establish the correct system processes to provide additional security.

There are other ways in which you can protect your data against fraudulent activity, such as being able to review supplier/employee bank details to identify if there are any inconsistencies with transactions or suspicious activity surrounding accounts.

As accountants and business advisers, Archer Gowland Redshaw can assist SMEs to identify where internal controls can be implemented. We can work with you to establish the correct processes, procedures, and help build additional security workflows to protect your business and financial data.

For More Information

For any further information on SME business risks, how to establish internal controls and the appropriate steps to securing against these, please contact the Archer Gowland Redshaw adviser team on (07) 3002 2699 or info@agredshaw.com.au.