Internal Controls -
Internal Controls: Only the Paranoid Survive
By Clifford A. Hockley
Think of yourself as the owner of a property management company. As you are reviewing the monthly financial statements you realize that you are not making as much money as you expected. As you dig through the numbers your gut keeps telling you that this does not feel right. Your accountant has been with you for 15 years and you trust her implicitly, but as you go home that night you keep thinking the expenses look okay, but the income is $5000 short this month.
The next morning you have the accountant bring you the last two years of records for your business. You can see there seems to be a pattern to the lack of income. Being an ambitious business owner, you always expect more, but that feeling is not leaving you. By stroke of fortune your accountant is going on vacation the next week and arranged for a temp to do only the urgent stuff. You call your CPA and ask him to come over to review the files with you.
What you find astounds you. It becomes evident after two hours that your accountant has been skimming from you for the past two years. One thousand here, two thousand there, over 24 months it amounts to $40,000. No wonder you were feeling poor. This seemed to be the only problem but you were not sure, so your CPA asked, “Do you have any internal controls? Are other people in your organization taking funds?” You respond that you have never heard of internal controls. The CPA sighs and then starts explaining.
Running a business carries with it the challenges and the risks of the marketplace as well as the internal challenges. No business can afford to watch their employees all of the time, but what they can do is put in controls. You can tell that you have a problem by looking at your past financial records, but you can’t do any thing about those problems, except for keeping them from happening in the future.
He summarized that there are two types of controls: preventive and detective. The preventive controls are active and stop the problems from occurring, but they are expensive and can be inefficient. The detective controls find the problem after it happens, it is usually a sampling approach, and is efficient but not as effective
Because risk is always present, you have to review those risks annually and decide where and how to control them. Some you cover by purchasing insurance, or self-insuring. Other risks you control for. He suggested you focus on daily deposits and monthly account reconciliation’s that you as the owner review. Set up other systems that work for your business to make sure your employees are doing the job; track vacancy rates, or occupancy rates. Use self-audits (checklists) for each department fill out and provide back to you. If they do it and made mistakes, this will help them find the problems and improve the job they are doing. Property management covers many different areas. You may need a self-audit for your on-site staff, your maintenance staff, and your accounting department.
Pick your battles and evaluate the cost of the audit process. You cannot control everything and you need your staff to be able to make decisions. You are looking for areas for possible risk, environmental lawsuits, and questions about your practices by your clients (how fast are units turned, for example). He then discussed the following issues:
1. Corporate Accounting and Property Management Accounting
a. The person who writes the checks should not sign them
b. Many companies separate the accounts payable and receivable jobs
c. Monthly reconciliation’s
d. Yearly spot check audits
2. Corporate staff – are they stealing from you?
a. Supplies
b. Phone calls
c. Gasoline
d. Charging personal expenses on company credit cards
e. Establishing company credit in their own name
3. Collections of funds from the properties
a. Who audits the on-site manager or the off site manager?
b. Are funds received via EFT?
c. Are you randomly auditing the on-site managers?
d. Are you training them correctly to begin with?
4. Expense Authorizations
a. Who can authorize purchases for your company?
b. Can on-site managers or maintenance people purchase supplies at will?
c. Are property budgets in place?
d. Are budgets being followed and reviewed?
d. Charging personal expenses on company credit cards
e. Establishing company credit in their own name
5. Computer access
a. Check stock locked up every night
b. MICR toner locked up when no one is in the accounting office
c. Limited computer access
6. On-site managers
a. Are the on-site managers collecting rents – are you inspecting the units to make sure that the managers are not collecting the rent and then keeping it?
b. Are the managers making up fees and then keeping them and not giving them to owners?
c. Do the rental agreements match the rent collected and the fees collected?
d. Are managers buying fixed assets and then selling them for cash i.e. refrigerators, ranges and dishwashers?
e. Are the onsite managers keeping a current inventory of the supplies, and is it correct?
f. Are you comparing building performance to discover variances in expenses and income?
7. Maintenance:
a. Is the work being performed that has been ordered?
b. Are the billings being made to the correct units?
c. Are there random quality inspections?
d. Are the billings correct, or over inflated?
e. Do you have tightly supervised maintenance controls both from a dispatching as well as expense standpoint?
f. Proactive maintenance planning and budgeting.
8. Insurance:
a. Are you insured for any theft? To what level?
b. Are you insured for employee practices?
c. Are you insured for environmental practices?
d. Are you insured with errors and omissions insurance?
The moral of the story is that internal control systems should not be ignored. You can self-audit to make it affordable, and as your company grows you can include internal control requirements in your job descriptions, and reduce your exposure to risk.
