Over the past ten years we have seen significant changes in the way we pay our bills. Not too long ago, no one would have ever dreamed that we could pay all of our bills without using a mail box or those old fashioned stamps. I now find it a pain when someone gives me a check and I have to go to a bank to put it in to my account. These changing times have also provided all of us with a little extra time in our day because it is easier and faster to pay our bills and review our accounts. However, all of these efficiencies that we have gained have brought significant risks with it. These risks have resulted in significant losses for some companies. I hope to give you some insight in to some of the risks that come along with all of the efficiencies we now take for granted.
The main risk that occurs when employees have access to spend money electronically is obviously theft. Theft of money electronically is much harder to detect than when someone steals cash. We have had significant controls over cash for a long time. We have authorized signers on our checks and some companies even require dual signatures. We have all of these controls over checks and cash but what controls do we have over someone transferring money to their own account. Most executives would say that it would be detected during the reconciliation procedures every month. What if the person stealing the money electronically is also the person in charge of reconciling that account? What if this person transferred small amounts each week or month over several years? It could add up to a significant sum.
Companies need to have more controls/checks and balances over electronic wire transfers and automated clearing house (ACH) payments. The best control I have seen is where an account is set up to only allow electronic transfers to certain payees. There is a specific process with multiple signatures required in order to get a vendor added to this list. If this same company wants to make a single electronic payment to a vendor, then it would require multiple authorizations. Another way to control electronic payments is to employ proper segregation of duties. Even the smallest of companies can segregate duties. Let’s take an example of the company that only has one person in accounting and that person reconciles all accounts and performs all accounting functions. In this case, I would recommend that the president/executive director or maybe the treasurer for the board or even someone from another department should be set up to perform electronic disbursements. Under no circumstances should that accountant be the person in charge of wire transfers.
Another area of concern for electronic payments would be credit cards. Having too many credit cards or a lack of control over credit cards can lead to theft. Credit cards are an easy way to make purchases (business or personal). There are various ways to use a company credit card to personal gain. The easiest is to go to an office store to purchase supplies and then pick up a few personal items. This can be almost impossible to detect. Another way is to buy things online from companies that seem to have a business purpose but are actually for them personally. Another horror story we have all heard about is using a company credit card while on a business trip for excessive expenses (i.e. expensive wine, Broadway shows, etc…).
The key to safeguarding against theft of cash via the use of credit cards is to first limit the number of credit cards your organization has open. The more credit cards that have monthly statements coming in increases the susceptibility for something to slip through the cracks. The next key is to actually review the credit card statements every month. Review each and every transaction and determine their specific business purpose. Transactions should be questioned and receipts should be reviewed. Even if the expense was charged by the chairman of the board – it should be questioned if the business purpose is not evident. I have a client where the treasurer for the board gets a copy of all credit card statements each month and reviews the transactions for reasonableness. This may not be feasible for some companies but is something to be considered. I normally recommend that companies start by limiting the number of credit cards to one or two mainly to be used for office purchases. I recommend that all travel and entertainment expenses go through an expense report process and have all receipts provided with that expense report. Then all you have to do is review these few credit card statements every month.
I hope the information above has provided you with some insight into some of the risks related to electronic payments and ways to mitigate those risks. If you have any questions or would like additional information, please feel free to contact me at lmann@ddfky.com.
Lance R Mann
Manager of Assurance Services
