Is Your Business at Risk of Fraud and Theft?
October 22, 2007
In a recent NEWS’
column titled “Fraud and Theft Prevention Need Attention” (July 16, 2007), the
topic of risks that businesses take was discussed and it concluded with the
mention of a Q&A document from the Dwyer Group, Waco, Texas, that provides
‘yes’ and ‘no’ answers to questions on safeguarding a business from internal
and external theft. This document has been made available to The
NEWS for publication by the Dwyer Group. The questions appear
below in italics before the correct ‘yes’ or ‘no’ answers and explanations.
For those who dispatch from the office, do you have a
system in place to check your service vans out at the start of the day, and
check them back in at the end of the day?
YES - By having a “check-in and
check-out” program in place and utilized on a daily basis, you will be able to:
protect your physical assets (service vans and equipment); control your
inventory and consumables; and reduce the opportunities for your technicians to
be doing side jobs. Each morning before a tech is dispatched to his jobs, a
designated person should at least:
• Inspect the physical condition and cleanliness of the vehicle.
• Verify the mileage.
• Compare the tech’s work orders to the parts on the van.
• Check for blank invoices or other unauthorized paperwork.
A similar process should be followed at the end of the day.
Besides providing a strong deterrent to potential fraudulent work, having a
check-out procedure in place will also benefit customer service by reducing the
chance that a technician would arrive at the job site without the necessary
parts or supplies.
Do you have a procedure to record the daily mileage
on each of your service vehicles and compare it to the jobs they were
dispatched to that day?
YES - The service technician should
have a log in his service vehicle to record the starting and ending mileage
each day. It is also recommended that the mileage to each job site also be
called back by the tech to the dispatcher and be recorded onto the dispatch
Do you conduct regular inventory counts and audits on
a surprise basis?
YES - If you keep an inventory of parts
and products in your business, you need to have a system to keep track of them
by part number and quantity. If possible, any high dollar parts should be kept
in a secure, locked area. In order to maintain accurate financial reports, you
will have to do a monthly count by part number and quantity and then cost it
out in order to get an opening/closing inventory value each month.
It is also advisable to do a “bulk count” or “inventory audit”
(where you just count the quantities of each part) on a more frequent basis. If
you do not conduct the inventory yourself, you should at least review the
results. Besides taking the inventories (and make it visible so that your employees
know that you are doing it), it’s also important that you have a process to
resolve any discrepancies.
It is also beneficial to maintain records of your primary
operating supplies and consumables. If you have employees who are going to do
side jobs, they will most likely also be trying to use these supplies also.
By having control of your parts and supplies, you have put in
place a strong deterrent for employees who might be tempted to do side jobs.
Do you get monthly balance sheets, P&L’s and cash
flow statements on your business?
YES - A key aspect of a good internal
controls program is having accurate and timely financial records on a regular
basis. In order to get a comprehensive picture of your business, you should get
more than just an Income Statement (P&L). You will also benefit from a
Balance Sheet and a Cash Flow Statement. Having these statements is important,
but understanding what they are telling you about the status and condition of your
business is equally vital. Your outside accountant can assist you in
understanding how to read and interpret these statements.
If you have an employee bookkeeper that prepares these monthly
statements and helps you understand them, you have to be conscious of the
integrity of this bookkeeper. It is always advisable to have your outside
accountant also review these statements.
Do you regularly review canceled work orders and
YES - Most customers do not know the
difference between the work order and an invoice. A dishonest technician who
tries to do a side job can take advantage of a situation where canceled work
orders are not tracked and followed up upon. Particularly if it is a smaller,
labor only job, and the customer is paying cash, the tech could give the work
order to the customer instead of an invoice, and later report back that the
customer changed their mind and the appointment was canceled.
A canceled work order represents not just a lost opportunity, but
also a potential fraud situation. You should have a system in your business
that identifies all canceled work orders and then a process to follow up with
the customers on the reasons for the cancellation. As part of your control procedures,
it is recommended that you rotate the people that do the follow-up calls with
the customers. If there are certain techs, or ISR’s, that appear to have more
cancelled work orders than the others, this should also be an early-warning
sign of potential problems.
Do you rely upon a long-time, trusted employee to
write your checks and reconcile your bank accounts?
NO - A key aspect of a strong internal
controls program is the separation of duties. You should never allow the person
who writes the checks to reconcile the checking accounts. It is strongly
recommended that the owner of the business sign all checks and also be
personally involved in at least reviewing all paid checks on the bank statement
each month. History has shown that often it is the “trusted,” long-term
employee who commits fraud in a small business.
You should also make your bookkeeper take a vacation every year.
While they are away have someone else review your books and look for
Do you fully understand what your books are telling
YES - The purpose of producing
financial statements (or books) is to allow a business owner to have an
overview of how the business is doing on a regular basis and also what may need
to be done to improve its financial viability.
By reviewing your books you should be able to answer such
questions as: “Is my business generating a profit?”; “Is there enough liquidity
in the business to pay my bills next month?”; and “Do we generate more cash
than we spend each month?” In order to know this, you have to do more than a
quick review of your profit and loss statement each month. Even though the
income statement might show you are making a profit, the business could be on
the path to bankruptcy.
In addition to regular financial statements, as a business owner you will also
benefit from having various management reports that allow you to track trends,
identify expenses which may be out of line, and to measure the business’s
progress against last year and your plan.
The ability to identify trends, and to spot inconsistencies, are
components of a good internal controls program. To be successful you want to be
proactive, rather than a reactive owner that waits for problems to develop and
then solves them by crisis management.
As an added precaution, you should never allow an employee to
take your books home to work on them. You have to monitor your bookkeeping
records carefully. The accounting software on your computer system should be
password protected with very limited access. Change the password frequently in
order to keep out unauthorized users.
Do you have your accountant or another independent
party audit your books at least annually?
YES - Having an accountant prepare your
books and financial statements is not the same as an audit. An audit involves
checking the integrity of the source documents, such as accounts receivables
records, accounts payable statements, etc., that were used to generate the
financial records in order to ensure accuracy and completeness and also the
completeness of the various financial processes employed in the business.
As the business owner, you need to stay close enough to the business
transactions to be able to spot unusual problems with receivables, payables,
refunds, etc. Ask questions about accounts receivable balances from time to
There are various levels of audits available. The cost depends
upon how in-depth it is. These may be done by your accountant or another
accounting or auditing firm. Having an audit on an annual basis is required of
public companies. However, having audits on a regular basis is advisable in
order to verify that you have adequate internal controls and practices in
place. Audits should be unscheduled and by surprise and should not happen at
the same time every year. If you suspect fraud, consider requesting a fraud
audit instead of a general audit.
Do you reconcile your checking accounts and merchant
credit card accounts at least monthly?
YES - Probably the biggest risks that
small business owners face is from the failure to reconcile their checking and
credit card accounts on a regular basis - at least monthly. The risk is not
only from fraudulent transactions but also from the inability to identify cash
flow problems. Reconciling involves the verifying of the checks written, and
the deposits made, per the check register (electronic or paper) with the checks
paid and deposits received according to the bank’s monthly statements. The
objective is to ensure that what is shown on the register is in agreement with
what the bank has on their records. Having accurate information regarding the
business’s current cash position is an essential component of managing
Besides its necessity for cash management, doing bank
reconciliations is a key internal control requirement to identify any
unauthorized payments out of the business that the owner might not be aware of.
Although an employee could prepare the reconciliation records, it
is extremely important that the business owner thoroughly review them. This
would include reviewing the signature on each check, looking at the payees to
see if they are recognizable, and also checking the supporting documents that
authorize each check (in order to verify that invoices are not paid twice.) Any
missing checks, checks out of sequence, or canceled checks should be
If you do not do it yourself, the person you have do the
reconciliations should not be the same person who handles and records the cash
receipts and disbursement functions.
Do you have a daily close-out procedure which is
followed and which you verify regularly for compliance?
YES - At the end of each business day,
there should be established and written procedures that the employees follow
regarding closing out the POS system, recording the sales, depositing the
proceeds, filing the paperwork, etc. The process should clearly spell out the
closing tasks by each job position. The purpose is to verify that the sales
recorded on the invoices match the proceeds (i.e., cash, checks, credit cards,
accounts receivables, electronic deposits, etc.). Any shortage or overage
should be reconciled.
Besides this financial closeout, there also needs to be a
physical closeout. This would involve such things as turning in the paperwork,
checking in the service technicians and service vehicles for completed work
orders, returned parts, etc. Additionally, there needs to be a system for
making the bank deposits for the day’s proceeds.
And, finally, procedures to secure any undeposited cash,
inventory, equipment, and the building premises for the evening.
As another internal control, it is recommended that, as a check
and balance, there be two people involved in the daily close-out.
Do you have an established system for receiving and
tracking all payments received in your business?
YES - All cash receipts should be
recorded and then deposited promptly. Any cash receipts not deposited at the
end of the day should be kept in a secure place overnight. If you receive
payments in the mail from accounts receivable customers, the person who opens
the mail and records these incoming receipts should not be the same person
responsible for management of the accounts receivable bookkeeping. Any incoming
check needs to be properly endorsed and should be immediately stamped “for
deposit only”. (This will prevent an employee from cashing them.)
Do you have a designated employee, and an established
procedure, for making daily deposits of your cash and checks?
YES - Making deposits of the day’s receipts
needs to be a part of the regular daily business routine. A specific employee,
along with a backup, should be designated to perform this responsibility. If
the deposit is not made, you then know who to turn to and find out why it was
not done. Depending upon when and where the deposits are made, you should want
to see a stamped deposit receipt from the bank that reconciles with the deposit
shown on the daily close-out sheet.
Whenever you receive a check from a customer, or in
the mail from an account, do you have them stamped “for deposit
YES - This is a simple internal control
that will prevent fraud. All incoming checks need to be recorded with the name
of the payer, check number, and amount. These checks should be deposited daily.
Do you have a procedure to call customers to verify
the work performed was to their satisfaction?
YES - This is recommended both for
improving customer service and also for preventing employee theft and side
jobs. When you make these calls, you should have a copy of the customer invoice
so that you may ask them specific questions about the products or services you
sold them. By so doing you might discover that your technician sold the
customer additional work on a cash basis.
Do you have a written policy regarding doing work for
“friends and family?”
YES - An employee (or one of their
family members) may occasionally have a need for one of your services. Rather
than put a technician in the position of considering handling this as a side
job, you should have a written policy of how you will handle situations such as
this. Make it an employee benefit. Specify who is eligible, how frequently,
what can be done, and what the discount (if any) off of the posted price will
Does your employee
manual contain a section regarding technicians doing side jobs?
YES - Write
and post an ethical conduct policy which lays out “the rules of the road” for
your business. Give a copy to all employees, and have them read it and sign it.
When hiring a new employee, review this policy before they are hired. Spell out
specifically what your expectations are, what you consider stealing, and what
you consider unethical behavior. And most importantly, have zero tolerance and
enforce your rules across the board.
Before you sign a disbursement check, do you review
all the supporting documentation?
YES - First of all, don’t be careless
with your company checks. Keep them in a locked drawer. Use only pre-numbered
checks and check frequently for missing check numbers. Have a “voided check”
procedure in place that requires you personally to validate all voided items.
Never, ever sign a blank check. That is asking for problems.
Checks should only be prepared after proper matching of
supporting documentation (vendors’ invoices, receiving report, purchase orders,
etc.). This supporting documentation should be canceled when the check is prepared
and marked with the check number. The issued checks then have to be accurately
recorded in the register. The person who signs the checks should carefully
review all the supporting documentation before signing.
Although it is recommended that the owner sign all the checks, if
the size of your business makes this impossible, you should still personally
take some time to spot inspect checks that are being written to verify that the
supporting documentation is in order and that established procedures are being
Do you regularly look inside your trash dumpster to
see what is in there?
YES - This is a part of internal
controls. If you have employees who are tempted to do side jobs or are
considering stealing some inventory, the trash dumpster can become a convenient
hiding place for materials they are trying to steal from your business. Or if
they are doing side jobs, they might dump the old parts, or waste, from the job
into your trash.
Is every customer provided an invoice which is
produced by your POS system?
YES - The customer should be given a
printed invoice generated by your POS system. Work orders are for internal use
and not for the customers. If the technician sells additional services while at
the customer’s site, you need a procedure to add this to the original work
order. Providing the techs with blank invoices for them to complete by hand is
asking for trouble and is an invitation for side jobs. It is also recommended
that you inspect the service vans to verify that the techs do not have their
own stock of blank invoices.
Do you personally open the envelope from your bank
with your statements and canceled checks and have your bank statements mailed
to your home address?
YES - If you have a thief in your
business, most likely they do not want you to see or review the bank
statements. The best first line of defense is to have the statements mailed to
your home address or to your accountant. You should open them personally and
conduct a quick scan for any obvious irregularities. If you do not personally
reconcile the checking account, you should still open the bank envelopes and do
the quick scans before you give it to the employee that does the
Have you personally reviewed your accounts
receivables within the last 30 days?
YES - If your accounts receivables are
increasing each month but your sales are not, the employee who handles your
accounts receivables may be using later receipts from other customers to cover
earlier thefts. Have more than one employee involved in counting and verifying
incoming receipts. Have a system to ensure all incoming checks are properly
endorsed as soon as they are received. If a customer complains that they have
not received credit for a payment they sent in, personally investigate the
situation. Request copies of the front and back of the customer’s check to
verify that it was deposited into your business account.
Do you personally sign every payroll check?
YES - This may take some time but it is
usually worth it. Review the checks to make sure you recognize the names. Keep
a current count of the number of employees you have, and verify this number
against the number of checks you have.
Besides providing another level of control, personally signing
the checks sends a positive message to your employees.
Is the person responsible for your accounts
receivables also responsible for maintaining your cash receipts
NO - This is another example where you
have to separate duties among your employees. The person who opens the mail,
and processes and records the receipts, should not be the same individual that
is responsible for managing the receivables and collecting the payments. If
this is difficult because you have only a few employees, then rotate
responsibilities so that more than one person is involved with accounts
Do you do
reference checks and background investigations on your employees prior to
bringing them on board?
YES - Effective
internal controls start with careful hiring. Do your legwork on checking
references. Don’t just ask for references - check them out. Although some
employers will only confirm dates of employment, if you persist in your
questioning, they will reveal more and possibly point out integrity warning
flags. It’s worth the time and expense to run a criminal records search on potential
new hires. There are companies that will do this for you. It is also advisable
to drug test new hires where legally permissible.
If you don’t hire competent employees and provide them with the
proper training, having the best internal controls will not help. Your staff
must fully understand their responsibilities, and the importance of those
responsibilities, in the success of your business. As the business owner, it is
your responsibility to lead by example and reward those who follow the rules.
Publication date: 10/22/2007