effective
 internal
controls
Presented by Eric Roring Pesik at
Corruption and Compliance
South & South East Asia Summit
        September 2012
    Hilton Hotel, Singapore
effective internal controls
internal controls
finance & accounting procedures
corporate IT systems
company policies & procedures
humanize internal controls
simplify internal controls
restaurant guest check
restaurant procedures
take your order
prepare your order
serve your order
pay for your order
receipt for order
restaurant guest check
human scale controls
1. simple
2. effective
3. efficient
organic controls
internal control
integrated framework
internal control is a process
affected by people
reasonable assurance
achieve objectives
1.   process
2.   people
3.   assurances
4.   objectives
integrated framework
human framework
human laziness
human carelessness
human dishonesty
1. laziness
2. carelessness
3. dishonesty
human framework
internal controls methods
segregation of duties
retention of records
supervision or monitoring
information processing
authorization of transactions
top-level reviews
electronic security
physical security
1.   segregation of duties
2.   retention of records
3.   super vision or monitoring
4.   information processing
5.   authorization of transactions
6.   top-level reviews
7.   electronic security
8.   physical security
internal controls methods
effective internal controls
risk focused
risk assessment
High Magnitude                 High Magnitude
                    Low Probability                High Probability
Magnitude of Loss




                    Low Magnitude                  Low Magnitude
                    Low Probability                High Probability



                                  Probability of Risk



                                                         risk matrix
who determines risk?
risk experts
subjective opinions
objective data
sources of data
categories of risk
Corruption                               51%
             Billing                      19%
          Non-Cash                       19%
   Expense Account                  14%
          Skimming                 13%
      Cash on Hand                11%
      Cash Larceny            9%
  Check Tampering            7%
Financial Statement          7%
             Payroll    4%
      Cash Register    2%



                                  probability of the risk
Financial Statement                            $1,730
         Corruption          $175
  Check Tampering        $131
             Billing     $128
      Cash Larceny      $100
          Non-Cash      $90
             Payroll    $72
          Skimming     $60
   Expense Account     $33
      Cash on Hand     $23
      Cash Register    $23



                                magnitude of the loss
Financial Statement                                          10.0
        Corruption                                     7.4
             Billing                     2.0
         Non-Cash                  1.3
  Check Tampering            0.7
      Cash Larceny           0.7
         Skimming            0.6
  Expense Account       0.4
            Payroll     0.2
     Cash on Hand      0.2
      Cash Register    0.0



                                               adjusted risk profile
perpetrators of risk
Sales                                        21.0%
             Operations                                 15.4%
             Accounting                                15.1%
      Exec/Upper Mgmt                                14.0%
             Purchasing                      10.7%
Warehousing/Inventory                 4.0%
                Finance               4.0%
       Customer Service             3.3%
Marketing/Pub Relations            2.9%
     Board of Directors            2.9%
    Mfg and Production           2.2%
      Human Resources            2.2%
Information Technology         1.5%
          Internal Audit    0.4%
      Research and Dev      0.4%
                   Legal   0.0%



                                  probability of the risk
Exec/Upper Mgmt                                      $829
     Board of Directors                                   $800
                   Legal                           $566
             Purchasing                         $500
                Finance                       $450
Marketing/Pub Relations                $248
Warehousing/Inventory                  $239
      Human Resources                $200
             Accounting            $180
    Mfg and Production            $150
             Operations         $105
      Research and Dev         $100
                   Sales       $95
Information Technology        $71
       Customer Service     $46
          Internal Audit   $13



                              magnitude of the loss
Exec/Upper Mgmt                                 10.0
             Accounting                         3.5
             Purchasing                   2.8
             Operations             1.7
                Finance             1.7
                   Sales         1.1
Warehousing/Inventory           1.0
     Board of Directors         1.0
Marketing/Pub Relations      0.4
       Customer Service     0.3
                   Legal    0.2
      Human Resources       0.2
    Mfg and Production      0.2
Information Technology      0.2
      Research and Dev     0.0
          Internal Audit   0.0



                                     adjusted risk profile
external data
internal data
company constituents
human laziness
human carelessness
human dishonesty
risk experts
ordinary employees
formal risk assessment
risk inventory
probability of occurrence
magnitude of loss
risk matrix
internal controls methods
1.   segregation of duties
2.   retention of records
3.   super vision or monitoring
4.   information processing
5.   authorization of transactions
6.   top-level reviews
7.   electronic security
8.   physical security
effectiveness of controls
cost of mitigating or avoiding
follow the money
Hotline                           59.2%
        Employee Support Programs                              59.0%
                      Surprise Audits                      51.5%
Fraud Training for Managers/Execs                         50.0%
       Fraud Training for Employees                       50.0%
 Job Rotation/Mandatory Vacation                        46.8%
                     Code of Conduct                    46.6%
                Management Review                   40.0%
                    Anti-Fraud Policy               40.0%
              External Audit of ICOFR            34.9%
          Internal Audit Department           30.6%
     Independent Audit Committee             30.0%
                 External Audit of F/S    25.0%
  Management Certification of F/S         25.0%
        Rewards for Whistleblowers       23.2%



                               effective loss reduction
Hotline    $100                     $245
        Employee Support Programs        $100                     $244
                      Surprise Audits     $97             $200
Fraud Training for Managers/Execs        $100             $200
       Fraud Training for Employees      $100             $200
 Job Rotation/Mandatory Vacation         $100            $188
                     Code of Conduct         $140                     $262
                Management Review          $120              $200
                    Anti-Fraud Policy      $120              $200
              External Audit of ICOFR        $140              $215
          Internal Audit Department           $145            $209
     Independent Audit Committee             $140            $200
                 External Audit of F/S         $150          $200
  Management Certification of F/S              $150          $200
        Rewards for Whistleblowers         $119       $155



                            benefit of loss reduction
risk detection
Tip                               42.3%
         Internal Audit                     14.3%
  Management Review                      11.3%
            By Accident              8.9%
         External Audit           5.8%
 Account Reconciliation           5.5%
Document Examination          4.4%
Surveillance/Monitoring     2.7%
            Confession      2.4%
      Notified by Police   1.7%
             IT Controls   0.7%



                                            detection method
Employee                                   49.2%

   Customer                     17.8%

 Anonymous               13.4%

      Vendor            12.1%

Shareholder/
                 3.7%
   Owner

  Competitor    2.5%

Perpetrator's
                1.8%
Acquaintance



                                        source of tips
With Hotline         47.1%


Tips Overall        42.3%


 No Hotline       33.8%


               companies with hotlines
With Hotline      47.1%


Tips Overall     42.3%


 No Hotline    33.8%      13.3%


         companies without hotlines
importance of hotlines
whistleblower bounties
follow the money
recap
effective internal controls
1. simple
2. effective
3. efficient
1.   process
2.   people
3.   assurances
4.   objectives
1. laziness
2. carelessness
3. dishonesty
1.   segregation of duties
2.   retention of records
3.   super vision or monitoring
4.   information processing
5.   authorization of transactions
6.   top-level reviews
7.   electronic security
8.   physical security
risk focused
objective data
follow the money
questions?
get more from
http://www.slideshare.net/ericpesik/
License and Credits
This presentation, excluding the images, is provided under creative commons attribution license.
http://creativecommons.org/licenses/by/3.0/
You are free to share, copy, distribute, and transmit this work; to remix, adapt this work; and to make commercial use of the work; under the condition that you attribute
this work to me by including the following attribution “Effective Internal Controls by Eric Pesik. Used with permission,” and URL Link:
http://www.slideshare.net/ericpesik/


Microsoft Office Online:
Except as noted below, all images in this presentation are from Microsoft Office Online. Used with permission from Microsoft:
http://office.microsoft.com/en-us/images/

Flickr Creative Commons:
The following images are from flickr creative commons and are licensed and used under creative commons attribution license:
http://creativecommons.org/licenses/by/2.0/deed.en

                    Art Coffee House Waitress by Wonderlane
                    http://www.flickr.com/photos/wonderlane/293137892/
                    Waitress by Adikos
                    http://www.flickr.com/photos/adikos/4319818916/
                    Rutherford Grill by Neeta Lind
                    http://www.flickr.com/photos/neeta_lind/2517034517/
                    Serving Food by Adrian Nier
                    http://www.flickr.com/photos/adriannier/4004167201/
                    Donut Shop Owner by Robert Couse-Baker
                    http://www.flickr.com/photos/29233640@N07/7104455917/
                    Two chorizo burritos with cheese and sour cream by Rick
                    http://www.flickr.com/photos/spine/1994814081/
                    Waiter by Hans Van Den Berg
                    http://www.flickr.com/photos/myimage/4353456304/
                    Blue Telephone by UggBoy♥UggGirl
                    http://www.flickr.com/photos/uggboy/5345135964/

Association of Certified Fraud Examiners:
All data is from the Association of Certified Fraud Examiners, Report to the Nations on Occupational Fraud and Abuse, 2010 Global Fraud Study based on 1,843 cases
of occupational fraud that were reported by the Certified Fraud Examiners who investigated them. http://www.acfe.com

Committee on Sponsoring Organizations of the Treadway Commission:
The Internal Control — Integrated Framework was commissioned by the Committee on Sponsoring Organizations of the Treadway Commission. It establishes a common
definition of internal control that services the needs of different parties for assessing and improving their control systems. http://www.coso.org

Effective Internal Controls by @EricPesik