Effective Internal Controls (Annotated) by @EricPesik

Presented by Eric Roring Pesik at
Corruption and Compliance
South & South East Asia Summit
September 2012
Hilton Hotel, Singapore

“These slides cannot replace the
full live presentation, so I have
added quotes and narration from
my live presentation to
supplement the visuals.”

“I am here to talk about instilling
good governance and ensuring
full compliance with an effective
internal controls program.”

“There are two main topics:
First, what are internal controls?
And second, how do you ensure
they are effective?”

finance & accounting procedures

“When we envision internal controls in
modern organizations, the typical
things one thinks about are finance
and accounting procedures, such as
revenue recognition rules, balance
sheets, and cash flow statements.”

finance & accounting procedures

“Or you might also think about your
corporate IT systems , such as
ORACLE, SAP, and the databases and
programs that keep track corporate
transactions.”

corporate IT systems

“Or you might think about general
company policies & procedures, such
as the rules we all follow to get our
expense reports approved.”

company policies & procedures

“These are typical examples of
internal controls. But they can be as
obscure or esoteric. Internal controls
should make sense to the people
that have to comply with them.”

humanize internal controls

“Instead of the typical corporate
internal controls, I offer you a simple
internal control...”

“Everyone has seen a restaurant
guest check. You knows what it is and
how it works. But how many people
this of this as an internal control?”

restaurant guest check

“We recognize restaurant
procedures, and we participate
without question or thought.”

restaurant procedures

“When the waitress takes your order,
the first internal control comes into
play when you tell the waitress what
you want. She writes it down. This
simple data entry drives restaurant
operations.”

take your order

“The waitress repeats your order as
additional an control to verify the
data, and correct it if it is incorrect.”

take your order

“The segregation of duties is another
internal control because the kitchen
must translate the written data into an
allowed order on the menu.”

prepare your order

“The kitchen uses the order to
manage production , preparing the
meal as described in the guest check,
and pulling raw materials from
inventory.”

prepare your order

“The segregation of duties is also a
fraud prevention control. The kitchen
operates to the written order,
preventing the waitress from
recording an inexpensive item but
delivering an expensive item.”

prepare your order

“When your order is ready the waitress
uses the order to verify customer
requirements against kitchen
production output.

serve your order

“There is a final verification when
your meal arrives. If you dispute the
order, the wait staff can compare your
dispute against the written order.”

serve your order

“After you eat, you must pay. The
cashier reviews the guest check to
calculate sales price and record the
sales revenue from your meal.”

pay for your order

“The restaurant keeps the order for
records retention. The manager can
audit these records to monitor the
business operations.”

receipt for order

“Total sales as shown in the guest
checks should match the revenue in
the cash register.”

receipt for order

“Production orders as shown in the
guest checks should match the
changes in inventory.”

receipt for order

“The guest check allows top level
review of restaurant operations. If
there are discrepancies,
management can investigate.”

receipt for order

“It doesn’t feel like an internal control.
It’s not bureaucratic. It helps
restaurant employees do their job
more effectively, so they use it
effectively.”

restaurant guest check

“The restaurant guest check is a
human scale control. It is easy to
understand and requires no special
skill or technical knowledge.”

1. simple
2. effective
3. efficient

“It is simple because it only requires
a small piece of paper passed from
user to user without special tools or
equipment.”

“It is effective because one item
drives nearly every aspect of the
business: sales, customer services,
operations, production, inventory,
revenue, accounting, planning,
management oversight...”

“It is an efficient control because it
does not interfere with how each
employee does his or her job. This
internal control helps employee their
job more efficiently.”

“This internal control was developed
organically. It wasn’t implemented by
legal or finance or compliance. It was
developed over time by the users
themselves to make their job easier.”

“There are probably similar internal
controls in your company developed
by the users themselves.”

internal control
integrated framework

“Let’s look at the opposite end of the
spectrum. The Internal Control -
Integrated Framework was
commissioned the Committee of
Sponsoring Organizations of the
Treadway Commission.”

“This is a formal framework for
internal control systems that is
employed by a majority of
multinational companies.”

“There are four key concepts in the
Internal Controls - Integrated
Framework.”

“Internal control is a means to an
end, not an end in itself.”

internal control is a process

“Internal controls are not just things,
they are people at every level of an
organization. Internal controls rely on
people for their effectiveness and are
affected by the inherent faults of
people.”

affected by people

“Internal controls cannot provide
absolute assurances. There are no
fool-proof internal controls.”

reasonable assurance

“Internal control should be directed at
achieving company objectives. An
internal control that is not tied to a
corporate objective is not an effective
internal control.”

achieve objectives

1. process
2. people
3. assurances
4. objectives

“Internal controls are processes
effected by people that provide
reasonable assurances that you are
meeting or achieving your corporate
objectives.”

“Internal controls protect against the
human desire to skip steps and take
shortcuts.”

human laziness

“Internal controls need to protect
against mistakes and human
carelessness.”

human carelessness

“Human controls need to protect
against human dishonesty.”

human dishonesty

1. laziness
2. carelessness
3. dishonesty

“Internal controls protect against the
inherent risk of having humans
participate in your business.”

“The integrated framework describes
methods we put in place to protect
against the human framework.”

“Separating authorization, custody,
and record keeping roles helps
prevent fraud or error by one person.”

segregation of duties

“Maintaining documentation allows us
to document and substantiate
transactions.”

retention of records

“Supervision or monitoring allows us
to observe and review ongoing
operational activity.”

supervision or monitoring

“Information processing allows us to
verify data entry, comparing file totals
with control accounts, and control
access to data, files, and programs.”

information processing

“Authorization of transactions ensure
that transactions are reviewed and
approved by an appropriate person.”

authorization of transactions

“Top level reviews allow reporting and
analysis of actual results versus
organizational goals and key
performance indicators.”

top-level reviews

“Electronic security provides
passwords and access logs to protect
data and programs from
unauthorized access.”

electronic security

“Physical security provides cameras,
locks, and physical barriers to protect
cash, property, and inventory.”

physical security

1. segregation of duties
2. retention of records
3. super vision or monitoring
4. information processing
5. authorization of transactions
6. top-level reviews
7. electronic security
8. physical security

“The eight categories of internal
control methods are overlapping and
nonexclusive.”

“How to you make them effective?”

“Internal controls must be risk
focused. They must be tailored to
actual risks your company faces.”

“To implement risk-focused internal
controls, you have to do a formal risk
assessment. This is something
everyone talks about, but rarely does.”

risk assessment

“Everyone has seen a typical risk
matrix. It is a tool to compare two
dimensions of data, the probability of
risk and the magnitude of harm, to
help you measure threats.”

High Magnitude High Magnitude
Low Probability High Probability
Magnitude of Loss

Low Magnitude Low Magnitude
Low Probability High Probability

Probability of Risk

risk matrix

“How many people have actually
plotted out risks their company
faces? This should not be merely a
thought experiment, but a formal risk
assessment.”

“Most companies’ risk profiles are
determined by the personal opinions
of a small number of individuals.”

who determines risk?

“Lawyers, accountants, risk officers,
experienced business professionals
are all risk experts. Their job is to
understand the risks our companies
face based on their professional
experience, training, and individual
expertise.”

risk experts

“But individual opinions are too
subjective, especially when risk
assessments are made by limited
individuals insulated from day-to-day
operations.”

subjective opinions

“Relying on risk experts is not
enough. To develop effective internal
controls, you need to supplement
subjective individual opinions with
objective risk data.”

objective data

“Without objective risk data, you do
cannot have a risk-focused program.
And you cannot demonstrate to
regulatory authorities that you have
appropriate controls in place.”

objective data

“The data in this presentation is
derived from reports from the
Association of Certified Fraud
Examiners. This presentation was
delivered in Asia, and uses Asia data.
But global data is similar.”

“Probability is the frequency of fraud
in each category. The percentages
exceed 100% because any event may
involve more than one risk category.”

Corruption 51%
Billing 19%
Non-Cash 19%
Expense Account 14%
Skimming 13%
Cash on Hand 11%
Cash Larceny 9%
Check Tampering 7%
Financial Statement 7%
Payroll 4%
Cash Register 2%

probability of the risk

“Corruption is the most frequent
risk, occurring in more than half of all
events.”

“The magnitude of loss is the median
loss for each event, in thousands of
US dollars.”

Financial Statement $1,730
Corruption $175
Check Tampering $131
Billing $128
Cash Larceny $100
Non-Cash $90
Payroll $72
Skimming $60
Expense Account $33
Cash on Hand $23
Cash Register $23

magnitude of the loss

“Financial statement fraud is
infrequent, but it is the most costly
form of fraud when it occurs.”

“The adjusted risk profile combines
the probability and magnitude
together and then scales the result
from 1-10, lowest to the highest.”

Financial Statement 10.0
Corruption 7.4
Billing 2.0
Non-Cash 1.3
Check Tampering 0.7
Cash Larceny 0.7
Skimming 0.6
Expense Account 0.4
Payroll 0.2
Cash on Hand 0.2
Cash Register 0.0

adjusted risk profile

“Financial statement risk and
corruption risks are both high risk
because of the high occurrence and
high cost. Corruption is a current hot
topic, but the data shows financial
statement fraud is a greater risk.”

Sales 21.0%
Operations 15.4%
Accounting 15.1%
Exec/Upper Mgmt 14.0%
Purchasing 10.7%
Warehousing/Inventory 4.0%
Finance 4.0%
Customer Service 3.3%
Marketing/Pub Relations 2.9%
Board of Directors 2.9%
Mfg and Production 2.2%
Human Resources 2.2%
Information Technology 1.5%
Internal Audit 0.4%
Research and Dev 0.4%
Legal 0.0%

probability of the risk

“The sales department is the most
frequent source of risk, probably
because corruption is the most
frequent category of risk. But the top
5 overall departments are similar, all
with double digits risks.”

Exec/Upper Mgmt $829
Board of Directors $800
Legal $566
Purchasing $500
Finance $450
Marketing/Pub Relations $248
Warehousing/Inventory $239
Human Resources $200
Accounting $180
Mfg and Production $150
Operations $105
Research and Dev $100
Sales $95
Information Technology $71
Customer Service $46
Internal Audit $13

magnitude of the loss

“Upper management and the board
of directors are the source of the
greatest median loss per event,
probably because financial statement
fraud is the most costly form of
fraud.”

Exec/Upper Mgmt 10.0
Accounting 3.5
Purchasing 2.8
Operations 1.7
Finance 1.7
Sales 1.1
Warehousing/Inventory 1.0
Board of Directors 1.0
Marketing/Pub Relations 0.4
Customer Service 0.3
Legal 0.2
Human Resources 0.2
Mfg and Production 0.2
Information Technology 0.2
Research and Dev 0.0
Internal Audit 0.0

adjusted risk profile

“The adjusted risk profile shows
upper and executive management is
the source of greatest source of risk
to the company.”

“External data is not enough. It helps
you benchmark your risk analysis, but
the key to developing risk-focused
controls is collecting your own
internal data.”

“When you need unfiltered data about
your company, you cannot rely on risk
experts, because they don’t know
what is happening with manager-level
and line-level employees.”

company constituents

“You need to discover open secrets
that everyone knows on the shop floor
but that never reach management.”

company constituents

“Employees know who is lazy in their
organization. They might not turn in
their co-workers, but they will tell you
the steps people skip.”

human laziness

“Employees know who is careless in
their organization. They might not turn
in their co-workers, but they will tell
you the mistakes people make.”

human carelessness

“Employees know who is dishonest in
their organization. They might not turn
in their co-workers, but they will tell
you how people steal from the
company.”

human dishonesty

“Ordinary employees are the real risk
experts in your company.”

ordinary employees

“A formal risk assessment is time
consuming. It requires putting all your
constituents in a room having each of
them teach you about the risks they
see every day.”

formal risk assessment

“Your risk assessment will produce a
risk inventory - a list of every risk
your employees identify.”

risk inventory

“Analyze the probability and
magnitude of each item in your risk
inventory to develop your company’s
risk matrix.”

risk inventory

“Once you develop your company’s
matrix, you must select appropriate
internal control methods to mitigate
the risks.”

“But your work is not done. You also
have to assess the effectiveness of
your proposed controls.”

cost of mitigating or avoiding

“Every internal control has a price. It
may be the financial cost to
implement, or the loss of operational
efficiencies due to burdensome
process steps or procedures.”


“Do not allow the cost of mitigation to
exceed the value of the risk. You
need to know the effectiveness of
each internal control.”


“Effectiveness is measured by the
reduction in median losses of
organizations with an internal control
versus organizations without the
same internal control.”

Hotline 59.2%
Employee Support Programs 59.0%
Surprise Audits 51.5%
Fraud Training for Managers/Execs 50.0%
Fraud Training for Employees 50.0%
Job Rotation/Mandatory Vacation 46.8%
Code of Conduct 46.6%
Management Review 40.0%
Anti-Fraud Policy 40.0%
External Audit of ICOFR 34.9%
Internal Audit Department 30.6%
Independent Audit Committee 30.0%
External Audit of F/S 25.0%
Management Certification of F/S 25.0%
Rewards for Whistleblowers 23.2%

effective loss reduction

“Hotlines were the most effective, but
the top 5 internal controls yielded
50% or greater median loss
reduction.”

Hotline $100 $245
Employee Support Programs $100 $244
Surprise Audits $97 $200
Fraud Training for Managers/Execs $100 $200
Fraud Training for Employees $100 $200
Job Rotation/Mandatory Vacation $100 $188
Code of Conduct $140 $262
Management Review $120 $200
Anti-Fraud Policy $120 $200
External Audit of ICOFR $140 $215
Internal Audit Department $145 $209
Independent Audit Committee $140 $200
External Audit of F/S $150 $200
Management Certification of F/S $150 $200
Rewards for Whistleblowers $119 $155

benefit of loss reduction

“Companies without hotlines suffered
median losses of $245k per event.
Companies with hotlines suffered
only $100k median losses per
event.”

“Since hotlines have the greatest
effective loss reduction, let’s do a
quick case study to examine hotlines
further and compare them with other
sources of risk detection.”

Tip 42.3%
Internal Audit 14.3%
Management Review 11.3%
By Accident 8.9%
External Audit 5.8%
Account Reconciliation 5.5%
Document Examination 4.4%
Surveillance/Monitoring 2.7%
Confession 2.4%
Notified by Police 1.7%
IT Controls 0.7%

detection method

“Tips are the source of 42.3% of risk
detection. They are the greatest
detection source.”

Employee 49.2%

Customer 17.8%

Anonymous 13.4%

Vendor 12.1%

Shareholder/
3.7%
Owner

Competitor 2.5%

Perpetrator's
1.8%
Acquaintance

source of tips

“Employees are the greatest source
of tips. But about half of all tips come
from sources other than
employees.”

With Hotline 47.1%

Tips Overall 42.3%

No Hotline 33.8%

companies with hotlines

With Hotline 47.1%

Tips Overall 42.3%

No Hotline 33.8% 13.3%

companies without hotlines

“Companies with hotlines receive
13% more tips than companies
without.”

“Hotlines are the most effective
internal control, reducing median
losses by almost 60%. Tips are the
number one source for detecting risk,
resulting in 13% more tips.”

“Why is this important?”

importance of hotlines

“Regulators are paying whistleblower
bounties to get tips. If you don’t have
a hotline, you are telling 13% of
people with tips to take them
somewhere else.”

whistleblower bounties

“They will follow the money.”

whistleblower bounties

“Follow the money, follow the risk.”

get more from
http://www.slideshare.net/ericpesik/

License and Credits
This presentation, excluding the images, is provided under creative commons attribution license.
http://creativecommons.org/licenses/by/3.0/
You are free to share, copy, distribute, and transmit this work; to remix, adapt this work; and to make commercial use of the work; under the condition that you attribute
this work to me by including the following attribution “Effective Internal Controls by Eric Pesik. Used with permission,” and URL Link:
http://www.slideshare.net/ericpesik/

Microsoft Office Online:
Except as noted below, all images in this presentation are from Microsoft Office Online. Used with permission from Microsoft:
http://office.microsoft.com/en-us/images/

Flickr Creative Commons:
The following images are from flickr creative commons and are licensed and used under creative commons attribution license:
http://creativecommons.org/licenses/by/2.0/deed.en

Art Coffee House Waitress by Wonderlane
http://www.flickr.com/photos/wonderlane/293137892/
Waitress by Adikos
http://www.flickr.com/photos/adikos/4319818916/
Rutherford Grill by Neeta Lind
http://www.flickr.com/photos/neeta_lind/2517034517/
Serving Food by Adrian Nier
http://www.flickr.com/photos/adriannier/4004167201/
Donut Shop Owner by Robert Couse-Baker
http://www.flickr.com/photos/29233640@N07/7104455917/
Two chorizo burritos with cheese and sour cream by Rick
http://www.flickr.com/photos/spine/1994814081/
Waiter by Hans Van Den Berg
http://www.flickr.com/photos/myimage/4353456304/
Blue Telephone by UggBoy♥UggGirl
http://www.flickr.com/photos/uggboy/5345135964/

Association of Certified Fraud Examiners:
All data is from the Association of Certified Fraud Examiners, Report to the Nations on Occupational Fraud and Abuse, 2010 Global Fraud Study based on 1,843 cases
of occupational fraud that were reported by the Certified Fraud Examiners who investigated them. http://www.acfe.com

Committee on Sponsoring Organizations of the Treadway Commission:
The Internal Control — Integrated Framework was commissioned by the Committee on Sponsoring Organizations of the Treadway Commission. It establishes a common
definition of internal control that services the needs of different parties for assessing and improving their control systems. http://www.coso.org

Effective Internal Controls (Annotated) by @EricPesik

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (8)

Similar to Effective Internal Controls (Annotated) by @EricPesik

Similar to Effective Internal Controls (Annotated) by @EricPesik (20)

More from Eric Pesik

More from Eric Pesik (19)

Recently uploaded

Recently uploaded (20)

Effective Internal Controls (Annotated) by @EricPesik