Internal controls stem from the idea that no one individual should have complete control over a given transaction process and that there should be proper segregation of duties among individuals involved in every process. By spreading responsibilities among employees, companies can mitigate the risk of fraud. Practically speaking, this means separating the preparation, recording and approval of a transaction among multiple people.

To illustrate this point, consider some internal controls related to processes within the accounts payable cycle.

Subcontractor Selection
Proper controls over subcontractor selection and approval help mitigate the risk of contracting with an unqualified subcontractor or one that does not have proper bonding, or that is being given preferential treatment by the company’s purchasers.

• Segregate subcontractor selection from subcontractor approval; no one person should perform both.
• Ensure that those responsible for purchases are getting at least three quotes for significant subcontracts and that they are not simply choosing their favorite subcontractor for every purchase. Spreading the work around will help keep subcontractors and suppliers honest, resulting in an economic benefit to the company. Be on the lookout for possible favors and kickbacks if the same purchaser always selects the same subcontractors and suppliers.
• Conduct a background investigation before signing an agreement with a subcontractor or major supplier. This includes obtaining their most recent financial statements, running credit reports and verifying their level of solvency. Do not rely on past financial history alone, as the subcontractor’s financial situation could have changed.
• Require all subcontractors to provide surety bonds if the subcontract is for an amount larger than what the company would be willing to be held responsible. If a company fails to require sufficient bonding, it becomes the subcontractor’s guarantor for payment to suppliers, as well as for the quality and timeliness of work.
• Make sure the subcontractor’s bonds are real by having a surety agent verify their authenticity. Forged bonds can result in significant losses to the contractors.

Do not solely rely on lien releases; they can be falsified. Consider requiring the contact information for the subcontractor’s suppliers, and emailing the suppliers each month before any payments are made to verify that the subcontractor is current with its suppliers. If not, consider issuing joint checks covering the amount due to the supplier and paying the difference, if any, to the subcontractor.

Subcontractor Analysis and Review
After selecting the subcontractor, remember to put controls in place to ensure, through analysis and review, that no unapproved subcontractor falls through the cracks, and that any unusual fluctuations or inconsistencies from the original contract, or subsequent change orders, are detected or prevented in a timely matter.

• Avoid having one individual responsible for the receipt of materials and approval of invoices. These two functions should be segregated in order to mitigate the risk of misappropriation of assets or paying for materials that were never received.
• Quantities on monthly subcontractor invoices should be compared to quantities approved.
• Compare actual quantities to budgeted quantities on all jobs, and investigate any significant or unusual fluctuations.
• Compare actual dollar amounts to budgeted dollar amounts on all jobs.
• As part of the end-of-job review, compare actual pricing to the original quote.
• Scrutinize change orders; skimming through them undermines the in-depth review of the original contract. Additionally, ensure two people approve significant change orders.
• Establish a system to track subcontractor payments. In general, subcontractors are paid in installments and projects are rarely paid in one installment. Consequently, a significant risk of overpaying will exist without proper controls in place.
• Consider assigning someone independent of the purchasing and accounts payable functions to periodically review the list of vendors and subcontractors. If a name is unrecognized, look at the invoices from and payments to vendors in order to determine the legitimacy of the vendor or subcontractor.

While the number of controls within a process varies from one company to another, depending on size and resources, the key is to remember that no one should have sole oversight over an entire process. Lastly, keep in mind that even the most robust set of internal controls is ineffective if a company fails to follow through on them.