Internal Controls and Fraud Prevention
Framework
COSO's five components are control environment, risk assessment, control activities, information and communication, and monitoring. Control activities include segregation of duties, proper authorization, adequate documentation, physical safeguards, and independent reconciliations. Preventive controls stop problems before they occur (approvals, access restrictions, pre-numbered documents); detective controls find them afterward (bank reconciliations, audits, variance analysis).
Segregation of duties
No single person should combine custody of assets, authorization of transactions, and recording. The clerk who handles cash should not also keep the ledgers or prepare the bank reconciliation. Collusion between two employees defeats segregation, which is why mandatory vacations, job rotation, surprise counts, and fidelity bonding are standard safeguards.
Fraud
The fraud triangle is pressure or incentive, opportunity, and rationalization. Asset misappropriation is the most common fraud - skimming, lapping, fictitious vendors, duplicate expense claims - followed by corruption and financial statement fraud. Red flags include employees who never take leave, unexplained lifestyle changes, missing or altered documents, and adjusting entries posted by unauthorized staff.
Traps
- Misclassifying a control as preventive versus detective.
- Assuming segregation of duties is sufficient; management override and collusion remain.
- Treating internal control as a guarantee rather than reasonable assurance, subject to cost-benefit limits.
Worked example
One clerk receives cash, records sales, and prepares the bank reconciliation. Fix: move the reconciliation to the owner or an outside accountant, require daily deposits with sequentially numbered receipts, and rotate or periodically review the clerk's work.
Rule of thumb: custody, recording, and authorization in the same pair of hands is a control failure.