Fraud Prevention and Detection through Internal Controls
The vast majority of fraud I've seen in small and medium sized businesses has not been particularly clever. It's just been the result of complete lack of control. A cashier who never took a day off. A vendor master that anyone could edit. A payroll register that had never been matched against attendance in years. The money didn't just disappear. It seeped out month on month through an open door.
That is why CA K. Vidyadaran, CA Naval Kishore Bajaj and I wrote Fraud Prevention & Detection Through Internal Controls (for the SME sector) which was published by The Institute of Internal Auditors India.
Why SMEs Need This Now
SMEs account for a huge proportion of India's output and employment, yet the vast majority operate on a trust basis rather than on systems. The owner signs everything, two people do ten jobs and documentation is just paperwork. These are the habits of the small business. They fall apart the moment the business grows. Banks, investors and due diligence teams will now look at governance and internal controls before they will lend or invest. Poor controls cost a business in two ways: in the losses themselves and in the cost of finance.
What the Book Covers
The book starts with the basics, covering an overview of the COSO framework followed by an explanation of fraud risk assessment. It then highlights key red flags, including employees whose lifestyles exceed their known income, staff who avoid job rotation, and pending account reconciliations.
Each business cycle is detailed in its own chapter:
- Payroll and HR: It includes ghost employees, inflated overtime, and master data changes
- Procurement: It includes kickbacks, vendor collusion, rotation of buyers
- Sales and receivables: It includes teeming and lading, unauthorised credit notes
- Inventory: It includes physical verification, variance analysis, ABC and FSN analysis
- Cash and bank: It includes surprise checks, dual signatures, bank reconciliation
- Fixed assets and financial reporting: It includes asset registers, monthly closing, valuation
For each area, we detail the preventive and detective controls a small business can actually put in place.
Four Controls Every Business Must Have
- Segregation of duties
- Documentation
- Internal audit
- Delegation of financial authority
The first and foremost important control is Segregation of duties, which is the best preventive control. Next is Documentation, which provides the audit trail. Next is Internal audit, which tests the rest. Last but not least is delegation of authority, which is about who authorises what and up to what limit.
Controls Have Limits
Collusion can beat them. Overly prescriptive controls will stifle the business. An indifferent top management will make any policy of no value on paper. Controls have to be appropriate, cost effective and owned by the people who run the business. The internal auditors will review and make recommendations; the managers will own the controls.
Who Should Read It
Entrepreneurs building anti-fraud controls from scratch. Young Chartered Accountants and internal auditors picking this as their specialism. Bankers, investors and due diligence people looking at the governance.
Fraud prevention is about protecting the years of work that a business has put into building its organisation. Read the book, check your own controls against it and close the gaps before someone else does.