Are your Internal Controls like Swiss Cheese?
by Gene Bucciarelli, CPA
Internal Control Systems
"Internal Controls cannot make an institution successful, but the lack of controls or only partial controls can be and commonly is a cause of its failure."
Regulators have always been aware of the reality of the above statement. Recently all regulators have formalized their interest in the institutions internal control framework by issuing guidelines for their members to follow. As a result examination emphasis on controls is increasing at an accelerated pace. If you haven't already you will soon see regulatory criticism on the lack of control emphasis in your policies and procedures.
Overall responsibility for the internal control framework at your institution rests with the Audit Committee. However, it's the managers and supervisors responsible for setting up the workflows who put the proper controls in the right places for each workflow. This of course means understanding the potential risks involved in the various activities of the institution and then installing the proper and necessary controls. Unfortunately the reality is that there is virtually no
formal internal control training for line managers and supervisors. As a result anything we know about controls usually comes from one of the following sources:
The way we did it at the last place we worked
Regulatory criticism
Internal Audit criticism
A dollar loss that highlighted the lack of a control procedure.
One of the many problems with this type of "education" is the lack of understanding of the why a certain procedure needs to be put in place. Only in the last instance do we get a hard education regarding the why. The majority of mangers and supervisors never understand fully the risks they should be worried about and need to prevent.
Controls throughout the institution and in every department need to be installed, reviewed and tested on a regular basis. Setting up a workflow with the proper controls is only the first step. As time passes turnover and lack of follow up tend to weaken controls or they disappear entirely without the knowledge of the managers or supervisors responsible. Written procedures alone do not guarantee that the controls continue to operate. It takes follow up, monitoring and testing (auditing). Managers and supervisors take notice; things may not be being done the way you think they are. Don't wait for the examination, audit or the loss to find out.
This multi part series of articles will concentrate on specific operational and administration activities and discuss the risks and possible controls that should be in place to control those risks. Future subjects will cover such areas as certifications, employee accounts, safe deposit, wire transfers, investments, dormant accounts, new accounts, negotiable instruments, levies, telephone transfers, hiring, accounts payable and many others covering branches, accounting and other specialized functions. Stay tuned and if you have any areas of concern let us know and we will try and fit it in.
Gene Bucciarelli is the principal of Internal Control Systems. A community bank internal audit and internal control consulting firm. He has been involved in bank auditing and internal control issues for over 25 years. He is an expert witness for employee fraud. He can be contacted at 925.828.7360 or email at genebu@home.com.
BankersOnline is a free service made possible by the generous support of our
advertisers and sponsors. Advertisers and sponsors are not responsible for site content. Please help us keep BankersOnline FREE to all
banking professionals. Support our advertisers and sponsors by clicking
through to learn more about their products and services.
Print Friendly!
Email This Article!
Discuss NOW!
