Are Your Internal Controls like Swiss Cheese?
Part Sixteen -- Preventive and Detective Controls
by Gene Bucciarelli, MBA CPA
"Never assume that what you are currently doing is the best way."
Our internal controls use a mix of the preventive and detective kind. Preventive controls prevent bad things from happening while detective controls detect them after they happened. It should be apparent that in the best of all possible worlds preventive controls are the most desirable. It is always better to prevent an error or fraud then to detect it later. Not only are preventive controls more desirable but they are usually the most cost efficient over the long term. Auditors and management should sleep better knowing that the cash vault is locked each night preventing access rather than depending on a daily cash count to ensure that no cash is missing.
I would argue that in looking at internal controls throughout the institution, auditors and management should implement as many preventive controls as possible. In many cases this involves the purchase of hardware or software. However these costs can be significantly smaller than personnel costs over the medium to long term.
Two branch related processes come to mind as examples:
Automated Cashiers Check
Software programs are available that can generate a cashiers check on a routine printer. Once the controls are set up as to who has access and to what dollar amount, this product removes the need to have a cashiers check supply. A supply needs to be locked up, tracked, certified and audited. All of which involves people and time. The software program provides a significant preventive control while the supply of checks on hand involves significant detective controls and on going costs.
Non Automated Telephone Transfers
Many banks allow the customer to call in and request a transfer of funds between accounts. Software programs are available that once set up will ensure that only the personnel with access enter the transfer information, the correct to and from accounts are already set up, and the possibility of overdrafts can be eliminated. Without this software each step takes time, involves documentation, and requires call back to ensure that the process was properly authorized and done correctly.
We use a number of preventive and detective controls in our banking environment. However there is always the opportunity to look for a better way. Skew your internal controls toward the preventive ones as much as possible. Consider what I call the four horsemen of internal controls as a guide for any process:
- Quality
- Timely
- Cost efficient
- Risk reduced
May your preventive controls work their magic before your detective controls even come to work!
Gene Bucciarelli, MBA CPA is the principal of Internal Control Systems, a community bank internal auditing and consulting firm. Reach him at genebucc@aol.com and 925.828.7360.
First published on BankersOnline.com 11/14/05
Privacy Policy Disclaimer Recommend This Site ! Contact Us
BankersOnline is a free service made possible by the generous support of our advertisers and sponsors. Advertisers and sponsors are not responsible for site content. Please help us keep BankersOnline FREE to all banking professionals. Support our advertisers and sponsors by clicking through to learn more about their products and services.
| 
Print Friendly!
Email This Article!
Discuss NOW!