Written by Tommy Stephens, K2 Enterprises
So you or your client is using QuickBooks to manage the finances of a small business and you're concerned about the internal controls in the software. And well you should be. According to statistics published by the Association of Certified Fraud Examiners, fraud is alive and well in the United States. In fact, fraud is consuming 6% of all business revenues in this country; this equates to an average loss of $4,500 per employee, per business. Further, over 80% of all frauds are committed in the absence of internal controls or when internal control measures are ignored. Considering numbers like these, it's no wonder why the average small business fraud carries a price tag of $98,000. And with QuickBooks holding a substantial portion of the market share of small business accounting systems, by extension a large percentage of frauds committed in small businesses involve this popular accounting software application.
Fortunately, QuickBooks - like many small business applications - contains a relatively effective mix of internal control measures that, when properly implemented and in concert with appropriate manual procedures and management oversight, can significantly strengthen internal control in small businesses. The key to successful implementation is understanding the nature of the controls and how to activate them. While not intended to be an all-inclusive listing, perhaps the five most significant of these measures are:
1.
Implement appropriate user IDs and passwords for all QuickBooks users.
2.
Establish the Audit Trail Preference and review the Audit Trail Report routinely.
3.
Activate the Closing Date and the Closing Date Password.
4.
Prepare meaningful budgets and periodically review actual-to-budget comparisons.
5.
Backup data files on a daily basis and ensure that backups are stored off-site.
The first line of defense in any software application is to establish user IDs and passwords for each user requiring access to the system and QuickBooks is no exception to this rule. User IDs may be established by selecting Company and Set Up Users from the menu. Here, specific rights and privileges should be granted to each user allowing each user to access only those areas of the application necessary to complete job tasks as assigned by documented job descriptions.
QuickBooks - like virtually all accounting applications - offers users the ability to generate an Audit Trail Report. This report answers the questions of "who" did "what" and "when" they did it. For every transaction entered, changed, or deleted in QuickBooks, the Audit Trail Report generates a history of the user who entered, changed, or deleted the transaction, the date and time the entry, change, or deletion was effected, and the appropriate transaction details. For the report to be truly effective, the Audit Trail Preference must be activated. Users will find the Audit Trail Preference by selecting Edit and Preferences from the menu; then select Accounting Preferences and the Audit Trail Preference will be found on the Company Preferences tab. Be aware that activating the Audit Trail Preference could cause the size of the QuickBooks data file to increase to a point where performance begins to suffer; however, statistics indicate that even with the Audit Trail Preference activated, users should still be able to comfortably process up to 1,000 transactions per month with no significant degradation of performance.
One of the chief concerns expressed by accountants and business owners alike is the fact that QuickBooks permits changes to "closed" periods. In fact, in QuickBooks there is no formal closing process so prior periods are always subject to change. However, setting the Closing Date and implementing a Closing Date Password can effectively "lock-down" prior periods so it is much less likely that transactions will be entered, changed, or deleted in those periods which are deemed to be closed. Like the Audit Trail Preference, the Closing Date and Closing Date Password are found on the Company Preferences tab of the Accounting Preferences window.
Implementing effective budgeting procedures can be one of the most effective internal control procedures a business of any size might employ. QuickBooks contains very effective budget maintenance and reporting features enabling users to create budgets and forecasts and then report on how the organization has performed relative to the budget. Users begin this process by selecting Company and Planning & Budgeting from the menu and then selecting Set Up Budgets. Detailed monthly budget data may be entered; budgets may even be created all the way down to the department (Class) level or the customer level if desired. Once entered, actual results may be reported and compared against the budget by selecting Reports, Budget & Forecast, and Budget vs. Actual. By thoroughly investigating and analyzing significant deviations from planned results, business owners and managers may be able to detect a fraud scheme in its' infancy.
Backup! Backup! Backup! It's not a matter of "if" but rather a matter of "when" you'll need to restore your data. This is true not only of your QuickBooks data, but other data on your computer or server also. Be sure that daily backups are generated, that backups are stored off-site, and that backups are tested periodically to ensure their reliability. As an alternative to traditional backup mechanisms, consider using an on-line backup service. With an on-line backup service, the process of making the backup and storing it off-site is outsourced to a firm that specializes in this type of service, making it more likely that your backup will be available when you need it.
No single measure or combination of measures can provide absolute assurance that internal control objectives are being met. However, by adopting the measures outlined above - along with other procedures targeted to the specific needs of a business - QuickBooks users can help to insulate themselves from fraud and other internal control failures. Remember, the key is in establishing a layered and measured response to the risks specific to the business. Good luck!
Printable version
