Trust is not an internal control...

In the recent past I have investigated a number of irregularities whose root cause has been lapse internal controls and lack of enforcement. Over the last few years many firms have crafted internal controls, some even appreciating that a risk department should be established. Many of the these firms have spent huge amounts of money crafting what I would call wonderful documents in as far as identifying risks and how to control/manage them.

I always appreciate the efforts that companies make to ensure that they documented controls. However, the implementation of such controls is wanting in most cases. And this is where the whole risk management process fails. In the anti-fraud profession we have come to appreciate that if a fraudster knows that he will not be detected, then internal controls fail. Fear of detection is what prevents fraud and misconduct. Think about your organization, do you think the internal controls would deter a potential fraudster. Detection entails: having the right internal controls, resources in your risk department, committed management that sets an example, being tough on non-compliance and ensuring that there is right communication to staff.

I have come across organizations particularly small NGOs and family run businesses where internal controls are non-existence.

It always saddens me as an owner of a business or a director of an NGO narrates how, they have always trusted person X to handle their accounts for the last ten years and he has always performed, only for them to find out that the trusted fellow was running a separate organization. Some of these cases have resulted in consequences that would have never been anticipated: Freezing of funding from donors, tax claims from the tax authorities or closure of the organization.

However much you trust your employees, ensure you review their work or have an independent person do it. Have a questioning mind especially for long serving employees in certain positions…trust cannot be an internal control. I have seen instances where family members who have been placed in positions of trust turning out to be real fraudsters. I have also investigated a case where a receipting clerk defrauded his organization about Kshs 200 million in a period of two years – he had served in the position for over ten years.