What is considered a poor internal control system?

There are a number of things that can point to a poor internal control over financial accounting. If a business has poor internal control over accounting, there is a great opportunity for its employees to commit fraud.

A poor internal control system would exist if there is no proper segregation of duties - if the same person who had custody of an asset was the same person who recorded it in the financial accounting records or could authorize its disposition. It would give the person who had custody of the asset a chance to steal it and cover up the theft by making false entries in the accounting records. Or it would make it possible for an employee who had the authority to authorize and sign company checks the ability to "authorize"and sign a check written to himself. If that person also recorded checks in the company system and reconciled the bank statements (or he was in collusion with another employee who was part of the fraud), he could cover up his act for a long time. A payroll manager who had the ability both to generate *and* distribute paychecks would be able to issue extra paychecks, or paychecks to nonexistent employees (which would be cashed by the payroll manager) without being caught.

A good internal control system begins at the top management level. Employees should receive a documented code of ethical conduct and understand it. There should be a culture of honesty that everyone follows, including top management. Duties should be properly segregated to prevent any opportunity for theft of company assets (including cash), and people should understand what they need someone else's approval for. Accounts should be regularly reconciled by a third party who is not part of the check-writing or collections-receiving, or recording process. There should be an internal audit function monitoring to see that the controls work as designed and that they are being followed. There should be an established mechanism for employees to report any fraud they see occurring in the workplace.

And even a well-designed internal control system is no good if no one is following the required procedures. So compliance should be monitored regularly.