Preventive and detective controls for a consultancy
The preventive and detective controls a consultancy should put around its money, how the two work together, and where Achekam blocks or only reports.
By Achekam · · 5 min read · For Consulting businesses in South Africa, Nigeria, Kenya
In a growing consultancy, the founders tend to approve everything themselves in the early years. They know every supplier, sign every payment and recognise every client name on the bank statement. Then the firm hires a finance officer, opens a second office, and the partners realise they no longer see most of what goes out of the bank.
That is the point at which controls stop being an audit word and become a practical need. A useful way to think about them is in two layers: controls that stop a problem happening, and controls that catch it afterwards. A consultancy needs both, and it needs to know which of its systems do which.
Two layers of defence
Investopedia's overview of internal controls explains that internal controls are broadly divided into preventative controls, which aim to stop errors or fraud from happening, and detective controls, which are backup procedures to catch items missed by the first line of defence.
Neither layer is enough alone. Preventive controls can be bypassed, worked around in a hurry or set up wrongly. Detective controls only help if someone actually performs them and acts on what they find. Together, they mean that a mistake or a dishonest payment has to get past a gate and then survive a later check.
ACCA's list of common control procedures gives a fuller picture of the tools available: physical controls, authorisation and approval limits, segregation of duties, management controls such as variance analysis, arithmetic and accounting controls such as reconciliations and trial balances, and human resources controls such as reference and qualification checks.
Stopping problems before they happen
Investopedia gives three examples of preventive controls: authorisation of invoices, verification of expenses, and limiting physical access to equipment, inventory, cash and other assets. In a consultancy, they translate like this:
- Authorisation of supplier invoices. Nobody pays a subcontractor, associate or software supplier without someone other than the requester approving the bill.
- Verification of expenses. Travel and client entertainment claims are checked against receipts and the engagement they relate to before they are repaid.
- Limited access. Only named people can release payments from the bank, change supplier or employee bank details, or reach the firm's laptops and client files.
- Segregation of duties. The person who sets up a new supplier is not the person who approves payments to it.
A small firm cannot always separate every duty. Where one person does several jobs, the detective layer has to work harder.
Catching what slipped through
Investopedia identifies reconciliation, the comparison of two sets of data, as the most important detective control, with corrective action taken when material differences are found. For a consultancy, the comparisons that matter most are:
- the bank statement against the books;
- the age analysis of client balances against what the engagement partners expect to be owed;
- the payroll against the list of current staff;
- supplier statements against the bills recorded;
- the management accounts against the budget, which is ACCA's variance analysis in practice.
A reconciliation that nobody reviews is not a control. Each one needs a named preparer, a reviewer and a date.
A consultancy's money flows and the control on each
| Money flow | Preventive control | Detective control |
|---|---|---|
| Subcontractor and supplier payments | Purchase order and approved bill before payment | Supplier statement reconciliation |
| Staff salaries | Second person verifies bank detail changes | Payroll compared with staff list monthly |
| Expense claims | Receipt and engagement checked before repayment | Partner review of claims by person |
| Client fees received | Invoices issued only from agreed engagement terms | Bank reconciliation and age analysis review |
| Partner drawings and personal costs | Agreed policy on what the firm pays | Monthly review of drawings accounts |
Partners' own spending deserves its own line, because it is the area where staff feel least able to challenge; owners' drawings and personal costs covers it.
Where Achekam blocks and where it only reports
It helps to know which of these controls the software enforces and which it leaves to people.
Where it blocks:
- A purchase order is raised from the selected quotation of an approved requisition. The person who raised the order cannot approve it, and an approved order can be cancelled with a reason.
- Supplier bills are recorded line by line with VAT. A bill without a purchase order waits for approval before it posts, and it can then be paid in full or in parts from a chosen bank account.
- An employee's bank account entered or changed by one person must be verified by another person before it is paid in the payment schedule or bank file.
- Bank lines are matched by suggestion and a person accepts each match. A line not yet in the books becomes a suggested journal that a person approves, and a reconciliation completes only when the difference is nil or every leftover line is explained.
Where it reports but does not stop:
- Approved purchase orders count as committed spend against budgets per expense account and period. The screen shows budget, spent, committed and available, and flags over-committed lines without blocking the purchase.
- Receivables are aged into 0-30, 31-60, 61-90, 91-120 and over 120 days, with overdue totals. The age analysis shows the problem; a person has to follow it up.
Reports are detective controls. They only work if someone reads them on a fixed day and does something about what they show.
A monthly detective routine for the partners
Set aside one meeting a month, with the finance officer presenting and one partner reviewing:
- Confirm the bank reconciliation for each account was completed, and read every explained leftover line.
- Review the age analysis and agree action on anything over 60 days.
- Look at the budget screen for over-committed lines and ask why.
- Scan supplier payments for names nobody recognises.
- Review expense claims and drawings by person.
- Record what was reviewed, by whom, and what follow-up was agreed.
The figures for that meeting can come straight from the management accounts; management accounts for partners suggests how to read them. Choose the date for the first review meeting now, and name the partner who will sign it off.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
