Directors or accountant: who owns internal control?
Who is responsible for internal control in a small advice practice: the directors, the owners or the outside accountant, and where each one's role stops.
By Achekam · · 4 min read · For Financial services businesses in South Africa, Nigeria, Kenya
"Our accountant takes care of all that." It is one of the most common answers a small advice practice gives when asked about its internal controls, and one of the most misleading. The outside accountant may prepare the annual financial statements, file the tax returns and even keep the books. But when a payment goes to the wrong account, a client's fee is never invoiced or an employee takes money, the question of who was meant to prevent it does not land on the accountant first.
This article sets out where responsibility for internal control sits in a small practice, in South Africa, Nigeria or Kenya, what that looks like for a team of a few people, and how to give an outside accountant the access it needs without handing over ownership.
Directors in a company, owners otherwise
ACCA explains that in a limited company, the board of directors is responsible for ensuring appropriate internal controls are in place, while in sole traders and unlimited partnerships, responsibility often lies with the owners.
For an advice practice, that gives a clear answer in most cases:
| How the practice is set up | Who is responsible for internal control |
|---|---|
| A private company | The directors, as a board |
| A partnership | The partners |
| A sole proprietor | The owner |
A director who is also the only adviser does not escape the role because the practice is small, and a director who leaves "the finance side" to a co-director has not delegated the responsibility, only the work.
What internal control is meant to achieve
It helps to know what the directors or owners are responsible for. ACCA lists the objectives of internal control as:
- the efficient conduct of business;
- safeguarding assets;
- preventing and detecting fraud and other unlawful acts;
- complete and accurate financial records;
- timely preparation of financial statements.
COSO, which publishes guidance on internal control, makes a broader point: effective internal controls can help an organisation articulate its purpose, set its objectives and strategy, and grow on a sustained basis with confidence and integrity in all types of information. COSO adds that internal controls have value beyond compliance and external financial reporting. In a practice, that means the same controls that stop a fraud also give the owners figures they can plan with.
The ACCA article on internal controls sets out who is responsible, the objectives above and the main types of control in one place.
The control environment in a team of five
Investopedia explains that the control environment, set by the board of directors and management leading by example, establishes for all employees the importance of integrity and a commitment to rooting out improprieties, including fraud.
In a large company, the control environment is a set of policies and committees. In a practice of five people, it is mostly behaviour:
- the director who approves their own expense claims through the same process as everyone else;
- the owner who reviews the bank reconciliation every month and asks about anything odd;
- the partner who refuses to let a client pay "in cash, off the books";
- the clear message that a mistake reported early is forgiven, and one hidden is not.
Staff notice what the people at the top do far more than what the policy file says. Practical ways to split duties among a few people are in separating duties in a small advice practice.
What the outside accountant does, and does not take over
An outside accountant can design controls, point out weaknesses, keep the books, review the monthly figures and prepare the annual statements. Those are valuable. What the accountant does not take over is the responsibility ACCA places on the directors or owners. The accountant sees the transactions after they happen; the people running the practice decide who may approve payments, who holds the bank passwords and who checks whose work.
Treat the accountant as a source of advice and a second pair of eyes, and keep the decisions inside the practice.
Appointing the accountant with the right access
On Achekam, a business appoints its accounting firm by entering the firm's Achekam address or firm code, and chooses the role: accountant, auditor, tax practitioner, payroll provider or adviser, with an access level. The firm accepts or declines.
The access level is where the practice keeps control. What the firm's people can do in the books depends on it:
- Bookkeeping access covers the accounting, but not the business's users, settings or payment gateways.
- Review access is read-only.
A practice that keeps its own books and wants the accountant to look over them each month can give review access, so the accountant sees everything and changes nothing; the steps are in giving your accountant review-only access. A practice that outsources its bookkeeping gives bookkeeping access, and still keeps users, settings and gateways in its own hands.
The administrator's own responsibilities
When a business signs up on Achekam, it gets its own workspace, its own books and its own web address on the Achekam domain, and the person who signs up becomes the administrator. That person holds a control in their own right: they decide who else gets in and what each person can do.
In a company, the administrator should be a director or someone the directors have formally chosen, not whichever staff member happened to create the account. Review the user list regularly, remove people who have left, and make sure no one person both sets up suppliers and approves payments to them.
Put the answer in writing
Write a short note, approved by the directors or owners, naming who is responsible for internal control, who the administrator is, which accounting firm has access and at what level, and when the controls will next be reviewed. It is a short document, and it ends the comfortable assumption that the accountant has it covered.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
