Internal audit or internal check for a growing provider
The difference between internal check and internal audit, signs a growing provider needs both, and how to give an outside reviewer read-only books.
By Achekam · · 5 min read · For Telecoms businesses in South Africa, Nigeria, Kenya
A provider that started with a founder, a technician and a bookkeeper rarely notices the day it stops being small. One year the founder signs every supplier payment; a few years later there are branches, a sales team on commission, a storeroom of routers, two payment gateways and a board that includes an outside investor. The controls that worked when everyone sat in one room have not kept up.
At that point someone usually asks whether the company needs internal audit. Often the honest answer is "not yet, but tighten the internal checks first". This article explains the difference between the two, the signs that a provider has outgrown internal check on its own, and how an outside reviewer can look at the books without being able to change them.
Internal check: one person's work checks another's
ACCA describes internal check as arranging accounting procedures so that no one person has absolute and independent control, with each person's work complementing another's on a continuous, day-to-day basis. It is not a department. It is the way ordinary work is split: the person who raises a purchase order does not approve it, the person who prepares payroll does not approve the run, and the person who banks the cash does not reconcile the bank account.
Internal check catches errors and discourages fraud as part of the normal flow of work, without anyone having to go looking. Its weakness is that it is only as good as its design and its discipline. When staff cover for each other during leave, or one trusted person quietly takes on two roles, the check disappears and nobody reports that it has gone.
Internal audit: an independent look, reporting upwards
ACCA defines internal audit as an independent appraisal function established within an organisation to examine and evaluate its activities, and says its head should report to the board of directors or the audit committee. ACCA adds that internal audit should be totally segregated from the finance department. Its technical article on internal controls sets out both ideas, with the other types of control a business relies on.
The difference matters. Internal check is built into the work; internal audit stands outside it and asks whether the checks are actually working. A finance manager who reviews her own team's controls is doing useful work, but it is not internal audit, because she is reviewing herself.
Signs a provider has outgrown internal check alone
No single size forces the decision, and the law in your country may set its own requirements for certain companies, so take advice on that. In practice, the questions below point the way:
- Is there a board with members who are not managers? They need someone independent to tell them whether controls work.
- Are there several sites handling stock and cash? Branch stores, van stock and walk-in payments multiply the places a control can quietly fail.
- Has a lender or investor asked about controls? That question usually arrives before a funding round or a large facility.
- Has something gone wrong that the normal checks did not catch? A stock loss, a duplicate supplier payment or a commission overpaid is a sign the design has gaps.
- Is billing complex? Usage charges, bundles, promotions and credits create many ways for revenue to leak.
Two or three of those together usually mean it is time for at least an outsourced internal audit review once or twice a year, before building an in-house team.
Monitoring with COSO's tools
COSO, whose Internal Control — Integrated Framework is used widely to describe internal control, states that effective monitoring is one of the five components of an effective system. Monitoring is the part that checks whether the other controls are still operating, which is exactly the gap a growing provider tends to have.
COSO also publishes Illustrative Tools for Assessing Effectiveness of a System of Internal Control, which it says are expected to help users assess whether a system of internal control meets the requirements of the updated 2013 Framework. A small finance team can use them as a structured checklist before hiring anyone: work through each component, note which controls exist, and mark where the evidence is thin. Applying COSO's framework in a small business takes that exercise further.
The internal checks Achekam already enforces
Several of the separations ACCA describes are built into Achekam's screens, so they hold even when the team is stretched:
- A purchase order is raised from an approved requisition, and the person who raised it cannot approve it.
- A pay run is approved by someone other than the person who prepared it, and nobody can approve a run that pays themselves.
- An unpaid customer debt can be written off only once a partner approves it.
- Months can be soft-closed, hard-closed and locked, and reopening a hard close needs a second approver.
These are internal checks, not internal audit. They make one person's work depend on another's; they do not tell the board whether the controls as a whole are working. How the write-off and credit approvals fit together for a provider is covered in controlling credits and write-offs.
Giving an outsourced reviewer read-only access
When you bring in an outside firm to review controls, it needs to see the transactions, not a summary someone prepared for it. In Achekam a business appoints its accounting firm by the firm's Achekam address or firm code, in a role such as accountant, auditor or adviser, with an access level, and the firm accepts or declines. What the firm's people can do depends on that level: bookkeeping access covers the accounting but not the business's users, settings or gateways, and review access is read-only.
For a reviewer, read-only is the right level. They can open the general ledger, which lists every posted line, and the trial balance for all time, a period or a date, and follow transactions to their source, without being able to post or change anything. One limit: a business cannot appoint a firm that is not already on Achekam, so the reviewing firm needs its own workspace first.
Where to start
List the five or six processes where money or stock leaves the business, and for each one write who starts it, who approves it and who checks it afterwards. Where one name appears twice, you have found the first internal check to fix, whether or not internal audit follows.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
