Years ago I used to work for a guy named Mike. He was the chief financial officer at the company where we both worked, and I was his controller. Mike, if you're reading this, you know who you are. You were the ultimate CFO.
Mike was obsessed about internal controls. And rightly so. Our company was publicly held. "The money doesn't belong to us," he often told me. "It belongs to our shareholders." This was true. He was an excellent CFO. And I'm pretty sure he was mentally ill.
At least about internal controls.
This guy would drive me nuts because he never trusted, never believed ... anyone. When somebody said something to him, it had to be backed up with facts and documentation. He was very cynical. That was Mike.
At the time, I thought he was a lunatic. But that was 20 years ago. Now I'm sure he was a lunatic. But it's OK. Because he chose to be crazy about something that mattered: money. And after running my own business now for the greater part of those 20 years, I realize that Mike was right. Along the way I've learned to appreciate all the things he told me about internal controls. The main thing is this: Many penny-pinchers who think they have good internal controls most likely don't.
Yes, that's you.
DUAL-SIGNATURES MYTH
Which means that your cash is not as safe as you think it is. Mike obsessed over this. And it wasn't even his money. We should all obsess like Mike. Many of the internal controls we think are effective are not.
For starters, there's the "dual-signatures" myth. When I worked with Mike, our checks had this statement written in bold: "Two signatures are required for amounts over $5,000." Do any banks really pay attention to this? Is it possible that they have a few other issues facing them, like staying liquid and avoiding failure from all those bad loans they gave out? And even if a check signer is "authorized," does that person have the authorization to also sign checks greater than $5,000?
Mike never believed it. He required an extra level of internal checking first, before any checks went out the door. Some may say that it would be the bank's liability if a check was cashed without the required two signatures. Maybe so. But good luck with that lawsuit. See you next decade.
Another thing Mike never believed was that our accountants knew what they were doing. For sure, they were smart guys. They were even based in New York, so they must be smart, right? And even though our company only had 50 employees, we were still publicly held, which required that extra level of scrutiny you would assume was being done by our accounting firm.
Well, here's the reality about accountants: They're stressed, they have limited budgets, their clients beat them up on fees, and they really don't have the manpower to truly do an adequate job reviewing their clients' internal controls. The accounting profession doesn't deny this. In fact, just read any auditor's opinion on a public company's statements. They clearly state that they're not responsible for their clients' internal controls and are relying on management for most of their information. "If you think our accountants have a clue about how our internal controls are working, then you're clueless," Mike said to me.
See what I mean?
And then there's Bernice, the nice lady who did our bookkeeping and accounts payable. "She could be a thief," Mike once said to me. A thief? I thought to myself. My God, the woman's a grandmother. She sings for her church choir. How could Bernice be a thief?
Mike believed that it's a myth that internal controls aren't needed if your people are trustworthy. He wasn't saying Bernice was a thief. He was saying that we have to keep our eyes open to the possibility. "There are stories about people like her in the paper all the time," he said.
I believe that people are inherently good, moral and ethical. Mike doesn't. Which is why he was the CFO and I was just the controller. And not a very good one at that.
THE PETTY CASH BAROMETER
Here's another myth: Petty cash is too immaterial for internal controls. I remember Mike becoming particularly incensed about that. We were discussing what "controls" we should have over our petty cash, which was never more than $500 kept in a metal box. I was of the opinion that the amount was so small it didn't warrant a lot of effort. "Who cares about a few hundred bucks?" I argued. That got Mike going. "$500 is $500," he would yell back at me. "If some of it goes missing, what does that say about the finance department? That we can't even be responsible for $500? We need to set the tone."
Once again, Mike was right. That $500 wasn't even our money; it was the shareholders'. But for most of us penny-pinchers, petty cash is our money. And we like our money. Most of us would likely stop and get out of our cars on the turnpike if we saw a $20 bill floating in the left lane. We haggle over amounts way less than $500. I get furious when a waiter overcharges me for a Coke! So it's not really the amount we're talking about, it's the principle. No, wait a second. It's the amount too. Petty cash counts. Keeping control over it is important.
One more myth: Policies and procedures are overrated, particularly in a small company. As anal-retentive as Mike was, he never really pressed me on written policies and procedures. Of course, we had certain key policies, specifically in the area of human resources. But he knew that writing up complicated sets of rules for a finance department that consisted of five people all working out of one room seemed a little overkill.
For most penny-pinchers, written policies and procedures are a myth. They don't add to our internal control. Most of us don't adhere to them if we don't feel like it. We don't even have the time to write them up. And if we did, they'd most likely be stuffed away in some drawer and forgotten about. Policies and procedures are important if you're running a big company. In a small business, they're of limited use.
Yeah, Mike was a lunatic. But it was always about money. I haven't spoken to Mike in a few years. Last I heard he was chief executive officer of another public company. I should buy shares in that company.
Gene Marks, CPA, is the owner of the Marks Group, which sells customer relationship, service, and financial management tools to small and midsized businesses.
