In a lot of the small governments we work with, one person wears several hats. They collect the money, they enter it into the system, they cut the checks, and at the end of the month they reconcile the bank account. That isn’t a sign of a bad employee. Usually it’s a sign of a dedicated one who has been asked to cover a lot with very little. But it’s also a segregation of duties problem, and when you’re short on staff and short on budget, it’s one of the easiest risks to let slide. It’s worth taking a hard look at.
The CARR test
An easy way to think about segregation of duties is the CARR acronym:
- Custody of the assets (handling cash, checks, or the ability to move money)
- Approval or authorization of a transaction
- Recordkeeping (posting to the books and records)
- Reconciling (comparing the records back to an outside source, like the bank)
Ideally, no single person performs more than one of these for the same transaction cycle. When one person handles two or more, an opportunity exists. Add a third or a fourth, and that opportunity grows, along with the chance that an honest mistake goes unnoticed.
The rule of thumb: if one person is doing two or more of the CARR functions in the same process, that’s a spot to look at first.
You can’t manage motivation. You can manage opportunity.
You have no way of knowing what’s happening in someone’s personal life, and you can’t control the pressure they may be under. What you can control is whether the opportunity is sitting there. That’s the piece squarely within your reach, and it’s where your effort pays off. Strong controls also protect your good employees, because when the records are reviewed by someone else, no one is left in a position where they can be blamed for something they didn’t do.
Practical steps when you’re short on staff
Full separation isn’t realistic with two or three people in the office. It doesn’t have to be. Here are steps we’ve seen work well in smaller entities:
- Use your governing board. Board members can review and approve bank reconciliations, sign off on the monthly financial reports, and look at the check register. That’s a real control and it costs nothing.
- Have someone other than the person who writes the checks open the bank statement, or set up read-only online access for a second person.
- Separate the person who adds a new vendor or new employee from the person who pays them.
- Require dual signatures, or at least a second review, on checks and electronic transfers above a set dollar amount.
- Rotate duties where you can, and require that employees who handle money take their vacation time. Issues often surface when someone else covers the desk.
- Turn on the audit trail and the user permissions in your accounting software, and limit who can void or adjust a posted transaction.
- Document what you’re doing. If a control is a monthly review by the fiscal officer’s supervisor, put initials and a date on the report.
Start with one process
You don’t need to redesign everything at once. Pick your highest risk area, usually cash receipts or disbursements, walk it through the CARR test, and see where one person is holding two or more pieces. Fix that one. Then move to the next process. Small, steady changes add up to a much stronger control environment.
Let’s take a look together
If you’d like a second set of eyes on how duties are divided in your office, or you want help finding practical fixes that fit the staff you actually have, reach out to Adam Lesch and our advisory team at alesch@jg.cpa. We’re always glad to help.