Internal audit in small and medium-sized companies: when it pays off

While a company is small, the owner is their own control. They sign every order, know every customer and see every invoice. As the company grows, that stops being possible. Decisions are handed to others, and the owner assumes things still go the way they used to do them. Internal audit checks that assumption.

What internal audit is and is not

It is often confused with two other things.

A statutory (external) audit gives an opinion on whether the annual financial statements present a true and fair view of the company. It is intended for owners, banks and the public, is mandatory for companies above prescribed thresholds and looks at the statements.

A tax inspection is carried out by the state and checks whether taxes have been correctly calculated and paid.

Internal audit works for management and the owner. It does not look primarily at the statements, but at the processes they come from: purchasing, sales, warehouse, payroll, payments, IT. It asks three things: is there a rule, is it followed and is it good enough. For most small and medium-sized companies it is not mandatory, so it is done because it is useful.

The aim is not to find someone to blame. The aim is to find the place where the process allows an error or abuse, before it happens.

Signs that it is time

• The company has grown, and procedures are the same as when there were ten of you.
• One person orders, receives goods and approves payment.
• The stocktake shows differences every year that nobody can explain.
• Costs are growing faster than revenue, and it is not clear why.
• The owner is stepping back from day-to-day management or handing it to the next generation.
• A sale, an investor or a larger loan is being prepared.
• There has been an incident: fraud, a major error or loss of data.
• A new information system has been introduced or a new location opened.

What is usually found

Findings repeat from company to company, because they arise from the same habits.

Duties not separated. The same person enters the supplier in the system, posts its invoice and makes the payment. There does not have to be bad intent for this to be a risk: nobody else sees an error.

Discounts and approvals without rules. Sales grants discounts and payment deferrals by feel. When they are added up, the margin turns out to be several percentage points below plan.

Purchasing without comparison. The supplier has been the same for years, nobody checks the prices, the contract has expired.

Warehouse. Goods are issued without a document, or the document is written afterwards. More on this in the article on stock that does not match.

Access that was left behind. A former employee still has a user account, and half the office knows the internet banking password.

Manual touch-ups of reports. Data is exported from the system to a spreadsheet, “corrected” there and only then sent to management. Nobody knows exactly what was corrected.

Records that do not reconcile. Customer balances in the sales program and in the accounts differ, and the difference is carried from month to month.

Rules that exist only on paper. The policy requires two signatures. In practice the second person signs without looking.

What it looks like in practice

Internal audit in a small or medium-sized company is not a project lasting months.

1. Agreeing the scope. Not everything is reviewed at once. One or two processes are chosen where risk is highest or where management sees least.
2. Interviews and a walk-through. How the work is really done, step by step, with the people who do it.
3. Sample testing. For example, thirty purchases from last year are taken, and for each the order, goods receipt, invoice and payment are checked.
4. The report. Short, with findings ordered by importance. Each finding states what could happen and what is recommended.
5. Action plan. Who changes what and by when.
6. A follow-up after a few months. Without it, recommendations stay in a drawer.

For one process this usually takes from a few days to a few weeks, depending on the size of the company and the state of its documentation.

An in-house auditor or an external service

Hiring an internal auditor makes sense in large organisations. A small or medium-sized company generally does not need a full-time person, but a few targeted reviews a year. An external auditor also brings what an employee can hardly have: independence from the people whose work is reviewed, and experience from other companies.

How much it pays off

The benefit rarely shows as a single line, but it can be worked out on an example. A company with revenue of five million euros in which sales, without rules, grants discounts averaging two per cent more than planned loses a hundred thousand euros of margin a year. A rule on who may approve which discount costs nothing.

The second benefit is what did not happen: the fraud that was not possible, the error caught before payment, the customer who did not get goods on credit while already late with payments.

The third is a calmer handover of responsibility. An owner who knows the processes work without their signature can work on development, not on control.

Why we also look at systems

A control that depends on someone remembering to check something is a weak control. A strong one is built into the system: a payment cannot be made without an approved order, a discount above a threshold requires a second person, every change leaves a trace.

That is why, alongside the processes, we review the information systems in which they run, and recommendations often include a change to settings or permissions in the software, not just a new policy.

If you are not sure whether processes work the way you think, tell us what worries you. Read more about the service in the description of internal audit.