Why Small Companies Still Need Internal Controls

Internal controls are important for every business, but often overlooked by smaller companies with fewer resources or understanding of what exactly they need to have in place.

You’ve heard before that small companies are the backbone of American business, and it’s absolutely true. Here in Colorado, 99.5% of Colorado businesses are small companies (674,741), with 48% of Colorado employees employed by small businesses (some 1.2 million people). In 2019, 5,921 firms exported goods worth $7.7 billion from Colorado, with 87% of those exporters small businesses.

Bottom line: small businesses are big contributors to the economy of our great state of Colorado. Having internal controls in place ensures that these businesses are able to achieve their operational goals. They protect the integrity of all financial reporting, help prevent fraudulent activity, and ensure a company is in compliance with rules and regulations.

Does my business need to comply with Section 404 of the Sarbanes-Oxley Act?

If you fall into the small business category, you might wonder: does my company need to worry about internal controls?

Public companies have to comply with Section 404 of the Sarbanes-Oxley Act, which states that the annual report must include their own assessment of internal control over financial reporting and an auditor’s attestation. If you’re a smaller public company (non-accelerated filer), the external auditor assessment of internal control is not required, but the report of management on your internal control over financial reporting is.

There are benefits of voluntary SOX compliance

To reiterate, even if you’re a small public company, you do have some compliance requirements regarding Sarbanes-Oxley. But if you’re a private company, there are still many reasons it’s worth the effort to make sure your internal control system is well developed. Here are a few of the benefits:

1. You’ll put potential investors and lenders at ease. Having internal controls in place proves to investors (private equity, for example) and lenders that the risk of misstatement or misappropriation of funds is low in your organization. That transparency of information assures these stakeholders that your financial data is accurate.
2. If a potential investor evaluates your business and discovers no internal control system and/or errors/omissions, this could bog down the due diligence process. Because investors seek to decrease their risk, this would be a red flag that could negatively impact any sale or investment.
3. You’ll be more aware of your risks. While you might trust your employees, it’s critical to understand your processes that pose potentially big financial vulnerabilities. You need to understand what best practices are and why so that you don’t put your employees in positions where they could commit fraud.
4. Entity-level controls set the tone for the organization. In a public company audit, an auditor’s conclusion about effective internal control over financial reporting includes an evaluation of entity-level controls. These are the rules and policies designed to guide management and employees and often considered the “tone at the top” type controls. Having these controls in place improves your business operational efficiency, ensures that senior employees are helping drive internal controls, and defines roles and expectations of all employees.
5. You’ll mitigate some of the most common types of accounts payable/accounts receivable fraud. AP fraud and AR fraud are very common and can seriously harm a smaller business. Internal controls can help you avoid schemes like false invoices/vendors, check tampering, fictitious statements, check skimming, fraudulent write-offs and kiting. No business owner wants to think their employees would be capable of acting unethically (or looking the other way when others do), but smaller businesses without internal controls are much more vulnerable.

There are many reasons that internal controls are important for your small business. First and foremost, they help prevent fraud and ensure financial date integrity. They also help you avoid conflicts of interest and mismanagement of finances (intentional or not). They help your business stay more organized, which is especially valuable for audits or situations where you’ll need to produce financial information to investors, a board of directors, lenders or regulators. And should you ever decide to go public, having these processes and procedures in place will save you time and headaches.

Call TGRP

TGRP Solutions has deep knowledge about Sarbanes-Oxley, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control Integrated Framework, and best practices for internal controls. We can help your organization (big or small) understand these best practices by performing an internal controls assessment. This assessment will identify where your internal controls (i.e., over financial reporting) need improvement and help you prioritize actions to take to mitigate risks. We’re familiar with common internal controls challenges and can help you put an effective framework in place!

If you are a small company and feel your organization could benefit from internal controls, contact us to learn more about our internal control assessments today.

In this two-part series, we’re discussing the importance of effective internal controls to protect your business and ensure you are in compliance with regulations. Stay tuned for the next blog coming later this year about internal controls for larger, public companies.