An internal audit is an evaluation of a business’s internal controls and an analysis of the degree to which an enterprise reaches its core objectives. Generally, the internal control framework consists of five factors: control environment, risk assessment, control activities, information, communication and supervision.

Historically an internal audit was often viewed as something that did not bring value to SMEs (small and medium enterprises). The good news is that SME owners are becoming more aware of the significance of sound internal controls. They are analysing the control environment, which is a critical component of the internal audit framework. However, internal audits are still regarded as only relevant to large entities like publicly listed companies or governments. This is predominantly due to the business operation misconception that SMEs are relatively less complicated, and the business owner is always involved in the daily operations directly.

The control environment of SMEs may differ from large organisations. But they should be reviewed regularly to ensure sufficient risk management and also efficiencies. The risks may vary with the nature of the business and external factors, including the overall economic environment, government policies, etc.

What are the benefits of internal audits?

In the context of SMEs’ controlled environment, risk management effectiveness is deeply determined by the business’ decision-makers. An SME must ensure awareness of the control environment and that management understands and have the right attitude and actions towards the internal control systems for achieving the SME’s overall objectives safely. The control environment sets the tone and the organisation’s culture. And as a business grows and departmentalises, and a decision needs to start moving down the chain of command, it becomes even more important to have a solid control environment, and test and update this regularly according to the circumstances and needs at the time.

An effective control environment will ensure:

• Operations effectiveness and efficiency
• Financial reporting reliability
• Laws and regulations compliance
• Assets safeguarding

An overview of internal controls for SMEs

When dealing with an audited entity, internal controls will look to:

• Ensure the effective conduct of business activities
• Protect the security and integrity of the assets
• Prevent, detect and correct errors and fraud
• Ensure the accounting is true, lawful, and complete
• Formulate and implement the relevant policies and procedures

The audit will include management controls, accounting controls and internal audit controls, and several other areas, including all business parts and processes.

As important economic entities, SMEs are often on a small scale with simple business natures, but as they grow, they can become just as complex as large businesses, but without the resources to manage this complexity. The operations though can often be more flexible, and resources allocation greatly improved by some simple tweaking.

All these characteristics are generally perceived as an advantage to SMEs. But they can also create specific problems, even being obstacles to having sound internal control systems for the company, with consequences as noted above.

Main problems

Existence of internal controls awareness

For some self-owned small-scale enterprises, the decision-makers do not believe that internal control systems are necessary as long as daily business management is under the chief executive’s direct control.

There are always some implementation issues, even when establishing internal controls. For example, many internal staff are relatives of the business owners or managers, leading to an ineffective internal control system, even a potential fraud situation or issues falling through the cracks. For instance, who reviews the expense claims of relatives and can question them without fear of consequences?

Inadequate internal control systems for SMEs

Many SMEs lack a complete internal control system, which is not implemented in enterprises for all business areas and operations. Below are several examples for reference.

1. A considerable part of a company’s financial department still maintains original manual accounting methods, and accounting procedures are not adequately documented or are using simple accounting systems with no analysis of drill-down capability. The financial information presented could be conflicting with information gathered from operational departments because of the lack of tie-up.
2. The financial or accounting department may have only one or two employees responsible for accounting, treasury and financial management. It is difficult to ensure proper segregation of duties due to the limited number of staff.
3. Information provided to management to aid decision-making may be a patchwork with room for error or misrepresentation of the company’s actual financial position.

Weaknesses of the internal control function for SMEs

There are common weaknesses observed in SMEs internal controls, which generally include:

1. Internal audit departments, if such exist, or those responsible for such reviews or governance lack independence and authority. The review or audit they performed is not independent of the practice of internal controls functions, and they are not correctly evaluating the enterprise’s financial information or department performance. Or they are too close to everything to be properly critical and or to see risks, issues and opportunities.
2. The staff of SMEs’ are lacking in training and experience in internal controls. Proper documentation and employee training are not prepared well enough for internal control procedures to implement correctly or at all, especially when significant staff turnover happens.
3. Monitoring control is required for the implementation of SMEs’ internal controls. It is an essential prerequisite for the personnel review with appropriate expertise.
4. The appropriate review policies are not being carried out. And nepotism hinders a proper independent review and implementation of controls. A proper system for reducing risk and aiding the business needs to be what is best for the business, outside of personal relationships and preferences.

Improving internal controls for SMEs

Strengthen the awareness of SMEs towards internal controls

A sound internal control system can effectively improve the management efficiency of enterprises, including SMEs. SMEs should establish a correct understanding of internal controls, using a scientific internal control system in place of simple personnel management structures to improve efficiency. Every person involved should be well informed of the significance and importance of compliance with the system.

As noted above, when a business grows, though, strong oversight over all aspects of the business becomes more complex, responsibilities need to be delegated, and therefore without the proper controls in place, the SME becomes prone to risks. Companies must always  review the internal controls according to the business at that time and adapt according to the circumstances

Clear objectives and purpose of internal controls

Internal control objectives are mainly to:

• Safeguard assets
• Ensure the security, integrity and efficient use of a company’s assets and resources
• Enable the provision of reliable and timely management information
• Reduce unnecessary costs and expenses
• Ensure the successful implementation and management of various functions to improve the effectiveness and efficiency of business operations
• Prevent or detect errors, defects and fraud
• Find the basis for the formulation of management policies and performance of a variety of legal obligations

Specific targets of each functional department and the internal mechanisms are chosen to ensure proper coordination to help achieve the control or business purpose. It requires

• Efficient resources allocation among the departments
• Various working objectives and work plans communicated to the relevant person in charge to understand the responsibilities of the department’s work
• All or most department heads leading by example
• Enhanced overall coordination of activities by the various departments

The Chinese Ministry of Finance issued specifications for internal control of small enterprises in 2017 for providing necessary guidance to companies, as it was seen as a critical part of business efficiency, operations and reducing risk.

Establish a sound internal control system

The design of an internal control system must follow certain principles. Establishing a sound internal control system for SMEs could be achieved over several organised phases through a specific and convenient time frame. It is important that business owners see the significance and benefits of having sound internal controls, and then efforts can be put into creating a reasonable internal organisation structure and segregation of duties. Without management buy-in, the maintenance of the improved internal controls will be challenging.

Mutual communication and understanding of various constraints are necessary, and in particular, SMEs should pay more attention to the riskier operating cycles, such as procurement and payment, sales and receivables, costs and expenses and other aspects that are considered key to business operations.

The business owner’s philosophy or management plays a vital role, particularly in SMEs long-term survival and development. Understanding the enterprise’s cultural development determines the SMEs direction and content, and establishing an internal control system will influence SMEs’ cultural development, for it is often seen as the SME is growing and cooperating.

In summary, most SMEs have ineffective internal controls, whereas most of them have poor awareness of problems in their internal control system, part of the SMEs’ developing internal environment. The global and local business environment has become more competitive and complex, and the subsequent ups and downs of the economic cycle seem to occur more frequently than previously and also changing government policies. As SMEs’ owners or managers become more aware of their business environment, it is expected that a growing number of SMEs will be willing to allocate resources to establishing sound internal controls, which are excellent and helpful practices as the business develops and evolves.

To enquire about your specific company, please contact our business consulting experts by sending an email to infochina@acclime.com.com