Are your internal controls helping you?

Although the Sarbanes Oxley Act only applies to public companies, putting aside the compliance factor, private companies can derive significant benefits from enhanced internal controls. Appropriate, properly functioning internal controls offer powerful benefits to private companies in a number of key areas.

If a private company's owners are considering the sale of all or part of the entity, or seek private equity financing, effective controls can increase a buyers' willingness to pay a premium. Controls enhancements can also lower borrowing costs and help attract new business partners. Today, investors, credit grantors and business people in general are keenly aware that a lack of strong internal controls increases investment and operational risk.

As a result, private companies are now actively seeking to enhance their internal controls, ensure the credibility of financial information and receive the operating benefits that a strong system of internal controls can provide.

Let's take a closer look at some of those benefits:

Financial Reporting Benefits

* Heightened credibility provided to all stakeholders: owners, employees, customers, lenders, or vendors;

* Better information to manage the business;

* Reduced risk of errors or irregularities.

Operational benefits

* Clarity on the roles and responsibilities of both management and employees;

* Greater controls over the management of business growth;

* Reduced costs obtained from greater operating efficiency;

* Maximized operating performance.

Regulatory benefits

* Decreased risk of litigation or business disruption;

* Lowered risk of employee or customer litigation;

* Increased credibility with the IRS, FDA, FTC and other regulators;

* More credibility in contractual relationships with vendors and customers.

In many, if not most, private companies, controls are informal. While management may believe controls are in place, they may not be functioning as intended, may not be fully implemented or may not have been implemented at all. Lack of segregation of duties can exacerbate control problems. In short, companies with inadequate internal controls remain unprotected against risks they thought were being mitigated.

Where Are the Greatest Risks?

If the critical "tone at the top" is unclear, poorly communicated or never enunciated to begin with, there may be no real focus on promoting ethical behavior, no written code of conduct, no ethics hotline and no advisory board in an oversight role. Controls may be detective rather than preventive--focused after the fact rather than before. The company may not even have a process for reviewing significant non-routine transactions involving management.

Or, a company may simply lack controls to prevent such occurrences as:

* inappropriate revenue recording;

* unauthorized revenue transactions (pricing changes, credit limit authorizations, weak customer acceptance policies);

* excess inventory purchases;

* purchases of products and services at higher-than-expected costs;

* unapproved payroll changes, risking unauthorized salary increases, employee salaries in excess of authorized levels and the potential for fictitious or "no-show" employees;

* unauthorized wire transfers;

* inappropriate investment of excess funds;

* unnecessary fixed-asset purchases;

* theft.

Smaller companies often struggle to segregate duties effectively without hiring significantly more administrative personnel. However, appropriate segregation can be achieved, even in smaller companies, by involving senior management in the review and approval process.

Another risk is that the information used to monitor operations may be flawed or inappropriate. Shortcomings may include a lack of sufficient detail, inattention to the details provided or over-reliance on reports whose source data is not periodically checked.

Employees may not understand why they are performing certain procedures, or what procedures should be performed to ensure internal controls compliance. Staff turnover, which is prevalent today, exacerbates this problem, as does failure to document policies and procedures.

Inadequate security is a serious control risk. Financial and physical assets need to be secured, as does access to information technology assets, both hardware and software. Securing intellectual property, such as formulas and customer information, is equally important.

Finally, regulatory noncompliance is a significant control risk that demands focused attention from private companies. Federal agencies such as the IRS, FDA, FTC and EPA issue and enforce regulations that apply to both private and public companies.

The bottom line for business owners: increased focus on internal controls maximizes the value of a business.

Paul Salerno ([e-mail]) is a Partner in PricewaterhouseCoopers' Private Company Services practice.