Can enhanced internal controls reduce risk? The answer is an emphatic yes. And the benefits for private companies—during good times and bad—can be more significant.
Many private company leaders believe internal controls focus solely on financial statement integrity. But the reality is they are far more robust than an exercise in documenting approvals; they can protect the business from a wide range of operational and financial risks across the entire organization. According to Sal Bianco, partner in PwC’s Private Company Services practice and national leader for the Engineering and Construction Industry for PwC Canada, “Internal controls get to the heart of knowing how your business is being run.”
So, what are internal controls? Risk-based internal controls are designed to help a company achieve their objectives, from financial to operational:
Effective risk-based internal controls also lead to other powerful benefits, such as lower borrowing and financing costs by ensuring more accurate reporting and compliance with debt agreements; an increase in interest from private equity investors and venture-backed firms who seek companies with strong and well-documented internal controls; and readiness for an initial public offering.
The end result: having strong controls in place goes straight to your company’s bottom line.
Indeed, the global economic downturn showcased a breakdown of companies caused by lack of internal controls. To conserve cash, many private companies turned to cost-cutting and downsizing efforts, but wound up as victims to a host of consequences, including financial fraud. The line between acceptable and unacceptable behaviour is often blurred in times of economic uncertainty.
Reduction in the number of staff, for example, often limits the ability to monitor business activity, leaving the business susceptible to fraud and other internal control issues. “Lack of internal controls can lead to legal and financial consequences by failing to manage organizational risks,” says Bianco.
“Private companies need to remember that it is far more time and resource consuming to deal with the consequences afterwards, than to implement sound internal controls up front.”
Key areas to consider
While the vast range of internal controls can sound daunting to many private company owners, the good news is that many effective controls are neither expensive nor time-consuming to put in place. The key, Bianco suggests, is for private companies to remain flexible: “Review the major risks facing your business, and then see what kind of controls are feasible to put in place— now and as the company grows.”
When reviewing internal controls, Bianco recommends that private companies consider the following areas:
The bottom line: internal controls can effectively reduce financial, operational, legal and reputational risk. However, Bianco warns that internal controls can only do so much to avoid the land mines associated with risk. “Management and employees need to take responsibility as well, which starts with setting the tone from the top. If a focus on risk management is either unclear or poorly communicated, or never communicated to begin with, private companies can expect an increased risk of unethical behaviour and other consequences.”
|Let's Talk: Internal Controls (385 KB)
Download the full PDF publication.