Chapter 7 Sarbanes-Oxley, Internal Control, and Cash 313
allow employees to borrow or steal cash and hide the theft in the records. Likewise, if
those engaged in operating activities also record the results of operations, they could
distort the accounting reports to show favorable results. For example, a store manager
whose year-end bonus is based upon operating profits might be tempted to record fic-
titious sales in order to receive a larger bonus.
To illustrate, consider the case where a payroll clerk was responsible for prepar-
ing the payroll and distributing the payroll checks. The clerk stole almost $40,000 over
two months by preparing duplicate payroll checks and checks for fictitious part-time
employees. After the theft was detected, the duties of preparing payroll checks and dis-
tributing payroll checks were assigned to separate employees.
Proofs and Security Measures. Proofs and security measures should be used to safe-
guard assets and ensure reliable accounting data. This control procedure applies to
many different techniques, such as authorization, approval, and reconciliation proce-
dures. For example, employees who travel on company business may be required to
obtain a department manager’s approval on a travel request form.
Other examples of control procedures include the use of bank accounts and other
measures to ensure the safety of cash and valuable documents. A cash register that dis-
plays the amount recorded for each sale and provides the customer a printed receipt
can be an effective part of the internal control structure. An all-night convenience store
could use the following security measures to deter robberies:
- Locate the cash register near the door, so that it is fully visible from outside the
store; have two employees work late hours; employ a security guard. - Deposit cash in the bank daily, before 5 p.m.
- Keep only small amounts of cash on hand after 5 p.m. by depositing excess cash
in a store safe that can’t be opened by employees on duty. - Install cameras and alarm systems.
To illustrate, consider the case where someone stole thousands of dollars in park-
ing fines from a small town. Citizens would pay their parking fines by placing money
in ticket envelopes and putting them in a locked box outside the town hall. The key to
the locked box was not safeguarded and was readily available to a variety of people.
As a result, the person who stole the money was never discovered. The town later gave
one person the responsibility of safeguarding the key and emptying the locked box.
Monitoring
Monitoring the internal control system locates weaknesses and improves control
effectiveness. The internal control system can be monitored through either ongoing ef-
forts by management or by separate evaluations. Ongoing monitoring efforts may in-
clude observing both employee behavior and warning signs from the accounting
system. The indicators shown in Exhibit 4 may be clues to internal control problems.^6
Separate monitoring evaluations are generally performed when there are major
changes in strategy, senior management, business structure, or operations. In large
businesses, internal auditors who are independent of operations normally are respon-
sible for monitoring the internal control system. Internal auditors can report issues and
concerns to an audit committee of the board of directors, who are independent of man-
agement. In addition, external auditors also evaluate internal control as a normal part
of their annual financial statement audit.
Information and Communication
Information and communication are essential elements of internal control. Information
about the control environment, risk assessment, control procedures, and monitoring is
6 Edwin C. Bliss, “Employee Theft,” Boardroom Reports, July 15, 1994, pp. 5–6.