Within the framework of good governance, both companies and associations, regardless of their size, should establish an adequate internal auditing system. In this article, we will examine what this means for small and medium-sized not-for-profit organisations, how they can set up such systems and more specifically, how to set up a limited internal auditing system for reviewing the entity’s purchases.
Internal auditing system
The aim of an internal auditing system is to prevent possible errors in accounting, whether or not caused intentionally by people within the organisation. The responsibility for setting up such a system lies with the governing body of the organisation. Note, however, that the required nature and scale of an internal auditing system is highly dependent on the nature and scale of the activities of the not-for-profit organisation. In other words, it is neither a requirement nor efficient for a small, local not-for-profit organisation to set up a comprehensive auditing system, but the organisation is also not completely exempt from setting up an auditing system.
Separation of functions
The separation of functions is an essential part of any internal auditing system. This term refers to the distribution of responsibilities and powers among different people within the organisation, so that several people are always involved in a transaction. Specifically applied to the purchasing process, this means that ordering, recording receipt, checking the invoice and transmission of the payment instruction are ideally not performed by the same person. When several people are involved in a transaction, errors are less likely to go unnoticed. It also has a preventative effect, reducing the temptation to commit fraud. It will often be pointed out that the separation of functions is not a given in smaller organisations. Nevertheless, some simple rules can make a major difference. The separation of functions is also a matter of making choices and is not necessarily related to the size of the organisation. It is certainly tempting to put everything in the hands of the treasurer because that works more smoothly.
The four-eyes principle
An example of the separation of functions in the purchasing process in a small not-for-profit organisation is the so-called ‘four-eyes principle’, where two different people are involved in every purchase. For example, there is the option of not sending invoices to the treasurer, but to another board member, who then approves the invoices for processing and payment. The treasurer will only be allowed to process and pay an invoice after this formal approval. If this audit is performed consistently and correctly, it will significantly reduce the risk of paying invoices for undelivered services. Periodically and at least annually, the payments can be reconciled with the original invoices by someone other than the treasurer. If the invoice address is different from that of the treasurer, payment reminders will no longer be sent directly to the treasurer either. In the event of late payment, this will be discovered at an early stage and the reason for this can be investigated (negligence or illness of the treasurer, payments transferred to a private account instead of to the supplier, etc.).
Implementing an audit
Essential for a good audit is that it be applied consistently and correctly. It should not be easy to circumvent the audit. If the functioning of the audit is to be verified retrospectively, a trail of the audit performed is therefore essential. In the case of the example concerning the auditing of each purchase invoice, this means that it is possible to demonstrate afterwards that the audit has been applied throughout. For example, a review by a second person who gives verbal authorisation to pay afterwards is difficult to prove. A better approach would be, for example, the signature of the controlling person on each approved purchase invoice.
Accounting and supporting documents
In accordance with the law, every not-for-profit organization, regardless of its size, must carry out (simplified) accounting. However, the mere performance of accounting and record-keeping of the associated supporting documents cannot be equated with an internal auditing system. For example, it is possible for someone with access to accounting to include personal invoices, for fake invoices for services not provided to end up in accounting, for the posting and payment of invoices to be duplicated, or for suppliers to charge incorrect prices or quantities which may only surface later in an additional audit, whether external or not (for example, by a government agency). However, accounting does offer many possibilities for setting up an auditing system.
2 or 3-way matching
2-way matching is basic reconciliation between the order on the one hand and the purchase invoice received on the other. The prices and quantities on the invoice are reconciled with the underlying purchase order or agreement. When purchasing certain goods or services, a delivery note will also be provided by the supplier. When the order, delivery and invoice can be reconciled with each other, this is referred to as 3-way matching. It is clear that this verification is optimal in combination with the separation of functions described above, in which the order, the receipt of the goods and the review of the invoice are not carried out by the same person. This reconciliation can be time-consuming and will be difficult if not all the documents are stored centrally. Digitisation of this process offers interesting opportunities here. There are time savings because certain routine checks can take place semi-automatically. After all, documents relating to ordering and delivery, as well as invoicing, are stored and handled centrally, enabling software to link up the documents. The separation of functions can be created by software, whereby different permissions are set for each member of the organisation. In addition, the 2 or 3-way match can always be traced back afterwards.
IT options
A number of accounting programs today offer separate modules to integrate these internal audits, in addition to conventional accounting. The advantage of this is that the consistent and correct application of an audit is monitored by software before the intended entry can be processed further. In the past, such systems had the connotation of being expensive, time-consuming and only suitable for very large companies. Today, there are already numerous options on the market that have also become accessible to small associations. In additionto integrated packages, software applications are also available to digitise only the purchasing process from order to receipt of the invoice. This information can then be linked to the internal accounting package or transferred to the external accountant.
Example of a purchasing process
To illustrate this, we give an example of an audit process on the purchases of an association, whether or not based on an appropriate information system. In an association, three people work in administration, persons A, B and C. The aim is to monitor the purchase and payment process on the basis of the four-eyes principle. As a result, it is decided that each order must be placed by A. Before A may place an order, they must have the approval of B. This approval is provided by means of an email which mentions the product or service, as well as its price. As soon as the invoice arrives, A will send the invoice and the email from B together to C. If C approves this, C will also make the payment.
If the above process is applied correctly, A and B will never be able to place an order separately without each other’s intervention and C knows that the transaction has been viewed by at least two people. Note that C above can only make the payments. However, bank portals today offer many opportunities to assign signing authority. Further checks are also possible here. Thus, it can be set that the person making the payments, person C, cannot create a new beneficiary or change the bank details of an existing beneficiary.
If, in the above example, the approval email is changed by an approval within an appropriate information system, the auditing system will become even stronger and more transparent. It is possible to go one step further by also initiating all orders via the information system. The ability to order may be limited to certain suppliers in a database. The software can prevent the person placing the orders, person A, from being authorised to add a new supplier. Running and centralising all the steps in the purchasing process digitally within one software application means that there is always a chronological overview of all completed and current orders, it is easy to monitor which invoices have not yet been approved, there is an overview of orders that have been completed but for which the invoice has not yet been paid, etc.
Decision
In order to ensure proper accounting, it is essential that any association, regardless of its size, considers how it checks its various transactions in order to prevent any errors or abuse. It is up to the governing body to incorporate appropriate checks and to set up an auditing system that is adapted to the specific situation. The separation of functions is an indispensable element in this, which, contrary to what is often claimed, can also be applied in small organisations. A lot can be achieved with a few simple rules. The 2-way or 3-way match is a basic check in the purchasing process. The digitisation of the purchasing process and the associated document flow offers undeniable advantages for internal auditing: time savings, standardised auditing, the integrated separation of functions and a subsequent audit trail. There is a wide range of software solutions available on the market which can be used for this purpose and which are also becoming increasingly accessible to smaller organisations.
This article was written by Frank Bloemen.