Enterprise Risk Management and Internal Controls Assessment

An internal controls assessment in California answers a question most companies assume they already know the answer to: if something went wrong in this process, would anything catch it before it mattered?

The reason is that controls get added after incidents and almost never get retired afterwards. What accumulates is a record of what has already gone wrong here, not a map of where this business can fail next. The process redesigned last year and the system that replaced the one a control was written for are both sitting outside it.

Why an internal controls assessment in California starts with risk

Assessing controls without first assessing risk produces a list of what exists rather than a view of what is missing. The sequence has to run the other way.

A workable risk assessment is not a hundred-line register scored one to five. It is a short conversation with each function about what would actually damage the business, converted into a small number of scenarios with a plausible magnitude attached. Ten to fifteen risks that a management team genuinely recognises is more useful than eighty that were generated to be comprehensive.

The output then drives everything: control testing goes where the exposure is, remediation is sequenced by consequence, and the board receives something it can act on rather than a heat map.

Segregation of duties in a small finance team

The textbook answer (separate the initiation, approval, recording and custody of every transaction) assumes enough people to separate them. A five-person finance team cannot fully segregate, and pretending otherwise produces documentation nobody follows.

The realistic approach is to identify the small number of combinations that genuinely enable material loss and address those specifically. In practice that is a short list:

• The same person can add a vendor and approve payment to it
• The same person can change employee bank details and run payroll
• The person who prepares the bank reconciliation is the person who reviews it
• One person holds both the ability to post journal entries and to approve them
• Administrative access to the accounting system is held by someone who also processes transactions in it

Where separation is impossible, compensating detective controls do real work: a monthly review of new and changed vendor master data by someone outside AP, an out-of-band confirmation for bank detail changes, and an owner review of the payment run against supporting documents. These are cheap, and each of them defeats a specific fraud that occurs regularly to companies of this size.

Outsourced and co-sourced internal audit

Companies rarely required to have internal audit still benefit from the function once complexity passes a threshold, multiple entities, regulated activity, a lender requiring assurance, or a board wanting independent verification of what management reports.

Building it internally is expensive and produces a function reporting to the people it examines. Outsourcing gives independence and a broader skill base; co-sourcing pairs an internal resource with external specialists for areas requiring depth the in-house team does not have. IT controls, privacy, treasury.

The deliverable that matters is an annual plan tied to the risk assessment, a small number of substantive reviews executed properly, and findings reported to the board with management's response alongside. What does not work is an internal audit function producing volume to justify its existence.

Fraud risk, specifically

Occupational fraud in owner-managed companies follows a small number of patterns, and they are not sophisticated. Fictitious vendors created by someone with vendor master access. Payroll additions or unauthorised rate changes. Expense reimbursement abuse that grows because nobody checks. Cheque and ACH tampering. Diversion of customer receipts where the same person banks and posts them. Business email compromise, in which a convincing email redirects a legitimate payment to a new account.

Each has a specific, inexpensive control. The reason they succeed is not that the controls are hard; it is that nobody assigned ownership of the review, so it happened for two months and then stopped.

What a report looks like

Findings ranked by consequence, not by discovery order, with an owner and a date against each. A distinction drawn between what must be fixed, what should be, and what is worth knowing but not acting on. And a remediation sequence that respects dependencies, several fixes only work once a prior one is in place, and attempting them in the wrong order wastes a quarter.

Where the assessment feeds a SOX 404 programme or a SOC 2 engagement, the control documentation is written in a form those frameworks can consume directly, rather than being rewritten later.