080113 Contractor Internal Controls

8/22/2019 080113 Contractor Internal Controls

http://slidepdf.com/reader/full/080113-contractor-internal-controls 1/33



Contractor Internal

Controls

at the Office andJobsite

K ARLINS R AMEY & TOMPKINS, LLC



Overview

1. Statistics confirm:

a) Persons convicted of fraud were generally trusted

employees

b) The most common behavioral red flag amongfraudsters is they live beyond their financial

means. Other indicators include gambling,

drinking and drug issues

c) Most perpetrators are male and between the

ages of 31 and 45; however, all ages and genders are subject to suspicion

d) Most fraudsters developed a sense of entitlement to the

funds due to envy or feeling underappreciated




2. In construction companies; jobsite, plant site

and job management related fraud is more

common than accounting and financial fraud

3. The most commonly stolen items in a construction

environment are:a) Labor

b) Fuel

c) Minor parts (batteries, oil filters, tires)

d) Construction materials (lumber, copper,

steel, etc.)

e) Subcontract or supplier overpayment for

kickback

f) Cash




B. War Stories:

1. Fake trucking company paid $11 million over 7-year period

2. Truck manager and CFO paid truckers for extra hauling and received $1 million in kickbacks over 5-year period

3. Job superintendent submitted hours for former employees

for several weeks after termination - over 3-year job

$200,000 stolen




4. Shop foreman signed for diesel delivery in excess of actual -

split re-sale of dyed diesel with truck driver - $250,000

estimated theft

5. Scale operator at asphalt plant and quarry allowed local

friends to circumvent scale and take materials for free6. Electrical contractor foreman ordered excess copper and

resold to scrap dealer - $100,000 stolen





7. Estimator gave low bid subcontractors the “number” toincrease and still remain “low bidder”, he received boats,

cars, girlfriend apartment rent trips, etc.

8. Controller paid his monthly credit card with electronic

transfer

9. Payable clerk prepared identical duplicate checks to alegitimate vendor - presented checks for signature to two

different signers - extra check was deposited into bogus bank

account




C. Management must Establish a Control

Environment

1. Management must set a good example and avoid

unethical or fraudulent behavior

2. Background check should be mandatory for all newemployees

3. Management should be skeptical and participate in the

control process

4. Management should understand and participate in

job assignments to maintain appropriate “separationof duties”




Key Internal Control

Recommendations




D. Cash Disbursements Controls

1. Invoices should be approved by

knowledgeable personnel

2. Check signing

a) Electronic signature or plates

should be safeguarded by signer

b) Dual signatures are recommended

c) Accounting personnel that have

authority to print checks should

never be authorized to sign checks




d) If Controller or CFO signs checks, they must be “locked out” of

check writing system

e) Check signer must review documentation for checks when

signing; signing a “stack of checks” is poor control

f) Scanners have made duplicate or altered invoices easier to prepare; approval initials or stamp should be used to prevent

fraud; signer should look for valid approval and authentication of

invoice




3. Check “signature shopping” involves requesting

signature from uninformed or careless signer a) Assign areas of responsibility to one signer who

consistently signs all checks for the same

vendor or type of expenditure

1) Example: one person signs all checks to a

specific supplier b) Helps prevent duplicate checks to legitimate

vendor




4. Checks should be issue only twice per month – not daily

a) Most companies issue checks on the 5th and 20th of the

month

b) Be skeptical of “emergency” checks and manually prepared

checks




E. Cash/Check Receipts and Deposit

Controls

1. Separation of duties controls require that

personnel responsible for billing and

receivable functions should never come into

contact with receipts or deposits

2. Controller or A/R clerk should never pick

up mail or take deposit to bank

3. Lock box or direct electronic deposit should

be utilized if practical




4. Mail clerk should prepare deposit log and

copies of receipts for A/R clerk

5. Management should review aged receivable lists

monthly

6. Controller should prepare proof of cash reconciliation

quarterly to reconcile actual deposits to total A/R credits

7. A/R clerk should not have authority to post journal

entries to receivables for bad debts or adjustments –

CFO or controller should post these entries if

necessary




F. Bank Statements & Reconciliation

Controls

1. Implement and utilize a Positive Pay

Verification Systema) Checks payees and amounts are

submitted to the bank as issued

b) Unless cleared checks match

submitted information, check will

not be honored and will bereturned unpaid




2. Bank statements and cancelled checksshould be received (unopened and

unaltered) by owners or management

personnel not involved in check

preparation process

a) Look at cleared checks for the

following:

1) Altered checks (payee or amount)

2) Unusual endorsement

3) Unauthorized or forged signatures

4) Unrecognized payee/vendor 5) Duplicate check in same period to

same vendor

b) Create fear with owners/management

will review checks




3. Monthly bank reconciliation should be

prepared within 48 hours of receipt

a) Reconciliation should be performed

by personnel not responsible for

check writing or signature

4. Review and authenticate all electronic

transfers or payments




G. Subcontractor, Supplier and Trucking Controls

1. Subcontractor and trucking disbursements are

regularly calculated internally – this process removes

an element of control – overpayment of subs or truckers will rarely be reported and refunded

2. Payments should be reconciled monthly to

subcontract agreement and original quotes




3. At the completion of the contract,

personnel should “audit” all payments

and reconcile total to pay quantities

and schedule of values for

reasonablenessa) Example, tons of rock purchased

should agree to pay item and hauling

tickets.

4. If practical, independent accounting

personnel should be assigned to

review the project management

approval process and scrutinize all

payments to subs, suppliers

and truckers




5. Accounting software should lock

down and prohibit payment to subs or

truckers unless insurance dates are

valid and surety bonds are on file

6. Subcontractor bonds should be

submitted to company bonding agent

for validity verification




7. Management should spot check

subcontractor and supplier bidding process and procedures:

a) Were 3 quotes obtained for all

major pay items?

b) If low bidder was not used, was it

approved and for valid reason?c) Are estimator and sub/supplier

social friends?

d) Is there a repeating low-bid

occurrence with one estimator and

a “favorite” sub or supplier?e) Does supplier/estimator provide

trips and benefits to estimator?




8. Are trucking tickets and haul payments

reconciled to quantities and quotes by an

independent person on a regular basis?




H. Jobsite Controls

1. Job material quantities per the

original bid should be compared to

actual quantities purchased on a

regular basis and at job completion –

significant variances should be

investigated and questioned

a) Scrap materials should be

safeguarded and sale should be

monitored

2. Loss jobs and any job that performed worse than expected should be

scrutinized




3. Purchase orders should be reconciled to Jobs site delivery tickets and

invoices

4. Jobsite fuel tanks should require

ticket

system5. Jobsite labor must be reported daily –

utilization of employee card or

fingerprint sign-in system prevents

labor rounding

a) More accurate phase code entry b) Prevents 10-10-10 daily labor

reporting redundancy




6. Jobsite equipment usage should be

reported daily and based on hour

meters

7. Jobsite cameras are recommended




J. Payroll Controls

1. Per above recommendation, report

time daily

2. Use direct deposit or smart card – not

payroll checks

3. Payroll bank statements and cancelled

checks should be reviewed by

management independent of payroll

system

4. Payroll bank reconciliation should not

be performed by payroll personnel




5. Someone independent of payroll clerk should trace monthly payroll tax

electronic deposits to payroll tax

returns

6. Occasionally perform a surprise

payroll check off a) Visit jobsite on pay day to verify

current employment of each

reported employee who received

payroll check(direct deposit/smart

card) b) Investigate “missing” employees

K R T




7. Implement internet monitoring software

to prevent “Facebook” and surfing abuse

by employees on company time

K R T




K. Travel & Entertainment Expenses

1. IRS and Corporate policies should requiremonthly report to document the business

purpose for all travel, meals and

entertainment

a) IRS requires business purpose

b) Credit card statement alone will not

suffice

2. Require odometer fuel usage system for

all company vehicles – scrutinize monthly

fuel report that indicates unusually low gas

mileage for a vehicle

K R T




3. Do not allow employees to purchase

company supplies with personal credit

card to obtain the “miles”

a) It is hard to maintain control if the

Company regularly pays personalcredit card balances

4. Scrutinize accounting personnel

company credit cards

5. Non-employee spouse travel and

credit card usage is fraud and can

result in IRS felony charges

K R T




L. Other Internal Control Procedures

1. Purchase employee fidelity theft

insurance coverage – $500,000

limit with $5,000 deductible is

common coverage limitsa) Coverage should include jobsite

and plant personnel

2. Use passwords to lock out

unauthorized personnel from certain

accounting and disbursement

functions

a) Owners and outside computer

consultants should be only

personnel with access to

passwords

K R T




3. Obtain an outside independent review

of computer security procedures,

passwords, etc. – at least once every

two years

4. Purchase internet monitoring software5. Use shredders – don’t underestimate

the danger of identity theft

6. Install and utilize office security

system

7. When employees are on vacation or

sick, select replacement personnel

with Separation of duties in mind

Documents

080113 Contractor Internal Controls