Angie Ziegler, CPP – Manager, Eide Bailly Joel

mitsue-stanley

Published 2026-08-27 · 55 slides · 0 views

↓ Download

Angie Ziegler, CPP – Manager, Eide Bailly Joel

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 1 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 2 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 3 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 4 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 5 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 6 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 7 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 8 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 9 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 10 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 11 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 12 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 13 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 14 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 15 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 16 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 17 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 18 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 19 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 20 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 21 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 22 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 23 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 24 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 25 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 26 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 27 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 28 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 29 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 30 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 31 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 32 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 33 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 34 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 35 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 36 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 37 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 38 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 39 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 40 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 41 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 42 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 43 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 44 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 45 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 46 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 47 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 48 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 49 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 50 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 51 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 52 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 53 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 54 of 55

Angie Ziegler, CPP – Manager, Eide Bailly Joel - slide 55 of 55

Description

Angie Ziegler, CPP Manager, Eide Bailly Joel Stencel, CPA Manager, Eide Bailly Internal Controls Internal Controls Question: What size company has the most employee embezzlements? Less than 150 employees 150 250 employees 250 500

Download this presentation From Below

"Angie Ziegler, CPP – Manager, Eide Bailly Joel" is the property of its rightful owner. Permission is granted to download and print the materials on this website for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.

Presentation Transcript

Angie Ziegler, CPP – Manager, Eide Bailly
Joel Stencel, CPA – Manager, Eide Bailly Internal Controls

Internal Controls

Question: What size company has the most employee embezzlements?

Less than 150 employees
150 – 250 employees
250 – 500 employees
More than 500 employees

Answer: What size company has the most employee embezzlements?

Less than 150 employees
150 – 250 employees
250 – 500 employees
More than 500 employees

What are Internal Controls? Institute of Internal Auditors Definition: A process, effected by an entity's board of directors (governing board), management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives

Includes
Effectiveness and efficiency of operations
Reliability of financial reporting
Compliance with laws and regulations

What Internal Controls Can Do? Help achieve performance goals and objectives
Help prevent loss and resources
Help ensure reliable reporting
Help ensure compliance with laws and regulations

More Examples of Control Activities Change computer passwords
Periodic analysis
Require vacations
Cross train employees
Budget vs. actual review

What Internal Controls Cannot Do Internal Controls can only help an entity achieve its goals and objectives

They cannot change inherently poor management or shifts in government policy
They cannot provide absolute assurance, only reasonable assurance
They cannot prevent simple errors and mistakes
The can be circumvented

Don’ts Subordinates approve boss’ travel or expense reimbursements
Too many controls (causes people to circumvent)
Inversely – not enough controls
No reconciliations
Too much trust in one person

Someone Is Up To No Good What is the estimated annual loss of revenue to fraud for a typical organization?

2%
5%
15%
25%

Types of Fraud Misappropriation of assets
85% of fraud causing a median loss of $130,000

Misrepresentation in financial statements
9% of fraud causing a median loss of $1 million

Corruption schemes
6% of fraud causing a median loss of $200,000

Someone Is Up To No Good More than 80% of all corporate frauds were committed by employees in six departments. Which department topped the list, with 17% of the crimes?

Sales
Accounting
Senior management
Purchasing

Higher Risk Organizations Three highest organizations for fraud

Governments (15%, with a median loss of $90,000)
Banking
Manufacturing

Control Environment Risk Assessment Control Activities Information & Communication Monitoring Activities Components and Principles of Effective Internal Control Demonstrates commitment to integrity and ethical values
Exercises oversight responsibility
Establishes structure, authority and responsibility
Demonstrates commitment to competence
Enforces accountability Specifies suitable objectives
Identifies and analyzes risk
Assesses fraud risk
Identifies and analyzes significant change Selects and develops control activities
11. Selects and develops general controls over technology
Deploys through policies and procedures Uses relevant information
Communicates internally
Communicates externally Conducts ongoing and/or separate evaluations
Evaluates and communicates deficiencies Components Principles

Drilling down on one aspect Points of focus may not be suitable or relevant, and others may be identified
Points of focus may facilitate designing, implementing, and conducting internal control
There is no requirement to separately assess whether points of focus are in place Control Environment The organization demonstrates a commitment to integrity and ethical values. Points of Focus:
Sets the Tone at the Top
Establishes Standards of Conduct
Evaluates Adherence to Standards of Conduct
Addresses Deviations in a Timely Manner

How Various Controls Affect Principles, e.g., Control Environment 1. An Organization demonstrates a commitment to integrity and ethical values Component

Principle

Controls embedded in other components may affect this principle Information Technology staff tests for data breaches of personally identifiable information continuously
Control Environment Management obtains and reviews data and information underlying potential deviations captured in reports generated immediately upon occurrence
Information & Communication Risk manager separately evaluates Control Environment, considering employee behaviors and whistleblower hotline results and reports thereon
Monitoring Activities

Control Objective 1 Control Environment How Does Your County:

Demonstrate commitment to integrity and ethical values
Exercise oversight responsibility
Establish structure, authority and responsibility
Demonstrate commitment to competence
Enforce accountability

6. The organization specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives.

7. The organization identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed.

8. The organization considers the potential for fraud in assessing risks to the achievement of objectives.

9. The organization identifies and assesses changes that could significantly impact the system of internal control. Risk Assessment Components and Principles of Effective Internal Control

How Various Controls Affect Principles, e.g., Risk Assessment The Controller identifies risks to the achievement of the objectives across the office and analyzes risks as a basis for determining how the risks should be managed. Component

Principle

Controls embedded in other components may affect this principle As part of the meetings with senior staff on goals and objectives, risks are noted and potential controls against those risks are brainstormed and initiated if approved by the audit committee. Risk Assessment The result of the brainstorming is communicated to staff as part of semi-annual reviews
Information & Communication A dashboard of risks is established and is updated with each batch cycle.

Employee reviews are completed timely.
Monitoring Activities

Control Objective 2 Risk AssessmentHow Does Your Organization:

Specify suitable objectives
Identify and analyze risk
Assess fraud risk
Identify and analyze significant change

10. The organization selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels.

11. The organization selects and develops general control activities over technology to support the achievement of objectives.

The organization deploys control activities through policies that establish what is expected and procedures that put policies into place. Control Activities Components and Principles of Effective Internal Control

How Various Controls Affect Principles, e.g. Control Activities The Controller selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels. Component

Principle

Controls embedded in other components may affect this principle Every two years, the Controller rotates duties among the divisional managers not only to provide them with a broader experience but also to lower the risk of financial reporting fraud. Staff enjoys the rotation as they are not working the same job repeatedly. Control Activity A report is developed predicting payables over the next 30 days and disseminated to fiscal officers. The payables are compared to encumbrances.
Information & Communication The Controller reviews payables that are unusual, or above $5,000 or infrequent.
Monitoring Activities

Control Objective 3 Control ActivitiesHow Does Your Organization:

10. Select and develop control activities
11. Select and develop general controls over technology
Deploy through policies and procedures

13. The organization obtains or generates and uses relevant, quality information to support the functioning of internal control.

14. The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control.

The organization communicates with external parties regarding matters affecting the functioning of internal control. Information & Communication Components and Principles of Effective Internal Control

How Various Controls Affect Principles, e.g. Information & Communication The operator of a gas station obtains or generates and uses relevant, quality information to support the functioning of internal control. Component

Principle

Controls embedded in other components may affect this principle With each credit card transaction, if the transaction is unauthorized, an error is generated and the attendant is notified. Gas pumps do not work unless cash is paid.
Control Activity Instances of fraudulent credit cards are notified immediately to local police via a push button or tie in
Information & Communication Video surveillance is used on all transactions and is monitored by the station owner. Tapes are stored for a minimum of 60 days and are time-stamped
Monitoring Activities

Control Objective 4 Information and CommunicationHow Does Your Organization: Use relevant information
Communicate internally
Communicate externally

16. The organization selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.

The organization evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and those charged with governance, as appropriate. Monitoring Activities Components and Principles of Effective Internal Control

How Various Controls Affect Principles, e.g. Monitoring Activities The Controller selects, develops, and performs ongoing and / or separate evaluations to ascertain whether the components of internal control are present and functioning. Component

Principle

Controls embedded in other components may affect this principle The quality assurance division reports are also transmitted to the division where the problem occurred. Corrective action is taken. If no corrective action is accomplished, the employee’s personnel file contains the issue and if repeated, could be grounds for termination.
Control Activity Statistical reports on uses of personally identifiable activity are reported to employees on a monthly basis. All employees are trained semi-annually on when / how / who can access PII
Information & Communication Reports on detections of improper use of personally identifiable information by employees are escalated to a senior review board that investigates all activities and reacts to breaks in accordance with state law.
Monitoring Activities

Control Objective 5 MonitoringHow Does Your Organization:

Conduct ongoing and/or separate evaluations
Evaluate and communicate deficiencies

Payroll Schemes Basic Components of a solid system

Segregation of job duties
Rotation of job duties
Payroll distribution
Ghost or Phantom Employees
Manipulated time records

Payroll Schemes Continued….

Unclaimed payroll checks
Writing extra payroll or bonus checks
Leave time manipulation
Withholding fraud
W-2 fraud
Computer Edits or Negative deductions

Segregation of Job Duties Large Company/Small Company

One person department
Have the accounting department complete all payroll bank account reconciliations
Department heads are asked to check employee list against the list of employees who received paychecks
Store paychecks outside the payroll department, but keep the key in the payroll department.

Rotation of Job Duties Training manuals
Short cuts can develop
Efficiencies
Take a vacation
Penalties of taxes if only one person knows the due dates
Have a third party step in

Payroll Distribution Paycheck, Direct Deposit, or electronic paycards
Who is allowed to receive the paycheck?
Security of paychecks
Should never be left in an unlocked cabinet
Paychecks that cannot be delivered to employee should be returned to the payroll department
Employee’s private information is on paychecks

Unclaimed Paychecks
When do you turn this into the state?
Don’t put this back into your cash accounts!

Phantom Employees What are Phantom employees?
Remote Locations
False information
Name
Social security number
Direct deposit account How do you catch this?
Payroll Department/Auditor delivers all checks and stubs (show ID)
Run a report for matching direct deposit numbers
SSA can run a match on social security numbers

Negative Deductions/Computer Edits Negative pay deductions
Over withheld deductions
Employee reimbursement for business expense
Flex Spending accounts

Computer system edits
Manager should run an edit log to review any changes
Review new hires, term employees, negative deductions

Blank Checks This is the largest source of potential exposure in a payroll department
Signature Stamps
Store check stock not in the payroll department
Computer systems that print signature on have a check off sheet
Document support for the check should be reviewed before signature

Payroll bank account
Balance and reconciliation of the payroll bank account with the general ledger should be segregated from the payroll department

Time Reporting Over reporting of hours worked and incorrect classification of paid time
Review of timesheets
Supervisor of employee should review
Payroll department should check for sign off of supervisor
Do they have enough vacation or sick
Reconcile the regular hours, overtime hours and paid time off

Time Reporting Timeclock systems
Do you have hourly and Salary clocking in?

Out with the old
Badge swiping “for friends”
Hand written timesheets/excel sheets

In with the new
Picture taking timeclocks
Finger print timeclocks
Cell phone apps
Eye scans

W2 Fraud and withholding Withholding Fraud
Depositing a large sum of money in at yearend
Filling out your W4 form

W2 Fraud

Accounts Payable & Purchasing Schemes Personal bills
Fictitious suppliers
Kickbacks
Ordering personal items
Petty cash funds
Employee expense accounts
Credit Cards

Vendor Payments Make sure to have an W-9

Follow up with vendor
Call Vendor
Ask for last invoice

Review Vendor list

Employee expense reimbursement policy
Receipts
Dollar Value

Prevention Don’t hire criminals (i.e. do a thorough background check)

Scrutinize the expense accounts of executives

Conduct routine audits
Regular audits by independent CPAs go a long way toward preventing fraud at all levels

Ensure the Board of Directors does its job of oversight of the executives

The “Fraud Triangle”

The “Fraud Triangle” Motive

The “Fraud Triangle” Motive Rationalization

The “Fraud Triangle” Motive Rationalization Perceived
Opportunity

PERSPECTIVE You will not prevent all losses.

You are trying to prevent large losses.

Keep this in Mind... Few things are more devastating, demoralizing, and tragic than the discovery that someone you trusted has committed fraud.

There is, however, one thing that is considerably more devastating, demoralizing, and tragic ...

When a totally innocent and honest employee falls under suspicion simply because the lack of internal control created the appearance of an opportunity to commit fraud.

Vulnerable Items Cash or the equivalent

High value, small size

Items in high demand

Big impact if taken

Internal Controls Where is your biggest exposure in your company?

Are you paying more than just your employees?

Segregation of your job duties…. Do you pass?

How Update Clarifies Requirements for Effective Internal Control – a final word before we go Effective internal control provides reasonable assurance regarding the achievement of objectives and requires that:
Each component and each relevant principle is present and functioning
The five components are operating together in an integrated manner

Each principle is suitable to all entities; all principles are presumed relevant except in rare situations where management determines that a principle is not relevant to a component (e.g., governance, technology).

Components operate together when all components are present and functioning and internal control deficiencies aggregated across components do not result in one or more major deficiencies.

Closing Statement

Angie Ziegler – aziegler@eidebailly.com
Joel Stencel – jstencel@eidebailly.com Thank You!

Angie Ziegler, CPP – Manager, Eide Bailly Joel

Related Topics

Share

Embed code

Download this presentation From Below

Presentation Transcript