By David Lund
Here is the scenario
You finally have a full-blown accounting policy manual in place. It has taken several months and a lot of work, but it is done. Something to be proud of indeed!
But, wait a minute, it seems like no one knows about these policies and whenever you speak about such and such internal control not being followed, you get the deer in the headlights look. This all too familiar stare means one thing, these people have no idea what you are talking about.
Your policy manual might be complete but you are still a long way from compliance. What is the solution? The answer is you need a regular program to test your control points to ascertain whether people are indeed following policy in the key areas of your operation. You need to create a monthly internal control review program and that is what this piece is all about.
The starting point and the great thing about your policy manual is it is broken down into approximately 30 different sections. Everything from cash to inventories to systems to food and beverage and all the way back to security and budgets and forecasts.
What you want to do is take your inventory of sections and break them down into 12 areas where you combine like sections.
For example, combine the three sections purchasing, accounts payable and inventories, into one. Another example would be pre paids, accruals and contra into one section. In the end what you want are 12 sections, conveniently one for each month.
Here are my ICR section titles:
Most section titles have a natural sister or brother so matching them up is not too difficult. Now that you have your 12 section titles laid out, the job is to pull out the most important control points. In my ICR program, I test about 55% of all my policies. In total, I have approximately 550 policies and about 300 questions or test points on my ICR spread over 12 months.
What you want to do to make the ICR come alive is take a policy and turn it into a question.
For example, I have a policy #04-16 titled Items not requiring a purchase order. I turn this policy into a question like this, “Have purchase orders been used for all items, other than food and items falling under Policy 04-16?”
Now I have a question on my internal control review program. You can go thru each section and pull out the most important points to test and turn them all into questions.
Once you have your control point questions laid out, I recommend thinking about how you will go about testing. The program is divided into 12 bite-sized sections, and I think the best approach is to have the “owner” of these combined areas be the one who does the testing.
There are several advantages to this.
One, that person is now deputized by you to make sure the controls are in place and being followed. Two, this helps get the word out about the rules of the road and it is nice that it comes from someone else. I find what works best is having your designate interview the appropriate people and ask/review and/or test for each control review point. The last thing you want is to have them sit in their office and fill out this form. That just will not work, you need to put legs on it.
My ICR template looks like this:
In my example, I have the purchasing manager review the ICR in January. I give them a couple of weeks’ notice and tell them the same review will happen again next year. I discuss with them that they need to interview the receiver, accounts payable, accountant, chef, F&B manager and the GM. We have questions for all of them.
This is where the magic happens. For example, when my purchasing manager asks the chef if he/she is approving all invoices for food in writing and that answer is going on this month’s report that must be signed off by the GM and myself with a copy sent to head office, now I have everyone’s attention. No more deer in the headlights, people now see what the policy is and how it comes to life.
I design my review program to test the most important areas and controls and I have the people who I want to be the stewards of those areas and controls test and review the key controls with the people who need to live with those guardrails all year long.
It never fails that the review reveals weaknesses in my system. I tell my designates doing the reviews that I am not interested in YES; I want to know what is really going on. In the example above I learned that the chef rarely reviews and approves the food orders. He in fact has an assistant sign the market list almost all the time.
Now I have my work to do. Once the report has been turned in to me and I have reviewed it with my purchasing manager I note the food order approval issue and I review the entire report and note this and other issues with the GM. In my hotel, we sell about $10m in food each year so we are buying about $2m. That is way too much risk to have the chef’s assistant approving the orders. The GM understands the deficit and they agree to deal with the chef, nice work.
One other aspect to recommend is each section of the ICR should have some “procedures and tests.”
Following are purchasing section tests:
This procedure and test section really helps put the meat on the bone so to speak.
I have consistently found that in general people that I have worked with want to follow the policies and the rules of the road, especially when they know what they are. But not always, and sometimes there is really a problem person and sometimes they have a point. My job is to be aware of what is working and not. The last thing I need is someone else telling me something about my operation that I should have known.
In the case above with the chef the GM shared with me that other kitchen area tasks were also in arrears, colleague reviews were seldom done, kitchen accidents were high, and there were some concerns over meals, especially in banquets. You get the point.
The ICR is a great program that really will help you know what is going on in your hotel as long as you use it properly and honestly. This is the essential element that will help build compliance. It will not happen overnight but if you stick with it is going to be the best tool you have to know your strengths and weaknesses.
The last thing I am going to say is it will never be perfect. If it is then I want someone else asking the questions!
