By David Lund
Here’s the scenario. You have finally got a full-blown accounting policy manual in place. It has taken several months and a lot of work, but it’s done. Something to be proud of indeed! But wait a minute, it seems like no one knows about these policies and whenever you speak about such and such internal control not being followed, you get the deer in the headlights look. This all too familiar stare means one thing, these people have no idea what you’re talking about.
Your policy manual might be complete but you’re still a long way from compliance. What’s the solution? The answer is you need a regular program to test your control points to ascertain whether people are indeed following policy in the key areas of your operation. You need to create a monthly internal control review program and that’s what this piece is all about.
The starting point and the great thing about your policy manual is it’s broken down into approximately 30 different sections. Everything from cash to inventories to systems to food and beverage and all the way back to security and budgets and forecasts. What you want to do is take your inventory of sections and break them down into 12 areas where you combine like sections. For example, combine the 3 sections, purchasing, accounts payable and inventories into one. Another example would be prepaids, accruals and contra into one section. In the end what you want are 12 sections, conveniently 1 for each month.
Here is what my ICR section titles are.
Most section titles have a natural sister or brother so matching them up is not too difficult. Now that you have your 12 section titles laid out the job is to pull out the most important control points. In my ICR program, I test about 55% of all my policies. In total, I have approximately 550 policies and about 300 questions or test points on my ICR spread over 12 months.
What you want to do to make the ICR come alive is take a policy and turn it into a question. For example, I have a policy # 04-16 titled “items not requiring a purchase order”. I turn this policy into a question like this, “Have purchase orders been used for all items, other than food and items falling under Policy 04-16?” Now I have a question on my internal control review program. You can go thru each section and pull out the most important points to test and turn them all into questions.
Once you have your control point questions laid out, I recommend thinking about how you will go about testing. The program is divided into 12 bight size sections, and I think the best approach is to have the “owner” of these combined areas be the one who does the testing. There are several advantages to this.
One, that person is now deputized by you to make sure the controls are in place and being followed. Two, this helps get the word out about the rules of the road and it’s nice that it comes from someone else. I find what works best is having your designate interview the appropriate people and ask/review and/or test for each control review point. The last thing you want is to have them sit in their office and fill out this form. That just won’t work, you need to put legs on it. My ICR template looks like this.
In my example, I have the purchasing manager review the ICR in January. I give them a couple of weeks’ notice and tell them the same review will happen again next year. I discuss with them that they need to interview the receiver, accounts payable, accountant, chef, F&B manager, and the GM. We have questions for all of them.
This is where the magic happens. For example, when my purchasing manager asks the chef if he/she is approving all invoices for food in writing and that answer is going on this month’s report that must be signed off by the GM and myself with a copy sent to head office, now I have everyone’s attention. No more deer in the headlights, people now see what the policy is and how it comes to life.
I design my review program to test the most important areas and controls and I have the people who I want to be the stewards of those areas and controls test and review the key controls with the people who need to live with those guardrails all year long.
It never fails that the review reveals weaknesses in my system. I tell my designates doing the reviews that I’m not interested in YES I want to know what’s really going on. In my example above I learned that the chef rarely reviews and approves the food orders, he in fact has his secretary sign the market list almost all the time.
Now I have my work to do. Once the report has been turned in to me and I have reviewed it with my purchasing manager I note the food order approval issue and I review the entire report and note this and other issues with the GM. In my hotel, we sell about 10m in food each year so we’re buying about 2m. That’s way too much risk to have the chef’s secretary approving the orders. The GM understands the deficit and they agree to deal with the chef, nice work.
One other aspect to recommend is each section of the ICR should have some “procedures and tests”. In the purchasing section above the tests are:
This procedure and test section really help put the meat on the bone so to speak. I have consistently found that in general people that I have worked with want to follow the policies and the rules of the road, especially when they know what they are. But not always and somethings this is really a problem person and sometimes they have a point. My job is to be aware of what’s working and not. The last thing I need is someone else telling me something about my operation that I should have known.
In the case above with the chef the GM shared with me that other kitchen area tasks were also in arrears, colleague reviews were seldom done, kitchen accidents were high, some concerns over meals, especially in banquets. You get the point.
The ICR is a great program that really will help you know what’s going on in your hotel so long as you use it properly and honestly. This is the essential element that will help build compliance. It will not happen overnight but if you stick with it it’s going to be the best tool you have to know your strengths and weaknesses.
