Addressing Problems with the Segregation of Duties in Smaller Companies
Gramling, Audrey A., Hermanson, Dana R., Hermanson, Heather M., Ye, Zhongxia, The CPA Journal
One of the fundamental elements of effective internal control is segregation of duties, meaning that a process is divided among several people. As such, no single person can take advantage of the situation for personal gain or other impropriety. Although segregation of duties is prevalent in larger, more bureaucratic organizations, it can present a challenge for smaller companies with limited personnel and constrained resources.
Newly available data can shed light on the problems smaller companies face in the segregation of duties. Specifically, the segregation of duties material weaknesses disclosed by smaller companies under Sarbanes-Oxley (SOX) section 404(a) for the 2008 fiscal year are analyzed below. SOX section 404(a) requires management to provide its assessment of the effectiveness of internal control over financial reporting and to disclose any material weaknesses in internal control. Smaller reporting companies do not yet have to comply with SOX section 404(b), which requires an auditor's opinion on the company's internal controls.
This article explores the types of smaller companies with segregation of duties problems; the nature of the weaknesses, including specific accounting areas affected and any compensating controls; possible solutions; and the sample companies' efforts to remediate these weaknesses.
The Audit Analytics database was used to identify smaller companies with material weaknesses related to segregation of duties. Specifically, companies with the following characteristics were selected:
* The Sarbanes-Oxley section 404(a) management report on internal controls indicated ineffective controls (at least one material weakness exists).
* One of the reasons listed was "IC - Segregations of duties/Design of controls (personnel)" (the material weakness involves a segregation of duties problem).
* The fiscal year was 2008.
* The company's market value was less than $75 million (the cutoff for smaller reporting companies is $75 million of public float).
* The company was U.S. -based.
These criteria yielded 358 small companies with segregation of duties material weaknesses disclosed by management, out of approximately 700 smaller companies with ineffective internal controls due to any type of material weakness. (A similar search of large companies [market value greater than $75 million] yielded less than 30 larger companies with segregation of duties material weaknesses. Thus, segregation of duties problems appear to be mainly a small company issue.) These 358 small companies were sorted by name and the first one-third of the management reports were analyzed, ultimately resulting in a sample of 116 companies.
Exhibit 1 presents descriptive information on the 1 16 sample companies. Their median market value was under $5 million, and their median assets were just over $1 million. Many of the companies also appear to be in the startup stage, as 42 have no revenues (median revenues were under $100,000), and the median net loss was nearly $1.3 million. The industry mix was weighted toward manufacturing and service companies. The median total number of material weaknesses reported by each company was two, ranging from one to eight.
Nature of the Segregation of Duties Weaknesses
The authors analyzed the management report on internal control for each of the 1 16 sample companies in order to understand the nature of the segregation of duties weaknesses. The reports differ in their level of disclosure, with some companies in order providing limited, boilerplate language and others providing in-depth discussions of their material weaknesses, compensating controls, and present and future remediation efforts.
As shown in Exhibit 2, the vast majority of companies described their segregation of duties weaknesses as too few employees (90 companies). A significant number (22 companies) did not discuss the specifics of the problem. …