What Private Companies Get Wrong About Internal Controls

Why should private companies care about internal controls? These are the relevant controls each company should have in place to reasonably ensure their financial data is complete and accurate. The thoughtful development of a formalized internal control framework designed to address the processes deemed to be most vulnerable to misstatement or fraud can help with effective management of risk associated with it.

Investors are increasingly demanding more frequent financial data, taking more of management’s time and focus from their day-to-day operations and normal processes. This data can allow investors to properly assess the performance of a company and guide their future investments. Management and investors need reliable information, both financial and operational. With the marketplace changing such that a large number of private companies are readying themselves for potential mergers, either via private equity transactions, initial public offerings or SPACs, the need for a more formalized control framework has become a value-based differentiator in the competition for investment dollars.

In today's environment, the risk of bad financial data being reported can have tremendous financial implications. As the competition for investment dollars pushes more private companies toward the public markets, the establishment of formalized controls can provide a valuable differentiator to potential suitors and a head start on moving toward potential public company status.

There are several myths surrounding internal controls, the first being that they are not relevant to private companies. A risk-based internal control framework can be relevant to any company and provide the basic checks and balances needed to reasonably ensure that the financial statements are not materially misstated. This can be as basic as the regular preparation of account reconciliations, budget-to-actual reviews, and journal entry approvals.

Another common presumption about internal controls is that taking the time to properly conduct a review, approve transactions, or perform reconciliations will prevent management from running the business and divert their attention from what's important. On the contrary, if the controls in place are based on a thoughtful risk assessment, these controls can focus management’s efforts on what matters and the areas that have the greatest potential impact to the business.

There is also the misconception that internal controls cannot be automated or adapted over time as the business changes. In today’s business environment, more processes and procedures are able to be automated relatively inexpensively, either through robotic process automation or other applications and tools. These tools can help management focus on what matters, improve speed and effectiveness, and reduce errors. Further, the development of an effective internal control environment is an iterative process that needs to be actively maintained. It should evolve with the business.

Thoughtfully considering a potential exit strategy can allow a company to set a timeline and the parameters around its control environment readiness and execution and may serve to make the company more attractive to potential partners or buyers who view this as a valuable differentiator. If a company has a near-term exit strategy that involves an IPO or SPAC, the risk level overall may be elevated because of the reliance on the financial statements by investors and the focus on each line item. The pace at which the company develops an internal control framework and monitoring program may be driven, at least in part, by short-term and long-term business goals. Where is the company in its life cycle and what direction is it headed?

When a company thinks about preparing for either an IPO/SPAC or another merger/exit event, its management is dealing with many issues: governance, investor relations and Securities and Exchange Commission reporting. Internal controls often fall to the bottom of the list. An effective internal control program can help generate sustainable value by providing business insights; validate the data used to develop financial reports; support strategic decision-making that is timely, accurate and reliable; and help extend the company's return on investment in the program long into the future.

(Source:  AccountingToday – Daily Briefing – Voices – June 23, 2021)