Internal Controls

What are internal controls?

Internal controls are policies, procedures, and systems that safeguard a company’s assets, ensure accurate financial reporting, and uphold compliance with laws and regulations.

Robust internal controls are particularly important for the procurement and accounts payable (AP) functions. Because these areas manage significant spending, which is often decentralized with poor visibility, they are vulnerable to potential risks. Internal controls help fend off these risks before any harmful action takes place.

Key objectives of internal controls in procurement and AP.

Preventing fraud and errors.

Internal controls aim to minimize the risk of fraudulent activities, like fictitious invoices, duplicate payments, or unauthorized purchases. They also help identify and fix unintentional errors that could lead to financial losses.

A good example of internal control in procurement that helps minimize fraud and errors is requiring two-factor authentication whenever a vendor makes a change to their payment information.

Ensuring compliance.

Controls help companies stay compliant with relevant laws, regulations, industry standards, and internal policies governing purchasing and payment processes.

One example of effective internal control that helps with compliance is the ability to suspend a virtual card for not complying with receipt requirements.

3. Safeguarding assets.

Internal controls protect company assets from misuse, theft, or damage — both physical assets like inventory and financial assets.

For example, approval chains that require transactions to be approved before a purchase is made help prevent misuse of company funds.

4. Promoting efficiency.

Well-designed controls streamline processes, reduce bottlenecks, and eliminate redundant tasks in the procure-to-pay cycle.

This control often comes down to workflows. The ability to configure workflows for maximum efficiency is essential to control the risk of inefficiencies.

Essential internal controls in procurement and AP.

Authorization and approval.

Clear approval hierarchies for purchases are established based on factors such as cost, department, and type of item. These hierarchies should be configurable to adapt to circumstances — for example, a member of the leadership team could appoint a delegate if they are out of the office.

Purchase orders, invoices, and payments should all require appropriate approvals before processing.

Spend controls.

Preset rules in the purchasing process let the system enforce company policies. A physical card may have a purchasing threshold, or even be restricted to certain categories. Giving a virtual card an expiration date can ensure that subscriptions are not automatically rolled over.

Reimbursement workflows can be configured so that only allowable expenses can be submitted.

Documentation and recordkeeping.

A complete audit trail is automatically created with supporting documents like purchase orders, invoices, receipts, contracts, and payment records, ensuring transactions are traceable and verifiable.

Vendor management.

Vendor management is a formal process for vetting and approving vendors, including due diligence checks and ongoing performance monitoring, helps reduce the risk of dealing with unreliable or fraudulent suppliers.

Three-way matching.

Before an invoice is paid, it’s compared against the corresponding PO and receipt. This triple verification ensures that the company is only paying for authorized goods and services that were actually received.

Reconciliations.

Regular account reconciliations, such as verifying bank statements and vendor statements, help uncover discrepancies, unauthorized transactions, and errors.

Physical controls.

Measures to safeguard inventory, restrict access to sensitive areas, and protect company assets from theft or misuse.

Segregation of duties.

Processes are designed so no single person has complete control over all stages of a transaction, so the responsibilities for authorizing purchases, receiving goods, processing invoices, and issuing payments are divided among different individuals or departments.

How Airbase helps with internal controls.

Airbase provides several key ways to strengthen internal controls within the procure-to-pay (P2P) process. Here’s a breakdown:

1. Segregation of duties and controlled spending.

• Pre-approvals: Airbase enforces approval workflows before a purchase is even made.
• Policy enforcement: Purchasing policies can be embedded directly in the platform (e.g., per diem limits, required expense categories) so the system can enforce them. This prevents unauthorized or non-compliant spending at the source.
• Corporate cards: Cards can be created for spending to an exact amount, vendor, or timeframe, minimizing the risk of misuse.

2. Clear audit trail.

• Complete transaction record: Receipts, invoices, or supporting documents are uploaded directly to transactions in Airbase, creating a thorough audit trail.
• Customizable coding: Extensive coding capabilities (departments, projects, GL codes) allow for robust classification and reporting of spend data.

3. Automated workflows for fewer errors.

• Automation of manual tasks: Airbase eliminates time-consuming, manual data entry and approvals, reducing the possibility of human error.
• Assisted reconciliation: Airbase features like pre-matching of transactions streamline account reconciliations and catch discrepancies early on.

4. Transparency and reporting.

• Real-time visibility: Finance teams and budget owners can see spend data as it happens, aiding quick intervention if needed.
• Customizable reports: On-demand reporting empowers teams to self-serve on spend insights, reducing the burden on the finance team and fostering accountability.