Establishing internal controls helps prevent fraud
NAIT STAFF
January/February 2022
All assets of an Islamic centre/mosque are traditionally considered a trust (amana), and the staff handling them bear a great responsibility: “Verily! God commands that you should render back the trusts to those, to whom they are due; and that when you judge between people, you judge with justice. Verily, how excellent is the teaching which He (God) gives you! Truly, God is Ever All-Hearer, All-Seer.” (4:58)
Such structures should be built and managed on the foundations of honesty, integrity, loyalty and mutual trust. However, anyone can fall prey to temptation and misguidance (1:6-7) and engage in unethical practices or apparently harmless mistakes that may damage the centre’s financial standing.
What are Internal Controls?
Organizations must have specific policies and procedures in place to prevent fraud, mistakes or manipulation. These can also help improve the efficiency, accuracy and timeliness of financial reporting. These specific policies and procedures are called internal controls.
Internal controls are either preventive or detective. While there are several kinds of internal controls, the most common are preventive and detective.
Preventive controls are policies and procedures that help deter, decrease or stop the chance of errors and fraud before they occur (e.g., restricted access through passwords, approvals, verifications, reconciliations, policies and procedures).
Detective controls are designed to uncover errors or irregularities that may already have occurred (e.g., monthly accounts and bank statement reconciliations, independent review of activities and balances, ongoing monitoring of expenses vs. budget and regular manual cash or inventory count in addition to the electronic one).
Implementing Preventive Controls
Preventive controls have a specific structure as outlined below. Your Islamic centre or nonprofit can implement those that fit their organizational structure and size.
• Assess the risk. Identify and analyze relevant risks and how they should be managed. For example, conduct monthly meetings to review risks and internal audits and perform thorough background and criminal checks before hiring.
• Control environment. The organizational culture influences the employees’ control consciousness. This may include formulating proper direction and clear policies, especially those that deal with financial affairs; emphasizing accountability at all levels; training employees how to notice and identify discrepancies or suspicious activity, as well as how to avoid risky and apparently harmless mistakes that can cause a serious problem; devising clear policies on how to respond when issues arise, who to inform and what to expect; and protecting the whistleblower’s anonymity.
• Control-activities. This includes establishing and enforcing clear policies regarding purchasing limits, approvals, authorizations, verifications, reconciliations, reviews of operating performance, physical and online safeguards and security of assets. See the Best Practices article below for detailed activities.
• Separate duties. Divide financial responsibilities so that no one person controls financial activities such as check signing, accounts receivables, record-keeping, reconciliation, and custody of assets. This also reduces the risk of error or inappropriate actions. The Best Practices section offers details.
• Communicate information. Make sure that communication, which is key to a good internal control system, flows easily. This can be accomplished by devising a broader system that defines expectations and policies, and clearly outlines the steps to follow when any suspicious activity or fraud is encountered.
• Monitor and report. Formulate and then implement ongoing evaluations to ensure that the internal controls are functioning well. To achieve these goals, conduct monthly reviews of performance reports and internal audits, report serious matters to management alert the board to any internal control deficiencies or need for additional corrective measures.
Implementing Detective Controls
This type of internal control has two benefits: In addition to indicating whether preventive controls are operating as intended, it also offers a chance to detect loopholes and irregularities. It may include conducting detective audits, for example, surprise or random cash counts, which can help keep employees stay honest and focused on performing with integrity.
Best Practices
As each Islamic centre is operated uniquely, the following best practices can be tailored to meet your centre’s needs and management style.
• Develop access controls and physical safeguards. For example, put locks on doors, cabinets, drawers and the safe in which you keep cash and/or checks; regularly back up all financial files on cloud-based systems; restrict access to bank accounts and financial software via passwords and authentication systems to authorized personnel; select strong passwords, change them regularly and don’t repeat them; don’t save access information on documents or in places that others may have access to; and periodically count all financial assets, cash and check stocks kept in lock on-site and compare this data with control records. Manually counting assets is crucial because fraud can occur off the books to bypass financial report audits.
• Separate duties. Divide the authorization, recording and custody of assets among employees; the person reconciling bank statements or conducting audits shouldn’t be an authorized check signer; ensure that records are routinely reviewed and reconciled by someone other than the preparer or transactor; the person opening the mail should have nothing to do with the accounting records; in case the centre doesn’t have enough employees, peer reviews can serve a similar function.
• Bank accounts. Set transactional, purchasing and withdrawal limits and require dual signatures for all cash disbursements over a certain limit. If the centre’s bank doesn’t honour this system, maintain a cash flow system to track the monthly expenditures; maintain a restricted account that only certain board members can monitor; keep the number of bank accounts to a minimum: one for payroll, one for operating expenses, and maybe another one for a large capital project; all check numbers — in sequence — should be accounted for; examine paid checks for a date, name and endorsement with a cash disbursements journal; compare details of bank deposits to cash receipts records, and follow up on old outstanding checks.
It is advisable to invest extra cash or savings in a halal manner, such as The North American Islamic Trust (NAIT; nait.net)’s Islamic Centers’ Cooperative Fund (ICCF) (https://www.nait.net/index.php/islamic-centers-cooperative) instead of keeping them in checking or savings accounts. Investing will place the cash beyond the easy reach of those taking care of financial affairs. This not only provides safety but also offers growth over cash long term and is integral to gaining financial sustainability in modern times
• Cash receipts. Issue pre-numbered receipts to individuals who bring money to the office. These should contain the date, name, amount and purpose of funds, and be signed by the person who received them. No less than two unrelated individuals should count these funds, and counting team members should be rotated.
• Cash disbursements. All non-petty cash disbursements should be made by pre-numbered checks; bills should be approved and evidenced in writing; blank checks should never be signed and kept for later use; all paid bills must accompany a vendor invoice and be marked as “paid” to avoid double payment; voided checks should be marked VOID and retained; give the check signer all supporting documents to review before signing it; prohibit all “CASH” checks, and clearly state the specific expenditure on each check.
Sources: Investopedia, UCSF Audit and Advisory Services, Washington State Office of Financial Management’s guide to internal control and auditing.
Sources: Investopedia, UCSF Audit and Advisory Services, Washington State Office of Financial Management’s guide to internal control and auditing.
[Editor’s note: Reprinted with permission from the North American Islamic Trust]