Skip to main content

CTS Manufacturing Blog

How to Use Your Manufacturing ERP Software to Achieve Internal Financial Controls

This is a guest post by Alan Hart, MBA, Principal Consultant at Pacific Shine Group in Portland, Oregon.

ERP Software Internal ControlsInternal control over financial reporting became a hot topic in the years following the enactment of the Sarbanes-Oxley Act of 2002 (AKA SOX or SARBOX), triggered by the accounting scandals discovered at many publically traded companies in the years that preceded it. Although it was primarily public companies that were in the spotlight (such as Enron, WorldCom, Adelphia Communications and others), some of these accounting practices were also present in privately owned enterprises.

Not surprisingly, these issues plagued organizations of all sizes and in diverse industries, and were the direct consequence of lack of internal control or poorly installed and executed controls within the organization.

The Role of Internal Controls

A well designed and effective internal control framework can lead to better financial reporting that is reasonably free from material errors, offers better disclosures and lowers the risk of internal fraud and other activities that invariably rob an organization of its assets while diminishing efficiency and lowering profitability.

Many internal controls can be automated using ERP software, and even though many of them are performed by humans, they can still be controlled in the organization’s ERP system or accounting software, which allows management to make an informed assessment as to the effectiveness of such controls.

While privately held organizations generally do not have to certify that their internal controls over financial reporting are effective, it is reassuring to know that a control environment exists and control activities are properly executed.

Contrary to popular belief, having a fully implemented internal control framework does not add an additional burden to the organization (with the exception of the initial setup), and can actually decrease the workload across the entire organization and decrease waste and losses due to fraud.

Internal Controls: An Example

Internal controls are activities (and also organizational behavior or characteristics) performed in order to mitigate pre-defined risks.

For example, if you realize that your financial statements may be flawed due to lack of review and approval of manual journal entries (the risk), and set up a control in your ERP system that requires a manager (e.g., Controller) to review and approve such journal entries prior to posting, than you have an internal control in place that is designed to mitigate the identified risk.

In this scenario, the person who makes the journal entries should not be the one who reviews and approves them. In order for this example control to be effective, you need to have evidence of its performance; the person performing the control activity must be suitably qualified to do it and, ideally, there should be clear certification (e.g., a proper signature, date, etc.) that the control was performed.

A properly set up control environment will include all required controls in all areas, such as purchasing, sales, revenue recognition, inventory and many others, in which risks to financial reporting and disclosure have been identified.

Who Needs Internal Controls?

All companies, regardless of size and form of ownership, can benefit from internal controls. There are many examples to support this, even though there may not be a legal requirement to perform and periodically certify it. Here are some reasons why companies deploy internal controls:

  • Controls may be necessary to comply with debt covenants
  • Shareholders may need assurance that the organization is committed to preserving its assets and maximizing the return to shareholders via improved efficiencies and eliminating or substantially reducing fraud and other losses
  • Valuation of privately held companies may increase merely due to the fact that an internal control framework is in place and financial statements (audited or not) are deemed more reliable.
  • Audit activities may be simplified, as the organization becomes more “audit friendly;” as a result, audit or review fees may substantially decrease

How Your ERP System Helps Establish and Retain Evidence of Internal Controls

Many ERP software packages can be effectively used to establish internal controls. Here are two examples:

Segregation of duties: Assuming you have the minimum required number of employees to effectively perform this control, it simple to set up and enforce through the user security features of the ERP software. For instance, the person who approves purchase orders should not have access to the section of the software (screen) where vendor payments are entered.

Electronic signatures: Many ERP software packages allow users to approve accounting and other activities electronically by indicating (and using their pre-authorized user profile in the security section of the software) that a control designated to them has been performed. Let’s say a sales order process supervisor reviews and approves the entry of sales orders (according to a control description plus a desktop procedure outlining and explaining the process). The manager indicates approval in a control field (usually a checkbox or a sales order status field) in the ERP software, making these sales orders available to ship. As a logged-in user having that particular privilege assigned in their user profile, this supervisor is the only person with the ability to make that entry.

On the evidence side, proving the performance of manual controls can also be part of the ERP system functions. A good example here is the attachment of reviewed and signed source documents to the ERP software database records for archival purposes and future reviews or audits.

If someone tasked with approval of incoming customer purchase orders performs the review and approval, and that PO is scanned and linked to the PO record in the purchasing system, drilling down through a list of PO’s and clicking on the link will bring up the stored approved document.

Here are two more illustrations of evidence:

Account reconciliations: The control performance (e.g., Controller reviews and approves all account reconciliations after tying out all subsidiary ledger balances to their control account balances in the G/L) can be evidenced by approving all standard (recurring) journal entries associated with account reconciliations (including accounts that did not require adjustments through JE’s). This can be either done through an authorized release within the system of a journal entry batch to posting, or an electronic attachment of an approval document (e.g., journal entry batch list). Either way, a test or audit of this control can easily be performed right in the ERP software.

Inventory adjustments: You may have a control saying that inventory cycle counts are performed daily and that all inventory adjustments (reconciliation of physical count to perpetual inventory in the software) are reviewed and approved by an accounting manager. Here, the ERP software will automatically generate the required inventory items to count each day, based on pre-defined logic. The adjustment, based on the findings on the count sheets, is evidenced by the authorization of the designated user who made the adjustments. The count sheets themselves are either saved electronically, or can be physically scanned and attached to the adjustment transaction, depending on the capabilities of the particular ERP software used.

Another type of controls, Entity Level Controls (controls pertaining to the organization as a whole, its environment, culture and other attributes), can also be performed and evidenced in the ERP software.

For example, a control might say that all persons in managerial financial positions (e.g., CFO, Controller, VP Finance, Treasurer, etc.) must undergo a comprehensive recruiting and interviewing process and all such process steps must be documented. All pertinent documents evidencing performance of this control can be electronically attached to the HR record in the ERP system. A test of this control can be simply performed by recalling these documents and noting the evidence or any deficiencies that may be discovered.

Once you identify the internal controls needed to mitigate risks to financial reporting, you’ll be able to assess which of those controls can be automatically set up in your ERP software and which ones will allow storing the evidence of performance of these controls as document attachments.

The Bottom Line on ERP Software Internal Controls

With the advent of modern accounting and ERP software, it is possible to automate a great number of internal controls. Today we have the capability to perform electronic audits or reviews at any time, with minimal inconvenience to the staff and with much greater accuracy. In theory, and to a great extent also in practice, there is no longer the need to search drawers in filing cabinets for the required documents.

When you properly analyze the risks and design controls that will mitigate those risks, the ERP software will merely ensure that the designated persons perform the controls assigned to them and that the automated processes, designed and put in place to achieve these control objectives, are effective. Users of financial statements will gain confidence in your operation and appreciate the accuracy and reliability of these statements.

About the Author

Alan Hart, MBA, is Principal Consultant at Pacific Shine Group in Portland, Oregon, with responsibility for client business development and hands-on client project implementations. Prior to starting Pacific Shine Group, he worked in various executive accounting and finance positions with technology and growth companies. Notable is his 18 years in the hi-tech manufacturing industry where he served as Controller, Vice President of Finance and CFO of several privately as well as publically held companies.

Combining his skills and experience in engineering with deep understanding of technical accounting, he is able to assist small and medium-size manufacturing companies establish GAAP compliant accounting and reporting systems,

Alan can be reached at (310) 384-1453 or alan.hart@pacificshinegroup.com.