Internal Control Best Practices for Receipts & Payment Processing in a Remote Landscape
As the world responds to the SARS-CoV-2 virus and incidence of COVID-19 (COVID-19), entities are adjusting to conducting day-to-day operations in a remote landscape. For many nonprofits (NFP) and small businesses, this is the first time they’ve had to figure out how to receive money and process payments virtually. Business practices won’t be ideal due to limited staffing and accessibility; essential personnel will be quickly identified; and businesses will be tested against both internal and external threats of errors and malicious activity. Your organization’s internal control structure may feel strained during this time. And while businesses can never be 100 percent certain they’re protected from errors and fraudulent activity, they can implement or improve on internal control best practices to help limit these risks.
This article examines internal control best practices to consider in a remote landscape:
- Collecting cash and checks
- Processing payments to external parties
- Using credit cards as an alternative to disbursing checks
Collecting Cash & Checks
Many NFPs and small businesses may not have or consistently use a bank lockbox and instead receive cash and checks via mail as their predominant transaction method. In a remote landscape, this mail may be forwarded to an employee’s personal mailbox or a P.O. Box. Controls that promote timeliness and transparency will be critical to reduce the risk of error and asset misappropriation.
Employees responsible for opening this mail should scan all mail and record it in a log, and the receipts should be deposited to the bank daily. On the same day, the scanned mail and log should be routed to a different employee to record in the general ledger. If staffing is available, a third employee should reconcile the scanned mail, log and deposit slip to the receipts recorded in the general ledger.
If your organization has a bank lockbox available, advise your donors and customers to send all cash and checks directly to the lockbox or, if possible, to use one of your other asset receipt options, such as a donor portal or website that supports credit card receipts.
Once the dust settles, think about what would have made this process easier so you can be better prepared in the future.
- If your organization doesn’t have a bank lockbox, consider working with your bank to open one. Lockboxes independently collect and directly deposit any cash and checks received in the mail, and authorized users can log in to a bank portal to view all deposits received. Under normal circumstances, using a lockbox reduces the risk that money received in the mail is misappropriated. The added benefit to your business is that funds received are deposited timely, regardless of your employees’ work location.
- Consider the receipt methods your donors and customers requested as well as what options you were able to accept. For example, if your business isn’t equipped to receive credit and debit card payments, work with a bank to set this up and start taking measures to become PCI compliant.
- For items scanned to route to employees, assess whether secure and encrypted options were available to share information, such as restricted share drives or online workflows.
- Evaluate whether staff had the tools available at home to conduct day-to-day operations, such as remote capture scanners for depositing checks.
Processing Payments to External Parties
Like the receipts process, checks are still the primary payment method NFPs and small businesses use to disburse funds. In the case of the COVID-19 pandemic, organizations are likely to bring in essential personnel to continue processing check runs, while employees with reconciling and monitoring roles may perform these duties remotely. Regardless of where business operations are performed, organizations should continue to enforce policies that govern the control environment.
For example, if your organization’s policy is to require a second signature on all checks above $5,000, the control is the second signer’s authorization of payment before it’s disbursed—not the existence of the second signature. This authorization of payment could be obtained by reviewing the supporting documents stored on a secured drive, in addition to placing more reliance on a detective control of monitoring check disbursements captured by the bank.
In addition, consider these best practices:
- Your business should be skeptical of any calls received asking for checks to be sent to different addresses or instructions to wire payments, as these requests may not be legitimate. Stick to your organization’s policies regarding any modifications to payee files and use of wires. Follow your routine validation protocols before disbursing funds to an unfamiliar address. If you don’t have validation procedures in place currently, now is a good time to consider implementing stricter protocols around these types of requested changes.
- Notify vendors that your organization may be delayed in payment, given the circumstances. This communication may save your organization late fees and interest charges associated with any delayed payments.
- If your business hasn’t already done so, work with your bank to set up positive pay for monitoring all checks cashed from your bank accounts.
In the long term, evaluate how your business could be in a better position when faced with a future crisis.
- Assess how approvals are obtained by authorized individuals and maintained in your records. If approvals are primarily obtained with paper sign-offs, research how these critical approvals and supporting documents could be managed electronically in your enterprise resource planning (ERP) system or a workflow tool, such as SharePoint. If your business isn’t ready to implement an ERP or workflow tool, begin building a document repository with organized indexing and naming conventions on a secured share drive.
- Consider using an Automated Clearing House (ACH) as an alternative payment method. Begin communicating with payees to see if this option is available, and if so, start adding payees’ bank routing and account numbers to your payee master file. Although transitioning from checks to ACH payment isn’t a quick or easy business move, it may put your organization in a better position to disburse funds remotely while also lessening some of the risks—including forgery, alteration, counterfeiting and misplacement/loss—and inefficiencies involved with processing physical checks.
- Lastly, several third-party vendors exist that are integral in organizations’ contingency plans for events requiring remote processing. These vendors offer many different levels of processing and automation services and may be a good option for some organizations.
Using Credit Cards as an Alternative to Disbursing Checks
During the pandemic, some organizations will use credit cards to pay vendors that would typically receive checks. This may occur through using corporate credit cards or procurement cards managed by the organization or reimbursing payments made using employees’ personal credit cards. Below are internal control best practices to consider if your business plans to use credit cards during this time.
- Enforce your organization’s approval and spending policies. During a crisis, it’s important to remember that policies set guidelines the business deems necessary. Build your processes around those guidelines.
- Require itemized receipts to be provided to the card administrator daily.
- Review card purchases timely against invoices, receipts and approvals to monitor for appropriate use.
- As it applies to cards managed by your organization:
- Confirm that card limits are appropriate and align with your organization’s spending policies.
- If your staff has been downsized, disable the cards of any terminated employees.
- Limit cards from being used to purchase certain items that may not align with your organization’s policies by setting merchant category code restrictions.
When possible, develop or improve your organization’s policies and procedures specific to credit card administration, payments and reimbursements.
As your organization navigates this pandemic, take time to set up a reliable internal control structure. Consider developing best practices to add to your business continuity plan so your business is better equipped to handle the current crisis as well as potential future emergencies that affect your business processes. Reflect on the proactive measures your organization took to help ensure your internal control structure wasn’t compromised by operating remotely. Invest in tools and resources to help your stakeholders feel more confident in your business’s ability to collect receipts and process payments, regardless of where your employees are working. Above all, remember that this circumstance isn’t permanent, but the damage from weak internal controls could be costly and avoidable.
For more information, reach out to your BKD Trusted Advisor™ or use the Contact Us form below.