The evaluation of internal controls is discussed in the IRM at 4.10.3.4. Examiners are required to evaluate the existence and effectiveness of internal controls for all types of business returns. Even in the small business environment, where the owner-managers control the entire operation, it is essential to evaluate internal control to determine the appropriate audit techniques to be used. The type of business, the records, and the owner’s financial status should be considered as part of the evaluation of internal controls.
What exactly are internal controls in a small business environment? When would they be considered inadequate to the degree of requiring an indirect method? Does the lack of good internal controls mandate the use of an indirect method? Conversely, do good internal controls automatically negate the use of an indirect method?
The answer to these questions is for the most part a judgment call by the examiner. It would be rare that a sole proprietor would be denied unlimited access to the cash resources of the business. While there could be a record keeping system that
incorporates a certain level of checks and balances, the credibility reverts back to the owner’s willingness to adhere to the established procedures.
In the absence of legal requirements for contractors, such as bonding or government contracts, for the most part a sole proprietorship with no employees is considered to have very weak or nonexistent internal controls. This conclusion would normally require strong consideration of an indirect method during the course of the examination. The exception would be a result of extenuating circumstances justifying a decision not to pursue an indirect method.
The next level would be “weak” internal controls. This might occur where the owner has occasional or limited access to the cash resources of the business. An example might be a larger Schedule C with an in-house accountant. The staff prepares the majority of the banking transactions. The owner, however, has the opportunity on occasion to skim cash sales and circumvent the control procedures that are in place.
In situations similar to this example, deciding whether or not to pursue an indirect method would require several considerations.
• Type of business involved (some are more prone to cash transactions); • The ease of skimming cash, e.g., a large number of unidentifiable customers
versus a small number of traceable customers;
• Established gross profit ratios, e.g., the fact that the business is operating well below the normal gross profit ratios may indicate skimming practices are present; • The taxpayer’s standard of living, e.g., a higher standard of living than the
amount of income reported may indicate potential skimming;
• Cash expenditures not reflected in the taxpayer’s records that are identified by a courthouse records check; or
• A high percentage of cash expenditures for business or personal expenses and some (or all) are not reflected in the taxpayer’s records.
The other end of the scale is a business with strong internal controls. This might be evidenced by an elaborate double entry record keeping system; periodic in-house audits; annual certified financial audits; an outside accountant who provides monthly write-up services; non-related owners with equal involvement in the business
operations; or limited cash transactions with easily traceable customers. Under these circumstances, the general rule would be not to pursue an indirect method, and the exception would be where extenuating circumstances dictate otherwise.
The key steps to evaluating internal controls are: • Understanding the control environment, • Understanding the accounting system, and • Understanding the control procedures.
First, the control environment is made up of the many factors that affect the policies and procedures of the business. The examiner must understand how the business
operates. Interviewing the taxpayer (and/or the representative) and touring the business are integral steps. Second, gaining knowledge of the accounting system provides information about many of the day-to-day business operations. Finally, the control procedures are the methods established to assure that the business operates as intended. The separation of duties is the primary control procedure because it will reduce the opportunity for any one person to both perpetrate and conceal errors or irregularities. The greater the number of employees, and the more complex the business, the more likely some formal control procedures will exist.
In conclusion, the internal controls of a business must be evaluated and discussed in the workpapers as a mandatory item on every business return examination. The workpapers should include a statement regarding the accessibility to cash by the
owner/manager, the quality of internal controls overall, and the effect the internal control environment had on the verification of income.
Audit Techniques for Evaluating Internal Controls
The internal control system should be tested for compliance with the procedures as described in IRM 4.10.3.4.5.3. Observe a transaction through the entire accounting process. Look for consistency in recording similar transactions. At this point, the scope and depth of the examination can be determined. If the books and records are reliable, the examination can include direct testing of transactions, such as tracing specific items to receipts. However, if it is determined that the books and records are not reliable, the examination should include indirect analyses. Because the examination of the books and records will reveal the likelihood of material errors, or that transactions were valid, determining reliability through internal control analysis is a key step.