By Megan Miller, Senior Manager, DHG Dealerships
We have heard the phrase time and again – that a sound internal control environment is an important element of a dealership’s overall organizational structure. Well-designed and implemented internal controls can help an organization achieve their objectives and improve overall operational effectiveness and efficiency. But how do we safeguard this internal control environment so that it functions properly in the dealership? This article will provide some tips and suggestions on how to develop and implement your own internal audit plan, whether you are a single-point dealer or a multi-rooftop group.
Initiation
Having a written, binding accounting policies and procedures (p&p) manual is a great starting point to determine what controls you currently have (or should have) in place to build a testing plan. If your dealership does not have a p&p manual, putting pen to paper is necessary prior to testing. Manuals can range from a several page narrative of the procedures in place at the dealership to a list of the key processes and controls that are performed throughout the month.
Once a comprehensive p&p manual is established, verify that there are no significant gaps in the processes, which is a step that should be repeated at least annually.
Importance of month-end controls
Identifying which controls to test on a periodic basis can also prove complex. Internal controls come in three forms: preventive, detective and corrective. When determining which to test, focus on the detective controls, especially if you have a limited amount of time to devote to internal audit activities. Detective controls identify where preventive controls were not effective in preventing an error. These types of controls largely include what you might consider your regular month-end controls (e.g. bank reconciliations, floor plan reconciliations, parts and vehicle physical inventories, etc.). While many preventive controls are the easiest and most cost-effective controls to implement, the detective controls can be your end-of-the-line defense, and they can make a significant difference in your overall control structure. If there is not currently a detective control in place for a certain process, then your internal audit testing may serve as that control.
If the accounting office isn’t currently using a month-end checklist or a formalized set of month-end work papers, now is a good time to implement such a process. A regular review of the month-end checklist and any associated work papers or reconciliations is an easy addition to your internal audit plan that will grant you a significant amount of detective control coverage.
Segregation of Duties
You cannot talk about internal controls without mentioning segregation of duties, but what does that exactly mean?
The concept of segregation of duties suggests that operating procedures and accounting processes performed by the dealership should contain an adequate division of duties between the personnel who are charged with (1) the physical custody, (2) the authorization to use and (3) the ability to record transactions dealing with financial assets. This system of internal checks and controls serves as a primary safeguard against possible misstatements due to either fraud or error. Consider implementing systems to include the following:
- Segregation of functional responsibilities so people charged with the receipt, custody and disbursement of assets are separate and distinct from those maintaining the records.
- Periodic rotation of personnel whose duties form an integral part of the internal control system (cross training).
- A system of authorization and recording procedures adequate to provide reasonable control over assets, liabilities, income and expenses.
- Periodic proofs of records (which is where internal audit comes into play).
- Regular annual vacations by all officers and employees, with the work of individuals on vacation routinely performed by a different employee.
Segregation of duties is such a significant part of a good internal control environment that it is difficult to ignore completely. Part of the periodic internal audit process should be to review the functions that each employee is performing to identify any of these overlaps in duties, and also allowing for employees to take regular vacations where their duties are performed by someone else in their absence.
Don’t forget about operations!
Although internal control concerns often center around the dealership’s accounting office, it’s important not to exclude operations from regular internal audit procedures. After all, accounting only records and reports what the departments are doing on a day-to-day basis. Consider adding some of these steps in the internal audit plan:
- Sales and Finance & Insurance (F&I)
- Each month, select a sample of deal files, weighted toward those with the highest back-end gross profit, to review for compliance. These select deals will help you gain more coverage with each deal file. Remember to analyze something from each salesperson and F&I producer every couple of months.
- Perform a lot walkthrough for Monroney sticker and Buyers Guide compliance (click here for the Federal Trade Commission (FTC) news release about their recent Buyers Guide compliance sweep).
- Parts
- Download an open parts ticket report and inquire about the aged invoices (generally, anything over a few days old) and anything open for an employee.
- Obtain the Dealer Management System’s parts override report and check for items such as cost overrides, repetitive sales price overrides and customer taxability overrides.
- Select a sample of wholesale customers each month to verify their sales tax exemption certificates and any other state required forms are on file.
- Perform test counts on fast-moving parts and a selection of high-dollar-value parts.
- Service
- Download an open repair orders (RO) report and inquire about aged ROs (generally, more than one to two weeks old) and anything open for an employee. Ask to see those vehicles that are still being serviced.
- Obtain the loaner vehicle tracking report and test to make sure it is accurate and up-to-date.
- Body Shop
- Review procedures for bulk materials inventory (such as paint and Bondo) and perform test counts.
- If the body shop has its own loaner fleet, obtain the loaner vehicle tracking report and test to make sure it is accurate and up-to-date.
Who plays a part in internal control?
The short answer is everyone in the dealership plays a part in the internal control structure. More importantly, there are several people who can play an integral part in the internal audit structure, and probably already do! Give yourself some credit if there are already procedures in place, for example, to review the bank reconciliation that the office manager prepared, or look through cancelled check images after they have cleared the bank. These functions are likely being performed by just the next level up, so start taking an inventory of those items and formalize the process by documenting it in an internal audit checklist.
Assigning roles and responsibilities
After the dealership has established a list of internal audit procedures to be performed on a monthly or quarterly basis, you may wonder how all tasks can be accomplished with the limited time we have in a day. Remember that it is okay to delegate the work as appropriate. When assigning roles, keep in mind that those performing the testing of the control should have no responsibilities related to that control. For example, much of the operational testing could be handled by personnel in the accounting office, as they should be removed from those functions. Within the accounting office, things may get a little trickier, but a best practice is to utilize an employee who is one or two levels above the person who is performing the control.
Timing of procedures
Month-end is busy enough as it is. While several of the internal audit procedures may need to be performed during that month end close process, or shortly thereafter, many can be performed throughout the month. Analyze the list of procedures and decide which ones can be moved outside of the month-end process, and have these procedures performed throughout the month. There is also much better control if the testing is performed on a surprise basis. If everything is done at the end of the month, then everyone knows to be on their best behavior at that time.
Holding everyone accountable
While an audit of the internal audit function sounds cyclical and repetitive, the practice is still an important step. Identify a way that motivates and holds the employees accountable, whether requiring them to sign off a checklist as part of their monthly responsibilities or simply emailing a quick recap of what they have accomplished. Be sure to communicate the accountability follow-up to accomplish the internal audit goals.
Following up
Testing controls may be a futile use of time without sufficient follow-up procedures in place. Luckily, most people do not like to be told that they are doing something wrong, so they may work harder to avoid such feedback. Review the results of the internal audit procedures in a weekly asset meeting or another time when the department managers can meet. On a quarterly basis, formalize those findings into a report and ask that the department managers provide a response on how they will correct those items going forward. Relay those responses to whomever is performing the testing of that control procedure so that person may follow-up and confirm that corrective action has taken place, which may serve as the corrective control to “close the loop” on the internal control structure.
Conclusion
Remember that just because you do not have an internal audit department, it is possible to obtain some internal audit coverage—you probably have already done so. Below is a quick recap of some easy steps to follow to build and implement an internal audit program:
- Start with building or updating your p&p manual.
- Review the manual on an annual basis to identify any deficiencies in your internal control structure.
- Identify key controls from the manual that you want to test on a rotating basis. Focus on the detective control procedures and make sure this includes the accounting office’s month end checklist and work papers.
- Review job functions periodically to ensure proper segregation of duties.
- Remember to include operations in your plan.
- Assign monthly and quarterly internal audit responsibilities to personnel within the dealership.
- Follow-up regularly on all areas.
Megan Miller is a Senior Manager, DHG Dealerships. She can be reached at megan.miller@dhg.com.
DHG Dealerships is one of the largest professional service teams providing assurance, tax and advisory services to dealers across the country. They collaborate with key industry stakeholders to enhance the insights we bring to our clients and provide them access to valuable resources. For more information, visit dhgdealerships.com.
