Internal controls: From compliance to competitive advantage

As Canada faces an uncertain trade and economic environment, businesses across the country are finding ways to become more resilient. From making use of government support programs to diversifying their markets to upskilling their workforce, Canadian businesses are working through current challenges to set themselves up for future success. Yet even in this landscape, one area of opportunity is often overlooked: internal controls.  In some organizations, internal controls have a bad reputation; they’re seen as extra work that gets in the way of ‘getting things done.’ Truthfully, if they aren’t correctly tailored to your business and its risks, they can be.  

However, when thoughtfully designed and effectively implemented, internal controls can help to safeguard your assets, ensure key reports are accurate and useful, reduce errors, streamline workflows, and free up resources for strategic initiatives.

What are internal controls?

Put simply, internal controls are the mechanisms an organization puts in place to increase the likelihood of achieving its business objectives. But it’s not simply the rules and regulations, the systems and paperwork of an organization; it’s the way that those things guide the actions of the employees tasked with executing the business’ mission. Let’s look at some practical real-world examples of situations in which internal controls could have prevented activities that harmed an organization.

How can internal controls drive value?

Traditionally, internal controls have been seen as protective measures, such as regulatory compliance and risk mitigation, both of which are crucially important to any business. However, the implementation of strong internal control systems can also improve business performance, including enhanced operational efficiency through process improvement and improved decision making driven by the availability of reliable and accurate data. 

Internal controls in practice 

Fraud via fictitious employees

A small organization relies on their payroll manager to set up new employees and run payroll every two weeks. After several months, the Controller notices that payroll expenses have increased and started investigating.  They found that the payroll manager had added fake employees to the payroll and the salaries for those employees were being paid directly into the payroll manager’s bank account.

How could internal controls have prevented this situation?

• Separate the ability to change employee payroll data from the ability to run payroll.  This prevents someone from being able to add, and pay, a fake employee without anyone else being involved in the process.
• If you are a very small organization, and it isn’t possible to separate those duties, make sure someone regularly performs independent reviews of changes to employee payroll information, and there is also a detailed independent review of payroll payments.

Managing cash flow

A construction company is growing quickly and taking on new projects.  However, they soon find that their costs are outpacing the cash coming in, and they are struggling to keep up.

How could internal controls have helped in this situation?

• Developing and monitoring cash flow projections help to reduce the risk of a mismatch between your cash inflows and outflows.
• Strong budget controls, including budget development, expense approvals, and monitoring of budget to actual can also reduce the risk of expenses getting out of control.

Decision making

During a busy holiday season, the website for a retail business has been busy with purchases from people looking for the perfect gifts. However, when the warehouse tries to fulfill the online orders, they realize that their actual inventory levels are much lower than the inventory recorded in their system, which will result in significant shipping delays and cancelled orders.

How could internal controls have helped this situation?

• Ensuring inventory counts are happening in a timely manner to identify discrepancies between actual and recorded inventory levels
• Forecast sales data to predict future demand and regularly adjust and monitor to ensure stock on hand is appropriate for predicted sales.

In each of the scenarios, a lack of internal controls led to a loss of value. In the case of the fictitious employee that meant the loss of the actual cash stolen by the payroll manager. In the other two cases, the lack of controls led to limitations on growth and the inability to take advantage of the business opportunities available to them. In both cases, there was a true loss to the organization.

Internal controls aren’t just about avoiding mistakes—they’re about enabling smarter, faster, and more confident business decisions. At Doane Grant Thornton, we help organizations design and implement controls that go beyond compliance, creating systems that are tailored to your business to support long-term success.

Internal controls aren’t just about avoiding mistakes—they’re about enabling smarter, faster, and more confident business decisions. At Doane Grant Thornton, we help organizations design and implement controls that go beyond compliance, creating systems that are tailored to your business to support long-term success.  Effective internal controls are not a ‘one size fits all’ approach – it’s important to design and implement internal controls in a way that works for your business helps you safeguard your critical assets, and ensures that you have accurate and complete information you can rely on to make important business decisions.

Whether you're scaling operations, preparing for an IPO, or simply looking to improve performance, our advisory teams are here to help.