<?xml version="1.0" encoding="UTF-8" ?><!-- generator=Zoho Sites --><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/"><channel><atom:link href="https://www.gogradient.com/blogs/tag/internalcontrols/feed" rel="self" type="application/rss+xml"/><title>Gradient Solutions Corporation - Gradient Blog #internalcontrols</title><description>Gradient Solutions Corporation - Gradient Blog #internalcontrols</description><link>https://www.gogradient.com/blogs/tag/internalcontrols</link><lastBuildDate>Tue, 24 Mar 2026 15:34:29 -0700</lastBuildDate><generator>http://zoho.com/sites/</generator><item><title><![CDATA[Should you be using an internal representation letter?]]></title><link>https://www.gogradient.com/blogs/post/should-you-be-using-an-internal-representation-letter</link><description><![CDATA[In 2017, I (Cal) decided to leave Gradient and join a small start-up company just to the south of Dallas in Waxahachie. &nbsp;Prior to this decision, ]]></description><content:encoded><![CDATA[<div class="zpcontent-container blogpost-container "><div data-element-id="elm_IXw7GBw4SA-_GEYOCd89fw" data-element-type="section" class="zpsection "><style type="text/css"></style><div class="zpcontainer-fluid zpcontainer"><div data-element-id="elm_g5a9k17ETjujHu6cwm_cxg" data-element-type="row" class="zprow zprow-container zpalign-items- zpjustify-content- " data-equal-column=""><style type="text/css"></style><div data-element-id="elm_05RG79NNSyKwsBUeAIkxcw" data-element-type="column" class="zpelem-col zpcol-12 zpcol-md-12 zpcol-sm-12 zpalign-self- "><style type="text/css"></style><div data-element-id="elm_quOm_NpeRd21zjtN5R2RSw" data-element-type="text" class="zpelement zpelem-text "><style> [data-element-id="elm_quOm_NpeRd21zjtN5R2RSw"].zpelem-text { border-radius:1px; } </style><div class="zptext zptext-align-center " data-editor="true"><div><p style="text-align:left;margin-bottom:19.2pt;">In 2017, I (Cal) decided to leave Gradient and join a small start-up company just to the south of Dallas in Waxahachie. &nbsp;Prior to this decision, most of my business life had revolved around external client service in audit or consulting. &nbsp;Thankfully, my external life prepared me well for a new reality within a single business as the Chief Financial Officer from June of 2017 to September 2019. &nbsp;During that time, I was part of completing three external audits of our entity's financial statements. &nbsp;As a consultant, I would recommend or suggest methods to improve oversight, reduce risk, or align processes to strategies. &nbsp;One of the items we’d regularly recommend to our friends in finance and accounting was the use of an internal representation letter to the entire executive or management team ultimately responsible for the success of the entity and the resulting information and transactions used in the financial statements. &nbsp;The standard representation letter required by external audit teams is very broad with a reasonable risk that knowledge of all events in the letter will escape even the most informed executive, Chief Financial Officer, Chief Executive Officer, Chief Accountant, or others that normally sign the final document. &nbsp;</p><p style="text-align:left;margin-bottom:19.2pt;">One of the first things I did during the first external audit as the CFO was to take my own advice and issue an internal representation letter to our executive team. &nbsp;It was a fairly simple process, but one that helped me feel more comfortable in signing the actual representation letter. &nbsp;I was also able to execute the process on my own without the other staff or IT. &nbsp;Here are the steps I followed and that I would recommend to you:</p><p style="text-align:left;margin-bottom:6pt;margin-left:23.25pt;"><span style="font-size:12pt;">·<span style="font-size:7pt;">&nbsp;</span></span>First, I reviewed the actual representation letter with our internal accounting team and legal. &nbsp;If we weren’t comfortable with an item or felt that the wording of an item needed to change, we proposed changes to the audit team. &nbsp;When the changes were reasonable, common ground was able to be reached on most proposed items.</p><p style="text-align:left;margin-bottom:6pt;margin-left:23.25pt;"><span style="font-size:12pt;">·<span style="font-size:7pt;">&nbsp;</span></span>Second, I took the final draft (unsigned) representation letter and re-wrote it in a form that hit the key items of the letter that I felt should be reviewed and shared by the executive team. &nbsp;During this process, I didn’t pass accounting type items to the team, but focused more on the broad business items or blanket statements in the letter wording. &nbsp; Each internal representation letter will look a little different and should be customized to your organization. Here are a few examples to consider.</p><p style="text-align:left;margin-bottom:6pt;margin-left:59.25pt;"><span style="font-size:12pt;">o<span style="font-size:7pt;">&nbsp;</span></span>Knowledge of all related party transactions or validation of those items listed in the letter.</p><p style="text-align:left;margin-bottom:6pt;margin-left:59.25pt;"><span style="font-size:12pt;">o<span style="font-size:7pt;">&nbsp;</span></span>Knowledge of all fraud or suspected fraud.</p><p style="text-align:left;margin-bottom:6pt;margin-left:59.25pt;"><span style="font-size:12pt;">o<span style="font-size:7pt;">&nbsp;</span></span>Knowledge of any material breaches in internal controls especially around financial reporting, privacy issues, or security.</p><p style="text-align:left;margin-bottom:6pt;margin-left:59.25pt;"><span style="font-size:12pt;">o<span style="font-size:7pt;">&nbsp;</span></span>Knowledge of any reports, studies, or reviews, whether internal or external, that have not been reported to the accounting team.</p><p style="text-align:left;margin-bottom:6pt;margin-left:59.25pt;"><span style="font-size:12pt;">o<span style="font-size:7pt;">&nbsp;</span></span>Knowledge of any regulatory or compliance related issues.</p><p style="text-align:left;margin-bottom:6pt;margin-left:59.25pt;"><span style="font-size:12pt;">o<span style="font-size:7pt;">&nbsp;</span></span>Knowledge of any health and safety issues.</p><p style="text-align:left;margin-bottom:6pt;margin-left:59.25pt;"><span style="font-size:12pt;">o<span style="font-size:7pt;">&nbsp;</span></span>Knowledge of any litigation or pending litigation or validation of those items listed in the letter.</p><p style="text-align:left;margin-bottom:6pt;margin-left:59.25pt;"><span style="font-size:12pt;">o<span style="font-size:7pt;">&nbsp;</span></span>Knowledge of any additional subsequent events or validation of those listed in the letter.</p><p style="text-align:left;margin-bottom:6pt;margin-left:59.25pt;"><span style="font-size:12pt;">o<span style="font-size:7pt;">&nbsp;</span></span>Knowledge of destruction or major changes to significant company assets.</p><p style="text-align:left;margin-bottom:6pt;margin-left:59.25pt;"><span style="font-size:12pt;">o<span style="font-size:7pt;">&nbsp;</span></span>Knowledge of any new significant contracts or agreements.</p><p style="text-align:left;margin-bottom:6pt;margin-left:59.25pt;"><span style="font-size:12pt;">o<span style="font-size:7pt;">&nbsp;</span></span>Knowledge of any significant staff turnover that could impact the organization’s financial reporting ability in a material way.</p><p style="text-align:left;margin-bottom:6pt;margin-left:23.25pt;"><span style="font-size:12pt;">·<span style="font-size:7pt;">&nbsp;</span></span>Third, I sent an email or made a phone call to each of the key executives explaining what I needed and why I needed it. &nbsp;It is important to communicate why their input and feedback is important and the broadness of the representations requested by the typical letter. &nbsp;As the CFO, this was also a good time to explain a few key points and how they relate to effective internal controls within the organization. &nbsp;The letter itself is also a good, short training document in the sense that it provides the executives a short and concise view of some of the key questions that are normally asked by external auditors.</p><p style="text-align:left;margin-bottom:6pt;margin-left:23.25pt;"><span style="font-size:12pt;">·<span style="font-size:7pt;">&nbsp;</span></span>Finally, I distributed the letter through the DocuSign system. &nbsp;Since it was the start-up, I had the fortunate, or some might say unfortunate, duty of having my hands in many of the shared service functions. &nbsp;With DocuSign, I was able to upload and distribute my document for signature without the support of IT or other professionals with the organization. &nbsp;It made for an efficient and effective process. &nbsp;</p><p style="text-align:left;">In my view, performing the process I outlined above, which doesn’t take a significant amount of time, helped me to feel more comfortable in signing the representation letter as provided by the external audit team. &nbsp;If you are one of the signers of the document, I’d encourage you to perform a similar process as I’ve listed above. &nbsp;The document doesn’t have to be highly formal or technical, but can simply be a short list of bullet points you’d like to get confirmation or more information about from your team.</p></div></div>
</div></div></div></div></div></div> ]]></content:encoded><pubDate>Thu, 18 Aug 2022 18:38:00 +0000</pubDate></item><item><title><![CDATA[Helpful hints for reducing fraud, waste, and abuse in purchasing card programs]]></title><link>https://www.gogradient.com/blogs/post/helpful-hints-for-reducing-fraud-waste-and-abuse-in-purchasing-card-programs</link><description><![CDATA[Many managers are ambivalent about purchasing cards (p-card). &nbsp;This love, hate relationship with purchasing card programs has the potential to cr ]]></description><content:encoded><![CDATA[<div class="zpcontent-container blogpost-container "><div data-element-id="elm_YvkcC-SGS-CyVMtQZk4THA" data-element-type="section" class="zpsection "><style type="text/css"></style><div class="zpcontainer-fluid zpcontainer"><div data-element-id="elm_rvZ3lDb4T_KQMJgB5Yi6fg" data-element-type="row" class="zprow zprow-container zpalign-items- zpjustify-content- " data-equal-column=""><style type="text/css"></style><div data-element-id="elm_DfU409exSlCFZJCrxPz4SA" data-element-type="column" class="zpelem-col zpcol-12 zpcol-md-12 zpcol-sm-12 zpalign-self- "><style type="text/css"></style><div data-element-id="elm_FiFAvSX_QGm8hmGN3dxWgw" data-element-type="text" class="zpelement zpelem-text "><style> [data-element-id="elm_FiFAvSX_QGm8hmGN3dxWgw"].zpelem-text { border-radius:1px; } </style><div class="zptext zptext-align-center " data-editor="true"><p style="text-align:left;margin-bottom:19.2pt;">Many managers are ambivalent about purchasing cards (p-card). &nbsp;This love, hate relationship with purchasing card programs has the potential to create unplanned risks. &nbsp;Either a p-card program is too risky to consider or it provides a good outlet to control and monitor small dollar spending. &nbsp;With the new strategies to recover costs through rebate programs, p-cards are becoming more of a staple of small to large entities. &nbsp;Over the years, Gradient has seen a variety of controls and issues within p-card programs. Here are some of our recommendations (not comprehensive) to reduce risk in p-card programs. We’d suggest performing a thorough review of your own program against best practices.</p><p style="text-align:left;margin-bottom:6pt;margin-left:23.25pt;"><span style="font-size:12pt;"><span style="font-size:7pt;">&nbsp;</span></span><span style="text-align:center;">·</span>You need well designed policies, forms, and training. The information needs to be supported by strong cultural norms. &nbsp;Without this, you don't have a foundation to monitor, instruct, and correct behavior.</p><p style="text-align:left;margin-bottom:6pt;margin-left:23.25pt;"><span style="text-align:center;">·</span>A single person or group (depending on size) needs to take responsibility for overall program management. &nbsp;Responsibilities must be clear.</p><p style="text-align:left;margin-bottom:6pt;margin-left:23.25pt;"><span style="font-size:12pt;">·<span style="font-size:7pt;">&nbsp;</span></span>Reconcile p-card policies to other organization policies including travel, purchasing, code of conducts, etc.</p><p style="text-align:left;margin-bottom:6pt;margin-left:23.25pt;"><span style="font-size:12pt;">·<span style="font-size:7pt;">&nbsp;</span></span>Implement and monitor both single limits and monthly limits.</p><p style="text-align:left;margin-bottom:6pt;margin-left:23.25pt;"><span style="font-size:12pt;">·<span style="font-size:7pt;">&nbsp;</span></span>Restrict vendors using the merchant category codes.</p><p style="text-align:left;margin-bottom:6pt;margin-left:23.25pt;"><span style="font-size:12pt;">·<span style="font-size:7pt;">&nbsp;</span></span>Monitor rejected (denied) purchase reports.</p><p style="text-align:left;margin-bottom:6pt;margin-left:23.25pt;"><span style="font-size:12pt;">·<span style="font-size:7pt;">&nbsp;</span></span>Require user input fields on transactions.</p><p style="text-align:left;margin-bottom:6pt;margin-left:23.25pt;"><span style="font-size:12pt;">·<span style="font-size:7pt;">&nbsp;</span></span>Perform periodic monitoring and data mining of p-card transactions.</p><p style="text-align:left;margin-bottom:6pt;margin-left:23.25pt;"><span style="font-size:12pt;">·<span style="font-size:7pt;">&nbsp;</span></span>Let people know when you find something. &nbsp;They need to know you are looking.</p><p style="text-align:left;margin-bottom:6pt;margin-left:23.25pt;"><span style="font-size:12pt;">·<span style="font-size:7pt;">&nbsp;</span></span>Ideally, link each individual transition to the general ledger to gain a comprehensive third-party spend view.</p><p style="text-align:left;margin-bottom:19.2pt;">We’ve also performed numerous data analysis programs around p-cards and have well developed processes using both visualization and transaction analysis techniques. Here are some of our recommendations (not comprehensive) for data analytic procedures within p-card programs.</p><p style="text-align:left;margin-bottom:6pt;margin-left:23.25pt;"><span style="font-size:12pt;">·<span style="font-size:7pt;">&nbsp;</span></span>Consider split transactions.</p><p style="text-align:left;margin-bottom:6pt;margin-left:23.25pt;"><span style="font-size:12pt;">·<span style="font-size:7pt;">&nbsp;</span></span>Consider potential matching or duplicative transactions.</p><p style="text-align:left;margin-bottom:6pt;margin-left:23.25pt;"><span style="font-size:12pt;">·<span style="font-size:7pt;">&nbsp;</span></span>Search for key words in the data.</p><p style="text-align:left;margin-bottom:6pt;margin-left:23.25pt;"><span style="font-size:12pt;">·<span style="font-size:7pt;">&nbsp;</span></span>Review activity by categories such as weekday, merchant category code, department, title, and cardholder.</p><p style="text-align:left;margin-bottom:6pt;margin-left:23.25pt;"><span style="font-size:12pt;">·<span style="font-size:7pt;">&nbsp;</span></span>Consider even dollar purchases.</p><p style="text-align:left;margin-bottom:6pt;margin-left:23.25pt;"><span style="font-size:12pt;">·<span style="font-size:7pt;">&nbsp;</span></span>Consider items with sales tax.</p><p style="text-align:left;margin-bottom:6pt;margin-left:23.25pt;"><span style="font-size:12pt;">·<span style="font-size:7pt;">&nbsp;</span></span>Flag and monitor particular vendor, cardholder, or merchant category code activity when appropriate.</p><p style="text-align:left;margin-left:23.25pt;margin-bottom:0.0001pt;"><span style="font-size:12pt;">·<span style="font-size:7pt;">&nbsp;</span></span>Review activity for frequency of cardholder usage, limit reasonableness, and spend against certain purchasing policy levels.</p></div>
</div></div></div></div></div></div> ]]></content:encoded><pubDate>Wed, 01 Jun 2022 21:17:00 +0000</pubDate></item></channel></rss>