Strong internal controls can help minimize losses

by | Sep 24, 2021


Thisarticle was originally published on March 13, 2017 and has been updated.

The multimillion dollar construction project was so large, it had its own accounting department. This system appeared to work until the 18-month project was completed and the owners found that a number of line items had gone over budget. This prompted an internal investigation to understand where things had gone wrong.

Red flags were raised when a thorough examination found that, while invoices had been paid, some checks were missing from the project files. The company’s bank provided copies of the checks, which revealed that a number of double payments had been made. Many of the accounting functions associated with the project were performed by the project controller. The checks—which had been prepared manually—had been altered by the project controller and deposited into his own account.  

As outrageous as it sounds, this problem is not uncommon for construction companies. According to a 2020 Association of Certified Fraud Examiners (ACFE) report, billing and payment fraud combined account for nearly 39 percent of reported incidents victimizing construction companies; for the industry, these types of schemes are second only to corruption. Yet many small and midsize construction companies do not have the internal controls in place to prevent, detect and respond to such events. 

The result can be catastrophic, especially for companies running on thin margins. The median loss for all cases in the ACFE study was $200,000; nearly one-quarter lost $1 million or more. There are, however, a number of steps that companies can take to help avoid unintended losses that results from error or outright fraud. 

Trust but verify

It is not enough to hire trustworthy people. Humans can make mistakes; errors as simple as the misapplication of costs, improper cost tracking or simple omissions can lead to lost profits. Even the most dependable employee—given the right motivation, opportunity and rationale—can be tempted to take funds from an employer. 

According to the ACFE, over 30 percent of all companies where fraud was discovered had very few internal controls in place. This is an important finding, as the report notes that only 12 percent of small businesses detected fraud by internal audit and only 8 percent by account reconciliation. Nearly one-third relied on tips to detect fraud at their companies. 

In fact, the ACFE noted that companies with strong internal controls reported median losses that were 54 percent lower than peers without those detection tools, while detecting fraudulent activity twice as fast.  

The key is to support qualified employees with internal controls that mitigate the risk of error or fraud. For example, any time an offline, manual process is introduced—using a spreadsheet for calculations, for example—errors can occur. This can make companies vulnerable. While automation may not always prevent loss, it can help avoid human error. 

On the other hand, a simple adjustment could have prevented the controller in the scenario above from the opportunity to defraud the company. Rather than have one person prepare and send the checks, segregating these duties among more than one person could have prevented the loss of millions of dollars. 

Consistent themes and COVID-19 impact

Leading up to the pandemic, the ACFE identified that the following fraud trends have been constant:

  • Organizations continue to lose about 5% of revenue to fraud each year
  • Asset misappropriation is the most commonly identified scheme
  • Tips are the best method of detection
  • The longer fraud goes unchecked, the higher the median loss

With COVID-19, fraud continues to increase.  While cyber fraud has become the biggest threat, companies indicated that the coronavirus has made it even more difficult to prevent, detect and investigate all types of fraud.  Travel restrictions, working remotely and a lack of access to evidence exacerbate the consistent themes noted above.  Anti-fraud professionals indicate that a remote workforce has led to challenges with oversight, interviews and changes in controls.

What companies can do

Here are some steps that construction companies can take to reduce the impact of error and fraud:

  • Establish internal controls: Active controls that seek out fraud can significantly limit the losses incurred through illegal activity. Controls include a range of activities, from surveillance and monitoring to internal audits and management reviews.
    • When selecting contractors through a non-competitive bidding process, use an evaluation committee with objective members.
    • Segregate duties to ensure that access to sensitive information or the level of approval authority is limited, as appropriate.
    • Delegate more oversight to a board audit committee, which can flag and address any potential override activity. Among reported frauds, 20 percent involved overrides of existing internal controls. This can be an especially challenging for small and midsize companies, since fraud typically involves a senior leader with the ability to work around these checkpoints.
  • Enforce controls: The most effective way to minimize fraud losses is to prevent them from occurring in the first place. An anti-fraud culture means communicating the importance of prevention, enforcing the procedures, and providing the support and training needed to do so.
  • Audit contractors throughout a project: Management should make sure all negotiated costs and contracts include a right-to-audit clause, enabling the construction company to conduct an on-site examination of the vendor’s books and records in case fraud or a violation of policy has occurred. Internal audits should be conducted by experienced members of the internal audit staff or outsourced to auditors with experience in construction audits.
  • Set up a hotline: Although a somewhat passive approach, tips gathered through a hotline or similar method can have a substantial impact on fraud detection. While effective, a hotline should only be part of a comprehensive internal controls approach.
  • Test the system: When a construction company has implemented its internal control system, management should consider testing it for possible holes. In addition to an external audit of controls and financial reporting, if a company suspects or becomes aware of potential fraudulent activity, management should consider launching an internal investigation or hiring an outside firm to handle the task. Tests should be performed annually and not taken lightly.
  • Continuously adapt and update controls for the remote environment:   It is imperative for all companies to view fraud prevention as an iterative process.  Monitor changes in personnel, procedures and most importantly fraud risks.  Adjust controls accordingly to address an ever-changing environment, even beyond the current pandemic.

Internal controls cannot eliminate errors or fraud entirely; anti-fraud controls significantly lower losses and speed up detection but do not always prevent fraud from occurring. The ACFE study noted, however, that the most prominent organizational weakness contributing to fraudulent activity was the lack of internal controls. And whenever humans are involved, errors will always occur. With financial and reputational risks at stake, construction company stakeholders will want to do everything they can to minimize those risks.

Questions or Want to Talk?

Call us directly at 972.221.2500 (Flower Mound) or 940.591.9300 (Denton),
or complete the form below and we’ll contact you to discuss your specific situation.

This article was written by Steve Kirn, Brian DiPaola and originally appeared on 2021-09-17.
2021 RSM US LLP. All rights reserved.

RSM US Alliance provides its members with access to resources of RSM US LLP. RSM US Alliance member firms are separate and independent businesses and legal entities that are responsible for their own acts and omissions, and each are separate and independent from RSM US LLP. RSM US LLP is the U.S. member firm of RSM International, a global network of independent audit, tax, and consulting firms. Members of RSM US Alliance have access to RSM International resources through RSM US LLP but are not member firms of RSM International. Visit for more information regarding RSM US LLP and RSM International. The RSM(tm) brandmark is used under license by RSM US LLP. RSM US Alliance products and services are proprietary to RSM US LLP.



KHA Accountants, PLLC is a proud member of RSM US Alliance, a premier affiliation of independent accounting and consulting firms in the United States. RSM US Alliance provides our firm with access to resources of RSM US LLP, the leading provider of audit, tax and consulting services focused on the middle market. RSM US LLP is a licensed CPA firm and the U.S. member of RSM International, a global network of independent audit, tax and consulting firms with more than 43,000 people in over 120 countries.

Our membership in RSM US Alliance has elevated our capabilities in the marketplace, helping to differentiate our firm from the competition while allowing us to maintain our independence and entrepreneurial culture. We have access to a valuable peer network of like-sized firms as well as a broad range of tools, expertise, and technical resources.

For more information on how KHA Accountants can assist you, please call 972.221.2500.

Which Game are You Trying to Win?

Navigate the tricky crossroads of sports and business with KHA Strategic Consultants as we shed light on the key to defining success in your organization. Drawing parallels from football, we discuss the importance of focusing on the right metrics – not just the convenient ones…

Bakes Takes Volume 1, Issue 4

Join Jonny Baker in his monthly roundup of must-read articles for leaders, featuring insights on leadership team reinvention, effective learning strategies, and the true drivers of job satisfaction. Dive in to explore these perspectives and equip yourself with new strategies for creating vision, alignment, and execution in your team.

Pulled in Too Many Directions?

Ever wonder why you’re constantly solving problems, yet your business is not growing? Read this parable about a gardener which illustrates the dangers of losing sight of what’s really important.

Are You Prepared for Battle?

Resources are limited, time is short, and enemies are real. To win the war in your market, you need to know yourself. Learn how to redefine your business strategy for today’s competitive landscape through KHA’s Dynamic Business Advising.

Bake’s Takes Volume 1, Issue 3

In this month’s Bake’s Takes, Jonny Baker explores the shift in leadership dynamics and the value of unleashing employee creativity. Baker discusses the need for a daring, contrarian mindset for breakthroughs and the power of asking the right questions. Gain insights from his top three recommended reads to navigate the complexities of change and strategic management.

Where Do I Look?

Ever felt like finding a solution to your business problem is like finding a needle in a haystack? Just as a needle is found by stepping back from the haystack, let KHA Strategic Consultants give you the outside perspective to find your answers. Contact us today for an objective assessment of your business and a proven path to success.