Processes outgrow their controls
A control built for six people and one bank account is still in place at forty people and four entities. It has not failed yet, which is not the same as working.
Tax service
Internal controls & tax risk
Most tax problems are process problems wearing a tax costume. Our managing partner is a Certified Internal Auditor: we fix the process, not just the return.
The problem
Controls decay quietly
They are designed once, for a business that no longer exists, and nobody re-tests them until something goes wrong.
Procedures get bypassed
Not maliciously, because the approved route is slow and a workaround is faster. Over time the workaround becomes the actual process.
Documentation is thin
The position was correct and the reasoning was sound, but nothing was written down. Three years later, at examination, that is indistinguishable from having no position at all.
What we do
What we review and build
An internal audit approach applied specifically to the processes that produce your tax filings.
- Control environment assessmentSegregation of duties, approval thresholds, system access rights and the actual (not documented) flow of a transaction from order to filing.
- Tax risk registerEvery material tax position identified, rated by likelihood and impact, with an owner and a substantiation standard attached to each.
- Month-end close disciplineA close calendar with defined reconciliations and sign-offs, so the year-end trial balance is a product of process rather than of February heroics.
- Documentation standardsWhat has to be retained, for how long, and in what form to support each position if it is examined years later.
- Cash and disbursement controlsDual authorization, vendor master file maintenance, and the payment controls that prevent both fraud and the misclassification that follows it.
- Systems and data integrityChart of accounts design, mapping between operating systems and the general ledger, and the reconciliations that catch a break early.
- Remediation and re-testFindings ranked by risk with practical fixes sized to your team, then re-tested after implementation to confirm they actually hold.
How it works
A process you can follow
Four stages, with a defined deliverable at each one. You always know where the work stands.
1
Walk through
We follow real transactions end to end and observe what actually happens, rather than reading a procedure manual.
2
Test
Sample testing on the controls that matter most, to establish whether they operate as described.
3
Report
Findings ranked by risk, each with a specific, proportionate remediation, not a generic best-practice list.
4
Re-test
After implementation we test again, because a control that was never verified is an assumption.
Who it's for
When this is worth doing
Usually after growth, after a scare, or before someone external starts looking closely.
Post-growth or post-acquisition After a notice or examination Preparing for a sale or raise Lender or bonding requirements Multi-entity groups Firms with high finance turnover Businesses with a fraud concern
Deliverables
What you get
- A documented process map of how transactions actually flow today
- A tax risk register with owners, ratings and substantiation standards
- Findings ranked by risk with proportionate, specific remediation
- A close calendar and reconciliation checklist your team can run
- A re-test after implementation confirming the controls hold
CIA
Certified Internal Auditor–led review
4
Common failure patterns tested explicitly
2
Passes: findings, then re-test
Questions
Frequently asked
Small businesses need controls more, not less, because there are fewer people to catch an error and often no separation between the person who records a transaction and the person who authorizes it. The controls should be proportionate: for a ten-person business that might be four or five specific practices, not a manual. The point is that they exist and are actually followed.
A financial statement audit gives an opinion on whether your statements are fairly presented, and only an independent firm that does not otherwise serve you can perform one. This is advisory work: we look at how your processes create tax risk and help you reduce it. It is not an audit, produces no opinion, and is designed to be useful rather than to satisfy a third party.
Four recur constantly: controls that became outdated as the business grew, procedures that are routinely bypassed because they are slower than the workaround, documentation habits that were never established, and no clear accountability for who owns a control. Almost every issue we find maps to one of those four.
Minimally. Most of the work is walkthroughs and sample testing, which typically means a few hours of your finance staff's time spread across a couple of weeks. We deliberately size remediation to the team you have. A recommendation that requires two more people is not a recommendation, it is a wish.
Related
Often paired with
Outsourced Accounting & CFO
Books, close and reporting your advisors can rely on.
Learn moreIRS & State Audit Representation
We deal with the examiner so you can run the business.
Learn morePayroll & Employment Tax
Forms 941, 940, W-2 and reasonable-compensation support.
Learn more