Internal Controls for Restaurants
Regardless of an entity’s size, geographic location and complexity, the ability to manage operational, financial and compliance risk is a key ingredient to success. Effective oversight and process controls are essential to managing this risk and mitigating the negative impacts of fraud, unauthorized transactions and other violations of company policies and procedures. Below are some basic internal controls that even the smallest organization should implement to help prevent and identify high-risk behaviors.
Who is closing the restaurant each day and reconciling the night sales? Who is opening and making the morning deposit? Theft can occur when the same manager counts the drawer at night and makes the deposit the next day—quietly siphoning off cash. Restaurants should reconcile their daily deposit reports and compare these reports to both what is deposited in the bank and reports from the point of sale. They should also perform monthly bank reconciliations timely and without fail, and the person preparing bank reconciliations should not be the individual making deposits in the bank. Finally, restaurants should limit the number of employees with the authority to sign checks.
A common form of embezzlement involves a CFO, human resources manager or other payroll employee fabricating a fictitious employee, generating fraudulent payroll checks. To prevent this, restaurants should carefully consider the role of each employee and match access to the payroll system to their responsibility. Different responsibilities (setting up new employees, maintaining the system and generating checks) should be segregated among employees, and payroll registers should be reviewed before and after they are submitted to processing.
System administrator rights should be limited to an employee independent of the financial statement/accounting cycle, as employees with full system rights could override any segregation of duties in place. Management should also consider an annual review of each individual’s access rights to ensure that their rights continue to fit their job responsibilities.
Similar to payroll fraud, employees in the accounts payable function can set up new vendors, enter invoices and produce checks—and by extension, create fictitious vendors and misappropriate cash. Responsibilities should be divided among multiple employees wherever possible to reduce this risk.
Financial statement review
Many restaurant owners are focused on their income statements and pay little attention to their balance sheets. However, insufficient review of the balance sheet often leads to unexpected adjustments, which can affect the income statement and skew operational performance. To produce accurate financial information to facilitate better decision-making, restaurants should consider:
- Analyzing, reviewing and reconciling all accounts (specifically balance sheets) to the general ledger on a monthly and annual basis.
- Assessing the monthly reporting package, including documenting and signing off on all manual journal entry reviews by both preparer and reviewer.
- Implementing a balance sheet log that assigns responsibility for updates to one employee and reviewing entries to another.
Each location should be held accountable for operational and financial performance. The general manager, on a regular basis:
- Review payroll prior to processing. Do labor percentages look reasonable?
- Review and approve all store invoices. Is the store overpaying vendors? Is someone assigned to review pricing?
- Review and approve daily sales reports.
- Review inventory for completeness and accuracy. Does the store have a lot of waste? Are food costs too high?
- Ensure compliance with policies and procedures for human resource functions.
- Review the results of store performance for accuracy.
Once the store manager completes the review and approval process, the restaurant should send a financial package to the corporate office for another level of review.
Although proper segregation may not always be possible in smaller organizations, and companies cannot completely eliminate incidents of fraud, there are ways for restaurants to meaningfully reduce their risks.
Formal documentation of all policies and procedures, as well as employee training, are simple yet important steps restaurant executives can take to reduce their exposure and protect their businesses.
Have questions about internal controls for restaurants? Contact Giselle El Biri at firstname.lastname@example.org
, and be sure to keep up with the Practice's latest thoughts by following us on Twitter at @BDORestaurant