Internal Controls For Purchasing: Getting It Right

Developing and applying internal controls is a crucial part of building and maintaining a successful business. This is especially true for vital functions like purchasing, where waste, needless expense, and unnecessary risks can occur without proper controls in place.

By following a few best practices, you can implement effective purchasing internal controls that also leave room for flexibility and handling uncertainty.

You’ll be sure that your organization is following the required rules and regulations, and is ready for an external audit at any time.

What Are Internal Controls in Procurement?

Internal controls in procurement are policies and procedures that control how purchasing is done and what can be purchased. They define who can approve purchases, what suppliers can be used, what payment terms are acceptable, and more.

Ensuring the rules are followed for compliance with regulations and audits such as the AICPA’s SOC 1 audits audits for service organizations is also a key factor in internal controls.

Purchasing software can help organizations automatically enforce compliance and internal controls through built-in approvals and rules that must be adhered to in order for a purchase to go through.

When looking at internal controls in procurement from a compliance-first perspective, there are 5 components and 3 objectives that most organizations consider.

What Are the 5 Components of Internal Controls?

When preparing for an audit, it’s important to understand the 5 components of internal controls for purchasing. These components act as guideposts for SOC 1 compliance and are commonly used in financial audits for many industries.

Organizations should know what these are and be able to show them to auditors if asked. They include:

1. Control Environment

   How an organization enforces policies and procedures an organization uses to control purchasing. This component also considers how well the company follows these policies.

2. Risk Assessment

   How an organization identifies financial threats and assesses the risk they pose toward company objectives.

3. Information and Communication

   How management communicates to purchasers and other stakeholders what’s expected of them in following internal controls. This also includes ensuring that they receive acknowledgment and understanding of what’s being asked of them.

4. Monitoring Activities

   The way management oversees company spend, how they identify when things aren’t working properly, and what they do to fix these issues.

5. Existing Control Activities

   The current controls (policies and procedures) an organization has in place and how long they’ve operated for.

What Are the 3 Objectives of Internal Controls?

Along with 5 components, there are 3 objectives that audits such as the SOC 1 place high importance on. These objectives address how a company is executing and reporting on its internal purchasing control policies and procedures. They include:

1. Operations

   Ensuring that internal controls are operating effectively and achieving what they’re expected to.

2. Reporting

   Providing financial reporting both internally and to clients that verify the organization is operating the way it’s expected to operate.

3. Compliance

   Defining the laws and regulations that must be adhered to and showing proof of compliance. Companies should be able to show that both they and the companies that rely on them as a supplier are in compliance.

Why Are Purchasing Controls Important?

Without internal controls for purchasing, you’ll be at a greater risk of failing financial audits.

Internal controls ensure you’re properly tracking expenditures and staying up to date with supporting documentation and financial statements—all of which are important during audits.

From reducing fraud risk to stopping wasteful spend, purchasing controls are important for a multitude of reasons.

• Ensuring Audit Compliance

  Without internal controls for purchasing, you’ll be at a greater risk of failing financial audits. Internal controls ensure you’re properly tracking expenditures and staying up to date with supporting documentation and financial statements—all of which are important during audits.

• Reducing Risk

  Along with ensuring compliance, reducing fraud risk and financial waste are the primary drivers for developing purchasing internal controls. In fact, the Association of Certified Fraud Examiners (ACFE) 2020 Report to the Nations found nearly 33% of fraud can be directly contributed to a lack of internal controls.

• Eliminating Financial Waste

  Ensuring that purchases are reviewed properly makes it much more difficult for wasteful purchases to slip through.

• Defines the Processes Staff Need to Follow

  Having well-defined controls stops staff from being confused about what they can and can’t purchase, and what they need to do when making a purchase.

• Improves Operational Efficiency

  Adhering to purchasing controls helps teams ensure that they are spending within their budgets and operating with efficiency.

• Maintains Segregation of Duties

  Purchasing controls define roles within the review and approval process so that no one person has too much control over a company’s spend.

• Improves Accountability

  In formalizing your purchasing procedures and creating these controls, you also improve accountability and generate more effective, audit-friendly data trails.

  Like accounts payable internal controls, purchasing internal controls are a risk management system (complete with contingencies) and not a series of unbreakable rules. Having flexibility with your controls ensures you’re not sacrificing competitive advantage when opportunities or struggles arise.

From vendor selection and management to contract negotiation and actual purchasing authority, having clear and consistent policies helps streamline your workflows.

What Are the Best Practices for Purchasing Internal Controls?

When it comes to internal controls, no two organizations have the same needs. Small businesses are more likely to focus on things like separating personal finances from business finances. Meanwhile, a large corporation is more likely to be on the watch for invoice fraud.

However, businesses of all sizes can benefit from following best practices when setting up purchasing internal controls. These best practices include:

• Put the Right People in Charge of Purchasing Controls

  Small business owners may find themselves wearing this hat along with their main duties. In larger organizations, choosing an individual or team to handle purchasing controls makes sense.

  You can choose a responsible purchasing team member or have them share the responsibility collectively.

  It’s important to choose wisely because this person or team will handle controls for:

  • Managing inventory.
  • Vendor selection, management, and relationship development.
  • Contract negotiation and management.
  • Purchasing best practices, including payment methods, approved buyers, and formalized approval workflows.
  • Collaboration with accounts payable and integrating purchasing data with the accounting system.

• Develop a Formal Purchasing Policy

  From vendor selection to purchasing approvals, having clear and consistent purchasing policies helps streamline your workflows. It also improves accountability, ensures your team is following the same guidelines and protects against rogue spending and fraud.

  Don’t overlook the importance of contingencies for critical processes, especially approval workflows and areas of the supply chain that maintain production and day-to-day operations. Planning ahead can ensure you’re ready to react quickly and efficiently when things take a turn for the worse.

  Documenting these policies in your procedures manual helps support ongoing compliance, accountability, and process auditing.

  Additionally, you can enforce these policies through purchase order software that enables you to set and streamline approval flows and allow purchases only through preferred suppliers.

• Segregation of Duties

  Keep purchasing tasks separated by capability and responsibility to ensure no single person has total control over purchasing activities. This avoids conflicts of interest, preserves accountability, and supports transparency.

  Make sure different people are in charge of:

  • Purchase approvals.
  • Receiving goods.
  • Invoice payment approvals/disbursements.
  • Bookkeeping/financial records management.
  • Inventory management.

  Failing to split these duties can lead to unauthorized purchases, fraud, unauthorized charges, and avoidable expenses from duplicate payments and chasing exceptions.

• Choose the Right Purchasing System

  Globalization has created a competitive global marketplace for businesses large and small. Due to this, every procurement process—from purchase requisitions to vendor management—needs to be optimized for accuracy and speed.

  Planergy’s purchasing software makes it easy for your purchasing departments to create, implement, and enforce internal controls. Teams can create controls for the approval process, suppliers, permissions, and more in order to meet standards while still allowing for contingencies and manual intervention if necessary.

  Good procurement systems have features like cloud computing, deep data analytics, robotic process automation, machine learning, and more. They make it possible for your purchasing department to:

  • Create data transparency for all transactions.
  • Eliminate human error and costly delays by automating time-consuming tasks such as data entry from approval workflows.
  • Create a closed buying environment where purchasing agents are automatically presented with approved vendors and pre-negotiated pricing terms and conditions.
  • Gain full control and visibility over all purchasing methods—from POs to credit cards.
  • Develop contingencies for all workflows, including approvals, so purchasing processes never get stuck.
  • Streamline processes such as requisitions and invoice approvals to be faster, more accurate, and complete. When supplier invoices are paid in a timely manner, purchasing teams are able to capture early payment discounts and avoid late payment penalties.
  • Create a connected software environment that integrates systems like accounting, ERP, marketing, and sales into the procure-to-pay system.
  • Make more strategic sourcing decisions based on complete purchasing information that’s automatically captured.
  • Create more robust and accurate financial reports that enable teams to make better financial decisions faster.

• Educate Your Team

  Purchasing policies, and the software that helps implement them, aren’t effective when people don’t know how to use them. Without proper training, team members are more likely to find workarounds that violate policies and controls.

  Ensure that everyone who’s involved with purchasing—from the CFO to the administrative assistant—knows the policies and controls and how to follow them by using the purchasing system. When everyone is trained properly, they’re much more likely to stick to these controls; which means your goals are more likely to be met.

  Always introduce new policies before they’re implemented and invest in training before, during, and after implementation to make sure everyone’s comfortable with the controls you’ve developed.

• Audit Controls Regularly

  As a company evolves, so should its purchasing controls, which is why it’s important to regularly do a thorough review of purchasing internal controls. The goal of this audit should be to make sure that the controls are still the right fit for the company.

  If controls aren’t working in a changing business environment, employees may try to circumvent them to purchase what they need. This leads to rogue spending and makes it more difficult to stay on track with budgets and preferred suppliers.

  Auditing purchasing internal controls can be part of a larger procurement internal audit program . An audit program helps procurement teams identify areas for improvement, ensure they’re meeting industry standards, reduce fraud risk, and of course ensure that internal purchasing controls are meeting company needs and being complied with.

Control Over Purchasing is an Investment Worth Making

Setting clear and effective internal controls over purchasing processes helps your business is a surefire way to minimize waste and maximize performance.

Investing time and resources to develop and implement these controls is always worthwhile. With help from the right software solution, any organization can create an optimized purchasing function that has automatic controls and policies built-in—generating value, rather than waste, for your organization.

Control rooms are vital for organizations to efficiently and effectively monitor multiple information streams and make accurate mission-critical decisions. With an ever-increasing number of content sources and applications to manage, in addition to collaborative information integration needs, today’s control rooms need to enable system management that is efficient and cost-effective, while at the same time offering maximum operator comfort.

Whether it’s for monitoring, decision-making, responding, controlling, collaborating, or communicating, control room solutions are an essential component to daily operations, allowing for more efficient work and better decision-making. Power plants can benefit from control room solutions in a number of ways: in their process facilities; for surveillance; in facility situation rooms; for command and control; for traffic management; and for broadcasting distribution monitoring (Figure 1).

1. Power plants can benefit from control room solutions in a variety of ways, helping operators work more efficiently and make better decisions. Rows of monitors visible from multiple workstations enable several workers to have input simultaneously on operations. Courtesy: ATEN Technology

In utilities and process control centers, operators continuously monitor and control constant flows of manufacturing, industrial control process, infrastructure/equipment status, and the dynamic change on demand to guarantee production and distribution in the best possible way. The challenges include providing an integrated real-time overview of process flow and equipment status for better situational awareness and decision making, along with a flexible and ergonomic system deployment for efficient yet managed access to devices. Information integration and visualization are especially important in these scenarios—from detailed network distribution information to topological overviews of the service area—in addition to redundancy/backup support to ensure continuous operations.

Control Room Trends

Control room operators are increasingly leveraging Internet Protocol (IP) networking technology. Utilizing “over IP” technology in control rooms for video, audio, and control data distribution and extension offers more flexibility and scalability for centralized or distributed control room operation. In control room scenarios, the migration from direct-connected systems to those that make use of IP networks has had various advantages—mainly, that controllers can configure connectivity architecture and the overall size of the KVM (keyboard, video, mouse) installation based on specific requirements, and systems can be designed to accommodate large distances, high performance, and varying levels of system redundancy and resiliency.

The major benefit of IP-based KVM in the control room is almost limitless scalability and flexibility. An IP-based KVM system also provides more extension options beyond traditional keyboard-monitor-mouse, including server sharing, video extension, and multicasting. For these reasons, IP-based control units mean you can upgrade your IP management efficiency by increasing productivity and reducing operational costs.

Related articles:
Ceramic Brake Pad: Enhancing Performance and Safety
How to Choose the Right TPE Car Mat?
Electric Golf Carts: Features and Benefits
Guide to Choosing and Using a Vehicle-Mounted ATV Winch
Is An Electric Scooter Worth Buying?
What is the best brand of tires for a pickup truck?

IP-based solutions that utilize TCP (Transmission Control Protocol)/IP for the communication protocol allow control room operators to monitor, access, and troubleshoot control room assets from any networked computer. This also means that image data from secondary sites or anywhere else on the network can be displayed on the main control room video wall, enabling a faster response to mission-critical emergencies.

Visualization and information integration also are increasing in importance. Monitoring and sharing the ever-expanding amount of video and data streams are essential for control rooms. High-quality video performance with the best resolution available makes possible rapid analysis of evolving situations and real-time decision-making (Figure 2).

2. Control rooms that offer the ability for workers to monitor and share large amounts of video and data enable more rapid analysis of evolving situations, along with the ability for real-time decision-making and collaboration. Courtesy: ATEN Technology

Display solutions extend from desktop screens for operators to large-size video walls for better collaboration, while multiple displays at workstations help operators visualize more information and improve operation. The importance of visualization and information integration for monitoring and decision-making in a control room environment has crucial implications for a system’s video quality and content distribution capabilities. In scenarios where video walls must be operational 24/7, solutions must allow for high-performance processing that enables video signals to be converted and scaled to meet display requirements—single, dual, or multi-screen display formats—at resolutions up to 4K. And with multiple video and data sources connected to the system, it should also be possible to create individually tailored video wall solutions that deliver high-quality resolution images to all displays in the control room in any configuration.

Control room operators perform a demanding role in monitoring and controlling complex systems, where the consequence of error is potentially devastating. Ergonomics are therefore optimized to minimize the risk of human error and maximize performance and efficiency. A more ergonomic design (Figure 3) results in a better workflow and device management. Call it intuitive access and control.

3. This control room looks futuristic, and it’s a showcase for ergonomic design. The workstations are positioned for clear sightlines of the large video monitor at the front of the room, while enabling easy visualization of multiple desktop monitors in a larger and more open workspace. Courtesy: ATEN Technology

In addition to extending hardware lifecycle and performance reliability by locating machinery away from operators in ideal environmental conditions, it is imperative to consider the operators themselves. Control and peripheral equipment should be located optimally, and displays should be angled for comfort and ease of viewing.

More importantly, access to controls should be intuitive to create an environment that enables operators to stay alert and in control so that when incidents do occur, responses can be instant and appropriate resources can be immediately deployed. For these reasons, operator workspace and control solutions that enable multiple computer desktop workflows are the way forward.

Utility Company Use Case

A state-owned power distribution company was looking to redesign and upgrade its large-scale dispatch control center to centrally monitor and manage dual-display and single-display high-performance workstations. Additionally, it needed to incorporate a KVM solution for up to 96 communication control servers for use by the internal IT staff.

Their challenges included:

■ Integrating multiple single and dual-view high-performance workstations distributed across different areas of the power distribution system.

■ Providing local and remote data center access from the communication control department to the dispatch center and remote access from outside the building by the internal IT staff.

■ Allowing desktop monitor to video wall switching for 2-D visualization of the power grid and geographic information.

■ Ensuring the flexibility to add users and high-performance workstations on the fly.

■ Including backup/redundancy software options to avoid downtime.

Utilizing ATEN’s KE Matrix Management Software (CCKM), a DVI Dual Display KVM over IP Extender, and a 32-Port Cat 5 KVM over IP Switch with Virtual Media, the integrator was able to utilize the power distribution company’s existing network infrastructure to provide remote access, monitoring, and management capabilities, and extended control of both single and dual-view high-performance workstations. Users can now access and manage the company’s communication control servers remotely when away from the office or over the local network, allowing them to be more efficient in their daily routines, minimize downtime, and quickly respond to issues as they arise.

Additional control room solutions could include:

■ Control and operation

■ KVM over IP matrix system

■ Desktop multi-view KVMP switch

■ KVM extenders

■ USB extenders

■ Matrix management software

■ Video wall

■ Modular matrix switches with video wall processor

■ Video distribution

■ Video splitters

■ Wall plates

■ HDBaseT video extenders

■ Fiber video extenders

Control Room Solution Advantages

When contemplating control room changes, selecting the technology, vendor, and integrator are obviously important. However, the following aspects should also be considered:

■ Seamless AV and IT Integration. The convergence of audiovisual (AV) and IT is already evident in many control room solutions. Look for experts who leverage IT/IP technologies as a way of connecting AV and server/device-room components, integrating information for collaboration, and facilitating responsive operations and crucial commands. The solutions offered should provide unlimited scalability, utilize space efficiently, and include re-deployable architecture. The solution should also allow for advanced, interactive, single sign-on management of the whole system, and should be able to leverage existing infrastructure and equipment, or at the very least, the tools to integrate with disparate systems.

■ Ergonomic Approach. Control room solutions should be designed to merge into operator-focused environments that will minimize the risk of human error and maximize performance and efficiency. For example, over IP solutions allow operators to be separated from devices, while safe, secure, remote access is made easy, and desktops and servers are made clutter-free and centrally manageable. Easy-to-navigate graphical user interfaces for convenient, intuitive configuration and operation should be standard.

■ Visual Excellence. This is not referring to an aesthetically pleasing product on the outside (though that’s always nice), rather, the component capabilities must be first-rate. For collaboration-heavy deployments, look for solutions that deliver high-performance image quality to multiple display video walls (Figure 4), as well as to desk console stations for mission-critical operations. Integrated information and visual details in resolutions up to 4K allow for more accurate monitoring, contact collaboration, and proper responses for situations that have an ever-increasing number of sources, authentication mechanisms, and applications to control.

4. Power plant operations require collaboration, and it’s important to deliver high-performance image quality to multiple display video monitors. The integration of information, along with visual details in resolutions up to 4K, allow for more accurate monitoring, contact collaboration, and proper responses for situations that have an ever-increasing number of sources, authentication mechanisms, and applications to control. Courtesy: ATEN Technology

■ Security and Reliability. Solutions should provide secure, reliable access to any system across multiple security domains 24/7 (Figure 5). Adjustable authority levels, encrypted communication and log-ins, virtual media data encryption, and vital rapid failover/backup support for systems and operation, from local and offsite, should be available.

5. Power plant operators increasingly know the value of security in their facilities. Systems need to be secure, with adjustable authority levels, encrypted communication protocols and data, and rapid response backup support. The ability to monitor all systems from a central location should enhance plant security and increase operational efficiency. Courtesy: ATEN Technology

■ Flexible Deployment and Management. Solutions should be easily managed and controlled, either remotely or locally across the end-users entire IT infrastructure. Recommended features include flexible authentication, secure access, and instant response.

Overall, seek a partner that understands the increasing complexity of control room requirements and provides end-to-end design and manufacturing, with the goal of increasing security and improving operator efficiency within the control room. Additionally, by building an intelligent, secure, and collaborative control room environment, mission critical systems will be accessible in real-time with the ability to handle mission critical emergencies from any location.

Considerations for Control Room Implementers

Accounting for control room infrastructure technology developments, such as the migration to digital video and advances in computing devices, can often involve great complexity in terms of combining all these requirements to provide flexible information display and user access. Implementing solutions in control rooms requires a sound knowledge of current and future developments in not only network connectivity and multiple IT system management, but also in how the integration of computer operations/control and audio-visual systems (Figure 6) can account for the need for essential decision-related content being available in remote spaces.

6. Network connectivity, enabling management of multiple IT systems, is among the developments that can be employed in today’s control rooms. Networks aid in the integration of computer operations and control, audio-visual systems, and other applications that can enhance efficiency. Courtesy: ATEN Technology

As control rooms are a fast-paced, high-pressure environment with a myriad of technological challenges, meeting these challenges efficiently requires a certain level of technical expertise. System integrators are required to consider many different aspects—solution components need to be reliable, manufactured for quality, and secure—but, along with build quality, the solutions themselves should also ideally provide future-proof infrastructure and investment protection, in addition to guaranteeing network safety and improving operator workflows.

What is needed are control room solutions that provide a networked distributed collaboration system that considers the complexities of signal distribution, the connectivity of both physical and virtual servers, data visualization, professional video walls, intuitive workflows, and operator controls. ■

—Aaron Johnson is a senior product manager at ATEN Technology Inc.
(www.aten.com/us/en/).