By Kelly Horn, Senior Fiscal Consultant

Why Internal Controls Deserve More Attention

Internal controls often don’t get the attention they deserve…until something goes wrong. Vendor payments are sent to a fraudulent account, payroll errors result in inaccurate payments, or a trusted employee is discovered to have been quietly misappropriating funds for years. By that point, the question isn’t “What happened?” but “How did we miss it?”.

Today’s environment comes with a growing list of risks: cybersecurity threats, compliance complexities, increasingly savvy fraudsters, and the ever-present challenges of stretched resources (including staff) and increased public scrutiny. When controls are weak or ignored, the consequences are serious:

• Financial loss or misstated financial reports
• Disrupted operations
• Legal headaches
• Damage to reputation

As we’ve learned from multiple high-profile examples over recent years, strong internal controls aren’t just a “best practice,” they’re your best safeguard against financial surprises, fraud, and operational disasters.

Internal Control Breakdowns: Real World Examples

Local governments across the country have faced significant losses due to gaps in internal controls. Here are a few real cases:

• Vendor “Spoofing:” A convincing but fraudulent email sent to accounts payable staff requests a change to a vendor’s banking information. Without verifying the request through a known contact at the vendor, preferably by phone, staff members update the payment details. Payments are then mistakenly sent to the scammer’s bank account. This is increasingly common yet easily preventable with the proper procedures in place.
• Ghost Employees & Vendors: When one person controls vendor or payroll setup and processing, fictitious names can be added and paid undetected. Proper segregation of duties and independent review would have blocked these schemes.
• P-Card Abuse: An employee with purchasing authority and no oversight approved their own transactions, accumulating $1.3 million in printer toner purchases which were later resold online.
• Fake Contracts & Invoices: A staff member created a fraudulent contract and submitted monthly invoices. With no vendor verification, budget checks, or invoice approval process, it went unnoticed for months.
• ACH & Wire Fraud: Unauthorized transfers of governmental funds have been made when dual approvals were not required.

Common Internal Control Weaknesses

In many of the examples above, the opportunity for fraud existed because a single employee could initiate and execute an entire financial process without involvement or oversight from anyone else, violating one of the most basic principles of internal controls, segregation of duties.  Below are common internal control weaknesses, how you can identify them in your organization, and  action steps you can take to mitigate risk.

These weaknesses are not always the result of negligence; they often stem from limited resources (including a limited number of staff) or legacy processes and systems that haven’t kept pace with the ever-evolving risk landscape.

What Local Governments Can Do Now

Even with limited resources, local governments can take meaningful steps to strengthen internal controls:

• Separate Critical Functions
  Divide authority, recordkeeping, custody, and reconciliation, especially in finance and HR.
• Implement Dual Approvals
  Require two levels of approval for high-risk items like ACH transfers, refunds, and payroll changes.
• Require Council or Board Oversight
  Significant contracts and spending should be formally reviewed and approved.
• Train Staff
  Provide regular training on internal controls, fraud awareness, ethics, and cybersecurity.
• Leverage Technology
  Automate reconciliations, utilize workflow approvals, use financial software to flag anomalies, and set alerts for unusual or unexpected transactions.
• Implement Internal Audits or Spot Checks on controls
  Follow up when controls are not properly designed or implemented.

Strong Controls, Stronger Communities

Internal controls aren’t glamorous, but they’re your first line of defense. They help prevent fraud, ensure accuracy, and support strong institutional oversight. But just as importantly, they build public confidence that local governments are managing resources responsibly and ethically.

Whether your organization is revisiting long-standing processes or establishing new and improved controls, every enhancement helps reduce risk and strengthen your organization’s operations.

Required Disclosures: Please Read

Ehlers is the joint marketing name of the following affiliated businesses (collectively, the “Affiliates”): Ehlers & Associates, Inc. (“EA”), a municipal advisor registered with the Municipal Securities Rulemaking Board (“MSRB”) and the Securities and Exchange Commission (“SEC”); Ehlers Investment Partners, LLC (“EIP”), an investment adviser registered with the SEC; and Bond Trust Services Corporation (“BTS”), holder of a limited banking charter issued by the State of Minnesota.

This communication does not constitute an offer or solicitation for the purchase or sale of any investment (including without limitation, any municipal financial product, municipal security, or other security) or agreement with respect to any investment strategy or program. This communication is offered without charge to clients, friends, and prospective clients of the Affiliates as a source of general information about the services Ehlers provides. This communication is neither advice nor a recommendation by any Affiliate to any person with respect to any municipal financial product, municipal security, or other security, as such terms are defined pursuant to Section 15B of the Exchange Act of 1934 and rules of the MSRB. This communication does not constitute investment advice by any Affiliate that purports to meet the objectives or needs of any person pursuant to the Investment Advisers Act of 1940 or applicable state law. In providing this information, The Affiliates are not acting as an advisor to you and do not owe you a fiduciary duty pursuant to Section 15B of the Securities Exchange Act of 1934. You should discuss the information contained herein with any and all internal or external advisors and experts you deem appropriate before acting on the information.