I asked the City of Quincy, Massachusetts CFO Eric Mason his thoughts on the numerous failures of financial controls in organizations popping up across the country and how he prevents that from impacting his own team.
Here’s what Mason had to say.
ERIC MASON: Well, we are under FBI investigation right now for one of our directors [of retirement services]...
But what I will say is there is no financial control that stops crime. You can’t have a control that stops murder. It’s about detection. It’s about creating a two-party process. But, that doesn’t stop everything. If you have somebody who stole a password, even that could be problematic.
If your systems are so vulnerable that someone can access it without committing a crime, then your controls are a failure. At the end of the day, people commit crime. People steal, people put their hand in the till. We need to be able to detect that before it ever becomes material. I believe it’s about redundancy in the application of checks and balances.
This process of internal checks and balances is what prevents any type of fraud in our finance team. We have a CFO, a director of accounts, we have a treasurer, and we all have different responsibilities. I can approve a purchase order, but I can’t process an invoice. Our treasurer, who wires all the money around, doesn't have access to our ledger. We’ve built this little triangle of defense from this sort of thing happening.
We have open communication between us. One thing that has always scared me is these monolithic cultures that exist in some government, when you have a treasurer or CFO or someone who has been in their same position for 30 years. Things like that give you a chance to manipulate. In some businesses, that style of financial leadership is very common, and then can put more pressure on people to be coerced into doing something.
Here, we understand that we would rat each other out in a heartbeat. My treasurers have always been some of my favorite people, but I always say that if someone at my job was most likely to punch me in the throat, it would be them. That’s how you have financial security and strong internal controls.
This editor’s note is part of a multi-part Q&A. Read part one here and part two here. View the homepage for the series here.