Troberg Stores Case Study
1. A business’s internal control process should address its need to comply with relevant state and federal statutes. Internal control is an integral component of an organization. It is management's job to maintain an effective control system that provides reasonable, but not absolute assurance for effectiveness and efficiency of operations, reliability of financial reporting, and compliance with applicable laws and regulations. According to the EPPA act employers are required by law to post notices summarizing the protections of the act in workplace areas. If certain laws and regulations such as the EPPA Act are required to be posted in workplaces areas then management’s internal control process need to comply with applicable laws and regulations. In order to stay compliant with relevant laws and regulations management can consult an advisor.
2. Below are policies and procedures used by stores to maintain control over checkout stand operations and the control object:

a) Provide a receipt for every transaction. Encourage customers to expect a receipt by posting signs at each register. i) This ensures that the cashier is not over charging the customers. ii) The cashier is handing them back the exact change due. A cashier might hand the customer less change back and at the end of the day pocket the money that his/her draw is over by. b) Put one employee in charge of setting up cash drawers. Have another double- check the cash count.

i) This control is to make sure the cashier is responsible for his/her draw at the end of the shift. If you give a cashier a draw with $100 and they agree it has the same amount then at the end of their shift they should have $100 plus the cash sales in the draw. Any less is the cashier’s error. If this trend continues one should look into it as a possibility of theft is possible. c) Each employee is responsible for his/her own cash drawer. No other employee should at any time (during lunch, breaks, etc.) be allowed to open or use another's cash drawer. At the end of each shift each cash drawer should be balanced by the employee and double- checked by another. i) This makes sure that the cashier is responsible for his/her draw at the end of the shift. Also helps agreeing to the cash total at the end of the shift when two people are counting it. This eliminates any discrepancies or errors in cash counting. Also makes the individual wholly responsible for his/her draw and liable for any errors or shortage of cash.

d) Cash register drawer is closed after each transaction. Register is locked at all times. i) Closing the drawer after each transaction ensures that the money is placed in the register and reduces the likelihood of an error or theft. ii) Locking the register limits who can access the register. Usually the cashier and a supervisor are the only ones with access to the cashier’s register.

e) Identify each over-ring and under-ring. Managers sign off all voids and over-rings. i) A cashier might hand the customer less change back and at the end of the day pocket the money that his/her draw is over by.

f) Limited amount of accumulated cash in the register. i) Use a drop-safe. This reduces the likelihood of losing a lot of cash in case of a robbery. Safe-drops prevent large sums of money being accumulated in the drawers. g) Check cash-to-sale ratios. i) These, along with unusually frequent refund transactions, can indicate employee theft. h) Check for counterfeit currency i) The look of the paper and its "feel" are usually the most obvious signs. A common counterfeiting practice is to "cut corners" off or use a checking marker.

3. Duties that typically should be segregated or separated across employees of a small business are the custody of assets, authorization or approval or related transactions, record keeping of related transactions, and execution of the transaction activity. Management should cross-train employees to segregate incompatible duties to prevent fraud.
Four main categories that should be segregated: * Authorization * Custody * Record Keeping * Reconciliation
If adequate segregation of duties is not economically feasible for small businesses than businesses should at least separate custody of assets from the record keeping. This means the person who receives and records receipts should not generate invoices and reconcile receivables. For small businesses, owners should be more involved in business operations. For example, owners should be the only ones authorized to sign outgoing checks and receive and review bank statements.

4. If business managers suspect an employee of theft they need to be careful how they approach the situation to avoid a lawsuit. It is management’s responsibility to investigate the situation and follow the business’s written policy regarding theft. If the policy states that theft will not be tolerated and result in termination, than management needs enforce that policy. It is also management’s responsibility to conduct an investigation in accordance with federal and state laws and regulations.
Steps to take if you suspect an employee of theft 1. Ask the employee that is suspected of theft to explain what is going on 2. Hire an investigator (interview employees) 3. Suspend the employee if he or she behaves suspiciously or if there’s credible evidence that the employee has engaged in or supported fraudulent activity 4. Document findings- keep notes and retain records
B. Managers should integrate ethical considerations into their businesses’ internal control. Management is responsible for "setting the tone" for their organization. A positive control environment is the foundation for all other standards. Promoting a positive control environment helps remove temptations for ethical behavior. Management should encourage a control environment that promotes:
• The highest levels of integrity and personal and professional standards
• A leadership philosophy and operating style which promote internal control throughout the organization
• Assignment of authority and responsibility
Management should clarify and communicate that unacceptable behavior will not be tolerated and disciplinary action will be taken if an employee violates ethical standards.
5. The EPPA does not improperly limit retail businesses’ ability to investigate and prosecute incidents of employee theft. There are other ways management can go about investigating and prosecuting an employee suspected of theft.
There are legal constraints that must be observed in investigating employee misconduct. Below are laws and regulations that have potential control implications for retail businesses:

The Fair Credit Reporting Act (“FCRA”) may impose administrative requirements on investigations in the workplace. FCRA generally requires the employer to protect the employee’s privacy and required to provide the employee a summary of the report containing the “nature and substance” of the report.
Employers may request standard consumer credit reports or investigative consumer reports (ICRs) on their employees. The employer must certify to the CRA that it will comply with the FCRA. The employer must also gain the individual's written consent before obtaining the report.

Searching desks, lockers and offices, accessing email, voicemail and other electronic data, videotaping or otherwise conducting surveillance of employees, whether at work or off the job, raises significant privacy issues. Employees can make legitimate claims that their privacy was violated while at work. The fourth amendment and privacy laws can limit an employer’s ability to investigate and prosecute employees. Employers should have a policy stating that the workplace is subject to searches.

--------------------------------------------
[ 1 ]. http://epic.org/privacy/fcra/. The Fair Credit Reporting Act (FCRA) and the Privacy of Your Credit Report