Internal Controls for Tech Startups - are they possible?

(Newsletter: tsCFO.003 v2 2023.03.14)

Internal Controls Redefined

Consider an unlikely scenario with a Cessna pilot and a talking eagle, both flying competently at 3000ft. You ask the pilot to spot a rabbit in the bushes below - “Are you kidding? - impossible at 3000ft” she replies. You ask the eagle to fly the Cessna - “I can’t even get past the door handle” it replies. The point is, it is not fair to ask a tech startup to follow a traditional Internal Control process designed for Enterprises, where segregation of duties (easy for an Enterprise given the number of Admin employees required to feed the accounting software), policy compliance monitoring, and multiple layers of pre-approvals are used to filter out rogue accounting transactions before they take place. What is less obvious, is that the flip side is also true. Enterprise accounting software can’t efficiently and effectively support the Internal Control process I am suggesting for tech startups.

I once asked the lead tech partner in a Vancouver “big four” accounting firm if he had any special suggestions for Internal Controls applicable to a tech startup. He replied that it was a very good question, but he never got back to me with an answer. After 30 years of experience, I can recommend a relatively efficient and effective Internal Control solution for tech startups, as long as I am granted “poetic license” to define Internal Controls as a disciplined process to ensure complete and accurate quarter-end financial statements. My internal control process does not prevent material “bookkeeping bugs” before they get posted, but it does identify and correct material “bookkeeping bugs” before quarterly financial statements are released (especially relevant if the tech startup has graduated to a rhythm of quarter-end Board reporting). Using QBO / Xero accounting software, a tech startup is like an eagle that can spot trend deviations from a high level, and instantly drill down to discover the rabbit lurking near a bush. If you have ever struggled with cryptic results from drill-down queries using Enterprise accounting software like BusinessOne (SAP) or PeopleSoft (Oracle), you will appreciate the vastly superior visibility provided by QBO / Xero in providing clear and instant drill-down transaction detail on any GL account. By the way, I have a convenient “Acronyms” sub-heading under the Newsletter section of my www.techstartupCFO.ca website if you ever get lost in the accounting acronym forest.

No company of any size can escape the Garbage In - Garbage Out (GIGO) paradigm. You need competent bookkeeping to correctly record General Ledger (GL) transaction level detail, which is the foundation for quality financial statements supported by drill-down explanations. Today’s versions of QBO / Xero support semi-automated bank feeds providing raw bank transaction data which the bookkeeper can transform into useful GL detail by entering rich transaction descriptions and accurate GL coding.

Double Entry Bookkeeping Primer

To follow the logic behind my proposed Internal Controls for tech startups, readers without formal accounting training (especially CEO’s, Founders, and organizations supporting tech startups) need a basic understanding of how double-entry bookkeeping works. I suggest making this effort will be a richly rewarded experience, as it will help any reader navigate around the unavoidable stream of financial, tax, and management reporting “rocks” on every tech startup’s journey. Gaining a basic understanding of double entry bookkeeping is like learning how to read your speedometer and fuel gage before you get behind the steering wheel of a car for the first time. Let’s start with the following highly simplified overview in Schedule A.

SCHEDULE A (click schedule with a large screen device to expand, click "X" at top-right to exit)

At the heart of all double-entry bookkeeping is the Trial Balance (TB). The TB is a list of General Ledger (GL) accounts with balances that add to zero (debits = credits). The TB includes all numerical data needed to produce a basic set of financial statements (balance sheet, income statement, cashflow statement). The TB list of GL accounts starts with a “snapshot” (or "photograph") Balance Sheet (BS) section, followed by a “video” Income Statement (IS) section. The Income Statement “video” captures revenue and expenses over a period of time (typically month, quarter or year). To sync elegantly with calendar quarters, the most common fiscal year-ends are either Dec31, Mar31, Jun30 or Sep30. The Balance Sheet “snapshot” shows the financial position or health of the business at a specific point in time, with Assets (cash, receivables, fixed assets) = Liabilities (payables, debt) + Equity (share capital, retained earnings).

All GL accounts associated with the Income Statement “video” section of the TB (revenue, expenses) clear to zero immediately after year-end, with the offsetting total (Net Income / Loss) flushed into a GL account in the Equity section of the Balance Sheet called Retained Earnings (RE). This flushing action resets all GL accounts on the Income Statement section of the TB to nil at the start of a new fiscal year, with the offsetting entry posted to RE (keeping debits=credits, and the TB total = zero). The term “double entry bookkeeping” refers to the fact that debits (positive) and credits (negative) posted in the GL accounts always offset each other perfectly, so the TB always adds to zero. The RE account is often renamed “Deficit” on the Balance Sheet if years of accumulated tech startup losses must be absorbed before “Earnings” (accumulated Net Income) overtake them to turn the negative “Deficit” into positive “Retained Earnings”.

The following Schedule B reveals more TB detail as we expand Schedule A into a modest sample of the most common GL accounts. Schedules C, D, E and F all work from the data shown below in Schedule B.

SCHEDULE B (click schedule with a large screen device to expand, click "X" at top-right to exit)

This elegant double-entry bookkeeping system enabled the Italian merchants who invented it to manage their business operations so effectively they accumulated the trading wealth needed to fuel the Italian Renaissance. In short, Leonardo and Michelangelo owe a tip of the hat to the creative beancounters of the early Renaissance.

I suggest that any CEO / Founder who doesn’t have a handle on basic accounting concepts is flying their tech startup without full instrumentation. Investing time to gain an appreciation for how their financial statements work would serve them well. The following three Schedules (C,D,E) explain how the TB data in Schedule B gets reformatted into each of the three standard financial statements. The same TB figures are used consistently throughout all Schedules, so you can flip back and forth to “zoom in and out” as you gain an understanding of how double-entry bookkeeping works.

SCHEDULE C (click schedule with a large screen device to expand, click "X" at top-right to exit)

SCHEDULE D (click schedule with a large screen device to expand, click "X" at top-right to exit)

As a bit of an aside, Canadian tech startups use ASPE (Accounting Standards for Private Enterprise), which recommends if the Income Statement is in a Loss position (typical for tech startups in their early years), the term “Income Statement” is replaced with "Statement of Operations". It is also very common to hear the Income Statement referred to informally as the “P&L” (Profit & Loss Statement). One might legitimately question the logic behind these multiple naming conventions. It almost appears as if the “accounting powers that be” have decided they can charge higher fees if they have at least two or three names for the same thing.

SCHEDULE E (click schedule with a large screen device to expand, click "X" at top-right to exit)

Internal Controls for Tech Startups 1of2 (BS)

With that double entry bookkeeping primer in the rear view mirror, the reader should have little difficulty following the logic behind my Internal Control process for tech startups, which is effectively a structured process for a Fractional CFO to perform a “lite” internal audit (as opposed to an extensive and expensive external accounting firm audit).

Audit theory is a logical extension of the Trial Balance adding to zero (debits = credits) in double-entry bookkeeping. In a nutshell, an auditor “hammers” the Balance Sheet (BS), and reviews trends on the Income Statement (IS). If every Balance Sheet General Ledger (GL) account is analyzed and adjusted to its correct balance at year-end, the Retained Earnings (RE) figure on the Balance Sheet is forced to be correct because the statement must balance. This means the “bottom line" Net Income figure on the Income Statement is also forced to be correct, because it is part of Retained Earnings. Flipping to the Income Statement side of the audit, the only possible error remaining for an auditor to consider is if any expense (debit) or revenue (credit) line has a material classification error. Many Income Statement classification errors can be spotted relatively easily in a monthly trend review, which completes the logic behind a “hammer the BS, review IS trends” approach to a financial statement audit.

As an aside, the other focus of audit attention on the Income Statement tends to be revenue recognition, which can be a complex area depending on the mix of products and services sold, and the timing of their payment. For example, a prepaid annual SaaS license triggers an initial “Unearned Revenue” (or “Deferred Revenue”) liability on the balance sheet offseting the annual cash payment, with revenue being recognized each month over the software license term. There is a natural bias for most companies to maximize their “top line” revenue reporting to investors, so auditors are required to carefully follow Generally Accepted Accounting Principles (GAAP) to ensure revenue is not overstated. For a Canadian tech startup, the GAAP guidelines that normally apply are called Accounting Standards for Private Enterprise (ASPE).

My suggested Internal Control ( or “Balance Sheet Review”) process for tech startups involves two steps, a Balance Sheet scrub (~80% of the effort), followed by an Income Statement monthly trend analysis (~20% of the effort). The logic is illustrated in Schedule F below.

SCHEDULE F (click schedule with a large screen device to expand, click "X" at top-right to exit)

The Balance Sheet Review process should be documented in a quarterly Excel .xlsx spreadsheet after the bookkeeper has done as much as they can to accurately post all known transactions to close QBO / Xero for the quarter-end (typically at Mar31, Jun30, Sep30, or Dec31). At a minimum, this means all bank statement transactions and payroll entries are recorded in QBO / Xero, and the bank is reconciled.

The Balance Sheet Review is mostly thoroughly performed at year-end, where the resulting financial statements will be subject to any required external Audit or Review Engagement, and will ultimately be used for the annual corporate tax return and any reporting to shareholders. With the Balance Sheet Review process, each Balance Sheet GL account (asset, liability, equity) must be fully analyzed and explained in a single Excel file. Multiple tabs can be used to capture supporting detail as required. In the example above, there would normally be individual spreadsheet tabs for the bank reconciliation, aged AR listing, fixed asset continuity schedule, aged AP listing, unearned (or "deferred") revenue analysis, loan analysis, and cap table. As the various GL accounts are “scrubbed”, any resulting correcting entries are identified and posted in QBO / Xero to correct the TB. This process is how QBO / Xero financial statements for a tech startup evolve towards their final complete and accurate version for quarter-end reporting.

The prior quarter’s “Balance Sheet Review” Excel spreadsheet is continually recycled as the starting point for the next quarter. Almost all of the analytical formats are reused, and any GL balances that haven’t changed from the prior quarter need no further analysis. Only GL changes since the prior quarter need to be analyzed and explained. This ongoing recycling of prior quarter analysis is why my suggested Internal Control process is efficient.

The Balance Sheet side of the process described above takes up ~80% of the review effort, but there is a second half of the Trial Balance (TB) to consider. This ~20% of the effort involves reviewing the monthly Income Statement (P&L) trend for each relevent GL account (revenue, expenses) for reasonableness and material (read significant) trend deviations that need to be explained. Once monthly TB columns from QBO / Xero are aligned, it takes little effort to spot revenue and expense trend deviations and evaluate their materiality.

In general, a deviation of under 5% of total revenue (or 5% of total expense) can be dismissed as immaterial (unless we are talking about indicators of bad behaviour such as fraud). A good way to think about materiality is to consider whether a correcting adjustment would have an impact on decision making by a manager or investor. If the deviation is highly unlikely to impact a business decision, why waste time fussing around with it? Engineers who work in extreme degrees of precision can struggle with the idea of beancounters (like Fractional CFO types) dismissing these immaterial differences, but this exercise in judgement by the beancounter is exactly how they strike a balance between efficiency and effectiveness. It can be a bit of a clash in cultures, but a beancounter constantly aiming for engineering precision would be a poor performer, as their work would never get done while they mentally burn themselves out.

When drilling down on an Income Statement GL account, a quick few clicks in QBO / Xero should explain the source of the deviation. The explanation must be documented in a cell comment for quick future reference (and a future copy/paste into the forecast model where the latest actuals overwrite earlier forecast values). Any material rogue transactions or GL classification errors are quickly identified, and correcting Journal Entries (JE’s) are documented. Only material deviations are investigated and explained (per shaded highlights in the Schedule F example above), so reviewing the monthly Income Statement GL trend for revenue and expense is quite efficient.

Internal Controls for Tech Startups 2of2 (Salary)

The second step in my Internal Control process for tech startups involves manually updating monthly payroll register data by employee in an Excel spreadsheet. The concept is identical to the process described above for the monthly Income Statement GL trend analysis of revenue and expenses. Gross salary trend deviations are identified, and any payroll errors are exposed in the process. I consider this to be an essential part of the Internal Control process for a tech startup for the simple reason that compensation tends to be ~80% of total operating expense. Some tech startups in their early days rely heavily on contractors. Where there is sufficient contractor activity, this same monthly trend review concept can be applied to contractor fees in addition to (or in place of) gross salary.

SCHEDULE G (click schedule with a large screen device to expand, click "X" at top-right to exit)

The transfer of payroll register data takes a bit of work (about 30% of the Internal Control process effort), but there is a rich reward with the following paybacks:

1) Transferring data from the external payroll register into the Schedule G spreadsheet above lets you effortlessly summarize gross salary information by department (at a minimum: S&M, R&D, G&A) into a simple Journal Entry (JE) for fast and efficient posting of gross salary by department into QBO / Xero. Employee benefits can be efficiently allocated to each department using the same gross salary data as an allocation base. This recommended best practice keeps confidential salary detail by individual out of QBO / Xero, which is a good thing, as I explain in my earlier Newsletter (tsCFO.002).

2) The same Schedule G gross salary data by individual is efficiently copied into the forecast model to overwrite previous forecast values with the latest monthly payroll actuals data by individual employee. This means accurate gross salary data by employee is aligned with future planned salary for that employee. The seamless flow from an historic actuals trend into future forecast months is a key part of establishing credibility with the forecast model, which in turn is critical for getting investors on board.

3) The same Schedule G gross salary by individual is copied into spreadsheets used to calculate the annual SRED claim, and to apply for other government R&D incentive programs.

Note that gross salary data and share/option ownership data (aka share capitalization data, or “cap table” data) are the two most confidential types of financial information in any tech startup. If this data leaks out, employees will start making uninformed comparisons between themselves, which can only lead to poor morale and turnover risk. In reality, at any point in time a few employees will likely be overpaid while others are underpaid, relative to their respective contributions. In a good tech startup, this gets corrected within a few years. In a poorly managed tech startup, outstanding employees not being recognized for their contributions will eventually seek employment elsewhere. The stock market works the same way - the share price for public companies fluctuates in the short term with the economic mood, or the latest investment fad. If company fundamentals including cashflow are strong, the true value of the company will eventually be reflected in the share price (so don’t sell during a market dip if you are holding a quality investment).

As a result of my recommended Internal Control process involving both a Balance Sheet Review and a Gross Salary Review, you will have materially complete and accurate actuals / financial statements at the end of each quarter. This means no shocking "surprise" accounting corrections at year-end. Your actuals data can be reliably compared to forecast model expectations, which allows you to consider any required course corrections early if the forecast assumptions prove to be overly optimistic (which is “situation normal” on the revenue side, especially with a long and complicated sales cycle).

Universal Internal Controls Still Applicable

Some classic “Enterprise Internal Controls” still belong in a tech startup environment. Common Internal Control processes that work for both Enterprise and tech startups include:

· PURCHASES - Two or more executives should approve material (large $) purchases. A formal Purchase Order with terms should be used for material purchases.

· TRAVEL EXPENSES - Nobody should approve their own travel expenses (as a minimum, a sole founder CEO can have an external Advisor vet their expense claim). Travel expenses should be approved in advance. Personal expenses (as defined by tax authorities like CRA) should never be claimed as company expenses. Personal expenses in corporate records are a red flag for auditors, tax authorities and investors alike.

· COMPENSATION - Two or more executives should approve all employee hires, and any compensation changes (eg. bonus, raise) in written form. Email approval is acceptable.

· SUPPLIERS - Potential suppliers should be vetted (check references) in advance to ensure you are working with ethical players who will deliver your order on time. For specialized items, consider a secondary source of supply to manage risk.

· CUSTOMERS - Potential customers with material orders should be vetted (check references) in advance to ensure you are working with ethical players who can and will pay you on time. Export Development Canada (EDC) can provide AR collection insurance on a large receivable from a foreign customer, reducing cashflow risk for the tech startup.

· DISTRIBUTORS / RESELLERS - Potential channel partners should be vetted (check references) carefully to ensure they will deliver the service level you expect, and any product promotion you expect. Some rogue distributors will attempt to catch you in a legal trap and force you to buy your way out of it. Be careful with any exclusive rights assigned to a distributor or reseller, despite what you may feel are adequate performance safeguards.

· HIRES - Follow best practices for filtering newhire candidates to ensure you are getting the brightest and best, and to ensure a fit with your corporate culture.

Conclusion

Tech startups (and other small business startups) have always struggled to follow the classic Internal Control script designed for large Enterprises, with its emphasis on segregation of duties and layers of supervision / approval. I have proposed an alternative Internal Control process designed around the strengths of tech startups. One of those strengths is leveraging the superior drill-down visibility offered by tech startup accounting software (QBO / Xero). Labour intensive Enterprise accounting software solutions can’t match this instant drill down visibility, an unavoidable consequence of their more complex environment and “heavy” accounting software design sitting on a big database engine.

A related strength of tech startups is low transaction volume and reduced complexity, so it is relatively easy for a single person (eg. CEO) to grasp the full picture and spot deviations. Balance Sheet GL structures generally follow a common pattern regardless of company size. The general approach to the Balance Sheet Review process I recommend for tech startups is familiar to anyone with sufficient audit experience.

In contrast, the Income Statement GL structure should be highly customized around a tech startup’s unique business model, especially when it comes to segmenting revenue. With an appropriately designed GL structure in place, deviations from established monthly Income Statement trends are quick to spot. With a bookkeeper providing solid QBO / Xero transaction level detail, they are also easy to explain. Required Journal Entry (JE) corrections to the accounting records will surface under the disciplined quarter-end Balance Sheet Review process and complimentary Gross Salary Review I have described. The resulting Internal Control process will work for any tech startup to provide complete and accurate quarter-end financial statements / actuals for reliable and informed decision making by managers and investors alike.