12.1 Internal Control Objectives, Segregation of Duties & Noncash Asset Theft
Key Takeaways
- AIPB Part 4 is the untimed open-book Internal Controls workbook final at 70% with no extra exam fee; AIPB's public skill list starts with preventing or spotting employee-theft red flags before check, card, and vendor fraud.
- Segregation of duties splits custody, recording, and authorization: the warehouse counts goods, the bookkeeper posts inventory, and the owner authorizes write-offs—one person must not hold two of those roles.
- AIPB teaching names unconcealed larceny as the most common noncash theft; other named inventory schemes are fraudulent shipments to an accomplice, fraudulent write-offs that alter counts, and falsified shipping or receiving reports.
- Five practical control types stop inventory theft: monitored documentation, a storing-and-counting system, segregation of duties, physical safeguards, and analytical review, plus independent checks by someone who does not handle the accounts.
- COSO's operations-reporting-compliance objectives are a widely used way to talk about why controls exist; COSO and the AICPA do not own the Certified Bookkeeper exam—AIPB does.
Why internal controls are a bookkeeper skill
AIPB's sixth skill workbook is Mastering Internal Controls and Fraud Prevention. On the Certified Bookkeeper path that workbook is Part 4: an untimed, open-book, multiple-choice final that passes at 70%, with no extra exam fee. AIPB's certification pages describe the skill as how to prevent—or spot—red flags of employee theft, then check fraud, credit-card fraud, and vendor fraud. This chapter covers the employee-theft half: noncash assets, cash handling, and prevention before hiring and bonding. Check, card, and vendor schemes wait for Chapter 13.
Bookkeepers sit at a dangerous intersection. They often see cash, inventory records, vendor files, payroll data, and write-off requests in the same week. AIPB's credential picture is skill through the adjusted trial balance, including basic payroll, for firms of up to about 100 employees. In that size shop, the person who posts the ledger may also open mail, walk the warehouse, or cut checks. Opportunity is the control problem. Personality tests do not replace split duties. This independent OpenExamPrep section teaches the control language AIPB tests. It is not an AIPB publication, and it does not treat COSO or the AICPA as the CB exam owner.
COSO objectives without rewriting the exam
Many U.S. firms describe internal control using the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control — Integrated Framework. COSO groups objectives as operations, reporting, and compliance (ORC): run the business without waste, produce trustworthy books, and obey law and policy. COSO is a widely used vocabulary for why a control exists. AIPB did not adopt COSO as the CB exam framework. If an item asks what a control is for, think protect assets, produce reliable records, and keep the firm legal—not "quote COSO principle 11 from memory."
Segregation of duties: the triangle
Segregation of duties (SOD) splits three functions that must not sit in one pair of hands:
| Function | What it means in a parts warehouse | Who should do it at Maple Ridge HVAC Supply |
|---|---|---|
| Custody | Physical possession: stocking, picking, shipping, counting | Warehouse clerk Kim |
| Recording | Books and perpetual records: inventory, COGS, AR, posted write-offs | Bookkeeper Jordan |
| Authorization | Permission to change reality: credit sales, inventory write-offs, adjustments | Owner Pat (or a manager with no warehouse key and no books) |
If Kim counts, posts the perpetual file, and approves "obsolete" write-offs, Kim can steal compressors and make the ledger agree. If Jordan opens checks, posts AR, and approves bad-debt write-offs, Jordan can steal a customer payment and bury it. The exam picture is not "hire three people because a framework poster said so." It is one person must not both take the asset and erase the trail.
Who counts inventory versus who records versus who authorizes write-offs is the inventory version of that triangle. A surprise count by someone who does not keep the perpetual records is an independent check. A write-off of damaged goods needs authorization from someone who did not have custody of the pallet.
Small-firm trap: "We only have two people." Then the owner takes one of the three roles—usually authorization plus a monthly independent review—and the bookkeeper does not also hold the warehouse key. Collusion (Kim plus Jordan) can still beat SOD, which is why analytical review and physical safeguards still matter when headcount is tiny.
How employees steal noncash assets
AIPB's Section 1 of the internal-controls workbook is employee inventory theft: red flags of false sales, phony write-offs, and related schemes, plus controls that prevent theft. AIPB teaching names unconcealed larceny as the most common type of noncash theft: the employee takes goods, tools, or supplies without a covering document. Maple Ridge's Kim dropping a $180 flaring tool into a gym bag is unconcealed larceny. So is walking copper fittings out the dock. There is no fake invoice. The control is physical (locked cage, cameras, exit checks) plus counts that Kim does not both perform and record.
Fraudulent shipment: goods go to an accomplice. Kim ships 12 compressors (cost $14,400) to a storage unit leased in a cousin's name and types a "sale" so the warehouse looks clean. Red flags include past-due accounts that will never pay, multiple "customers" at one mailing address, COGS rising as a percentage of sales, shipping documents with no matching sale, and customer complaints about short shipments when Kim steals from a real order instead of inventing one.
Fraudulent write-off: after the theft, someone alters the count or writes stock off as scrap, obsolete, or shrinkage so books still equal. Kim steals eight compressors, then "counts" eight fewer and asks Jordan to post shrinkage that Kim also approves. The missing piece is authorization separated from custody.
Falsified shipping or receiving report: the document is the cover. A purchase order calls for 100 fittings; 100 arrive; Kim records 82 received and takes 18. Or Kim ships extras and forges a packing list. Matching PO → receiving report → vendor invoice (and sales order → packing list → customer invoice) is proper documentation, monitored. Copies in the file instead of originals are a red flag of altered paperwork.
Tools and data. Noncash theft is not only merchandise for resale. HVAC shops lose gauges, cordless tools, and van stock. Offices lose laptops, customer lists, price files, and payroll Social Security numbers. A bookkeeper who can export the customer file or payroll register is holding a noncash asset. Password sharing, an unlocked backup drive, and a personal USB stick are control failures, not "IT's problem next year."
Lapping (intro only). Lapping is a cash-receipts scheme: steal Customer A's check, later post Customer B's check to A's account, then C to B, forever. It needs custody of checks plus recording of AR. Full cash procedures are in Section 12.2. Check alteration and forged endorsements are Chapter 13.
Fake vendors (intro only). A bookkeeper who can add a vendor and issue a payment can pay "Ridge Mechanical Consulting LLC"—themselves. Purchasing SOD, three-way match, and kickbacks are Chapter 13. Remember the triangle here: authorization of new vendors must not sit with custody of check stock and recording of accounts payable.
Five control categories that stop inventory theft
AIPB's workbook drills five practical control types. Use the names. Do not invent a sixth category called "we trust people."
| Control type | What it looks like | What it stops |
|---|---|---|
| Proper documentation, monitored | Prenumbered sales orders, packing lists, receiving reports; match shipping documents to sales; investigate extras and number gaps | Fake shipments, unrecorded sales, "missing" receiving |
| System for storing and counting | Bins, location codes, cycle counts compared to perpetual records by someone other than the person who stocks the bin | Unconcealed larceny that would otherwise look like "we are messy" |
| Segregation of duties | Salespeople write orders but cannot release goods; warehouse cannot create a customer or write off stock | One person both moving goods and writing the story |
| Physical safeguards | Locked warehouse, keycards, cameras, sealed vans, serialized tools | Walking assets out the door |
| Analytical review | Monthly gross-margin percentage, unexpected past-due AR, scrap spikes, parts-to-job ratios | Schemes that still "balance" the ledger |
Independent checks cut across those rows: the owner graphs margin, a clerk who does not keep the records does a surprise count, and an outside bookkeeper or CPA—or the owner, or the owner's spouse—reviews accounts the inside bookkeeper handles. AIPB's rule for a fraud-focused review is simple: do not assign it to the employee who handles the accounts being examined.
Job-ticket documentation (translated from food-service controls). A kitchen that will not plate food until a sales order is in the system is documentation plus SOD. Maple Ridge's version: parts do not leave the cage without a job ticket or sales order, and the person who picks parts cannot void the ticket alone.
Worked combined failure: Kim ships 12 compressors to an accomplice at cost $14,400, keys an $18,000 sale to "North End Mechanical," and never collects. Books show revenue and AR. COGS percentage jumps, past-due AR rises, and two "customers" share a mailing address. Controls that would have stopped it: warehouse cannot create customers; shipping matched to authorized sales; write-offs and new customers authorized by Pat; independent AR aging review. If Jordan also never takes vacation, you are already looking at Section 12.3's red-flag list.
Exam traps: (1) treating a balanced perpetual inventory as proof of no theft; (2) letting the warehouse both count and write off; (3) calling COSO or the AICPA the CB exam sponsor; (4) dragging check kiting, card skimming, and vendor kickbacks into this chapter—they are Chapter 13; (5) ignoring tools and data because they are not "inventory on the balance sheet."
Walking the triangle with Maple Ridge numbers
Read the diagram as a closed triangle. Each side is allowed. Any two functions in one person is the exam failure.
- Kim (custody) may count 40 condensers on the shelf. Kim may not post the perpetual inventory or approve an $8,000 obsolete write-off.
- Jordan (recording) may post COGS when a real sales order ships. Jordan may not be the only person who releases goods or authorizes the write-off that hides a shortage.
- Pat (authorization) may approve a $2,200 damaged-goods write-off after looking at photos and a count Pat did not perform. Pat should not also be the only person posting the inventory ledger if Pat also stocks the cage—small-firm owners who do both must add an independent count or outside review.
Independent check, worked: On September 20, 2026, office clerk Dana—who does not keep inventory records—counts bin A-14 and finds 22 filter kits. The perpetual record says 31. The 9-unit gap is a signal, not yet a named thief. Next steps: cutoff test of recent shipments, camera review, and a write-off Pat authorizes only after the cause is known. If Kim both counted and posted, Kim could have changed 31 to 22 and the gap would never appear.
The bar chart below is a study ranking, not a published frequency table. AIPB teaching calls unconcealed larceny the most common noncash theft; the other three bars are the other inventory schemes AIPB names in Section 1. Do not memorize fake percentages for the workbook final.
At Maple Ridge HVAC Supply, which assignment correctly separates custody, recording, and authorization for inventory?
According to AIPB teaching on noncash theft, which scheme is the most common type?
Kim ships compressors to an accomplice and types a fictitious sale so the perpetual inventory still looks complete. Which control failure best explains how the goods left?