Restaurant Internal Controls: Systems for Scaling Successfully

Growing restaurant groups that struggle to implement effective restaurant internal controls will have trouble scaling their operations. Systems and internal controls allow you to delegate management and operations securely to spend time on your highest-value activities without worrying about fraud and cost mismanagement. We explain essential internal finance controls you can implement in your restaurant group to give you peace of mind as you disconnect yourself from daily operations:

• Corporate card management
• Commingling
• Segregation of duties
• Standardized procurement process
• Financial report review
• Inventory
• Documentation back-up

Remember that there is a tradeoff between efficiency and internal controls because internal controls require multiple layers of approvals and bureaucracy. However, technology and the plethora of restaurant accounting applications have significantly streamlined internal controls. It can be tempting to circumvent internal controls in a fast-paced environment such as the restaurant industry. While most people are trustworthy, the people who are most likely to know and exploit your weaknesses are your employees. Frequently, it can be someone that you have trusted for a long time. Therefore, it’s essential for you and your management to lead by example and follow processes and internal controls religiously.

Restaurant Internal Controls for Corporate Cards

Traditional corporate cards, cards linked directly to the company’s bank accounts or credit cards, are convenient payment methods but can lead to overspending and/or cost mismanagement. For streamlined and secured card spending, we recommend implementing an accountable expense reimbursement plan or purchasing cards (p-cards). Find out more about Managing Card Spend and Controls in a Restaurant Group.

Commingling

You should not be commingling personal or sister company purchases through your group’s bank and credit card accounts.

Sister Companies

Generally, the bank and credit card account associated with each restaurant, management company, holding company, and/or real estate entity should only capture the payments and deposits associated with that business. How you separate transactions depends on your legal structure and accounting setup. For example, if your management or holding company has a 20% stake in five restaurants with five separate bank accounts and ownership, one restaurant should not pay the expenses of another restaurant. If one restaurant loans money to another, or the management company handles payroll or purchasing on behalf of the five entities, you may transfer funds to cover expenses and ensure the accounting tracks intercompany loan balances.If your holding company wholly owns all five locations; then commingling purchases for multiple businesses should be fine.

Commingling can mean different things for different companies. Please consult with your accountant or CPA, or contact us to learn more.

Separating purchases between different businesses can improve expense management and catch unauthorized purchases, which strengthens overall restaurant internal controls. If a card is used for multiple businesses, the approver could believe that unauthorized purchases are for the other business and vice versa; they must be well versed in both businesses instead of one, and the likelihood of fraud and unauthorized purchases is more likely.

Personal Expenses

If you commingle personal expenses with business purchases, discerning unauthorized purchases becomes extremely difficult, leaving your restaurant’s internal controls vulnerable and prone to fraud. Also, you shouldn’t run personal expenses through your restaurant for multiple other reasons, but here are the top 5:

1. It makes your financial statements meaningless for analysis.
2. You could mislead external stakeholders and provide inaccurate financials, resulting in potential legal action.
3. It could pierce the corporate veil, meaning you could lose your limited liability shield if you were ever taken to court, and they could prove that your business account was being used for personal expenses.
4. If the IRS catches you doing this, they will question your legitimate business expenses.
5. If the personal expenses are classified as distributions, then your distributions could trigger a red flag from the IRS because they’re very high in proportion to your salaries.

Here are common purchases that restaurateurs frequently think are business expenses but are actually considered personal:

• Commuting vehicle expenses.
• Meals and travel that are not ordinary and necessary (checking out the new hot competitor in town is generally not considered a business expense).

Segregation of Duties

Segregation of duties assigns various steps of a process to different people to ensure a single person does not have excessive control, giving them the opportunity to make mistakes or commit fraud and theft, which is a core principle of strong restaurant internal controls. Here is how you can implement adequate segregation of duties in your restaurant group:

• The purchaser and payer for inventory and supplies should be two separate people. The person receiving orders must sign the invoices and upload them to restaurant management software (such as MarginEdge or Restaurant365). The person paying, typically the accountant, should reconcile the amount with the vendor’s records, ensure the purchases are valid, and pay them.
• To further strengthen the payment process, you could implement invoice approvals and/or bill pay approvals, which require the invoices and/or payments to be approved by another person. For example, after a Chef places and receives an order, they upload the signed invoice to MarginEdge or Restaurant365. The invoice is routed to the GM for approval. Once approved, the invoice is routed to the accounting team for payment. As a result, instead of one, three people must approve an invoice before it gets paid.
• The reviewer of the financials must differ from the person who has prepared and reconciled the financials. For example, the accountant reconciling the bank and credit card accounts and POS with the P&L should not be the same accountant who finalizes and reviews the financial statements. The Controller or Accounting Manager must review the financial statements and reconciliations before finalizing. These are all standard processes provided by The Fork CPAs.

Proper segregation of duties also ensures separate user accounts (for payment platform, QBO, etc.) for each person so you can clearly track audit logs and activity. These user accounts must be closed out when an employee is offboarded.

The most often overlooked internal control breakdowns are typically related to the segregation of duties. Here are some of the most common overlooked internal control breakdowns:

• The Controller has access to everything in case they need to jump in and help. This access is efficient but more vulnerable to fraud. There should be no exceptions. You must remember that employees know where the weaknesses are.
• A bookkeeper, accountant, or assistant GM is promoted, and the old credential access is not revoked; so they end up having control and access to everything.
• Managers are not held accountable for what they approve. Managers should not be approving invoices or other purchases without reviewing. Employees catch on to this and can take advantage of the weak area.
• Making all executives/owners signers.

Implement a Systemized Procurement Process Across Locations

To properly segregate duties and prevent duplicate payments, cost mismanagement, or unauthorized purchases, you’ll need a systemized way to purchase products from your purveyors. Take a look at A Complete Guide to Restaurant AP Controls to learn how to implement an ironclad procurement (ordering and payment) process.

Restaurant Internal Controls for Inventory

Taking inventory improves the accuracy of your cost of goods sold and strengthens restaurant internal controls. It also allows you to understand the amount of purchases left over to accurately calculate the product sold in a time frame – aka the cost of goods sold (COGS).

Taking inventory also serves as a verification method to ensure the product is not wasted or stolen. Inventory is a convenient place to plug all unreconciled purchases for a bad actor. The person taking inventory must not be the same person reviewing and submitting it because they may make mistakes or skew the numbers in their favor to conceal fraudulant activity.

For example, assume Joe purchases $750 worth of prime rib, and takes $250 of it home. He tells the bookkeeper that $250 of prime rib is sitting in inventory when it’s not, so that only $500 ($750-$250) of Cost of Goods Sold shows up on the P&L. An unwary owner-operator may not check inventory reports and review their balance sheet, thus creating a considerable vulnerability for theft.

Review Financial Reports Thoroughly

Taking inventory needs an ironclad system. Your last line of defense is reviewing financial reports proactively to catch anomalies. Here is what you’ll need to do:

• Review the general ledger report from your accounting system periodically to ensure all purchases are reasonable, legitimate, and authorized.
• Review your food/labor costs so if something stands out (like a very high food cost) you can investigate. For example, if you costed out your menu for a 40% food cost, which is regularly 43%, employees could be stealing or making unauthorized purchases. Taking inventory will also help with this.
• Review your balance sheet. The balance sheet is where all the dead bodies are found and is often the most overlooked report by restaurateurs. Your balance sheet measures your financial position and health; it presents your cash, inventory, receivables, prepaids, accounts payable, sales tax payables, loans, and more. If any of these values are misrepresented, you can be sure that your other financial reports are incorrect and misleading.

For example, you must review gift card sales, redemptions, and liability balances frequently to ensure the amounts are reasonable and accurate. Gift cards are an easy way for bad actors to give away free meals and plug the payment tender to gift cards. If you don’t reconcile and review balances, you can overlook fraud and abuse.

To review financial reports thoroughly, ensure your accounting and bookkeeping are accurate, timely, and consistent. Get in touch with us to improve, streamline, and delegate your accounting and bookkeeping.

Require Documentation for All Transactions

An inefficient, but effective way of reducing theft and excessive purchasing is requiring documentation for all transactions. This can be implemented separately from the initiatives above, or it can be implemented alongside them. We recommend the latter.

Requiring documentation for all transactions requires every transaction in your ledger to have documentation. All corporate card transactions must have documentation, such as a receipt or payment confirmation, with a valid explanation. All invoice payments and receipts must have a receipt or invoice uploaded to your restaurant management system.

Your accountant should maintain a weekly ledger of transactions that don’t have documentation and the restaurant management can review the ledger weekly to ensure the transactions are authorized. Many firms use a suspense, ask my accountant, or uncategorized expense account to track transactions lacking documentation. MarginEdge and Restaurant365 also code each receipt by line item, so if an unexpected purchase is made you might catch it on your P&L.

Implement Actual vs Theoretical (AvT) Reporting

AvT reporting provides your theoretical cost of goods sold based on the menu items sold in each time period using your restaurant’s recipes and most recent ingredient prices. The theoretical cost is compared to your actual cost of goods sold, which is calculated by taking your beginning inventory plus purchases and subtracting ending inventory.

If there is a 3-4%+ variance, then you could have a theft or waste problem. Implementing AvT reporting is a big project and will require software like MarginEdge or Restaurant365. If your menu is changing or very large, you could implement it for your top 5-10 items only, or the most problematic (prone to waste/theft) menu items.

Petty Cash and Cash Drawer

This day in age, petty cash should be rarely used. It’s not secure and a waste of time to reconcile and maintain. If you haven’t done so already, replace petty cash with expense reimbursements or p-cards as mentioned above. Take a look at Managing Card Spend and Controls in a Restaurant Group to learn more.

Ideally, you should be doing daily cash drops at your bank and the only paper cash you have at the restaurant should be for the cash drawer. The paper cash or petty cash at the restaurant should be locked in a safe with a key.

Misleading Internal Controls

What’s even worse than not having a sense of security? A false sense of security. You must ensure that restaurant internal control protocols are not paying lip service but are actually being followed religiously. Here are some misleading controls that may seem effective on the surface but are easily circumvented:

• Providing exceptions for owners, partners, and/or executives, including:
  • Issuing corporate cards to all executives.
  • Providing unlimited access to all accounts.
• Not getting full documentation when documentation is required.
• Approvers approving without reviewing and/or ensuring documentation is sufficient and following protocol.
• Not updating access and responsibilities when someone is promoted (see Segregation of Duties).

Human Resources (HR) Internal Controls

Accounting, Finance, and HR need to integrate and communicate to ensure internal controls are effective between the departments. Here is how HR can complement the process:

• Require mandatory vacations (consecutive days).
• Job rotation where possible (helps to avoid collusion).
• Upon promotion, an employee’s access should be updated to ensure segregation of duties is still effective.
• Update the offboarding process to ensure the employee is:
  • Removed from the accountable plan or p-card platform and their cards have been returned
  • Removed from any finance system (MarginEdge, Restaurant365, QuickBooks Online, etc.)
• Weekly cross-checking of active employee lists with:
  • cardholder list
  • signers
  • users
  • approvers

Internal Controls in Your Restaurant Group

Internal controls aren’t a one-time project – they’re the foundation that lets you step away from daily operations without losing sleep over fraud, waste, or cost creep. Start with the controls that address your biggest vulnerabilities today, then layer in the rest as your group grows. And review controls and processes regularly to ensure they’re followed religiously.

If you’re not sure where your gaps are, or you’d rather hand the accounting and bookkeeping to a team that builds these controls in by default, we can help. The Fork CPAs works exclusively with restaurant groups, and we implement segregation of duties, procurement systems, documentation standards, and reporting reviews as part of how we operate. Contact The Fork CPAs for a consultation, and let’s put controls in place that scale with your restaurant group.