Designing an internal control system for a 120-store retail chain

Background

The client is a consumer goods retail chain that expanded from 45 to 120 stores in three years and operates two distribution centres, one in the south and one in the north. The board was preparing to bring in a strategic investor and recognised that existing controls relied mainly on the experience of area managers. Inventory shrinkage had reached 1.9% of revenue, well above management's expectations.

Challenges

• Month-end stock counts were carried out by store staff themselves, with no independent reconciliation.
• Cash takings were banked in several different ways, and some stores held cash overnight for two to three days.
• Permissions to change prices, void receipts and process returns on point-of-sale terminals were granted widely, including to shift staff.
• The purchasing approval matrix was undocumented, and many large purchase orders needed only one signature.

Our approach

• Weeks 1–4 — risk assessment: visited 18 representative stores and both distribution centres, and analysed 12 months of sales data for anomalies in voids, returns and manual discounts.
• Weeks 5–9 — design: a risk and control matrix for six processes (purchasing, receiving, inventory, sales, cash and payroll) with 84 control points, each with an owner and frequency.
• Weeks 10–12 — access rights: worked with IT to narrow POS permissions, set up two-level approvals and introduce daily exception reports.
• Weeks 13–16 — pilot and roll-out: piloted at 20 stores, refined the design, then trained all 120 store managers and set up rotating cross-count teams.

Results

Two quarters after chain-wide implementation, inventory shrinkage fell from 1.9% to 0.8% of revenue. Post-payment voids decreased by about 70%. Cash takings are banked the same day at 96% of stores and within 24 hours at the rest. The control matrix was used by the strategic investor during due diligence and became the foundation document for the newly established internal audit function.

“Good internal control does not slow a store down. The aim is fewer steps in the right places, and data that tells you when something is out of line.” — Ms Le Phuong Thao, Director, Internal Control & Risk, Corvane Advisory

Lessons learned

In retail, most losses stem from overly broad system permissions rather than from missing procedures. Daily exception reports allow area managers to focus on the few stores showing unusual patterns instead of checking all of them equally. Piloting with a small group first ensures controls fit real operations and are accepted by staff.

In the following year, Corvane carried out two independent compliance reviews at 30 randomly selected stores and reported directly to the supervisory board.