Investigate and let people know you are going to investigate. Investigate and explain to people that you are going to investigate so there are no surprises. Security controls should not be taken personally by the people being checked, just like a teller shouldn’t view the bank counting the money in the drawer (rather than just accepting the teller’s count) as an indication that the bank thinks the teller is dishonest. Explain that concept to employees so that they understand it. But even the best controls will never be foolproof. For that reason (among many others), trustworthiness is a quality that should be appreciated.

Remember that there is no sense in having laws unless you have policemen (auditors). The people doing the auditing should report to people outside the department being audited, and auditing procedures should not be made known to those being audited. (This is one of our few exceptions to radical transparency.)

Beware of rubber-stamping. When a person’s role involves reviewing or auditing a high volume of transactions or things that other people are doing, there’s a real risk of rubber-stamping. One particularly risky example is expense approvals. Make sure you have ways to audit the auditors.

Recognize that people who make purchases on your behalf probably will not spend your money wisely. This is because 1) it is not their money and 2) it is difficult to know what the right price should be. For example, if somebody proposes a price of $125,000 for a consulting project, it is unpleasant, difficult, and confusing to figure out what the market rate is and then negotiate a better price. But the same person who’s reluctant to negotiate with the consultant will bargain furiously when he is hiring someone to paint his own house. You need to have proper controls, or better yet, a part of the organization that specializes in this kind of thing. There’s retail and there’s wholesale. You want to pay wholesale whenever possible.
