Key takeaways
- Project money can leak in two ways: it is lent out to related parties, or it leaves through a payment system with no segregation of duties
- Balances with directors and group companies need an agreement, a resolution, interest and a due date
- When a single service provider performs 5 of the 7 steps in the payment cycle, the system has no self-detecting control
- Approval controls the amount and the reason, but not where the money goes
The examples in this article are written to illustrate risk patterns and do not identify or accuse any person or entity. Warning signs are grounds for further review, not a conclusion that wrongdoing has occurred.
Director accounts: where personal money mixes with company money
| Account name | Hidden risk | Warning signs | Checkpoint |
|---|---|---|---|
| Loans to directors | Drawing company money for personal use, and the statutory interest income issue | Balance keeps growing, with no agreement and no interest | Check approval resolutions, loan agreements and market-rate interest |
| Amounts due to directors | Unexplained money coming into the company, or revenue avoidance | Large director loan with no identifiable source | Check the source of funds and the loan documents |
Illustrative example: a director receivable that became a tax bill
A family group of companies regularly transferred cash to a director for personal cash flow, recording it in the director receivable account with no loan agreement and no interest charged. On audit, the Revenue Department took the view that the company should have earned market-rate interest, and assessed additional interest income together with penalties and surcharges. Part of the amount was also treated as a benefit received by the director, affecting personal income tax.
Lesson: director receivable and payable accounts are where personal finances mix with the company's, and they are where the Revenue Department pays attention.
Intercompany transactions in a corporate group
For developers with several entities, intercompany transactions are often the biggest risk point
| Account name | Hidden risk | Warning signs | Checkpoint |
|---|---|---|---|
| Payables to the main contractor (if a group company) | Construction prices are not market prices, which raises transfer pricing issues and the shifting of profits and losses between companies | Large debit balance (advance payments to the contractor) with no performance security | TP documentation comparing prices with external contractors, advance payment terms and a bank guarantee |
| Receivables / loans to group companies | Money paid by customers into the project is lent out to prop up other companies in the group | Balance keeps growing, with no repayment date; interest is accrued but never received in cash | Loan agreement, board resolution, market-rate interest, and an assessment of the borrower's ability to repay |
| Payables / loans from overseas companies | Unclear source of funds, WHT burden and money-laundering risk | Counterparty is an offshore juristic person with no documents evidencing actual services | Check the agreement, WHT under Section 70 and the double tax treaty, exchange differences, and the source of funds |
| Intangible assets / trademarks | Rights bought from a related party at a high price, not amortised and not tested for impairment | Value unchanged for several years, with no amortisation in the income statement | Rights agreement, independent valuation, impairment testing under TAS 36, and WHT on royalties paid abroad |
| Suspense accounts with no counterparty name | Items that cannot yet be posted anywhere or that nobody will own | Balance carried across periods, large amount, no breakdown | Request the detail of every item, set a policy to clear suspense accounts within 30 days, and do not close the books with balances outstanding |
Three accounts to review in detail every month, without exception
- Customer advances compared with the sales contract register
- Outstanding balances with group companies and directors
- Every suspense account with an outstanding balance
Tax burden of transactions with group companies and overseas parties
| Item | Tax burden | Evidence required |
|---|---|---|
| Lending to group companies | Interest should be charged at market rates; otherwise the assessment officer has the power to make an assessment under Section 65 bis of the Revenue Code | Loan agreement, board resolution, market reference rate, and evidence that the interest was actually received |
| Interest income from group companies | It is CIT income on an accrual basis even if not yet received, and when the payer pays interest to a domestic juristic person, 1% WHT must be withheld | Monthly interest calculation schedule, and the payer's PND 53 return |
| Paying service fees, commission and royalties abroad | Withhold WHT under Section 70 (generally 15% for royalties and interest) unless reduced under a double tax treaty | Agreement, evidence that the services were actually provided, the recipient's tax residence certificate, and PND 54 |
| Importing services from abroad | The payer must remit VAT on behalf of the foreign operator (PP 36) | Invoice and evidence that PP 36 was remitted in the correct period |
| Transfer pricing | Juristic persons whose revenue reaches the statutory threshold must file the related-party information report together with PND 50 | Transfer pricing documentation for construction work, management fees and intragroup loans |
Commonly missed points that nobody catches
- Accruing interest receivable from group companies as income with no plan to collect it, or, when it is actually paid, failing to withhold and remit WHT
- Paying money abroad without withholding WHT and without filing PP 36
- Claiming a refund of input VAT related to sales of condominium units
- Charging selling and marketing expenses to WIP to reduce a loss
All four appear in the trial balance, and the owner can ask about them immediately without being an accountant
When the whole accounting function, including fund transfers, is outsourced
A map of where controls disappear
Internal control rests on a single principle: the person who approves ≠ the person who pays ≠ the person who records ≠ the person who reconciles. When the whole cycle is handed to a single service provider, this principle survives at only one point: the approval step.
| Duties in the payment cycle | Who does it in this structure | Control that should exist | Status |
|---|---|---|---|
| 1. Raise the payment request and source the supplier | In-house team | Purchase requisition, price comparison | Still within the company |
| 2. Approve the payment | Owner / director (paper documents) | Delegation of authority (DOA) schedule | The only control left |
| 3. Transfer funds through the bank | Service provider | The approver must not be the person who initiates the transaction | Outsourced |
| 4. Record in the accounts | Service provider | The person recording must not be the person who pays | Outsourced; overlaps with step 3 |
| 5. Bank reconciliation | Service provider | The reconciler must be independent of the payer and the recorder | Outsourced; overlaps with steps 3–4 |
| 6. Calculate and remit tax | Service provider | Reviewed by someone else before filing | Outsourced |
| 7. Close the books and prepare financial statements for the auditor | Service provider | The person preparing the financial statements must not be the person who controls payments | Outsourced; overlaps with steps 3–6 |
A single service provider holds 5 of the 7 steps: it initiates the payments, records them, reconciles them and closes the books. If an error or fraud occurs, the only person who could detect it is the person who carried out the transaction. This is not an accusation that the service provider is dishonest; it is a structural fact that the system has no self-detecting control.
Five misconceptions
| The owner's understanding | The reality |
|---|---|
| I approve every document; money cannot go out without passing through me | An approval document only controls the transactions that are put forward. It does not control those that are never submitted, such as direct transfers, changes to the beneficiary account number after approval, or duplicate transfers. |
| If anything is wrong, the auditor will find it | An auditor gives assurance that the financial statements are free of material misstatement. An audit is not a search for fraud in individual transactions, and it takes place after the money has already gone out. |
| The service provider files the tax; if it is wrong, it is their liability | The taxpayer is the company, and the person signing the return is a director. Penalties, surcharges and criminal liability therefore remain risks for the company and its directors. |
| The books close on time, so the system must be good | Closing on time while suspense accounts carry balances, there are many year-end adjusting entries, or the books do not agree with the statements means closing the books to finish them, not to get them right. |
| I see the financial statements every month, so that counts as checking | The financial statements are an output produced by the service provider. Checking requires evidence from third parties, namely bank statements and tax payment receipts, which the owner pulls directly without going through the service provider. |
Ten minimum controls
| # | Control | Why it is needed |
|---|---|---|
| 1 | The owner holds the bank token / OTP as final approver; the service provider can only be the maker | Separates the maker from the real approver in the system, not just on paper |
| 2 | Set two-tier approval limits and require two approvers for transactions above a set limit | Removes the risk of a single person completing a transaction alone |
| 3 | Lock the beneficiary register (beneficiary whitelist); adding or changing an account number requires approval separate from payment approval | Prevents account numbers being changed after approval |
| 4 | The owner has view-only access to every bank account and enables real-time alerts for incoming and outgoing transactions | Data comes directly from the bank, not through the service provider's hands |
| 5 | Bank statements are sent directly from the bank to the owner's e-mail | Statements must not pass through the hands of the person being checked |
| 6 | The company owns the username and password for the Revenue Department e-Filing system and Social Security; the service provider is granted access under the company's account | Prevents filing without the company seeing it, and prevents data being held hostage when the engagement ends |
| 7 | The owner pulls tax payment receipts from the Revenue Department system every month | Confirms that the return has been filed and the tax paid, rather than just being told it has been filed |
| 8 | Bank reconciliations are reviewed every month by a third party, such as the owner, an internal auditor or a financial adviser | Restores the missing detection mechanism |
| 9 | The service provider submits a register of suspense accounts and adjusting entries every month, with an explanation of each item | Suspense accounts and adjusting journals are the main channel for covering traces |
| 10 | State in the contract that the company owns all accounting data and has direct access to the accounting system at all times | Prevents data being held hostage in a dispute or when changing provider |
Clauses to include in the engagement contract with the accounting firm
| Topic | Wording to include |
|---|---|
| Scope of work and deliverables | An itemised list of monthly deliverables with due dates, such as the trial balance, the three financial statements, bank reconciliation reports for every account, a suspense account register, an adjustments register, and copies of tax returns and payment receipts |
| Exclusions | State clearly that the service is not an audit, does not provide assurance and does not cover fraud detection, so that the owner knows to arrange additional layers of review themselves |
| Financial authority | The service provider acts only as the maker of entries. Final approval rests with the company, and the service provider must not hold the approver's token |
| Data ownership | All data, documents and accounting files belong to the company. They must be handed over within 15 days of the contract ending, and the handover must not be conditional on payment of outstanding fees |
| Access and inspection rights | The company and any auditor it appoints may access the accounting system and working papers at any time without prior notice |
| Liability and insurance | Set a liability cap and provide for compensation for penalties or surcharges caused by the service provider's errors, and require professional indemnity insurance |
| Conflict of interest | The service provider must disclose it if it also provides services to the company's counterparties, contractors or affiliates |
| Confidentiality and PDPA | Personal data protection requirements for project customers' data |
| Handover plan | Steps and timeline for handing over work when changing service providers, including handover of the usernames for the tax refund system |
Liabilities that cannot be transferred, even by outsourcing
| Legal duty | Who bears it | Notes |
|---|---|---|
| Keep proper accounts and retain documents for at least 5 years (Accounting Act 2000) | The company and its authorised directors | A hired bookkeeper has separate duties of their own, but this does not relieve the company of its liability |
| File returns and pay tax correctly and in full (Revenue Code) | The company is the taxpayer; the directors sign the returns | Penalties, surcharges and, in cases of intent, criminal liability are risks for the company and its directors |
| Manage the business with due care (Civil and Commercial Code) | Directors | Handing work to outsiders without a supervisory system may be seen as a failure to exercise sufficient care |
| Safeguard advance payments received from condominium unit buyers | The developer company and its directors | If customer money is misused to the point that units cannot be transferred, this can lead to both civil claims and fraud allegations |
Outsourcing reduces workload but not liability. What the owner buys is manpower, not responsibility. When 5 of the 7 steps are sent out, the owner must bring at least one independent layer of review back in
Illustrative example: every payment approved, but the money went out to the wrong place
The directors approved every payment on paper and sent the approvals to the accounting firm to make the transfers. It was later found that several transfers had gone to account numbers that did not match the vendor on the approval form, because adding payee account numbers in the banking system was not controlled separately from making payments. In the books, the entries were recorded under the correct vendor names, so the bank reconciliation balanced every month and there was no sign of a problem in the financial statements, until one vendor chased up a payment it had not received
Lesson: A bank reconciliation performed by the person who made the transfers is not a control. Locking the payee register is essential
Project owner's corner: what to look for and what to ask
- Do not use the company's account as a personal wallet. If borrowing is necessary, have a contract, market-rate interest and a board resolution
- Request statements directly from the bank every month, then sample 5 payments and trace each back to its approval and the identity of the payee
- Ask every month: how many payee account numbers were added or changed, and who approved them
- Check who actually holds the bank token and the Revenue Department system usernames today
Internal auditor's corner: checkpoints
- Focus testing on accounts that no outside party can confirm, such as cash, stock and transactions with directors
- Test segregation of duties at the level of access rights in the banking and accounting systems, not at the level of the organisation chart
- Test the 3-way match between the approval, the statement entry and the accounting record, focusing on whether the payee matches
- Review the payee register retrospectively for duplicate account numbers, payees using individuals' accounts, and account number changes made no more than 7 days before the payment date
This content is management and internal audit guidance, not a legal or tax opinion for a specific case. Check the current law and consult an auditor, tax adviser or lawyer before making decisions in a real case.