INTERNAL CONTROL

Internal control basicsProcesses to review

Tracking tools

INTERNAL CONTROL

Internal control is a process – effected by those charged with governance, management, and other personnel designed to provide reasonable assurance about the achievement of an entity’s objectives which may fall into 3 categories:

Reliability of financial reporting

Effectiveness and efficiency of operations

Compliance with applicable laws and regulations

WHY ARE INTERNAL CONTROLS IMPORTANT?

Effective internal controls• Safeguard public resources• Protect employees• Assist in fraud prevention

FIVE COMPONENTS OF INTERNAL CONTROL

• Control Environment• Risk Assessment• Control Activities• Information and Communication• Monitoring

CONTROL ENVIRONMENT

• Starts at the top and sets the tone. Functions well if Management believes that controls are important and communicates that view to employees at all levels.

• Foundation for all other components of internal control providing discipline and structure.

• Key managers responsibilities clearly defined.

• Reflective of managements respect for and adherence to compliance requirements.

• The person assigned to perform the internal control review must be or become, if not already familiar with the day-to-day activities of the entity.

• Organizational charts

• Planning and budget documents

• Job descriptions

• Inventory of statutory responsibilities and authorities

• Policies and procedures manuals

• Reports

• Audits, management reviews, program evaluations

• Internal control policies and procedures

EVALUATION OF GENERAL CONTROL ENVIRONMENT

RISK ASSESSMENTS

• Identify the vulnerability of each assessable entity to waste, loss, unauthorized use or misappropriation.

• Consider Internal as well was External Events. (change in personnel)

• Consider Controls that have not been reviewed for a period of time.

• Analyze for possible effect, considering the likelihood and impact.

• Consider factors unique to your agency

• Past experience

• Staffing levels and experience

• Complexity of activities in relation to your mission

• Determine how to respond to each risk and who is responsible.

STEP 1: IDENTIFY EVENTS(RISKS) ASK

• What practices are being questioned by auditors and other oversight agencies?

• What information is critical to the agency’s operations and how vulnerable is it?

• What activities are regulated by the federal or state government?

• Are assets (cash, inventory, fixed assets) adequately protected?

• What circumstances may endanger future funding of your programs?

• New personnel.

• Incorporation of new technology.

STEP 2: ANALYZE IDENTIFIED RISKS

• How important is this risk?

• How likely is it that this risk will occur (likelihood)?

• How large is the dollar amount involved (impact)?

• To what extent does the risk potential of one activity affect other activities?

• Are existing controls (policies and procedures) sufficient to manage this risk?

• To what degree are secondary controls in place?

SPEAK THEIR LANGUAGE

• What is the mission?

• What will stop you from completing that mission?

• What preventative steps are you taking to reduce or eliminated that risk?

STEP2 CONTINUED: PRIORITIZE IDENTIFIED RISKS

• Likelihood = the possibility that a given event will occur.

• Impact the result or effect of an event.

• 3= High Risk – Mitigate or reduce the risk.

• 2= Medium Risk – Manage the risk.

• 1= Low Risk – Accept the risk.

DETERMINE A RISK RESPONSE

• Identify possible response• Accept and Monitor

• Transfer (Share)

• Reduce the likelihood

• Reduce the impact

• Avoid

• Evaluate the risk responses• Consider the likelihood and impact

• Consider costs and benefit

• Select a response

CONTROL ACTIVITIES ARE THE POLICIES AND PROCEDURES THAT HELP ENSURE THAT MANAGEMENT DIRECTIVES ARE CARRIED OUT.

• Policies and Procedures

• Management objectives (clearly written and communicated throughout the agency)

• Approvals and Authorizations

• Verifications

• Reconciliations

• Segregation of duties

• Physical and access controls

• Education, training and coaching

CONTROL ACTIVITIES IN A STRONG SYSTEM OF INTERNAL CONTROL

• Pre-numbering Documents

• Authorization of transactions

• Independent Checks to maintain asset accountability

• Documentation

• Timely and appropriate performance reviews

• Physical controls for safeguarding assets

• Segregation of duties

INFORMATION AND COMMUNICATION

• Risk communication creates a dialog about the existence, nature and severity or acceptability of risks.

• Communication can be formal through reports, training, written policy manuals, accounting and financial reporting manuals

• Communication can be informal through e-mail, speech, and actions of management.

• Most effective when travels in all directions.

MONITORING

• The process that assesses the quality of internal control performance over time by assessing the design and operation of controls on a timely basis and taking the necessary corrective actions.

• Allows an agency to react dynamically to change.

• Ensures things are working as planned

• Ongoing – Supervisory review of reconciliations, reports and processes.

• Periodic – internal audit sampling and at least annual reviews of high-risk business processes.

LIMITATIONS ON INTERNAL CONTROL

• Human Error which may include errors in the design or use of automated controls.

• Deliberate circumvention of controls by collusion of two or more people.

• Management override of internal controls.

• Segregation of duties issues.

RECOMMENDATIONS/ REPORTING

• A brief narrative of potential subsequent actions.

• Develop a new policy and/or procedure.

• Provide additional training.

• Functionally realign responsibilities to improve the segregation of duties.

• Schedule a detailed internal control review.

• Give any reasons why subsequent action should not be taken. For example: cost implement corrective action exceeds the value of the relative risk; legal mandate requires that the controls be in place even though costs exceeds perceived benefits.

BALANCE SHEET REVIEWS

• Cut-off procedures for Liabilities – Payroll and A/P

• Controls over Assets in FAE – How are new assets communicated to finance, depreciation calculations, disposal of assets.

• Matching/Timeliness – Expenses recorded in the proper period.

• Accuracy of tuition revenues – resident, non-resident, who gets a waiver.

• Who prepares and reviews your journal entries?

• Investments – Who controls? Who reviews?

EVENT CYCLE

• Determine the event cycle. Review the series of processes which initiate and achieve an end product. Each have a defining beginning and ending point.

• Examples

• The disbursement cycle begins with the submission of the A-19 ends with a check printed.

• A student loan event cycle begins with the receipt of an application and concludes with the disbursement of the loan.

DOCUMENT EACH EVENT CYCLE

• Interview the person(s) involved in the cycle

• Review existing documentation

• Observe the activity

• Prepare either a narrative explanation documenting personnel performing the procedures, the forms and records developed and maintained, the number or dollar value processed.

• Walkthrough of the process from start to finish by tracing transactions from start to finish.

PROPER SEGREGATION OF DUTIES

• Properly segregate duties so that no one person performs two or more of these functions

• Processes/records transactions

• Authorizes/Approves transactions

• Has custody of asset related records

INCOMPATIBLE DUTIES

• Payroll – process payroll, employee file maintenance, receive/distribute checks/ prepare bank reconciliation

• A/R – prepare deposit, access cash and check/ perform cash application in HP/ prepare bank reconciliation

• A/P – setting up vendors/ processing payments/ printing checks/preparing bank reconciliation

• Journal entries/Reconciliations – Prepare, sign, date must have a second reviewer sign and date.

AREAS OF EXPOSURE

• Employees who control a transaction, process or function from beginning to end. Not the entire system of cash receipts or disbursements, but rather a small slice.

• Primarily serves as bank account custodian but also performs the monthly reconciliation.

• Primarily acts as a cashier but also prepares the daily bank deposit.

• Primarily prepares input in account payable, but also has access to the checks.

• Prepares customer A/R cancellations and adjustments (write-offs) but also acts as a relief cashier.

• Primarily acts a cashier, but also reconciles the bank deposit information with the organizations accounting records.

• Employee with custody of assets, authorization or approval affecting those assets and reporting of related transactions.

PREVENTION OF SOD ISSUES

Hire additional staff

Split the responsibility between two existing staff members

Establish a monitoring program for this key employee that effectively accomplishes a segregation of duties without hiring or using 2 employees to do the job, such as having an independent party monitor key employee tasks.

DON’T FORGET ABOUT THE HP

• Documented procedure to remove terminated employees and periodically verify terminated users have been removed.

• Appropriate approval of new users and new menu access.

• Review current menu access for segregation issues.

• Be mindful of back up personnel. Make sure their additional duties to not create segregation of duties issues.

• Don’t share passwords.

POP QUIZ

• The 2012 Association of Certified Fraud Examiners Report to the Nations on Occupational Fraud and Abuse analyzed where fraud is occurring and at what frequency by industry. Where do you think government and public administration cases rank?

• A. 7th

• B. 1st

• C. 2nd

• D. 15th

CASH RECEIPTING LOSS PREVENTION AND DETECTION• Adequate SOD

• Compare Bank deposits to cash receipts records and verify the mode of payment agrees – deposits are intact.

• Review voided transactions to ensure they are supported

• Verify inventory records agree to usage

• Review bank reconciliations

• Perform surprise cash counts

• Look for missing deposit slips

• Look for unusual activity by employee or department

• Look for unusual journal entries

ADDITIONAL CASH RECEIPTING CONTROLS

• Safeguard and limit access to receipts awaiting deposit. How long has it been since the safe combination was changed?

• Perform a periodic “look back” of revenues. Do they make sense given your understanding of operations?

• Review receipt sequence. Are receipts used in sequential order? Are all receipt numbers accounted for?

• Review bank reconciliations. Are they timely? Do the reconciling items make sense?

• Get a handle on unanticipated revenues

• Create and review error reports

• Know who is receiving the billing complaint calls

• Mandatory vacations

• Cross train duties

PURCHASE CARD REVIEW

• Ensure second signature on all submitted P-card logs.

• Ensure detailed credit card receipt is received, summary only is not acceptable.

• Statements paid without detail receipt to support purchase.

• Ensure items that were purchased are received and on-site.

• Review purchases for unusual vendors.

• Expense greatly exceeds what was budgeted or prior year totals.

ACCOUNTS PAYABLE CHECK REVIEW

• Review Travel Expense Report – Require conference agendas/registration be included in submission to ensure per diem is not submitted.

• Support is originals and not photocopies.

• Review vendor lists for unusual vendors or excessive payments.

• Reports are approved by budget authority or someone other than employee submitting for reimbursement.

• Ask follow up questions on unusual items. Confirm with a third party if necessary.

• Ensure reimbursement is not for expenses paid by college credit card.

ADDITIONAL PAYMENT CONTROLS

• Ensure items purchased are on site.

• If you use positive pay make sure you know what the bank is verifying.

• Review for expenses that end in round numbers.

• Have an expectation of reasonable expenses and compare it to actual payments entered into the system.

• Checks should never go back to the department or person that initiated the payment.

PAYROLL INTERNAL CONTROLS

• Review payroll expenses for unusual fluctuations and amounts that are outside of your expectation, including benefit line items and overtime.

• Review personnel files to ensure you are not paying ghost employees.

• Look for unusual journal entries.

• Look for employees that rarely or never take leave.

• Review payroll reports for employees that use a PO box.

DOCUMENTATION/EVIDENCE OF REVIEW

• Required to have adequate written documentation of activities conducted in connection to risk assessments, review of internal control activities and follow-up actions.

• Completed risk assessments

• Spreadsheets

• Write up of process

• Testing documentation

DATECheck

Number Vendor Amount PO attachedProper Coding

meals with meetings

form/travel request Proper Approval paid timely

Y winning bid on RFP14-001

y subscription no quote necessaryY no quotes attached/ with in state guidelines

multiple itemsno quote necessary

y

Y Signed by Fisal who is an assistant Dean not a Dean

YY

Y

on contractY

Y

Y

not pre-authorized

no, appears not set over to A/P timely, Billing from 6/7;7/9;7/18;7/22;7/29;8/05;

food service check there

Yes exception addressed with Myra See Newbook

9/23/2014 SID 950557147-S receipt # 8510140990

y student registration for CUSP student leadership conference

signed after event sent back for additional information

Y contract from 2010, pull to verify ratesn/a Bev Lucas9/24/2014 803151 Sharp Electronics 3194.7 no ed 2/ ee 50

Y/Fiasal Jaswal

9/24/2014 803143 Poppinjay's café 242.28 n/a 1H07yes/ off campus

Y/Carla Boyum one not signed

9/24/2014 803122 CUSP 7525 a-19-1as22 264 181 EG

89

n/a Myra Van Vector

9/24/2014 803107 Pete Smith 1850 n/a refund n/a n/a

9/18/2014 802981 Andrew's Fixture Co 5201.25 45986149.051.1J05.J

a.00

n/a Y/Ata Karim

9/18/2014 802967 Arista catering 368.25 n/ayes/ off campus Russ Beard

9/11/2014 802792 Snohomish Publishing Co 2921.89 46005 Watchdog

n/a Y/ Dr Rule

9/11/2014 802783 Alberto Magana 854.23 TEV522.264.1977.

GA00 n/a Y Bill O'conner

9/11/2014 802779 Ata Karim 995.74 TEV 149.061.31K00

n/a Teri Hull

8/27/2014 802372 Eric Nelson 706 45909148.014.1M04.

ER.89 n/a Gayle Solberg

8/25/2014 802404 Apple Computer 64976.2 45694

n/a Y

8/25/2014 802214 Kelly Paustain 1170.92 n/a 149.082.1P15yes/ off campus Y/ Ray white?

8/25/2014 802218 Talakai Construction 2479 45855/45586/503.S09.935.1

x20.SF.89

yes/ off campus No

8/21/2014 802355 Clarus Corporation 8989.03 a-19-1a149.85.1L10.E

G.30 n/a Y / Bart Becker

8/11/2014 802156 Hotel Murano 730.86 N/A149.061.1K25gf00/522.264.1

n/a Y

8/11/2014 802173 USA International 39880 45872148.061.1N74.

ER.89 n/a Y

8/11/2014 802162 PNTA 5549.68 45476149.011.1C05.

JA.00

n/a Y

8/11/2014 802171 Taylor Associates Communications, Inc 4000 45659148.041.1Z00.

EY n/a Y/Teri Hull

8/11/2014 802155 Filter LLC 40295 #45179148.085.K1X.E

R.89

HOW TO KEEP TRACK OF IT ALL

• Survey Monkey• Binders• One - Note• Data Base