Educating Staff Employees

1. Educating Staff Employees Internal Controls

2. Welcome One of the first things we need to do is get an understanding of who you all are and figure out just what it is you want to get out of this session. [Poll the audience] Ask for examples, both of wants and needs One of the first things we need to do is get an understanding of who you all are and figure out just what it is you want to get out of this session. [Poll the audience] Ask for examples, both of wants and needs

3. Review the basics Identify objectives of training Discuss training methods Identify next steps

4. NYS Internal Control Act The COSO Report NYS Standards for Internal Control Division of Budget, B-350 Internal Control Task Force (ICTF) 1987 NYS Governmental Accountability, Audit & Internal Control Act of 1987 1992 COSO – An Integrated Framework 1999 NYS Standards for Internal Control 2003 OSC 2003-14, State Agency Internal Audit Units’ Compliance with Internal Control Act 2004 Internal Control Task Force is formed The concept of Internal Controls has been around for a long time, but it wasn’t until the last twenty years that someone standardized an actual definition for us to use. These two items are really the starting points for us. As usual, NYS was ahead of the game, but it was really COSO that created the framework that we’ll be working from. NYS updated its Internal Control Act (incorporating COSO) in 1999 as the Standards for Internal Control Spurred on by a series of financial reporting scandals, the main organizations that issue accounting and auditing standards, set out to determine what was going on and how to correct what was becoming a pervasive problems. The result was the Treadway Commission, which in September 1992 issued the COSO report - Internal Controls – Integrated Framework. 1987 NYS Governmental Accountability, Audit & Internal Control Act of 1987 1992 COSO – An Integrated Framework 1999 NYS Standards for Internal Control 2003 OSC 2003-14, State Agency Internal Audit Units’ Compliance with Internal Control Act 2004 Internal Control Task Force is formed The concept of Internal Controls has been around for a long time, but it wasn’t until the last twenty years that someone standardized an actual definition for us to use. These two items are really the starting points for us. As usual, NYS was ahead of the game, but it was really COSO that created the framework that we’ll be working from. NYS updated its Internal Control Act (incorporating COSO) in 1999 as the Standards for Internal Control Spurred on by a series of financial reporting scandals, the main organizations that issue accounting and auditing standards, set out to determine what was going on and how to correct what was becoming a pervasive problems. The result was the Treadway Commission, which in September 1992 issued the COSO report - Internal Controls – Integrated Framework.

5. The integration of the activities, plans, attitudes, policies, and efforts of the people of an organization working together to provide reasonable assurance that the organization will achieve its mission.

6. Pop Quiz What are the five components of Internal Control?What are the five components of Internal Control?

7. Ensure efficient & effective operations Safeguard resources Help adhere to laws & directives Provide reliable data & timely reports COSO referred to this as a framework, because it’s meant to be a blueprint that organizations can follow. These five areas are components because even though they have a natural order, like the people in a unit, they are all equally dependent upon each other. They’re rather like the links of a chain – the strength and integrity of the chain itself is only as strong as the individual components. In our work, we’ve found that the majority of problems in an organization can be traced back to a weakness in one or more of these components. Internal Controls are about People, Process and Technology COSO referred to this as a framework, because it’s meant to be a blueprint that organizations can follow. These five areas are components because even though they have a natural order, like the people in a unit, they are all equally dependent upon each other. They’re rather like the links of a chain – the strength and integrity of the chain itself is only as strong as the individual components. In our work, we’ve found that the majority of problems in an organization can be traced back to a weakness in one or more of these components. Internal Controls are about People, Process and Technology

8. B-350

12. Internal Control Task Force

13. Charged with providing guidance on the development of an ongoing education and training plan to assist agencies in complying with the training provision of the Internal Control Act.

14. Agency management should identify and assign staff to one of three training levels: Line Staff Middle Management Executive Management In order to maximize benefits, training should be targeted based on staff roles and responsibilities.In order to maximize benefits, training should be targeted based on staff roles and responsibilities.

15. This “basic” level targets agency staff whose job responsibilities are clearly defined according to established procedures. Generally speaking, staff at this level do not have specific supervisory responsibilities, and are not responsible for establishing policy

16. The objective at this level is to provide education and awareness of the basic fundamentals of why internal controls are important and how they serve as an effective means to control risks. In addition to the examples provided by the ICTF, agency management should also identify learning objectives that are specific to their respective agenciesIn addition to the examples provided by the ICTF, agency management should also identify learning objectives that are specific to their respective agencies

17. Recognizing risks and controls Understanding agency goals Knowing that everyone has a role to play and accountability is not optional! Each line staff employee must understand that it is their responsibility to seek ways to identify and eliminate wasteful controls that impede performance and to strengthen those controls designed to provide accountability and to preserve assets and scare resourcesEach line staff employee must understand that it is their responsibility to seek ways to identify and eliminate wasteful controls that impede performance and to strengthen those controls designed to provide accountability and to preserve assets and scare resources

18. Training Methods

19. Several factors to consider: Agency size Internal Control Staff resources Level of Executive Support Amount of cooperation with other agency units

20. Variety of tools that can be used Training Classes Orientation Session Newsletters Posters Intranet webpage

21. Training Classes

22. ALL employees attend a training session on Internal Controls Training sessions mandatory (depending on executive level support) Employees should be trained on a fixed schedule basis

23. Positive attributes: All employees are educated on Internal Control basics on a fixed time schedule (annually/biannually) Required in-person attendance gives employees opportunity to ask questions and get better understanding of the Internal Control Concepts

24. Challenges: Requires significant executive support for the Internal Control Program Requires significant staff time to create and present training sessions Probably more effective for smaller agencies with centralized staff – may be difficult to implement with larger agencies and those with numerous field staff

25. Orientation

26. Incorporate Internal Controls training as part of the New Employee Orientation Session Presentation given at Orientation Session by Internal Control Officer Self-guided Internal Control Power Point presentation during session.

27. Positive attributes: All new employees are educated about the department’s internal control program and internal control basics Doesn’t require as much staff time as mandated training sessions for all employees Doesn’t require additional time for the employees to attend another session.

28. Challenges: Requires cooperation and coordination with HR and Training Units in the Department Requires staff time to present at the sessions and/or prepare the self-directed power point presentation Other topics are presented at the session, so employees may not give full attention to Internal Control Program

29. Quick Hitters

30. These are items that are brief in nature and are intended to promote general awareness of the basic concepts of internal controls. Broadcast messages Brochures & Pamphlets Newsletters & Bulletins

31. Newsletters are prepared by the Internal Control Unit and distributed to all employees Posters are created in support of the Newsletter using the same key themes Can cover a variety of Internal control topics, or can cover internal controls in different units of the organization

32. Positive Attributes: Provides employees with information about internal controls in place, basics of internal controls Does not require employee attendance Can be prepared on a scheduled basis – set by Internal Control Unit (i.e. quarterly)

33. Challenges: Requires Internal Control staff time to create the newsletter articles Cooperation with the communications/ graphics unit is needed Articles may be based on activities of different units in the organization and this requires their participation and support

34. Agency Intranet

35. Establish an Internal Controls Webpage on your agency’s Intranet page Provides employees with: basics of Internal Controls Internal Control Unit information Risk assessment tools Useful internal control information links

36. Positive Attributes: Always available to employees on the intranet Can be updated to provide recent information Doesn’t require much Internal Control Staff time for updates

37. Challenges: Requires coordination with communication unit/ information technology unit Needs to be kept current and up to date May not be best for agencies with significant amount of field staff that do not regularly check the intranet

38. There are other methods that can also be used: Contests/quiz games Presentations at staff/division meetings Training events with other units (e.g. internal controls and information security)

39. Review Key Points

40. Keep current on the standards Be visible Provide information & guidance whenever possible Build a Resource Library Each line staff employee must understand that it is their responsibility to seek ways to identify and eliminate wasteful controls that impede performance and to strengthen those controls designed to provide accountability and to preserve assets and scare resourcesEach line staff employee must understand that it is their responsibility to seek ways to identify and eliminate wasteful controls that impede performance and to strengthen those controls designed to provide accountability and to preserve assets and scare resources

41. Recognizing risks and controls Understanding agency goals Knowing that everyone has a role to play and accountability is not optional! Each line staff employee must understand that it is their responsibility to seek ways to identify and eliminate wasteful controls that impede performance and to strengthen those controls designed to provide accountability and to preserve assets and scare resourcesEach line staff employee must understand that it is their responsibility to seek ways to identify and eliminate wasteful controls that impede performance and to strengthen those controls designed to provide accountability and to preserve assets and scare resources

42. Use a variety of methods: Orientation Sessions Newsletters Posters & Pamphlets Intranet webpage Keep it current!

43. Any additional ideas? What do you do in your agency?

44. Questions ?