Payment Collection and Internal Controls

1. Payment Collection and Internal Controls

2. Why Are We Here? • To enhance our business practices • To provide a safety net for individuals, departments, and the university • To establish internal controls related to accepting payments at the university

3. The role of internal controls and designations of accountability How to apply appropriate segregation of duties criteria The roles, responsibilities, procedures, and constraints associated with each step What Will We Learn?

4. Why Are You Here? • Your department/unit/office has been identified as an official payment collection area • Certification is required in order to process payments

5. To Achieve Certification • Participate in training • Pass payment collection certification test

6. Agenda • Accountability & Internal Controls • Segregation of Duties • Record Keeping • Authorization • Custody • Reconciliation • Good Business Practices

7. What are the different forms of payment accepted at the university? • Currency and coin • Checks • Credit cards • Money orders • Travelers checks • Electronic funds

8. Agenda • Accountability & Internal Controls • Segregation of Duties • Record Keeping • Authorization • Custody • Reconciliation • Good Business Practices

9. Accountability – What is it? • Delegation of authority to qualified persons to: • Initiate, approve, process and review business transactions • Holding these persons responsible for: • The validity, correctness and appropriateness of their actions

10. Accountability • Everyone is accountable for their actions • Of all the individuals involved in the receipt, recording and balancing of funds, the person of ultimate responsibility is the custodian • Payment processors are accountable for • Recording payments accurately • Observing all of the USF internal controls • Protecting the cardholders information

11. Accountability • Supervisors are accountable for • Proper allocations of payments • Assignment of duties that comply with separation of duties guidelines • Others are accountable for • Proper transfer of custody of payments • Accountable officers are ultimately responsible for payment transactions.

12. Myth Internal controls are essentially negative, a list of “thou shalt nots.” Truth Internal controls ensure the right things happen the first time, & every time. Internal Controls Tone at the Top, Issue 20 11/03 Institute of Internal Auditors

13. Internal Controls • Protect the staff • Protect the payments • Help define what you do as a payment processor

14. Examples of Internal Controls • Generally, access to credit card terminals and POS systems must be limited to a primary and a secondary custodian • Physical safety of the information and equipment must be ensured at point of collection and when stored overnight

15. Examples of Internal Controls • All adjustments must be documented and approved by a supervisor (authorizer)

16. Examples of Internal Controls • The payments must balance to the system where the payments were recorded • Deposits must be reconciled to the general ledger

17. A Real Life Example • You drive to a local store to purchase ten pieces of sod to repair a spot in you lawn • The following actions occur • How many internal controls can you identify?

18. A Real Life Example • You walk up to a cashier to buy a product • Cashier scans a bar code in a brochure • You pay for the sod and are given a receipt • With instructions to go outside to see an attendant • Outside the store you present the receipt and learn you were charged the wrong amount • You go back in the store; a supervisor is called to void the receipt and ring up the new sale • Then you go outside to pick up what you bought

19. What Internal Controls Were Observed? • Bar codes were used for inventory and pricing control • You paid a cashier; no one else could accept payment • You were given a receipt • An attendant had to deliver the product to you (prevents theft and errors and confirms you were charged correctly) • A supervisor had to make the corrections; they acted as an authorizer • The attendant initialed the receipt to acknowledge you received what you paid for

20. Agenda • Accountability & Internal Controls • Segregation of Duties • Record Keeping • Authorization • Custody • Reconciliation • Good Business Practices

21. Segregation Of Duties “Segregation of duties provides the assurance that no one individual has the physical and system access to control all phases of a business process or transaction: from authorization to custody to record keeping.” Diane McKiernan, Logical Apps (a certified Oracle partner)

22. Four Functions of Segregation of Duties • The four functions are Record Keeping, Authorization, Custody and Reconciliation • The ideal is that any one person performs only one function; four people are needed for the four functions • If one person performs two functions • Risk exists that presents the opportunity for something to go wrong • A compensating control is needed to reduce the risk • The compensating control might be an extra layer of review

23. When Segregation Is Not Possible • Provide mitigating or compensating controls • Design additional procedures to reduce risk • Design data system security roles to restrict access

24. Example of a Compensating Control • When a cashier receives a payment, they also record the payment • The cashier is acting as a custodian and a record keeper • This creates risk • As a compensating control, after the cashier balances at end-of-day, a supervisor reviews the balancing and signs off

25. Agenda • Accountability & Internal Controls • Segregation of Duties • Record Keeping • Authorization • Custody • Reconciliation • Good Business Practices

26. Record Keeping - Definition • Record keeping is the process of creating and maintaining departmental records • Record keeping may occur manually or through an automated data system

27. Record Keeping – Examples at USF • Mail log - paper or electronic • Customer cash receipts • Official USF pre-numbered cash receipts • System generated cash receipts • Deposit slips • Credit card receipts • Electronic funds transfer (EFT) payment documentation • Cashier balancing reports • System sales reports

28. Record Keeping - Retention • Observe record retention requirements • Records serve multiple needs • Satisfy audit needs • Helpful in researching a question

29. Agenda • Accountability & Internal Controls • Segregation of Duties • Record Keeping • Authorization • Custody • Reconciliation • Good Business Practices

30. Authorization • Authorization is the process of granting formal approval to perform a specific function • For example, someone must be authorized in order to perform one of the following functions: • Verify cash collections • Review daily balancing reports • Approve discounts, voids, or refunds

31. Authorization • The person who originally created a transaction should not be the one who reviews and approves a correction, creates a void, or issues a refund • The best practice is to have a supervisor review and approve the correction using an ID of their own

32. Agenda • Accountability & Internal Controls • Segregation of Duties • Record Keeping • Authorization • Custody • Reconciliation • Good Business Practices

33. Custody • Having access to or control over any physical asset • Examples of custodians: • Collector of funds • Deposit preparer • Anyone with access to safes, lock boxes, & file cabinets where funds are kept • Custodians of petty cash funds or change funds

34. Custody – System Passwords • Your cash register or Point Of Sale system should be password protected to assign accountability and fix responsibility • Every person must have their own password • Passwords must never be shared • Don’t write your password down • If you need to leave the work area, sign off your password; log back on when you return • Passwords should be changed periodically • Passwords should be inactivated whenever a custodian vacates the position

35. Custody – Register Keys If your cash register or point-of-sale system uses key access: • Only essential staff should possess the keys • An inventory of the keys should be kept • Keys should never be shared • Keys must be collected whenever a custodian vacates the position

36. Custody – Storage of Funds The safe or lock box combination should be changed: • Any time an employee with knowledge of the combination or access to the key terminates or is reassigned • Periodically • Funds should never be stored in a desk, even if it is locked

37. Agenda • Accountability & Internal Controls • Segregation of Duties • Record Keeping • Authorization • Custody • Reconciliation • Good Business Practices

38. Reconciliation & Balancing • Cashier Balancing • Check Log Balancing

39. How Would You Define Reconciliation ? • A reconciliation is simply a comparison of two sets of information as of the same point in time • Identify the differences between what actually did post in Finance Mart vs. what you expected to post in Finance Mart

40. Why Reconcile? • Good internal controls and sound business practices necessitate the reconciliation of funds by business staff • USF needs assurance that all assets are safeguarded and used to the best benefit of the university

41. What Do We Reconcile? • Point of sale transactions ( POS ) • Check logs • Transaction reconciliation • Budget review and reconciliation • Credit cards

42. Point Of Sale Transactions • The POS system should • Record sales and cash collections • Produce a daily detailed sales report • Produce a pre-numbered customer receipt • Reconciliations to perform • Balance the cash drawer • Balance the day’s sales to actual collections • Reconcile daily balancing sheet to deposit

43. Transaction Reconciliation • Reconcile • Deposits to accounts receivable postings • Deposits to general ledger postings • Inventory to sales

44. Non-inventory Reconciliation • Some sales may not involve tangible inventory • To ensure that all billings have been completed, review • Room usage logs • Equipment or lab usage logs • Participant lists or class rolls • Order forms or contracts for services

45. Credit Card Reconciliation • When credit cards are used with a POS • POS system should produce a report of credit card transactions • Compare the POS report to the daily settlement report • Supervisor reviews this

46. Reconciliation - Guidelines • Reconciliation must be performed by a person with no cash handling responsibilities • The reconciliation form must be dated and signed or initialed • The prescribed procedure should be followed

47. Agenda • Accountability & Internal Controls • Segregation of Duties • Record Keeping • Authorization • Custody • Reconciliation • Good Business Practices

48. Financial Responsibility • Become familiar with the USF policy regarding fraud prevention and detection • http://generalcounsel.usf.edu/policies-and-procedures/pdfs/policy-0-024.pdf

49. Oversight & Monitoring of Accounts Receivable (AR) • Outstanding AR is reviewed at least monthly • Someone other than the person who maintains AR conducts the review

50. Are You Ready For The Test? • Accountability • Payment processors are accountable for • Recording payments correctly • Observing USF internal controls • Internal controls exist • To protect the staff • To protect the cash