Internal Control Concepts

1. Internal Control Concepts A Guide for Deans, Directors, and Department Chairs

2. What are internal controls and why are they important?

3. Internal control is a process, effected by an organization’s people, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: • Effectiveness and efficiency of operations • Reliability of financial reporting • Compliance with applicable laws and regulations

4. That sounds kind of technical. What does it mean in layman’s terms?

5. Consider your own personal internal control system: • When you came to work today, did you lock the doors to your house? • Do you keep the PIN number for your ATM card confidential and in a safe place? • Do you balance your checking account each month? • Do you compare credit card statement charges with your signed receipts? • Are you planning and saving for retirement?

6. In our University environment internal controls serve the same purpose: • Protect the University’s assets • Ensure records are accurate • Promote operational efficiency • Encourage adherence to policies

7. Most internal controls can be classified as PREVENTIVE or DETECTIVE • Preventive - designed to discourage errors or irregularities. • Detective - designed to identify an error or irregularity after it has occurred.

8. Examples of Preventive Controls • Reading and understanding applicable areas of the University Electronic Handbook • A manager’s review of purchases for a proper business purpose prior to approval • A computer application that requires password protection

9. Examples of Detective Controls • An exception report from the electronic timekeeping system • A comparison of transactions on monthly operating reports with departmental source documents • A manager’s review of long distance telephone charges

10. Who is Responsible for Internal Control?

11. Virtually all employees play some role in effecting control.

12. An organization’s leaders are ultimately responsible and must assume“ownership” of the internal control system for theirareas of responsibility.

13. Provides leadership and direction to senior administrators. Together with them, the president shapes the values, principles, and major operating policies that form the foundation of the institution’sinternal control system. The President

14. Vice Presidents • Colleges • Departments • Auxiliary Operations • Support Services Provide direction to senior administrators responsible for major functional areas such as:

15. Deans, Directors, andDepartment Chairs Have line responsibility for designing and implementing control systems at unit levels. Are responsible to execute institution-wide control policies and procedures. These responsibilities should come with authority and accountability to the next higher level.

16. What is the Manager’s Responsibility?

17. You, as a manager, are responsible for ensuring that internal controls are established and functioning to achievethe mission and objectivesof your unit.

18. To evaluate internal controls, first think about the followinggeneral objectives: • Propriety of transactions • Reliability and integrity of information • Compliance with University policies and government regulations • Safeguarding assets • Economy and efficiency of operations

19. Next, identify your unit’s specific objectives within these same broad categories: • Propriety of transactions • Reliability and integrity of information • Compliance with University policies and government regulations • Safeguarding assets • Economy and efficiency of operations

20. Identify what controls currently exist or that should be established to reasonably assure the achievement of each specific objective of your unit.

21. What is the Office of Compliance and Audit Responsibility?

23. Internal Auditing provides an independent evaluation of the adequacy of internalcontrols and reports the results to theUniversity Administration.

24. The auditor’s evaluation includes an examination of the following internal control elements: • Personnel • Authorization Procedures • Segregation of Duties • Physical Restrictions • Documentation and Record Retention • Monitoring Operations

25. What Can JeopardizeInternal Controls?

26. Inadequate segregation of duties • Inappropriate access to assets • Inadequate knowledge of University policies • Form over substance • Control override • Inherent limitations

27. How Much Do Internal Controls Cost?

28. The Cost of Implementing a Specific Control Should Not Exceed the Expected Benefit of the Control. • The potential loss of a computer printer may justify the cost of a door lock but not an alarm system.

29. Sometimes there is no out-of-pocketcost to establish an adequate control.A realignment of duty assignmentsmay be all that is necessary toaccomplish the objective. • Voided receipts are approved by someone (preferably a manager) other than the person preparing receipts.

30. A well designed internal control structure: • Enhances operations by improving overall efficiency and effectiveness • Reduces the risk of loss through fraud or theft

31. Questions about internal control and your specific area of responsibility? • Contact the Office of Compliance and Audit, C-260 ASB • Telephone ext. 8-3853 Information for this presentation was obtained from “Internal Control Concepts”, NC State University, Internal Audit Division, http://www2.acs.ncsu.edu/audit/selfaccs/intcont/controls.htm