NYSICA Internal Control Conference 2007 From Compliance to Commitment

1. NYSICA Internal Control Conference2007From Compliance to Commitment How to Make Testing Internal Controls Understandable and Useful to Managers Presented by: Tom Lukacs NYS Division of the Budget October 22, 2007

2. Internal Control Testing Testing: One, Two, Three…

3. What Is Internal Control Testing? It’s Like Placing Your Procedures Under A Microscope

4. Internal Control Testing Makes sure controls “on paper” are: • Actually being used as designed • Really meet the control objectives

5. Internal Control Testing PURPOSE: Testing controls allows us to: • Have confidence in our control system based on hard data • Spot weaknesses in our control system

6. Internal Controls Are: THE SAFEGUARDS AND MANAGEMENT OVERSIGHT DESIGNED TO: • Prevent, detect, and correct program and/or operational breakdowns • Ensure that goals are met

7. Internal Control Process • Identify Functions • Assess Risk/Vulnerability • Conduct Internal Control Reviews • Take Corrective Action

8. Internal Control Review Checks Whether Controls Work by: • Evaluating If Controls Are Adequate & • Testing If Procedures Are Followed

9. Internal Control Testing In some cases, a simple test may prevent unwanted situations from occurring: Smoke detector Failure to work during fire TestPrevents Test drive a car Buying a lemon Physical exam Serious health problems

10. Types of Control and Examples DOCUMENTATION - Policies and procedures RECORDS - Recording transactions & events AUTHORIZATION - Approving transactions STRUCTURE - Separation of duties SUPERVISION - Monitoring control objectives SECURITY - Safeguarding resources

11. Manager’s Guide:Testing Compliance with Internal Control Requirements Published by DOB to Guide & Assist Agencies In Implementing Testing Programs

12. Steps in the Testing Process • Identify Transaction to Test • Determine Standards that Apply • Select Test Method • Determine Level of Testing • Plan Testing Process • Conduct Test • Document & Assess Results • Take Corrective Action

13. Identify Transaction to Test • Key Controls • High Priority Functions

14. Determine Standards That Apply Identify Performance Goals

15. Select Test Methods Three methods for testing controls to determine if they are working : 1. DOCUMENT ANALYSIS – Review records, forms, or other documents 2. OBSERVATION – Watch the control being performed in practice 3. INTERVIEW – Elicit information from those performing that control

16. Determine Level of Testing • Use Best Judgment Consider Feasibility & Cost-Benefit • Sample Need Not Be Statistically Random/Valid • Depends on Transaction & Type of Documentation

17. Plan Testing Process Get Advice from ICO/IA on: Testing Method, Size & Timing How to Document Results What to do with Results

18. Conduct Test • Be Objective • Be Fair • Be Flexible

19. Analyze Test Results To: Determine specific causes of variances Identify regional or statewide trends Assess actual or potential impacts

20. Take Corrective Action When weaknesses are found, decide to: Institute new controls Improve existing controls, or Accept the risk

21. Summary • Overview of Testing as Part of Internal Control Program • Test to Have Confidence that Procedures are Working • It’s Not Brain Surgery

22. Questions?

23. THANK YOU!!!

24. Internal Control Testing Contact: Tom Lukacs Associate Budget Examiner New York State Division of the Budget State Capitol Albany, NY 12224 (518) 402-4158 Tom.Lukacs@budget.state.ny.us

25. Class Exercise - Case Studies • Work in Teams • 2 Minutes Review & Identify Errors • 3 Minutes Discuss Draft Testing Plan • 5 Minutes Report Out to Group