Developing Written Procedures for Internal Controls

1. Developing Written Procedures for Internal Controls Presented by: Sharon B. Robinson, CPA, MBA Retired!!!!!!!! October 5, 2011

2. Today’s Agenda • What internal controls are • Internal Controls Framework • Types of Internal Controls • Why and how policies and procedures enhance internal controls Government Finance Officers Association of LA ~ October 5, 2011

3. When all else fails, ….. Government Finance Officers Association of LA ~ October 5, 2011

4. …Read the directions? Government Finance Officers Association of LA ~ October 5, 2011

5. Internal Controls Internal controls are the structure, policies, and procedures used to provide reasonable assurance that an organization’s objectives are achieved in the following areas: • Safeguard assets • Effective and efficient operations • Reliable financial reporting • Compliance with applicable laws and regulations Government Finance Officers Association of LA ~ October 5, 2011

6. Key Concepts • Internal control depends on people - People at every level are accountable and responsible for their own processes and transactions. • Managers are responsible for developing and implementing policies and procedures. They also monitor how well policies and procedures are adhered to. Government Finance Officers Association of LA ~ October 5, 2011

7. Quotable Quote “There are two ways to stop fraud—one is to lock up everything around you, and the other is to surround yourself with ethical people.” --Chris Linton, CFE New Zealand’s Inland Revenue Department Fraud Prevention and Investigation from GAO publication Government Finance Officers Association of LA ~ October 5, 2011

8. Internal Control Advantages • Can reveal and minimize errors and omissions • Discourages employee theft • Protects assets • Improves public accountability • Standardizes management practices and procedures Government Finance Officers Association of LA ~ October 5, 2011

9. Who’s Responsible for Internal Controls ? • Management • All Employees • Internal Auditors? • Internal auditors evaluate the effectiveness of internal controls • External Auditors? • Provide independent assessment on the reasonableness of financial reports Government Finance Officers Association of LA ~ October 5, 2011

10. Everyday Examples • Use a PIN with your ATM card. • Lock your doors (house, car, etc.). • Review credit card statements and other bills before you pay them. • Don’t leave blank checks and cash lying around. Government Finance Officers Association of LA ~ October 5, 2011

11. COSO Integrated Control Framework Government Finance Officers Association of LA ~ October 5, 2011

12. Components of Internal Control • Control Environment • Risk Assessment • Control Activities • Information and Communication • Monitoring Government Finance Officers Association of LA ~ October 5, 2011

13. Control Environment • Tone at the top • People are the core of it all. • Ethics • Competence • Integrity • Make everyone conscious of controls • All of the other elements of internal control are based here. Government Finance Officers Association of LA ~ October 5, 2011

14. Control Environment • Includes: • Organizational structure • Formal policies and procedures • Delegation of authority and responsibility • Incentives and rewards • Human resource management, including commitment to personnel competency Government Finance Officers Association of LA ~ October 5, 2011

15. Risk Assessment • The entire organization must be aware of and deal with all risks. • Identify, analyze and manage the risks related to each activity. Government Finance Officers Association of LA ~ October 5, 2011

16. Information and Communication • Ensure that all staff are aware of and trained on policies and procedures (e.g., staff meetings; information systems) • Ensure that the right information is getting to the right personnel Government Finance Officers Association of LA ~ October 5, 2011

17. Monitoring • Tests controls to ensure they are functioning as intended • Allows the organization to make corrections to controls where needed • Auditors (internal and external) • Audit Committees Government Finance Officers Association of LA ~ October 5, 2011

18. Control Activities • Control activities occur throughout the organization at all levels and in all functions. • They can be defined by policies and implemented through procedures. Government Finance Officers Association of LA ~ October 5, 2011

19. Control Activities include: • Approvals • Spending Limits • Reconciliations • Verification • Reviews • Reporting • Segregation of Duties Government Finance Officers Association of LA ~ October 5, 2011

20. Controls Classifications Internal Controls can be classified into two major categories: • Preventive Controls—stopproblems before they happen. • Detective Controls—findproblems after they happen Government Finance Officers Association of LA ~ October 5, 2011

21. Controls Classifications • Preventive controls prevent errors or exceptions. Examples: • Standard policies and procedures • Proper segregation of duties • System limited access Government Finance Officers Association of LA ~ October 5, 2011

22. Controls Classifications • Detective controls are designed to identify an error or exception after it has occurred. • Detective controls include: • Exception reports • Reconciliations • Periodic audits Government Finance Officers Association of LA ~ October 5, 2011

23. Human Resources • For example: Hiring ,Contracts – • Approval for hiring a new employee • Hiring checklist is completed • Verification of contract terms • Contract documentation is signed and kept on file Government Finance Officers Association of LA ~ October 5, 2011

24. Payroll • Timesheets for hourly employees are kept, reviewed, approved and submitted by supervisor • Reconcile payroll reports to timesheets and ISIS/HR audit reports • Review all changes to payroll on a monthly basis • Ensure that information on terminated employees is processed immediately. Government Finance Officers Association of LA ~ October 5, 2011

25. Purchasing and Travel • Know what’s being purchased – approvals • Segregation of purchase, receipt and invoice approval • Documentation and approval of travel and business expenses • Monitoring and reconciliation of P-card purchases – tracking through a budget process Government Finance Officers Association of LA ~ October 5, 2011

26. Budgeting • Approved budget • Monitor and report on budget variance • Communication of budget issues to appropriate level • Ensure proper subcoding for expense type – remember P-card purchases! Government Finance Officers Association of LA ~ October 5, 2011

27. Cash Management • Secure cash locations • Use of lockbox • Use of receipt books • Logs identifying receipts and those who handle cash • Petty cash log review/reconciliation • Bank reconciliations performed by someone other than receiver of cash Government Finance Officers Association of LA ~ October 5, 2011

28. Policies & Procedures: Who needs ‘em? Properly established and implementedpolicies and procedures become invaluable for identifying and delegating responsibilities, preserving a consistent level of quality performance throughout an organization. Government Finance Officers Association of LA ~ October 5, 2011

29. Part of the Internal Control Structure Formal written documentation that instructs, informs, leads, and guides workers • Written policies • Formally developed and written procedures • Approvals • Segregation of duties Government Finance Officers Association of LA ~ October 5, 2011

30. Policy Defined • A set of rules and principles that provide guidance and require a course of action • Cover a wide range of issues • Broad and apply to all • WHAT needs to be done Government Finance Officers Association of LA ~ October 5, 2011

31. Examples of Policies • City Ordinances • Leave policy • Conflict of interest policy Government Finance Officers Association of LA ~ October 5, 2011

32. Sample: Personnel Policy Statement of Policy • Employees of the agency are expected to perform their specific duties and conduct themselves in a manner that fosters the achievement of the agency's purpose and goals. The conduct of each employee is expected to reflect a commitment to: • Putting forth the employee's best effort; • Managing the employee's work time for maximum effectiveness and efficiency; and • Performing to the best of the employee's ability the duties and responsibilities of the position. • Disciplinary guidelines are established to communicate the agency’s view regarding inappropriate conduct and to assure that fair and equitable disciplinary action is administered when an employee violates the standards of conduct. (Source: Florida Employee Handbook) Government Finance Officers Association of LA ~ October 5, 2011

33. Procedures Defined • Detailed work steps that must be performed to accomplish the policy’s objective • Apply to specific work tasks, roles, and departments Government Finance Officers Association of LA ~ October 5, 2011

34. Procedures Examples • Bank reconciliations • End-of-period closings • Grants processing • Budget development processes Government Finance Officers Association of LA ~ October 5, 2011

35. Why We Need Them • Part of the internal control structure • To guide employees and hold them accountable • Part of our accountability to the public • May be required by local ordinance • Can cause you to question the way things are done Government Finance Officers Association of LA ~ October 5, 2011

36. Who writes them? • Management is responsible for the internal control structure. • Finance  Business Manager • Human Resources HR Director • Citywide  Mayor and/or governing body • May hire a consultant • Line workers with oversight Government Finance Officers Association of LA ~ October 5, 2011

37. Policy and Procedure Development Cycle Continuous Cycle Government Finance Officers Association of LA ~ October 5, 2011

38. Development Process • Upper management develops policy. • Mid-level management develops procedures. Government Finance Officers Association of LA ~ October 5, 2011

39. Development Process • Multi-Step Process • Data Collection – • Policies: regulations, laws • Procedures: • Talk to employees doing the work • Understand where and how the process interacts with other processes Government Finance Officers Association of LA ~ October 5, 2011

40. Data Sources • State laws, rules, and regulations • Federal laws, rules, and regulations • Search the internet • Contact similar organizations (i.e., other cities, universities, departments) Government Finance Officers Association of LA ~ October 5, 2011

41. Development Process • Prepare a draft of the policy and related procedures. Add pictures, charts, examples, where possible. • Verify. Have management and users read for accuracy and clarity. • Finalize and approve. Upper management should sign off. Government Finance Officers Association of LA ~ October 7, 2010

42. Development Process • Publish and store. • Send to applicable workers and support staff • Remove out-dated policies and procedures • Replace with new ones • Keep in a central easily accessible place (i.e., library or intranet) • Affirmation – affected employees should acknowledge receipt and understanding • Monitoring – Update as needed Government Finance Officers Association of LA ~ October 5, 2011

43. SAMPLE Policies and Procedures Government Finance Officers Association of LA ~ October 5, 2011

44. EXAMPLE: Cash Handling Policy and Procedures Mississippi State University Government Finance Officers Association of LA ~ October 5, 2011

45. EXAMPLE: Bank Reconciliation Procedures Bank Reconciliation Government Finance Officers Association of LA ~ October 5, 2011

46. EXAMPLE: Purchasing Policy and Procedures City of Oneida, New York Government Finance Officers Association of LA ~ October 5, 2011

47. Effects of Ineffective Policies and Procedures Government Finance Officers Association of LA ~ October 5, 2011

48. City of Opelousas Cash Receipts Not Deposited During our review, we noted deficiencies in cash management practices at the Department of Public Works and the Department of Code Enforcement. Both departments routinely made sales of scrap metal for cash. Reconciliation of the scrap metal sales with the cash deposits showed approximately $5,816 of cash from the scrap metal sales was not deposited into City accounts. In addition to these amounts, we noted cash collections from the scrap metal sales were routinely deposited into City accounts months after the receipt of cash. Louisiana law requires daily deposits of funds whenever practicable. (Excerpt from Legislative Auditor’s Compliance Report – City of Opelousas- June 29, 2011) Government Finance Officers Association of LA ~ October 5, 2011

49. Procurement Practices • Between May 5, 2008, and September 17, 2010, the City made 14 payments to Anderson Ironworks for 10 public works on City-owned structures. Three of these projects totaled over $7,500. • The City’s procurement policy requires three written or faxed quotes for projects over $7,500. • City records show only one of the three projects had quotes as required by the purchasing policy. In addition, only two of the projects were authorized using appropriate requisitions and purchase orders as required by the purchasing policy. • The project that included written quotes was approximately $42,000 to repair the roof and install siding for the City library. The City’s purchasing policy requires all projects over $10,000 to use formal sealed bids with invitations to bid and advertisements. In addition, the bids are to be opened, tabulated, and evaluated by the City Council before being forwarded to the Purchasing Department with a requisition. • Although the City obtained three written quotes, it had no documentation supporting the use of a formal sealed bid process or evaluation of bids by the City Council as required by its purchasing policy. Government Finance Officers Association of LA ~ October 5, 2011

50. Contractual Services • The City pays a contractor $1,200 a month to transport City residents to doctor’s appointments. He currently transports two residents, but in the past he has transported as many as four residents. He works on Tuesdays, Thursdays, and Saturdays. • Contractor does not submit documentation supporting the services he performs for the City. He uses a City vehicle as well as a City Fuelman card to transport residents to their treatments. There is no documented City approval for this practice. The City does not document basic program activities such as how residents are selected, evidence of medical need, or residents enrolled. The City Clerk was unable to provide a formal, written contract detailing the contractual responsibilities of the parties. • There is no documentation of competitive procurement as required by the City’s purchasing policy. Government Finance Officers Association of LA ~ October 5, 2011