1. Internal Control Workshop
Kenneth Wilson, Associate Comptroller
Deb Martin, Internal Auditor

2. Agenda Quiz on what you know
Movie on applying internal control concepts in higher education
Review answers to quiz
Presentation reviewing concepts, objectives, and risk assessment
Case studies
Wrap-up

3. Internal Control Quiz

4. Which of the following is not a true statement?

5. Which of the following is not a true statement?
Putting controls in place will always cost more money
Controls help to ensure compliance with policies
Controls will help the organization achieve its mission
Controls will help protect the organization's assets

6. The most important component of internal controls is:

7. The most important component of internal controls is:
Segregation of duties
Following policies
The integrity, ethical values, and competence of an organization’s employees
Theft prevention

8. Who has the primary responsibility for internal controls in your school/department/college?

9. Who has the primary responsibility for internal controls in your school/department/college?
The school/department/college dean or director
The school/department/college Business Manager
The Internal Audit department
Accounting Services

10. Segregating duties is important because:

11. Segregating duties is important because:
An employee should not be put in a position where they are able to “steal and conceal”
Having too many duties overburdens an employee
Required by Purdue policy in processing payroll
The auditors may write you up if you don’t do it
All of the above

12. Which of the following is not an example of internal controls?

13. Which of the following is not an example of internal controls?
Maintain adequate records
Combine recordkeeping and custody of assets
Apply technological controls
Make deposits daily or per policy

14. Which of the following is true regarding internal controls?

15. Which of the following is true regarding internal controls?
Are only needed to keep dishonest people from stealing
Are not needed in a small office where everyone knows each other
Are not needed if the staff is honest
Are always necessary regardless of the staff involved
Are only required in situations when the Business Manager is located away from the office

16. Which is not an example of internal controls?

17. Which is not an example of internal controls?
Approval of documents by the Business Manager (or delegate)
Training in various systems: SRM, Banner, SAP,BEX
Protecting office and lab equipment in secured areas
Creating and communicating to staff policies and operating procedures
Requiring one person to handle all payroll to minimize exposure to confidential information

18. The Business Manager of the School of DeArts wants to make sure the controls that were implemented are still effective. The Business Manager should:

19. The Business Manager of the School of DeArts wants to make sure the controls that were implemented are still effective. The Business Manager should:
Ask all of the other school Business Managers if they have had any money stolen
Change the locks on the doors
Spot-check transactions, records, and reconciliations to ensure they meet expectations
Ask for an Internal Audit of the school’s internal controls
All of the above

20. The Business Manager for the School of BigBucks is trying to decide the best way to receive and process the money from conference attendance. Which of the following ideas would have adequate controls?

21. The Business Manager for the School of BigBucks is trying to decide the best way to receive and process the money from conference attendance. Which of the following ideas would have adequate controls?
Have money delivered/mailed to the department, create CRV, and walk deposit to the Bursar
Have funds sent directly to PRF and put in one of the departments accounts, to be used at departments discretion in the future
Bill through the PSCD system – funds are sent to a lockbox that automatically records the receipt in the GL
Have funds sent directly to Business Manager for deposit in outside bank account.

22. The Business Manager for the School of LearningStuff is trying to decide the best way to process payroll for their ten non-exempt (hourly) lab techs who work for the school’s only researcher. Which of the following ideas would have adequate controls?

23. The Business Manager for the School of LearningStuff is trying to decide the best way to process payroll for their ten non-exempt (hourly) lab techs who work for the school’s only researcher. Which of the following ideas would have adequate controls?
Each employee would fill out their time card, compute total regular and overtime hours, then give it to the school secretary for input into the system.
Each employee would fill out their time card, then give it to the school secretary who would calculate hours and input it into the system.
The school secretary would keep track of lab tech hours, compute total hours and input them into the system.
All of the above contain adequate controls.
None of the above contain adequate controls.

24. One critical element in the internal controls of any department, school, or college is:

25. One critical element in the internal controls of any department, school, or college is:
Background checks for all employees
Level of education of staff
Integrity and ethics of the chair, dean, or director
The number of policies and procedures

26. No matter how well designed and executed, internal controls can fail because:

27. No matter how well designed and executed, internal controls can fail because:
Employees can make mistakes or exercise poor judgment
There can be collusion – where two or more individuals work together to steal
Management may override established policies or procedures
All of the above

28. What a great job it is to be the Business Manager for Bugs-n-Bees Studies! You are reviewing the receipts agreeing to the monthly procurement card statements. You notice that one of your researchers, who has a P-card, has been ordering stuff from itbeatsworking.com on a regular basis, about $500 per month. The receipts for these purchases look unusual. What do you do?

29. What a great job it is to be the Business Manager for Bugs-n-Bees Studies! You are reviewing the receipts agreeing to the monthly procurement card statements. You notice that one of your researchers, who has a P-card, has been ordering stuff from itbeatsworking.com on a regular basis, about $500 per month. The receipts for these purchases look unusual. What do you do?
Immediately disapprove it and call the cops
Communicate with the account manager, PI, and discuss the purchases and support being provided
Approve it
Call Accounts Payable
Call Internal Audit

30. You have accepted a position whose duties include the role of Business Manager for several departments in your school. One of your first decisions is to delegate your signature authority and the review of the payroll reports for fiscal transactions to a fiscal approver for one of the departments. Of the list of potential candidates, who should you not chose to be a fiscal approver?

31. You have accepted a position whose duties include the role of Business Manager for several departments in your school. One of your first decisions is to delegate your signature authority and the review of the payroll voucher reports for fiscal transactions to a fiscal approver for one of the departments. Of the list of potential candidates, who should you not chose to be a fiscal approver?
The account manager for the department
Administrative support staff who have no payroll processing duties
Administrative support staff who are payroll processors
Administrative support staff who have no payroll processing duties but who are outside of the department
You would not choose: a, c, or d from above

32. Internal Control Concepts & Objectives

33. Why have Internal Controls?
Promote operational efficiency and effectiveness
Provide reliable financial information
Safeguard assets and records
Encourage adherence to prescribed policies
Comply with regulatory agencies

34. Basic Concepts of Internal Controls
Management, not auditors, must establish and maintain the entity’s controls
Internal controls structure should provide reasonable assurance that financial reports are correctly stated
No system can be regarded as completely effective
Should be applied to manual and computerized systems

35. Detailed Internal Control Objectives
Recorded transactions are valid
Transactions are properly authorized
Existing transactions are recorded
Transactions are properly valued
Transactions are properly classified

36. Detailed Internal Control Objectives
Transactions are recorded at the proper time
Transactions are properly included in subsidiary records and are correctly summarized
Ensure compliance with policy
Safeguard Assets

37. What are Control Activities?
Control activities are the policies and procedures that help ensure that actions identified as necessary to manage risks are carried out properly and in a timely manner.
Policies should be implemented thoughtfully, conscientiously, and consistently
Mechanical procedures are not useful without focus on policies

38. Control Activities Include:
Approvals
Authorizations
Verifications
Reconciliations
Reviews of Performance
Security of Assets
Segregation of Duties
Controls over Information Systems

39. Approval, Authorization, & Verification
Management authorizes activities and transactions within limited parameters.
Management specifies when prior supervisory approval is needed.
A supervisor’s approval implies that he/she verified conformance with policies and procedures.

40. Reconciliations Relate different sets of data to one another.
Identify and investigate differences.
Take corrective action when necessary.

41. Reviews of Performance
Management compares information about current performance.
To budgets
Prior periods, competitors
Other benchmarks
Measures against achievement of goals and objectives.
Identify unexpected results or conditions which require
follow-up.

42. Security of Assets
Access to assets such as equipment, inventories, and cash is restricted.
Periodically assets are counted and compared to control records.

43. Segregations of Duties
Duties are segregated to reduce the risk of error or inappropriate action.
Normally the responsibilities of the following should be separated:
Initiating, approving, & recording transactions
Handling the related assets
Reconciling balances
Reviewing reports
One person cannot steal and conceal.

44. Controls over Information Systems
General controls include data center, system software acquisition & maintenance, security access, and system development & maintenance.
General controls support the functioning of application controls.
Application controls are programmed steps designed to control application processing.

45. Risk Assessment: Creating the Right Balance and Understanding the Limitations of Internal Controls

46. Risk Assessment is a process to
Identify significant risks
Assess risks
What is the likelihood of occurrence?
What is the potential impact?
Manage these risks through:
Avoidance
Acceptance and Sharing (Insurance)
Mitigate with Controls

47. What are risks?
A risk is anything that could jeopardize the achievement of your organization’s objective.
Achieve our goals
Operate effectively and efficiently
Protect the university’s assets from loss
Provide reliable financial data
Comply with applicable laws, policies, and procedures

48. Risks Questions to ask yourself: What can go wrong?
How could someone steal from us?
What policies are we most affected by?
What types of transactions in our area provide the greatest risk?
How can someone bypass the internal controls?
What potential risk areas could cause adverse publicity?

49. Limitations on Internal Controls
Employees can make mistakes or exercise poor judgment
There can be collusion – where two or more individuals work together to steal
Management may inappropriately override established policies or procedures

50. Questions?

52. To: Faculty, Staff, and Students Fr: A. V. Diaz
OFFICE OF THE EXECUTIVE VICE PRESIDENT FOR BUSINESS AND FINANCE, TREASURER
To: Faculty, Staff, and Students
Fr: A. V. Diaz
Executive Vice President for Business and Finance, Treasurer
Re: Fraud Reporting Program
Best practices provide for a fraud reporting program as an important part of a healthy business environment. Purdue University has in
place controls to provide reasonable assurance that fraudulent, illegal, or dishonest activity on the part of University employees, officers, or
business contacts is prevented or detected, but the potential for inappropriate transactions and behavior still exists within the University, as
it does in any organization. therefore, consistent with best business practices, Purdue University has implemented a fraud reporting
program to ensure that the University provides a mechanism for reporting improper or inappropriate acts.
This is an important program, and I encourage you to use it when appropriate and to communicate the existence of this program to your
Colleagues in the University community. Please help us make the program a success by using it for its intended purpose, reporting
suspected improper or illegal acts affecting Purdue University that you have witnessed or of which you might have knowledge. Personal
complaints regarding harassment or issues other than fraud should be filed according to existing University policies.
The Internal Audit Office is responsible for the administration of the Purdue University fraud reporting program. For additional information
on the program, please visit A Disclosure Form for Anonymous Reporting is available at the Web site. If you have
specific questions about the program, please contact Peggy Fish, Director of Audits, at (765) or
To anonymously report suspected fraud or other wrongdoings, call (765) , toll-free (866) , or mail information to Purdue
University, Internal Audit Office, Freehafer Hall of Administrative Services, 401 S. Grant Street, West Lafayette, IN
Thank you for your assistance and commitment to this effort.
c: President France A. Córdova
Hovde Hall, Room 230 • 610 Purdue Mall • West Lafayette, IN Phone (765) • Fax (765)

53. Reportable Activities Include
Theft
Embezzlement
Improper reporting of time
Questionable payments
Misuse or questionable use of cash/p-cards
Diversion of or lack of timely deposit of revenues
Credit card fraud
Inappropriate communication of confidential information
Any other illegal or questionable acts

54. Fraud Reporting Program Not Intended for:
Monitoring personnel issues:
address through departmental management or Human Resources
Direct to the Office of the Vice President for Ethics and
Compliance or to the Office of Institutional Equity Issues related to:
affirmative action
equal access
equal employment
educational opportunity

55. Mechanisms to Report Suspicious Acts
Fraud Reporting Hotline a) is anonymous
b) has no caller ID
c) has no call back option
Anonymous Form
a) available through Internal Audit’s homepage
Call Internal Audit Direct

56. Internal Control Case Studies

57. New Business Manager 2 employees
Payroll Clerk, 20 yrs. exp., does own payroll/HR processing, does all follow-up review, knows new system, everyone is happy with her, wants to be left alone, schedules vacation around payroll, will call you when she needs you
Accounting Clerk, 18 months exp. at PU, prior exp., no training except invoice vouchers, does work by category once a month (Cash receipts, funds transfers, billings, Budget Adjustments, Error Corrections.) Purchasing done as needed. Works well with giving academic administrators what they need.
BA has senior role with Dean, does not look at monthly statements since staff is so competent and has delegated all signature authority without further review.

58. Procurement Cards
One clerk for procurement card transactions – extensive use of the card occurs. People love its ease.
Only has one card so not does need a check-out process.
Distribution document is quickly reviewed and approved. Does account allocation but never changes object code.
Users have 90 days to turn in receipts – meets requirement to turn in reconciliation within 90 days.
Validates amount of receipt matches the reconciliation.
Missing receipts are not pursued – she finds that the BM accepts certain explanations for missing receipts and she always uses these standard reasons.
The clerk is newly graduated from high school and is up-to-date on desktop computer skills. Saves the department from having to train her. They are very happy.

59. Travel PI has federal grant that requires a lot of travel.
Car travel primarily to 3 locations.
PI is account manager and has chosen who the delegate will be – a clerk reporting to them.
Business Manager delegated signature authority, but delegate insists on signing Bus Managers name – BM agreed to this.
PI/delegate make travel arrangements and process all transactions.
Delegate knows of instance where PI was in town during “travel”
BM just found out exception to policy routinely filed – no receipts for travel since PI stays with colleagues.
Cuts down on grants travel costs – everyone is happy.
It bothers BM, but you are reviewing monthly statements and feel as good as you can about it. .

60. Asset Control Inventory of capital assets is hard to make a priority.
New capitalization limit is wonderful, assets went from 500 to 150.
Inventories have never really been completed in past.
Lot of movement in departmental equipment – a lot of take home.
Student hourly is performing inventory with scanning equipment.
125 of 150 items found – BM is very happy with this # but is being asked to resolve the remaining 25,
Not really BM problem since she is new since last inventory 2 years ago.
Will be hard to resolve since equipment taken home is not recorded and equipment has been disposed of.
Property Accounting is requiring police reports on unresolved items.

61. Receipting of Revenue
½ day workshop developed for 300 people, at $50 per person.
Chair has decided to deposit the revenue in a restricted fund to maintain control.
Documentation for registration states that fee is a donation – although the donation is required for registration.
Department secretary is in charge of process and will receive and process all registrations and payments.
Chair is not interested in details, only wants final list.
Cash and checks coming via mail and hand delivered.
Registration information is entered into a database and registration forms are then destroyed because of lack of storage space.
Receipts are not being issued because mailed-in registrations would be too much trouble and expense.
Secretary accumulated all receipts before processing CRV.
Business Manager found out about this when transaction showed up on the monthly operating statements.

62. Internal Controls Thank you for your time and participation
If questions please contact Ken Wilson at or or Deb Martin