Internal Control Concepts A Guide for Deans, Directors, and Department Chairs

What are internal controls and why are they important?

Internal control is a process, effected by an organization’s people, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: n Effectiveness and efficiency of operations n Reliability of financial reporting n Compliance with applicable laws and regulations

That sounds kind of technical. What does it mean in layman’s terms?

Consider your own personal internal control system: n When you came to work today, did you lock the doors to your house? n Do you keep the PIN number for your ATM card confidential and in a safe place? n Do you balance your checking account each month? n Do you compare credit card statement charges with your signed receipts? n Are you planning and saving for retirement?

In our University environment internal controls serve the same purpose: n Protect the University’s assets n Ensure records are accurate n Promote operational efficiency n Encourage adherence to policies

Most internal controls can be classified as PREVENTIVE or DETECTIVE n Preventive - designed to discourage errors or irregularities. n Detective - designed to identify an error or irregularity after it has occurred.

Examples of Preventive Controls n Reading and understanding applicable areas of the University Electronic Handbook n A manager’s review of purchases for a proper business purpose prior to approval n A computer application that requires password protection

Examples of Detective Controls n An exception report from the electronic timekeeping system n A comparison of transactions on monthly operating reports with departmental source documents n A manager’s review of long distance telephone charges

Who is Responsible for Internal Control?

Virtually all employees play some role in effecting control.

An organization’s leaders are ultimately responsible and must assume “ownership” of the internal control system for their areas of responsibility.

Provides leadership and direction to senior administrators. Together with them, the president shapes the values, principles, and major operating policies that form the foundation of the institution’s internal control system. The President

Vice Presidents Provide direction to senior administrators responsible for major functional areas such as: Colleges Departments Auxiliary Operations Support Services

Deans, Directors, and Department Chairs n Have line responsibility for designing and implementing control systems at unit levels. n Are responsible to execute institution-wide control policies and procedures. n These responsibilities should come with authority and accountability to the next higher level.

What is the Manager’s Responsibility?

You, as a manager, are responsible for ensuring that internal controls are established and functioning to achieve the mission and objectives of your unit.

To evaluate internal controls, first think about the following general objectives: n Propriety of transactions n Reliability and integrity of information n Compliance with University policies and government regulations n Safeguarding assets n Economy and efficiency of operations

Next, identify your unit’s specific objectives within these same broad categories: n Propriety of transactions n Reliability and integrity of information n Compliance with University policies and government regulations n Safeguarding assets n Economy and efficiency of operations

Identify what controls currently exist or that should be established to reasonably assure the achievement of each specific objective of your unit.

What is the Office of Compliance and Audit Responsibility?

Internal Auditing provides an independent evaluation of the adequacy of internal controls and reports the results to the University Administration.

The auditor’s evaluation includes an examination of the following internal control elements: n Personnel n Authorization Procedures n Segregation of Duties n Physical Restrictions n Documentation and Record Retention n Monitoring Operations

What Can Jeopardize Internal Controls?

n Inadequate segregation of duties n Inappropriate access to assets n Inadequate knowledge of University policies n Form over substance n Control override n Inherent limitations

How Much Do Internal Controls Cost?

The Cost of Implementing a Specific Control Should Not Exceed the Expected Benefit of the Control. n The potential loss of a computer printer may justify the cost of a door lock but not an alarm system.

Sometimes there is no out-of-pocket cost to establish an adequate control. A realignment of duty assignments may be all that is necessary to accomplish the objective. n Voided receipts are approved by someone (preferably a manager) other than the person preparing receipts.

A well designed internal control structure: n Enhances operations by improving overall efficiency and effectiveness n Reduces the risk of loss through fraud or theft

Questions about internal control and your specific area of responsibility? n Contact the Office of Compliance and Audit, C-260 ASB n Telephone ext Information for this presentation was obtained from “Internal Control Concepts”, NC State University, Internal Audit Division,