1. Internal Controls Todd Olszowy VP Finance/CFO Water & Power Community CU

2. Internal Controls Definition: A well defined and documented set of systematic measures adopted and implemented by an organization designed to: –Conduct business in an orderly, efficient & effective manner –Safeguard assets and other resources –Deter and detect errors, fraud and theft –Ensure accuracy, completeness and compliance of financial and reporting data –Ensure compliance and practice to established and adopted policies and procedures

3. Internal Controls Conducting business in an orderly, efficient and effective manner –Establish Risk Tolerance Assess the degree to which you are willing accept risk Document, report & manage to risk tolerance Be willing and able to accept and survive the consequences of risk failure

4. Internal Controls Continued –Cost/Benefit Analysis Are the internal controls implemented due to risk assessment creating an operating environment that restricts member service (orderly), inhibits employee productivity or morale (efficient) or prohibits growth (effective)

5. Internal Controls Safeguard assets and other resources –Basic safeguards should be incorporated into credit union policies and procedures Rotation of duties Proper segregation of duties Compulsory vacations Dual controls Adequate documentation Surprise audits/cash counts/access controls

6. Internal Controls Deter & detect errors, fraud and theft Credit unions with limited staff are often at higher risk of errors, fraud and theft due to the fact that many critical duties and responsibilities are preformed by few people

7. Internal Controls Ensure accuracy, completeness and compliance of financial and reporting data –Annual examinations, audits and AUP (agreed upon procedures) are not designed nor intended to detect fraud and thus are not intended to be utilized as substitutes for a safe and sound system of well documented and executed system of internal controls.

8. Internal Controls Ensure compliance and practice to established and adopted policies and procedures –Document risk tolerance and state in your policies the what, who, when, why & how Policies should explicitly state –What are you going to do –Who is going to do it –How often are you going to do it –Why are you doing it –How do you intend to do it

9. Internal Controls Continued Actual practice should ensure that –You actually did what you said you were going to do –It was done by the person or persons you said were going to do it –It was completed within the proper timeframe –Document why you did it –Was it done procedurally in the manner in which you intended

10. Internal Controls NCUA Examination Focus –NCUA Letter No. 13-CU-01 NCUA goal is a strong, safe credit union system Credit unions continue to evolve and face various economic and operational challenges NCUA 2013 Supervisory Focus is to improve credit union capacity to manage risk

11. Internal Controls NCUA continued 2013 Examination Capacity Focus –Operational Risk The risk of loss resulting from inadequate or failed internal processes, people and systems that ensure the security and stability of service delivery channels Two primary areas of operational risk focus –Technology - Adopting new technology to meet evolving member service needs and leveraging automation to increase efficiency i.e remote deposit capture, online banking, mobile banking and social media –Internal Controls – examination of a sound system of controls to ensure that credit unions are operated in a safe manner consistent with board approved policies and procedures

12. Internal Controls NCUA continued Balance Sheet Management –In 2013 NCUA examiners will focus on the ability of credit unions to generate adequate earning without adversely increasing specific risk factors Interest Rate Risk (IRR) – high levels of long-term assets funded by short-term less stable funds (shares) Concentration Risk- focus on a limited diversification of assets Less Established Products – credit union entrance into less established more complex products where the credit union may lack the experience and expertise to adequately mitigate risk controls

13. Internal Controls Cooperation/Relationships/Resources –CCUL –Larger Credit Union –CPA/Audit Firm –NCUA Examiner

14. Internal Controls Summary –The purpose of internal controls is not to entrap or inhibit employees but rather to provide an environment which discourages staff and management from doing something they would not ordinarily do. –In smaller credit unions the supervisory committee typically oversees the internal control function –Ultimately credit union officials are responsible for implementing a system of sound internal controls and for ensuring that those controls are regularly adhered to by staff as well as management

15. Internal Controls Questions?