Internal Control ConceptsInternal Control Concepts

A Guide for Deans, Directors, A Guide for Deans, Directors, and Department Chairsand Department Chairs

What are internal controls and What are internal controls and why are they important?why are they important?

Internal control is a process, effected by an Internal control is a process, effected by an organization’s people, designed to provide organization’s people, designed to provide reasonable assurance regarding the reasonable assurance regarding the achievement of objectives in the following achievement of objectives in the following categories:categories:

Effectiveness and efficiency of operationsEffectiveness and efficiency of operations Reliability of financial reportingReliability of financial reporting Compliance with applicable laws and Compliance with applicable laws and

regulationsregulations

That sounds kind of technical. What That sounds kind of technical. What does it mean in layman’s terms?does it mean in layman’s terms?

Consider your own personal Consider your own personal internal control system:internal control system:

When you came to work today, did you lock When you came to work today, did you lock the doors to your house?the doors to your house?

Do you keep the PIN number for your ATM Do you keep the PIN number for your ATM card confidential and in a safe place?card confidential and in a safe place?

Do you balance your checking account each Do you balance your checking account each month?month?

Do you compare credit card statement Do you compare credit card statement charges with your signed receipts?charges with your signed receipts?

Are you planning and saving for retirement?Are you planning and saving for retirement?

In our University environment internal In our University environment internal controls serve the same purpose:controls serve the same purpose:

Protect the University’s assetsProtect the University’s assets Ensure records are accurateEnsure records are accurate Promote operational efficiencyPromote operational efficiency Encourage adherence to policiesEncourage adherence to policies

Most internal controls can be classified Most internal controls can be classified as as PREVENTIVEPREVENTIVE or or DETECTIVEDETECTIVE

PreventivePreventive - - designed to designed to discourage errors or discourage errors or irregularities.irregularities.

Detective - Detective - designed to identify designed to identify an error or an error or irregularity after it irregularity after it has occurred.has occurred.

Examples of Preventive ControlsExamples of Preventive Controls

Reading and understanding applicable Reading and understanding applicable areas of the University Electronic areas of the University Electronic HandbookHandbook

A manager’s review of purchases for a A manager’s review of purchases for a proper business purpose prior to proper business purpose prior to approvalapproval

A computer application that requires A computer application that requires password protectionpassword protection

Examples of Detective ControlsExamples of Detective Controls

An exception report from the electronic An exception report from the electronic timekeeping systemtimekeeping system

A comparison of transactions on A comparison of transactions on monthly operating reports with monthly operating reports with departmental source documentsdepartmental source documents

A manager’s review of long distance A manager’s review of long distance telephone chargestelephone charges

Who is Responsible for Who is Responsible for Internal Control?Internal Control?

Virtually all employees play Virtually all employees play some role in effecting control.some role in effecting control.

An organization’s leaders are ultimately responsible An organization’s leaders are ultimately responsible and must assumeand must assume “ownership” of the internal control “ownership” of the internal control

system for theirsystem for theirareas of responsibility.areas of responsibility.

Provides leadership and direction to senior Provides leadership and direction to senior administrators. Together with them, the administrators. Together with them, the

president shapes the values, principles, and president shapes the values, principles, and major operating policies that form the major operating policies that form the

foundation of the institution’sfoundation of the institution’sinternal control system.internal control system.

The PresidentThe President

Vice PresidentsVice Presidents

Provide direction to senior Provide direction to senior administrators responsible for administrators responsible for major functional areas such as:major functional areas such as:

• Colleges

• Departments

• Auxiliary Operations

• Support Services

Deans, Directors, andDeans, Directors, andDepartment ChairsDepartment Chairs

Have line responsibility for designing and Have line responsibility for designing and implementing control systems at unit levels.implementing control systems at unit levels.

Are responsible to execute institution-wide Are responsible to execute institution-wide control policies and procedures.control policies and procedures.

These responsibilities should come with These responsibilities should come with authority and accountability to the next higher authority and accountability to the next higher level.level.

What is the Manager’s What is the Manager’s Responsibility?Responsibility?

YouYou, as a , as a managemanager, are r, are responsible for ensuring that responsible for ensuring that

internal controls are established internal controls are established and functioning to achieveand functioning to achievethe mission and objectivesthe mission and objectives

of your unit.of your unit.

To evaluate internal controls, To evaluate internal controls, first think about the followingfirst think about the following

general objectives:general objectives:

Propriety of transactionsPropriety of transactions Reliability and integrity of informationReliability and integrity of information Compliance with University policies Compliance with University policies

and government regulationsand government regulations Safeguarding assetsSafeguarding assets Economy and efficiency of operationsEconomy and efficiency of operations

Next, identify your unit’s specific Next, identify your unit’s specific objectives within these same objectives within these same

broad categories:broad categories:

Propriety of transactionsPropriety of transactions Reliability and integrity of informationReliability and integrity of information Compliance with University policies and Compliance with University policies and

government regulationsgovernment regulations Safeguarding assetsSafeguarding assets Economy and efficiency of operationsEconomy and efficiency of operations

Identify what controls currently Identify what controls currently exist or that should be established exist or that should be established

to reasonably assure the to reasonably assure the achievement of each specific achievement of each specific

objective of your unit.objective of your unit.

What is the Office of Compliance What is the Office of Compliance and Audit Responsibility?and Audit Responsibility?

Internal Auditing provides an Internal Auditing provides an independent evaluation of the independent evaluation of the

adequacy of internaladequacy of internalcontrols and reports the results to thecontrols and reports the results to the

University Administration.University Administration.

The auditor’s evaluation includes an The auditor’s evaluation includes an examination of the following internal examination of the following internal

control elements:control elements:

PersonnelPersonnel Authorization ProceduresAuthorization Procedures Segregation of Duties Segregation of Duties Physical RestrictionsPhysical Restrictions Documentation and Record RetentionDocumentation and Record Retention Monitoring OperationsMonitoring Operations

What Can JeopardizeWhat Can JeopardizeInternal Controls?Internal Controls?

Inadequate segregation of dutiesInadequate segregation of duties Inappropriate access to assetsInappropriate access to assets Inadequate knowledge of University Inadequate knowledge of University

policiespolicies Form over substanceForm over substance Control overrideControl override Inherent limitationsInherent limitations

How Much Do Internal How Much Do Internal Controls Cost?Controls Cost?

The Cost of Implementing a Specific The Cost of Implementing a Specific Control Should Not Exceed the Expected Control Should Not Exceed the Expected

Benefit of the Control.Benefit of the Control.

The potential loss of a computer printer The potential loss of a computer printer may justify the cost of a door lock but may justify the cost of a door lock but not an alarm system.not an alarm system.

Sometimes there is no out-of-pocketSometimes there is no out-of-pocketcost to establish an adequate control.cost to establish an adequate control.A realignment of duty assignmentsA realignment of duty assignments

may be all that is necessary tomay be all that is necessary toaccomplish the objective.accomplish the objective.

Voided receipts are approved by Voided receipts are approved by someone (preferably a manager) other someone (preferably a manager) other than the person preparing receipts.than the person preparing receipts.

A well designed internal control A well designed internal control structure:structure:

Enhances operations by improving Enhances operations by improving overall efficiency and effectivenessoverall efficiency and effectiveness

Reduces the risk of loss through fraud Reduces the risk of loss through fraud or theftor theft

Questions about internalQuestions about internal control and your specific control and your specific

area of responsibility?area of responsibility?

Contact the Office of Compliance and Contact the Office of Compliance and Audit, C-260 ASBAudit, C-260 ASB

Telephone ext. 8-3853Telephone ext. 8-3853

Information for this presentation was obtained from “Internal Control Concepts”, NC State University, Internal Audit Division, http://www2.acs.ncsu.edu/audit/selfaccs/intcont/controls.htm