TECHNICAL REPORT NO.

UKR-7

Internal Control and Cash Management

Manual and Questionnaires

November 1995
 TECHNICAL REPORT UKR-7
Internal Control and Cash Management
Manual and Questionnaires

November 1995

Prepared by:
Bradford C. Else, MIM CPA

Submitted by the ZdravReform Program to:

AID/ENI/HR/HP
AID Contract Number: CCN-0004-C-00-4023-00
EXECUTIVE SUMMARY

The need for enhanced internal control is a natural part of managing new streams of revenues at a
health care facility. In addition, as operating margins tighten, the need to optimize controls over
assets and cost management increases. This manual, along with its supporting questionnaires, is
offered for those health care managers at Polyclinic No. 2 in L’viv, Ukraine, who are beginning
the process of establishing useful and meaningful internal control procedures. Although these
concepts are rather far-reaching for the polyclinic at this time, it is important and useful to
present such concepts early on in the clinic’s reform program. The facility will have to “migrate”
to more advanced internal controls as policy and economic progress deems their role and
usefulness appropriate. Internal control over cash and other crucial operating assets ultimately
promotes efficient and effective delivery of health care.

1. OVERVIEW OF INTERNAL CONTROL IN HEALTH CARE

ORGANIZATIONS

While internal control has many purposes, its chief aim within the health-care-facility setting is
twofold: It is intended to provide health care managers with measurable assurances of (1) their
facility’s effective and efficient operation, and (2) the reliability of the facility’s financial reports,
which are sent to various external organizations in support of applicable laws and regulations. In
addition, internal control seeks to minimize the risks of unauthorized acquisition, use, or
disposition of assets. In other words, internal control also seeks to prevent fraud or minimally
identify and detect fraud in a timely manner.

Examples of internal control include the following:

• Proper control procedures for the receipt, storage, and use of drug and medical supply
inventories (for example, periodic inventories, unannounced audits, and procedural testing).
• Effective control procedures for the collection, recording, and accounting of cash from user
fees. (For example, the individual handling the cash should not also keep the organization’s
books.)

2. CREATING AN INTERNAL CONTROL STRUCTURE

Creating an effective internal control structure is a primary concern of most health care
organizations seeking to improve their operations. Specifically, the internal control structure
refers to the policies and procedures established to provide reasonable assurance that the
organization’s objectives will be achieved. The following five components are key to
establishing an effective internal control structure.

1. Creating an organization that promotes an environment of control. Management’s attitude

has a significant influence on the effectiveness of an organization’s internal control structure.
A management team with a cavalier attitude regarding its fiduciary responsibilities is likely to
have difficulty establishing a working system of internal control. Likewise, managers who
fail to give written policies to employees whom it holds responsible for control are offering a
 less than optimal environment. In an optimal environment, management should, for example,
encourage and support efforts among employees to control the management of cash.
2. Assessing and prioritizing risk and minimizing the possibility of losses. For example,
management should identify those areas of cash management that pose the greatest risk of
fraud or calculation errors.
3. Establishing activities and procedures intended to maintain internal control. For example,
management should institute appropriate measures to document user fee cash transactions. In
addition, establishing methods that identify the status of actual versus expected performance
is useful for identifying high-risk areas that are not yet under control.
4. Promoting information and communication among all managers within the organization.
For example, management should encourage people at all levels of the organization to
support and promote internal control mechanisms. In addition, those responsible for certain
aspects of the control process need to be thoroughly trained in the control task and have a
clear understanding of their responsibilities. Written job descriptions are useful in promoting
this understanding.
5. Monitoring the internal control process in a methodical manner, making corrections and
improvements as required. For example, management should periodically audit the control
processes to ensure that they are functioning as intended.

In addition, the management of a health care organization should consider the size, complexity,
and diversity of its services and applicable legal requirements when designing internal controls.
Generally, the larger and more complex an organization, the more elaborate the internal control
structure needed.

3. MANAGEMENT’S OBJECTIVES FOR INTERNAL CONTROL

It is management’s responsibility to establish and maintain an adequate internal control structure.

In establishing an effective control structure, management can consider a number of specific
objectives, including the following:

• Attempting to ensure that all transactions are authorized. For example, the collection
and management of user fees are accomplished only when properly authorized and
controlled. Thus, all user fees should be tracked and accounted for on numbered receipts.
• Ensuring that all documentation and accountability for assets conform with local and
national laws and procedural requirements. For example, only authorized forms that are
completed in accordance with known laws and regulations should be used.
• Preventing unauthorized access to assets such as cash or medicine inventories. In addition,
the internal control system should prevent unauthorized access to nonasset items, such as
prenumbered checks or receipts.
Ensuring that assets such as cash amounts on hand are accounted for. For example, such
assets should be periodically compared with actual amounts, and the appropriate action
should be taken in the event of any discrepancy. In addition, the internal control system
should ensure the timely posting of transactions.

4. CONTROL PROCEDURES

1
When establishing internal controls, management should follow five main procedures:

1. Establish a system for authorizing transactions and activities. This is normally accomplished
through a written policy with the approval of senior management.
2. Segregate duties in order to reduce the opportunity for any one person to be in a position to
perpetrate and/or conceal errors or irregularities in the normal course of his or her duties.
This can be done by assigning different people the responsibilities of authorizing
transactions, recording transactions, and maintaining custody of assets.
3. Design and require the use of documents and records that help ensure the proper recording of
transactions and events.
4. Institute adequate safeguards for accessing and using records and assets such as cash or
medicine inventories. Such safeguards should also cover access to records, documentation,
and record-keeping files.
5. Perform independent checks of the internal control process and periodic validation via
auditing to ensure that records reflect assets, and that a reconciliation of assets and records is
accurate and balanced. The independent checks should first attempt to identify the types of
errors or irregularities that could occur, then determine the risk of these errors or irregularities
actually occurring. Finally, the checks should provide relevant tests and audit procedures to
evaluate the possibility that errors have occurred. Those performing the periodic audits
should be familiar with the internal control process but not be a part of it. In other words, the
auditor should be somewhat “independent” of those involved in the process.

Sections 5 and 6 of this manual constitute a “tool kit” for internal control. The measures and
questionnaires provided are meant to serve as a guide, not a mandate, and as such portray a rather
complete picture of internal control. Polyclinic managers are encouraged to use their judgment
as to the cost of adopting internal controls versus the risks associated with foregoing them. With
that in mind, the following pages indicate areas the facility might want to focus on and/or adjust.

5. DEFICIENCIES INDICATIVE OF INADEQUATE INTERNAL CONTROL

A number of deficiencies indicate poor or inadequate internal control procedures or policies.

These can be categorized into three groups: deficiencies in the design of the internal control
structure, deficiencies in the operation of the structure, and all other deficiencies.

Typical Deficiencies in Internal Control Structure Design

• An inadequate overall internal control structure, including a lack of a minimal structure (for
example, no written policies or defined responsibilities for managing cash).
• The absence of appropriate segregation of duties consistent with the appropriate control
objectives (for example, the individual who collects the cash also maintains the bookkeeping
records and retains control over deposits).
• The absence of appropriate reviews and approvals of transactions, accounting, or
bookkeeping entries, or reconciliation of records with assets (for example, no periodic audits

2
 or minimal checks of bookkeeping accuracy). This deficiency also includes inadequate
procedures for performing periodic checks.
• Inadequate provisions for safeguarding assets (for example, cash is not secured in a daily
manner in a safe place).
• The absence of control techniques considered appropriate for the type and level of transaction
(for example, the authorization of discounts in excess of material [minimum but significant]
amounts is not clearly defined).
• Evidence that the system fails to provide adequate and accurate outputs (for example, an
internal control system that is subject to abuse, fraud, or frequent errors).

Typical Deficiencies in Internal Control Structure Operations

• Evidence of the internal control system’s failure to prevent or detect misstatements of

accounting or bookkeeping information;
• Evidence that the system is failing to safeguard assets from loss, damage, or
misappropriation;
• Evidence of the intentional override of the system by those in authority;
• Evidence of failure to perform the tasks that are part of the internal control structure (such as
reconciliations not being prepared in a timely and accurate manner);
• Evidence of willful wrongdoing by employees or management;
• Evidence of manipulation, falsification, or alteration of accounting records or supporting
documents;
• Evidence of intentional misapplication of accounting principles; and
• Evidence that employees or managers lack the qualifications and training to fulfill their
assigned functions.

Other Deficiencies

• Absence of a sufficient level of control consciousness within the organization;

• Failure to follow up on and correct previously identified internal control structure
deficiencies;
• Evidence of significant or undisclosed transactions; and
• Evidence of an undue bias or lack of objectivity on the part of those responsible for the
organization’s accounting functions.

6. INTERNAL CONTROL STRUCTURE QUESTIONNAIRES

The following are detailed examples of internal control questionnaires. The questionnaires have
been designed to provide health care managers with the necessary information to evaluate their
organization’s internal control structure. The questionnaires are not intended to fit all health care
organizations; therefore, users should adjust selected questions as required to suit the needs of
their organization’s internal control environment and operating realities.

3
The questionnaires include spaces in which to indicate negative or positive responses. Negative
responses indicate less than adequate internal control, while positive answers generally indicate
adequate internal control. A “not applicable” (N/A) column is also included.

In addition to using the following questionnaires, a complete evaluation of an organization’s

internal control structure would entail observing, discussing, and verifying the structure’s design
and operation. The questionnaires serve as catalysts for evaluating issues and concerns
commonly deemed important to establishing internal control structures that meet international
standards.

The end of the questionnaires contain room in which to add comments and suggestions regarding
the strengths and weaknesses of the internal control structure. The questionnaires act as
documentation of the internal control process and provide written continuity for subsequent
reviews.

Finally, it should be noted that these questionnaires do not replace the need to perform periodic
audits and detailed analyses of the internal control processes in place within an organization.

4
General Internal Control Questionnaire

ANSWER BASIS FOR ANSWER

Question Yes No N/A Observation Discussion Testing
1. Does the health care organization have an
organizational chart?
2. Does the organization have a chart of accounts or
an organized financial accounting system?
3. Are there accounting and internal control
manuals, and do they set forth accounting procedures?
4. Does the organization have a controller or chief
accountant?
5. Does the organization have an internal auditor or
equivalent person?
6. If there is an internal auditor, is he/she
independent from the internal control processes?
7. If there is an internal auditor, are there internal
audit reports available? Have they been reviewed
recently?
8. Is the general accounting and bookkeeping
department completely separate from the cash receipts
and cash disbursement function?
9. Is the general accounting and bookkeeping
department separate from the sales, purchasing, and
operational departments?
10. Are regular vacations required for those who
control the operational and financial cash,
bookkeeping, asset, and/or record-keeping functions?
(Vacations often cause others to notice discrepancies.)
11. If regular vacations are not required, are the
regular duties of these key individuals temporarily
assigned to others?
12. Does the head office retain adequate control over
branch facilities?
13. Are expenses and costs under budgeted control?
In other words, is there a budget plan with which others
can compare performance?
14. Are key and material bookkeeping entries
approved by senior management personnel?
15. Are periodic financial statements prepared and
submitted to management?
16. If periodic financial statements are prepared, are
they designed to alert management to significant
fluctuations in costs, revenues, assets, and the like?

List the names of those employees exercising the following functions:

Accountant ________________________________________
Bookkeeper ________________________________________
Cashier ________________________________________
Internal Auditor ________________________________________
Shipping ________________________________________
Purchasing ________________________________________
Receiving ________________________________________
Payroll ________________________________________
Tax ________________________________________
Department Head ________________________________________

Are any of these functions performed by the same person?

Based on all of the information above, comment on the adequacy of internal control. For all weaknesses indicated, recommend corrective actions
that should be taken. Then, update this checklist to monitor the weaknesses.

Originally prepared by: Date:

5
Reviewed on subsequent
examination by:

Notes:

6
Internal Control Questionnaire for Cash
ANSWER BASIS FOR ANSWER
Question Yes No N/A Observation Discussion Testing
1. General
2. Is there an accounting department separate from
the cashier?
3. Does the organization use a ledger system of
accounting?
4. Is the accounting system maintained by a trained
bookkeeper and/or accountant?
5. Is there a safe location for cash deposits such as a
bank or safe?
6. Does the facility deposit each day’s receipts
without delay?
7. Where is the deposit made? (bank, safe, etc.)
8. Are deposits deposited by someone other than the
cashier or bookkeeper?
9. Does a responsible employee other than the
cashier investigate any debits from the deposit
location?
10. Are the cashier’s duties segregated from the
recording of cash receipts or accounts receivable?
11. Does an employee other than someone in the
cashier’s department make entries in the ledger?
12. Do procedures prohibit the cashier from gaining
access to the accounts receivable ledgers and monthly
bank/safe and/or customer statements?
13. Does someone other than the cashier handle the
petty cash fund? the repair fund? the payroll fund?
(and so on)c.
14. Identify the funds that are handled by the cashier
(or the same person).
15. Does a select group of individuals retain the right
to have the exclusive right to withdraw funds? (If not,
note at the bottom of the questionnaire who else has
such rights.)
16. Is there a withdrawal cosignature authority
process?
17. Do strong controls exist that highlight when cash
should have been received but was not?
18. Does the cashier assume full responsibility for the
receipts from the time they are received until the time
they are handed over for deposit?
19. Is the cash adequately safeguarded (physically)
within the facility?
20. Does proper segregation exist between those
employees who have access to patient funds (cash)
and those employees who have access to nonpatient
funds (such as payroll accounts)?

Cash Receipts

1. Is an independent listing of cash receipts prepared

before the receipts are submitted to the cashier or
bookkeeper?
2. Does a third party verify this listing against the
deposit slips before receipts are deposited?
3. Are cash receipts deposited intact each day?
4. Do procedures restrict the accounts receivable
bookkeeper from...
5. preparing the bank deposit?
6. obtaining access to the cash receipts book?
7. having access to collections from customers?

7
8. When cash sales occur, do all receipts have
prenumbered identification?
9. Are all receipts accounted for daily and matched
with the cash collections?
10. Are authenticated duplicates of the deposit slips
retained and reconciled to the corresponding amounts
in the cash receipts records?
11. Does someone prepare a daily report of cash
balances?
12. Is the bank deposit made by someone other than
the cashier or bookkeeper?
13. Do proper controls exist pertaining to
unsatisfactory payments by patients?
Methods
1. Are receipts of currency immaterial?
2. Are receipts recorded by cash registers or other
mechanical devices?
3. If so, are the machine totals independently
verified by others outside of the area?
4. Does the facility use sales or cash receipt books?
5. If so, are they prenumbered?
6. Does a non-cashier-type person independently
check the numerical sequence and daily totals?
7. Are the receipts matched with the cash
collections?
8. Are the unused receipt books properly
safeguarded?
9. If none of the above is used, is some equivalent
system used? Explain at the bottom of the
questionnaire.
10. Do adequate controls exist preventing
misappropriations of cash by the cashier, such as
fictitious discounts, waivers, allowances, and so on?
11. Do the recipients of miscellaneous receipts of
cash such as those from the sale of equipment report
them to the accounting department and the cashier?
12. Does the accounting department independently
compare those reports with the related cash and
bookkeeping entries?
Cash Mail Receipts (if applicable)

1. Does someone other than the cashier or

bookkeeper open the mail?
2. Are employees who have access to the accounting
records prohibited from receiving unopened mail?
3. Does the employee who opens the mail maintain
a listing of money, checks, and so on?
4. If so, is this record verified by someone else, such
as the cashier?
5. Is this record compared with the cash receipts
book periodically?
6. Do people rotate from function to function?

Based on all of the information above, comment on the adequacy of internal control. For all weaknesses indicated, recommend corrective actions
that should be taken. Then, update this checklist to monitor the weaknesses.

8
Originally prepared by: Date:
Reviewed on subsequent
examination by:

Notes:

9
Internal Control Questionnaire for Medical Inventories and Supplies

ANSWER BASIS FOR ANSWER

Question Yes No N/A Observation Discussion Testing
1. Are the following items kept under the strict
control of a few designated employees: medicines?
bandages? topical ointments? gases? disposable and
reusable medical instruments, such as syringes and
needles?
2. If practical, are inventories recorded monthly in
bookkeeping or other accounting records?
3. Are receiving reports or notifications made upon
the arrival of new medicines or other inventory items?
4. Are receipts for issuance made for withdrawal of
inventories?
5. Are withdrawals allowed only under a specific
system of designated authorizations?
6. Are adequate inventory levels maintained?
7. Are physical inventories taken at least yearly (or
periodically during the year)?
8. Is the inventory supervised by an independent
manager or equivalent?
9. Is the merchandise labeled and classified
properly?
10. In large inventories, are prenumbered inventory
tags or an equivalent system used?
11. Is an overall review periodically made of slow
moving or obsolete inventory?
12. Are adequate accounting controls kept on items
kept in patient areas (near nursing areas, for example)?
13. If periodic inventories are maintained, are they
annually reconciled to actual amounts by means of a
complete physical inventory?
14. Do all inventory records show quantities, unit
costs, and aggregate values?
15. Are inventory records maintained by and
accessible to individuals other than those who have
access to the inventory?
16. Have there been any reports of inventory theft?
17. Are inventories maintained in centralized storage
areas?

Based on all of the information above, comment on the adequacy of internal control. For all weaknesses indicated, recommend corrective actions
that should be taken. Then, update this checklist to monitor the weaknesses.

Originally prepared by: Date:

Reviewed on subsequent
examination by:

Notes:

10
Internal Control Questionnaire for Payroll

ANSWER BASIS FOR ANSWER

Question Yes No N/A Observation Discussion Test
ing
1. Does the organization use time clocks, signed
time cards, or the equivalent?
2. If so, are the documents above completed by the
employee and signed each pay period by the
supervising manager or department head?
3. Are the time cards controlled by the payroll
department?
4. Are test-checks made of employee records and
production of work?
5. Are time cards compared with actual employees?
Do they match (to ensure that there are no fictitious
employees)?
6. Is more than one employee involved in the
preparation of time cards and payroll?
7. Are payroll duties effectively rotated?
8. Are vacations of payroll clerks enforced?
9. Are wage rates authorized in writing by the
designated supervising manager?
10. Is the payroll double-checked as to the hours
worked, rates, payroll deductions, and taxes?
11. If the payroll is delivered by check, are the checks
prenumbered? Are blank checks in a secure area?
12. Is the payroll bank account reconciled by
someone other than the individual who prepares the
payroll, delivers the payroll, or signs the checks?
13. If cash wages are paid, are payroll receipts
maintained by employees?
14. Are workers identified by their supervisors or is
another suitable system used to validate employment?
15. Is the system for employment validation under
control?
16. Is the distribution of the payroll periodically
rotated among employees?
17. Are unclaimed wages relatively insignificant?
18. Are audits of the payroll system periodically
made by outside “independent” auditors?
19. During disbursement of cash payrolls, is the area
of disbursement secure?
20. Have there been sudden payroll fluctuations
within certain departments?
21. Are payroll checks or cash disbursements picked
up only by the intended employee?
22. Is the process for adding an employee to the
payroll under control and done through cross-
authorization procedures (with more than one
management signature)?
23. Do cash records of payroll match bookkeeping
records and reconcile to bank amounts?
24. Other (add as appropriate to organization).

Based on all of the information above, comment on the adequacy of internal control. For all weaknesses indicated, recommend corrective actions
that should be taken. Then, update this checklist to monitor the weaknesses.

11
Originally prepared by: Date:
Reviewed on subsequent
examination by:

Notes:

12
Internal Control Questionnaire for Purchases and Expenses

ANSWER BASIS FOR ANSWER

Question Yes No N/A Observation Discussion Testing
1. Does the hospital or clinic have a purchasing
department?
2. If so, is it independent of the accounting
department?
3. Is it independent of the receiving department?
4. Is it independent of the shipping department?
5. Are purchases made only after the appropriate
authorization signatures are acquired according to
internal policy?
6. Are all significant purchases channeled through
the purchasing department?
7. Are purchase orders authorizations required of all
significant purchases?
8. Do certain items get purchased through
competitive bidding?
9. If so, is the review of bids independent and
objective?
10. Are purchase prices thoroughly reviewed and
checked by a knowledgeable employee?
11. At the time of receipt, are purchased quantities
checked against actual receipt quantities?
12. Is the receiving department denied access to the
purchasing records?
13. Does the receiving department fill out receipt of
goods documentation?
14. Are copies of the receiving reports sent to the
accounting or bookkeeping department? If not, how are
accounting records updated? (Explain in the “Notes”
section below.)
15. Are copies of the receiving reports sent to the
purchasing department? If not, how are purchasing
orders reconciled to actual goods received? (Explain in
the “Notes” section below.)
16. When goods are returned to vendors, are credits
obtained?
17. Are there only a few, nonmaterial unmatched
purchase orders within the receiving reports?
18. Do safeguards exist for the proper accounting
against orders of partial shipments received?
19. Does a responsible official approve payment of
purchasing orders?
20. If purchases are paid directly out of cash, are the
systems for purchase authorization, inventory receipt,
quantity verification, and cash disbursement
authorization intact, independent of each other, and
capable of being tracked?
21. Does the accounting system support sufficient
account classification detail to test and validate where
expenses were booked versus what was paid out?
22. For items that are not “tangible,” such as
electricity and heating utilities, is there any
reconciliation of amounts paid with amounts
consumed?

Based on all of the information above, comment on the adequacy of internal control. For all weaknesses indicated, recommend corrective actions
that should be taken. Then, update this checklist to monitor the weaknesses.

Originally prepared by: Date:

13
Reviewed on subsequent
examination by:

Notes:

14
Internal Control Questionnaire for Petty Cash Funds

ANSWER BASIS FOR ANSWER

Question Yes No N/A Observation Discussion Testing
1. Does the organization use an imprest cash fund (a
fund in which receipts/vouchers are maintained for
each expense)?
2. Are the petty cash slips prenumbered?
3. Do different employees periodically take charge
of the fund?
4. Is the amount of the petty cash fund small enough
to require frequent replenishment?
5. Is there a maximum amount that may be drawn
from the petty cash fund?
6. If so, state the amount.
7. Are receipts/vouchers maintained for each
expense?
8. Do regulations prohibit the cashing of payroll
checks from the fund, or the exchange of selected
currencies within the fund?
9. Does an independent and responsible employee
reconcile the total vouchers with the remaining cash
before replenishing the fund?
10. Do the vouchers explain the nature of the
expense, as well as include the amount written out in
words?
11. Is the custodian of the petty cash fund the only
one who has authorization to sign receipts/vouchers
and authorize disbursements?
12. Are unexpected checks of the petty cash fund
performed?
13. Has there been previous abuse of such funds and
have steps been taken to correct the situation?
14. Other (add as appropriate to the organization).
15. Other.
16. Other.
17. Other.

Based on all of the information above, comment on the adequacy of internal control. For all weaknesses indicated, recommend corrective actions
that should be taken. Then, update this checklist to monitor the weaknesses.

Originally prepared by: Date:

Reviewed on subsequent
examination by:

Notes:

15