Thomas P.

DiNapoli
State of New York
Office of the State Comptroller

Internal Controls

Steven J. Hancox
Deputy Comptroller
Division of Local Government and
School Accountability
 Internal Controls

Introduction
Today, local governments are faced with providing needed services to citizens with limited
public resources. Local officials are entrusted with these limited public resources and are
responsible for complying with laws and regulations, meeting goals and objectives, safeguarding
assets, and issuing reports that inform the public of the results of government activities. A good
internal control system is necessary to assist local officials in meeting all their responsibilities.
In this session, we will focus on the following areas:

Page #
Background 1
What are Internal Controls? 1
Why are Internal Controls Important? 2
Who is Responsible for Internal Controls? 2
Key Components of Internal Control 3
Internal Control Examples 8
Top Ten Fraud Risk Indicators 10
Internal Control Checklist 10
Conclusions 11

Background
Internal controls have always been an important element of any local government’s financial and
operating structure. In the 1990’s, concerns about fraudulent financial reporting resulted in a
group being formed and a study on internal controls being produced. This group – the
Committee of Sponsoring Organizations (COSO) – developed a report that defined internal
control and identified five key components of internal control.

What are Internal Controls?

Internal controls are essential to “good” government management and can be defined as
activities (safeguards) that are in place to provide reasonable assurance that things are “going as
planned.” Simply put, internal control is anything that local officials can do to safeguard assets
and make more efficient and effective use of these assets.

Internal Control, as defined in the COSO report, is “a process effected by the entity’s board of
directors, management, and other personnel, designed to provide reasonable assurance
regarding the achievement of objective in effectiveness and efficiency of operations, reliability
of financial reporting, and compliance with applicable laws and regulations.”

1
 Internal Controls

There are four objectives of an Entity (local government):

* Protection of Assets
* Effectiveness and Efficiency of Operations
* Reliability of Financial Reporting
* Compliance with Applicable Laws and Regulations

The definition reflects certain fundamental concepts:

 It’s a process. It’s a means to an end, not an end in itself

 It’s accomplished by people. It’s not merely policy, procedures and forms.
 It can provide only reasonable but not absolute assurance that assets and
resources are safeguarded.

Why are Internal Controls Important?

Internal controls can help a local government achieve its objectives. They are checks and
balances to support the mission and to help prevent fraud, waste, and abuse. Although, as we
mentioned above, internal controls can provide only reasonable but not absolute assurance that
assets and resources are safeguarded, they are the first line of defense to prevent and detect
fraud. All local governments need internal controls to:

 Ensure mission accomplishment

 Reduce fraud opportunities
 Prevent loss of funds or other resources
 Establish standards of performance
 Assure compliance with laws, regulations, policies, and procedures
 Preserve integrity
 Eliminate adverse publicity
 Assure public confidence

Consequences of weak internal controls can be the waste or misuse of the local government’s
assets, inaccurate or incomplete information, and embezzlement and theft.

Who is Responsible for Internal Controls?

Before we discuss the key components of internal control, let’s talk about who’s responsible for
internal controls within a local government. Generally, everyone is responsible!

 The Governing Board provides important oversight while the Chief Executive
Officer provides leadership and direction to the governance team
(management/leadership team).

2
 Internal Controls

 The Governing Board and the Chief Executive Officer are responsible for
establishing the presence of integrity, ethics, competence, and a positive control
environment.
 The Governing Board is also responsible for establishing major operating policies
that form the foundation of the internal control system.
 The Chief Executive Officer is responsible for establishing government-wide
regulations/procedures to ensure implementation of the major operating policies.
 The governance team provides direction and oversight to senior administrators in
major functional areas such as general operations, departments, auxiliary
operations, and support services.
 The Chief Fiscal Officers, Managers, Administrators, directors, and departments
execute the major government-wide control policies and procedures. They may
also design and implement control systems at detailed levels within their specific
units.
 Managers and other supervisory personnel are responsible for executing control
policies and procedures at detailed levels within their specific units.
 Each individual within a local government or unit is responsible for being
cognizant of proper internal control procedures associated with their specific job
responsibilities.
 Claims auditors are responsible for auditing claims and internal auditors are
responsible for examining the adequacy & effectiveness of the local government’s
internal controls, and making recommendations where control improvements are
needed. Internal auditors contribute to the effectiveness of the controls, but they
are not responsible for establishing or maintaining them.

As you can see, every administrator, manager and staff member is responsible for assuring that
established internal controls are followed and applied.

Key Components of Internal Control

The five components of internal control identified by the COSO report are:

1. The Control Environment

2. Risk Assessment
3. Control Activities
4. Information and Communication
5. Monitoring

We will now discuss each of these components and how they can be used in improving an
internal control system.

3
 Internal Controls

Control Environment

This is also referred to as the “tone at the top.” It is the foundation for all other components of
internal control, providing discipline and structure. Factors include the integrity and ethical
values and competence of the unit’s people, management’s philosophy and operating style, the
way management assigns authority and responsibility, organizes and develops its people and the
attention and direction provided by the governing board.

Integrity and Ethical Values- Integrity and ethical behavior are essential elements of the
control environment. As the Treadway Commission 1 reported, “A strong ethical climate at all
levels is vital to the well being of the entity, all of its constituencies and the public at large.” The
key element in a favorable control environment is management’s attitude, as demonstrated
through its actions and example.

An example of unethical behavior by board members gives the green light to all employees of
the unit to follow their example. A couple of years ago a state commissioner was accused of
taking his state vehicle to Florida for vacation. What kind of example do you think that gave to
the employees of his department?

On a more familiar level, what would employees of your municipality think if the board
members’ travel or conference expenses bypassed the usual audit function of your municipality?
What kind of example would that give to the poor employee whose expense accounts were gone
over with a fine toothcomb?

Commitment to Competence and Human Resource Policies and Practices- A favorable

control environment also requires competent and honest staff. The following personnel policies
and practices can play an important role in meeting this need:

 Establish and maintain up-to-date job descriptions for all employees. These
descriptions should detail the responsibilities of each position as well as the
qualifications needed to fill the position. It is important that job descriptions be kept
up to date to reflect changes in responsibilities.

 Follow appropriate hiring policies. It is essential that job qualifications and

references be thoroughly checked before hiring new employees. In addition a
government may wish (or be required by law) to require bonding for employees in
sensitive positions. Moreover, the process of hiring should be open, thorough and
well documented to ensure that conscious and unconscious biases are avoided.

 Assign authority and responsibility in an appropriate manner. Employees should

possess all the authority and only the authority needed to fulfill their assigned
responsibilities as outlined in their job description.

1
The Treadway Commission was created in 1985 to identify the causal factors of fraudulent financial reporting and
to make recommendations to reduce its incidence.

4
 Internal Controls

 Ensure that employees are properly trained. A combination of formal and on-the-
job training is essential to ensure that employees are properly prepared to perform
their duties. Moreover, training should be offered on an ongoing basis to reinforce
existing skills and to help employees adjust to changes in their job responsibilities
and work environment.

 Periodically review and document performance. It is not enough to hire honest and
qualified individuals; management must also periodically review their performance
and document that review. When corrective action is needed that action should be
taken promptly and should be thoroughly documented. It is especially important
that management pay particular attention to the performance of employees during
their initial probation period of employment. Also, top management should
periodically review the performance evaluations to ensure that managers at all
levels are giving frank and objective evaluations of performance.

If a unit’s control environment is lacking, it is a good indication that severe problems exist in
some of its internal control processes. This does not say that severe problems exist in all its
internal control processes. The same holds true for all of the other COSO principals. It is merely
an indication not an absolute, because there is always the possibility that some other control
principle or authority has established the proper procedures or processes.

Participation of Governing Boards or Audit Committee- An entity’s control consciousness is

influenced significantly by the governing board and audit committee, if any. Attributes include
the board or committee’s independence from management, the experience and stature of its
members, the extent of its involvement and scrutiny of activities, the appropriateness of its
actions, the degree to which difficult questions are raised and pursued with management, and its
interaction with internal and external auditors.

Managements Philosophy and Governing Style- This covers a wide range of characteristics. It
may include their approach to risk taking and monitoring risk and their attitude and actions
toward information processing, financial and operational reporting, and personnel.

Organization Structure- This is in reference to the departments and offices of the municipality.
Are they effective and conducive to controls and accountability?

Assigning Authority and Responsibility- What is the method of assigning authority and
responsibility? Does this method provide for the proper delegation of authority and
responsibility?

Role of the Governing Board- The elected board is responsible for establishing policies and
procedures that help ensure that the assets of the unit are protected.

5
 Internal Controls

Risk Assessment

Risk assessment is one of the components and addresses the local government’s (not the
auditor’s) assessment of control risk. Risk Assessment is the local government’s identification
and analysis of relevant risks to achieving its objectives, forming a basis for determining how the
risks should be managed. This process identifies risk and analyzes its likelihood of occurrence
and its impact. This process will allow management to determine how much risk they are
willing to accept and to set priorities accordingly. Management may initiate plans, programs, or
actions to address specific risks, or it may decide to accept a risk because of cost (cost/benefit
analysis) or other considerations. The risk assessment is an ongoing process. Risks can arise or
change due to circumstances such as the following:

 Changes in the operating environment; governments do not operate in a vacuum. Thus,

changes in a government’s circumstances can produce unanticipated risks. For example,
intense media scrutiny or political debate surrounding a particular program could place extra
pressure on staff to cut corners in order to achieve results. In the same way a change in
regulations can have a serious effect on the way an activity is conducted. An example would
be the disposal of municipal solid waste.
 New personnel - even the best systems and equipment are no better than the people who
operate them. As a result, changes in personnel always carry with them a certain element of
risk. New employees are likely to need some time before they become proficient in their new
position. Likewise there may be an interval of time between the departure of an employee
and the hiring of a replacement during which time the duties of the departing employee may
be performed on a temporary basis by one or more individuals. The risks accompanying
personnel changes especially increase when changes are numerous, involve high-level staff,
or employees in highly sensitive positions.
 New or revamped information systems or technology- the revolution in data processing has
profoundly affected how most state and local governments operate on a day-to-day basis.
Moreover the computer revolution is an ongoing one requiring governments periodically to
alter or replace their information systems to take advantage of technological advances. Such
changes often entail considerable disruption and attendant risk.
 Rapid growth can place acute pressure on internal controls as staff attempt to respond to a
rapid increase in the demand for services. In particular staff may attempt to cut corners in an
attempt to avoid complaints and speed up services.
 Staff reductions - when staff is reduced, separation of duties and the normal checks and
balances of a system can be drastically altered.
 New programs, activities, or services- staff may be unfamiliar with the program requirements
and in some instances programs are begun before a well thought out internal control process
has been formulated.

If the governing board alone is involved in assessing and monitoring risk, there is a good
possibility that many of the specific risks facing individual programs and activities will be
missed. Conversely, if a government’s risk assessment and monitoring is performed by lower
level managers, it is quite possible that more generalized risks may be completely overlooked.

6
 Internal Controls

Accordingly, effective risk assessment and monitoring must include and involve managers at all
levels.

Changes in a government’s circumstances can render internal controls inadequate. Likewise,

there is a tendency for internal controls to deteriorate over time unless they are properly
maintained. Therefore, it is important for management to monitor on an ongoing basis the
continued functioning of internal controls.

The basic concepts of the risk assessment process should be present in every entity, regardless of
size, but the risk assessment process is likely to be less formal and less structured in small and
mid-sized entities than in larger ones.

In a risk assessment process, the first step is to group naturally interrelated activities into
“control cycles.” After that, management should prioritize the examination of controls by
department, activity, or control cycles based upon the perceived degree of “vulnerability” by
considering the risk’s impact, and likelihood of occurrence. Once priorities have been
established, management should initiate the process of testing controls by documenting how
transactions and events are selected for evaluation. This documentation, which may take the
form of a narrative, memorandum or a flow chart, should clearly show who is responsible for
doing what. Management’s next step is to identify potential risks. Management then identifies
all of the related control policies and procedures designed to compensate for those potential
risks. The design of each compensating control should be evaluated to determine whether the
control would be effective if it is operating as designed, followed by testing to see if the control
has actually been implemented and is operational. If management discovers that controls are not
working properly, they should be amended, or steps should be taken to improve compliance.
Throughout this process, management needs to consider that the costs of the controls do not
exceed their benefit.

Control Activities

Control Activities are the policies established by the board and procedures developed by the
board, department heads, or others in order to be in conformance with these policies. Policies are
usually adopted in order to control the various risks identified in the unit’s risk assessment and in
some cases, in order to be in conformance with various laws, rules and regulations. Some of
these policies that I’m sure you are all familiar with are the Procurement Policy, the
Investment Policy and the infamous Standard Workday Policy for retirement reporting
purposes.

Once policies are adopted, the concerned departments or functions must develop procedures in
order to ensure that the policies are followed. These procedures must ensure that proper
separation of duties is observed. The procedure must also ensure that proper reporting and
reconciliations are adopted, proper authorizations are received, proper security of assets and
records is maintained, periodic verifications are performed, and analytical reviews are
performed.

7
 Internal Controls

Information and Communication

The information and communication component relates to the financial reporting process and, in
particular, the accounting system and underlying transactions. It consists of methods and records
established to identify, capture, and exchange information in a form and time frame that enables
people to carry out their responsibilities effectively, and to maintain accountability for the
related assets and liabilities. The information system should produce reports containing
operational, financial and compliance-related information that make it possible to run and
control the unit. Management should review the reports and use them in their decision-making
process. There is nothing worse than when you had the necessary information in order to make
the correct decision and did not utilize it.

Monitoring

Once the governing board, in conjunction with management, has assessed the risk potential of
the various processes within the municipality, a schedule of review should be planned and
outlined. This monitoring also applies to the various policies passed by the board. All major
policies should not be passed and then forgotten. Time has a way of changing the circumstances
and conditions from when the policy was first passed. On at least a yearly basis all policies
should be reviewed and a determination made as to whether they should be amended.

Internal Control Examples

General Controls

Here are some general controls that are important:

 Timely records and reports

 Written policies & procedures
 Physical safeguards of assets (e.g. fire proof safe for cash & minutes book)
 Locking your desk and office when not there
 Keeping computer passwords secret
 Verifying the accuracy of another staff’s work

There are many more controls but these give you the general idea.

8
 Internal Controls

Controls for Cash Receipts

There is no absolute control system for any transaction cycle including cash receipts, but there
are certain control procedures that are usually effective. For cash receipts they include:

 Central Cash Receipts Function - Generally, the more central the cash receipts function is,
the better it can be from an internal control standpoint. It allows management to properly
segregate duties and provide good physical controls.
 Individual Accountability – Each individual collecting cash should be individually
responsible for their accountability (i.e., have their own cash drawer and accountability
records). This ensures that, if there is a problem, the problem can be pinpointed.
 Point of Sale Control - This means that the individual making the payment provides the
control (e.g., a cash register that has a visible amount rung up, a sign that says that you
should be sure to ask for a receipt).
 Control of Forms - These could be press-numbered duplicate receipt forms, permit forms,
etc., that are controlled and reconciled by someone other than the person collecting cash.
 Timely Recording and Deposit - Ideally, cash should be recorded by some method at the
same time it is received. This recording could be in a cash receipts book, on duplicate
receipts or by other methods. Deposits should be made daily or more often if necessary.
This control helps to prevent major loss by theft.
 Segregation of Duties - The same person receiving cash should not be responsible for
recording receipts in detail customer accounts, enforcing of unpaid accounts or reconciling
control or bank accounts.
 Periodic Reconciliations - This is the reconciliation of cash per books to cash in banks at
least once a month by someone independent of the cash collection or enforcement functions.

Controls for Cash Disbursements

The key word here is "Independent.” The following tend to be effective internal controls for
cash disbursements:

 Independent Central Receiving Function - Goods are received and receiving slips are
verified and signed before the goods go to the department that ordered them. This process
helps to make sure that goods are actually received prior to payment for them.
 Independent Central Accounting Function – All the accounting functions are handled
through one central office, usually the business office.
 Independent Central Pre-Audit Function- The review of claims for completeness,
authorization, itemization, legality, etc., prior to payment is a pre-audit function. This should
be defined and well-documented in order to be most effective. This is usually the
responsibility of the internal auditor if there is one.
 Independent Check Signing and Mailing - The signing of authorized checks and mailing
them directly to the vendors. It also includes the control of blank checks and the control of
signature plates to protect against unauthorized use.

9
 Internal Controls

 Segregation of Duties - Ideally, none of the above functions or reconciliations should be

performed by the same individual.
 Reconciliations - The reconciliation of cash in bank to book balances at least monthly by
someone not involved in the check signing function. This is probably the best method of
detecting irregularities in the cash disbursements function.
 Reports to Departments- Periodic (monthly) reports are distributed to departments showing
a comparison of expenditures to budget with detail reports available on request.

Top Ten Fraud Risk Indicators

Just to reemphasize how important internal controls are, the Ohio State Auditor reported the
following top ten risk indicators in school districts in Ohio:

 Key documents missing

 No separation of duties
 Accounting system in disarray
 Lack of policies that establish controls
 Inadequate monitoring to ensure the controls were working as intended
 Ineffective accounting, information technology or internal audit staff
 Documentation that is photocopied or lacking necessary information
 Unusual employee behavior
 Tips or complaints about fraud
 Lack of established code of ethics

Internal Control Checklist

In order to minimize the risk of fraud or abuse in your school district, the following checklist
will assist you:

 Adhere to policies and procedures. Especially, documentation and authorization

 Ensure physical security over assets
 Provide appropriate training to employees
 Independently review and monitor tasks
 Provide for segregation of duties. If not possible, then provide additional controls
 Establish clear lines of authority
 Rotate duties in positions susceptible to fraud (if possible). You need to make
sure certain jobs are possible to rotate (same level or job titles)
 Ensure that employees take regular vacations
 Schedule regular independent audits of areas susceptible to fraud
 Ensure background checks for employees handling financial information
 Make sure internal controls are being followed
 Review staff’s work, documentation, policies and procedures continually

10
 Internal Controls

 Ask for documentation

 Ensure that one person does not have total responsibility for a process
 Evaluate performance regularly
 Report suspicious activity

Conclusions
As a result of increasing pressure on local governments, well-planned and documented internal
control procedures are being recognized as becoming increasingly important in controlling local
government financial operations. Local government managers must recognize this increasing
importance and implement an improved control environment and additional or improved control
procedures where a well thought out cost/benefit analysis indicates they would be cost effective.
While the final decision on improved control procedures rests with the management of the local
government, management should keep in mind that there is always more than one way, and
almost always a cost effective way, to improve control procedures. Lastly, documentation of
existing control environment, accounting system, and control procedures generally has the effect
of improving controls and making them more effective.

11