The Elements of appropriate Internal Controls

What is meant by “Internal Controls?” Internal Control: an integral component of an organization’s management that provides reasonable assurance that the following objectives are being achieved: • effectiveness and efficiency of operations, • reliability of financial reporting, and • compliance with applicable laws and regulations.

Who is Responsible for “Internal Controls?” 45 CFR 1304.50(g) --Governing body responsibilities  45 CFR 1304.50(g)(2) -- Grantee and delegate agencies must ensure that appropriate internal controls are established and implemented to safeguard Federal funds in accordance with 45 CFR 1301.13.

Elements of “Internal Controls” The Governing Body Integrity and Ethical Values Commitment to Competence Managements Philosophy and Operating Style Organizational Structure Assignment of Authority and Responsibility

Elements of “Internal Controls” Human Resources Policies and Procedures Risk Assessment Control Activities Information and Communication; and Monitoring

Elements of Internal Controls The Governing Body Monitoring Integrity and Ethical Values Information and Communication Commitment to Competence Control Activities Managements Philosophy and Operating Style Risk Assessment Organizational Structure Assignment of Authority and Responsibility Human Resources Policies and Procedures

The Governing Body

The Governing Body The Governing Body has developed and implemented written policies that define there roles and responsibilities and that inform them of the management procedures and functions necessary to implement a high quality program. If so, they are updated annually and approved by the Governing Body.

The Governing Body Governing Body members are independent of the agency and management. The Governing Body members have the knowledge, organizational experience, and financial expertise to serve effectively in their role.

The Governing Body The Governing Body schedules sufficient number of meetings and the meetings are sufficient in length and depth to cover the agenda and provide healthy discussions of the financial issues. The Governing Body constructively challenge managements planned decisions, particularly in the area of financial reporting, and probe the evaluation of past results.

The Governing Body Regular meetings are held between the Governing Body, CFO, CEO, other key members of the financial management team and the independent auditor regarding the annual audit. The sessions are conducted on a regular basis throughout the audit process.

The Governing Body The Governing Body receives key information from management in sufficient time in advance of meetings to prepare for discussions at the meetings. The Governing Body approves the annual audit plan.

The Governing Body A process exists for informing the Governing Body members about significant issues on a timely basis and in a manner conducive to the Governing Body having a full understanding of the issues and their implications.

The Governing Body The Governing Body is informed about personnel turnover in key functions including, senior management, and key personnel in the financial/accounting department. The Governing Body observes patterns of unusual employee turnover situations as an indicator of problems.

Integrity and Ethical Values

Integrity and Ethical Values Definitions Integrity: firm adherence to a code of especially moral values Ethical: conforming to accepted standards of conduct

Integrity and Ethical Values The organization has a comprehensive code of conduct, and/or other policies addressing acceptable business practice, conflicts of interest, and expected standards of ethical and moral behavior? The Code of Conduct is distributed to all employees.

Integrity and Ethical Values All employees are required to annually acknowledge that they’ve read, understand, and complied with the code of conduct. Management demonstrates through actions its own commitment to the code of conduct.

Integrity and Ethical Values Dealings with clients, suppliers, employees, and other parties are based on honesty and fair business practices. Management takes appropriate action in response to violations of the code of conduct.

Integrity and Ethical Values Management is explicitly prohibited from overriding established controls. Controls are in place to provide reasonable assurance that internal controls are not overridden by management. Deviations from policies are investigated and documented. Violations (if any) and the results of investigations brought to the attention of the Governing Body.

Integrity and Ethical Values The organization is proactive in reducing fraud opportunities by: (1) identifying and measuring fraud risks, (2) taking steps to mitigate identified risks, (3) identifying a position within the organization to oversee the fraud prevention program, and (4) implementing and monitoring appropriate preventative and detective internal controls and other deterrent measures.

Integrity and Ethical Values The agency has developed and implemented anonymous ethics and fraud procedures to investigate and report issues of fraud to the Governing Body. (Consider Whistleblower)

Commitment to Competence

Commitment to Competence Definitions Commitment: an act of committing to a charge or trust Competence the quality or state of being competent

Commitment to Competence The level of competence, required knowledge and skills are defined for each job in the accounting department. The Governing Body and Management Team make every effort to determine whether the accounting staff has adequate knowledge and skills to do their jobs.

Managements Philosophy and Operating Style

Managements Philosophy and Operating Style The accounting function is viewed as a team of competent professionals bringing information, order, and controls to financial decision-making. The selection of accounting principles made in the long-term are in the best interest of the organization (as opposed to short-term maximization of funds).

Managements Philosophy and Operating Style Assets, including intellectual assets are protected from unauthorized access and use. Managers respond appropriately to unfavorable signals and reports. Projections and budgets are reasonable and achievable.

Organizational Structure

Organizational Structure The accounting department within the organizational structure is appropriate for the size of the organization. The key manager's in the accounting department are given adequate definitions of their responsibilities.

Organizational Structure A sufficient numbers of employees are employed in the accounting department to allow those individuals to effectively carry out their responsibilities.

Assignment of Authority and Responsibility

Assignment of Authority and Responsibility Job descriptions are in place for each management and support staff in the accounting department. The authority delegated is appropriate for the responsibilities assigned. Senior managers get involved as needed to provide direction, address issues, correct problems, and/or implement improvements.

Human Resources Policies and Procedures

Human Resources Policies and Procedures Personnel, Policies and Procedures are in place for hiring, training, promoting, compensating and terminating employees in the organization. Employees understand that sub-standard performance will result in remedial action.

Human Resources Policies and Procedures Remedial or corrective actions are taken against management and staff in response to departures from approved policies. Employees understand the performance evaluation system and its relationship to training, promotions and salary increases.

Risk Assessment

Risk Assessment The organization consider risks from external sources such as creditor demands, economic conditions, regulation, and/or labor relations.

Risk Assessment The organization consider risks from internal sources such as key employees (retention and succession planning), financing and the availability of funding for key programs, competitive compensation and benefits, information systems security, and backup systems.

Risk Assessment The risks of a misstatement of the financial statements are considered and steps taken to mitigate that risk. If applicable, the risks associated with foreign/off-shore operations are considered, including their impact on the financial objectives.

Control Activities

Control Activities The organization has a process in place to ensure that controls as described in its policy and procedures manuals are applied as they are meant to be applied. The fiscal manual documents all important policies and procedures in order to implement appropriate internal controls.

Control Activities The organization has implemented a system to review and updated policies and procedures on a regular basis (as needed).

Control Activities Supervisory staff regularly reviews the functioning of internal controls. The review conducted is documented and the results are used for improvements. Appropriate and timely follow-up activities are conducted.

Information and Communication

Information and Communication A process in place to collect information from external sources, such as industry, economic, and regulatory information, that could have an impact on the organization and/or the financial objectives. Milestones to achieve financial objectives are monitored to ensure that timing deadlines are met.

Information and Communication Necessary operational and financial information is communicated to the right people in the organization on a timely basis and in a format that facilitates its use, including new or changed policies and procedures.

Information and Communication A process is in place to respond to new information needs in the organization on a timely basis. There’s a process in place to collect and document errors or complaints to analyze, determine cause, and eliminate a problem from recurring in future.

Information and Communication A process is established and communicated to officers, employees, and others, about how to communicate suspected instances of wrongdoing by the organization or its employees. A process exists to ensure that anyone making such a report is protected from retaliation for making such a report.

Monitoring

Monitoring Officers and employees understand their obligation to communicate observed weaknesses in design or compliance with the internal control structure of the organization to the appropriate supervisory or management staff.

Monitoring Interactions with external stakeholders are periodically evaluated to determine if they are indicative of a weakness in the internal controls structure. Example, consider the frequency of complaints about incorrect invoices, statements, and acknowledgments.

Monitoring Follow-up activities are taken on recommendations from the independent auditors for improvements to the internal control system. Staff is required to sign off, indicating their performance of critical control activities such as performing reconciliations.

Monitoring The Independent audit has the right number of competent and experienced staff? They have access to the governing body and finance staff. The reporting structure is in place to ensure objectivity and independence. The work of the independent audit team is appropriate to the organizations needs and complies with the Single Audit Act.