Presented to President’s Cabinet

INTERNAL CONTROLS are the integration of the activities, plans, attitudes, policies and efforts of the people of an organization working together to provide reasonable assurance that the organization will achieve its mission. Simply put -

Internal Controls are actions taken to make sure the right things happen and the wrong things don’t.

Promote efficient and effective operations and produce quality products and services Safeguard resources against loss due to waste, abuse, mismanagement, errors and fraud Ensure adherence to laws, regulations, contracts and management directives Develop and maintain reliable data, and accurately present the data in timely reports

Everyone in an organization has responsibility for internal control. Senior Management sets the “tone at the top” that affects integrity, ethics and other factors of a positive control environment.

Compliance with laws and policies Accomplishment of mission Relevant and reliable data Economical and efficient use of resources Safeguard assets

Monitoring Assess internal control performance Control Activities Tools that help prevent or reduce risk Risk Assessment Identification and analysis of relevant risks to achievement of objectives Control Environment Sets the tone for the organization The foundation for all other components of internal control Communication Information

Setting the proper control environment is crucial to the effective implementation of all the other elements of internal control. Staff will take their cue from the attitude and example displayed by management.

 RISKS are events that threaten the accomplishment of objectives and can be either internal or external. They ultimately impact an organization’s ability to accomplish its mission. Examples of risks include:  Human error  Fraud  System breakdowns  Natural disasters Examples of risks include:  Human error  Fraud  System breakdowns  Natural disasters

 Identify each risk in terms of: Likelihood The probability that an unfavorable event would occur if there were no internal controls in place Significance or Impact The magnitude of the effect on the organization if the unfavorable event were to occur Cause The reason why the unfavorable event may occur

 Risk assumption – impact and likelihood low (do not establish control activities)  Risk control – take action to lower the probability or eliminate the risk (establish control activities)  Risk avoidance – abandon plan; risks uncontrollable and unacceptable (do not carry out the function)

COSTS BENEFITS Managing Risk Risk The cost of internal control should not exceed the benefit derived

 Control activities are tools – both manual and automated – that help identify, prevent or reduce the risks that can impede accomplishment of the unit’s objectives. Directive Controls (Laws, Regulations) Directive Controls (Laws, Regulations) Preventive Controls (Approvals, Authorizations) Preventive Controls (Approvals, Authorizations) Detective Controls (Reconciliations, Audits) Detective Controls (Reconciliations, Audits) Corrective Controls (Training, Supervision) Corrective Controls (Training, Supervision)

 Documentation – preserving evidence to substantiate a decision, event, transaction or system  Approval and Authorization  Verification – determination of the completeness, accuracy, authenticity and/or validity of transactions, events or information  Supervision  Separation of Duties – division of key tasks and responsibilities among various employees  Safeguarding Assets – restricting access to resources and information to help reduce the risk of unauthorized use or loss  Reporting – helps promote accountability for actions and decisions

 All Employees Have Responsibility for Internal Controls ◦ Senior Management sets the “tone at the top” that affects integrity, ethics and other factors of a positive control environment.  Management should consider risks to achieving established objectives and strategies and manage appropriately (accept, control or avoid).  Communication must occur up, down and across an organization.  An Internal Control Program is a good idea and IT’S THE LAW

 Standards for Internal Control in New York State Government, Office of the State Comptroller.  Control Environment – Tone at the Top, New York State Internal Control Association