1. INTERNAL CONTROLS – THINGS WE DO TO KEEP BAD THINGS FROM HAPPENING
Jim Arnette, CGFM, CISA
AGA Past-National President

2. WE DIDN’T THINK IT COULD HAPPEN TO US...
INTERNAL CONTROLS
“Fraud just couldn’t happen here because all our employees are honest.”
“Our office is small…We don’t have any fraud risks.”
“Implementing internal controls is too costly.”
“Internal controls? That’s why we have insurance.”
“Utilizing internal control procedures is not worth the effort.”
“If we get audited every year, why do we need internal controls?”
WE DIDN’T THINK IT COULD HAPPEN TO US...
WE NEVER SAW THAT COMING...

3. INTERNAL CONTROLS
“There’s no such thing as a small fraud…Some frauds just haven’t matured yet…”

4. INTERNAL CONTROLS
“How could a county bookkeeper write checks to a legitimate company and deposit those checks into her personal account?”

5. INTERNAL CONTROLS

6. INTERNAL CONTROLS
191 Vendor Checks
$200,000

7. INTERNAL CONTROLS
FRAUD TRIANGLE

8. INTERNAL CONTROLS
FRAUD IN TENNESSEE
Over 10,000 allegations since 2013 (hotline, fraud reporting forms, phone calls, s, faxes, etc.)
Hundreds of allegations investigated each year
$9 million in cash shortages

9. WHAT ARE INTERNAL CONTROLS?
Internal controls are methods put in place to provide reasonable assurance that the objectives of the government will be achieved in operations, reporting, and compliance…
Checks and balances that are in place to detect and to help prevent fraud…
Things we do to keep bad things from happening...
They keep things under control…

10. KEY EVENTS IN INTERNAL CONTROL HISTORY
INTERNAL CONTROLS
KEY EVENTS IN INTERNAL CONTROL HISTORY
1972 – GAO issues the first Yellow Book
1983 – GAO establishes Standards for Internal Controls in the Federal Government – This was the Green Book…
1984 – Single Audit Act
1990 – Chief Financial Officer’s Act
1992 – COSO releases the Internal Control Framework
2002 – Sarbanes-Oxley Act

11. KEY EVENTS IN INTERNAL CONTROL HISTORY
INTERNAL CONTROLS
KEY EVENTS IN INTERNAL CONTROL HISTORY
2004 – COSO – Enterprise Risk Management – Integrated Framework
SAS Communicating Internal Control Matters Identified in an Audit
2014 – DATA Act
2014 – OMB Uniform Grant Guidance
2015 – Fraud Reduction and Data Analytics Act
2016 – Update to Circular A-123

12. WHY DO WE NEED INTERNAL CONTROLS?
Reduce opportunities for fraud and waste
Help management make better informed decisions
Establish performance standards
Help ensure compliance with applicable laws, regulations, policies, and procedures
Eliminate adverse publicity
Protect government assets
Promote effectiveness and efficiency of operations
Ensure reliability of financial reporting
Promote transparency and accountability
PUBLIC TRUST

13. WHO’S RESPONSIBLE FOR INTERNAL CONTROLS?
Management
Governing Board
Audit Committees
Internal Audit Function

14. INTERNAL CONTROLS Control Environment Risk Assessment Monitoring
Control Activities (e.g. Segregation of Duties)
Information and Communication
Monitoring
Components

15. INTERNAL CONTROLS
“How could a public utility award thousands of dollars in bonuses without a bonus policy or board approval?”

16. INTERNAL CONTROLS

17. $293,779.22 in unapproved bonuses
INTERNAL CONTROLS
$293, in unapproved bonuses

18. INTERNAL CONTROLS

19. INTERNAL CONTROLS

20. WHY INTERNAL CONTROLS DON’T WORK
No internal control system will provide absolute assurance whether they will allow an organization to meet their objectives without issues
Internal control is implemented by humans and requires the use of their judgement in decision making…Humans are prone to mistakes and moral and ethical lapses
Some internal controls just don’t work
Management blindly trusts their employees
Staff might not be up to speed on internal control policies
There’s a cost vs. benefit - No organization has unlimited resources
Sometimes internal controls are subject to management override
There’s the possibility of collusion

21. INTERNAL CONTROLS Oliver Springs Housing Authority
$160,000+ Cash Shortage

22. INTERNAL CONTROLS
“How could an employee at a local housing authority use Federal funds to purchase a cruise, sporting goods, clothes, etc.?”

23. INTERNAL CONTROLS

24. INTERNAL CONTROLS

25. INTERNAL CONTROLS

26. INTERNAL CONTROLS

27. INTERNAL CONTROLS No oversight by the Board of Commissioners
Didn’t operate within their budget
Used hand-written receipts
No segregation of duties
Multiple employees used the same cash drawer
Deposits not made in a timely manner
Accounting records not kept on a current basis
Checks only contained one signature
Credit card invoices paid without supporting documentation

28. INTERNAL CONTROLS
“Never trust the people you cheat with. They’ll throw you under the bus.”
Marianne Jennings, Ethics Professor, Arizona State University, Author
“Three people can keep a secret if two are dead.”
Ben Franklin, Founding Father

29. KEY POINTS TO REMEMBER INTERNAL CONTROLS
Internal control is the combination of people, policies, and procedures that organizations rely upon to obtain reasonable assurance that their government’s operating effectively
The primary responsibility for internal control lies with management…But the governing body has the ultimate responsibility to be sure management is doing what they’re supposed to do
External auditors rely on internal controls to support their audit opinions regarding the financial statements
Audit committees and internal auditors support management and the governing body regarding internal control
Reasonable assurance requires an internal control system that addresses the 5 components of internal control: control environment, risk assessment, control activities, information and communication, and monitoring
Even the best system of internal control will fail in an unfavorable environment
Risk assessment is not a one-time event…It’s an on-going process

30. INTERNAL CONTROLS

31. AGA Past-National President
INTERNAL CONTROLS
“Accounting and Accountability Professionals Working Together to Make Government Work Better…”
Jim Arnette
AGA Past-National President