1. OCPS Internal Controls and Stakeholder Value
September 17, 2018

2. Why Are Internal Controls Important?
An effective system of internal controls forms one of the keystones necessary to building, maintaining and improving stakeholder value. Effective internal controls help to:
Avoid surprises
Assure the adequacy of process performance
Perform jobs more efficiently and effectively
Improve the overall quality of our district
Stakeholders expect a good system of internal controls.
Not just the right thing to do, but the best thing to do for efficiency and effectiveness as well as our reputation and stakeholder satisfaction.

3. Greater Stakeholder Value
Premise
Surprises
Greater Stakeholder Value =
Good Controls =
Fewer Surprises
Good controls are important and valuable.
Surprises are not good things in this case.

4. What Are Internal Controls? 1/2
An internal control is defined as:
A process, effected by an organization’s board, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories:
Effectiveness and efficiency of operations
Reliability of financial and other reporting
Compliance with applicable laws and regulations
“Internal controls help to ensure the achievement of an objective.”
Reliability of reporting is a key one for us since we do so much of it.
And we’re not just talking about financial data. Look at FEFP, Title IX, Student achievement, Teacher performance evaluations, etc.
Reliability of reporting is critical.

5. What Are Internal Controls? 2/2
This definition reflects certain fundamental concepts:
Internal control is a process. It’s a means to an end, not an end in itself.
People effect internal control. It’s not merely policy manuals and forms, but people at every level of an organization.
Internal control can be expected to provide only reasonable assurance, not absolute assurance, to an organization’s management.
Internal control is geared to the achievement of objectives in one or more specific but overlapping categories. They are:
Control Environment Information
Risk Assessment Communication
Control Activities Monitoring
Key take aways here are:
People
reasonable assurance (there are no absolutes – the best way to avoid risks is to not get out of bed in the morning, but then nothing would get done)
Geared to achievement of objectives

6. Control Environment
The control environment sets the tone of an organization, influencing the control consciousness of its people. It is the foundation for all other components of internal control, providing discipline and structure. Control environment factors include:
Integrity, ethical values and competence of the organization’s people
Management’s philosophy and operating style
Methods management assigns authority, responsibility and organizes and develops its people
Attention and direction provided by the board
How solid are the controls in your work environment?
This is the “tone at the top” that is paramount to a culture of control consciousness and effectiveness.
Thankfully this is not an issue at OCPS. Our Board and Superintendent have set a clear tone that provides guidance and direction.

7. Risk Assessment
Every organization faces a variety of risks from external and internal sources that must be assessed.
A precondition to risk assessment is the establishment of objectives, linked at different levels and internally consistent.
Risk assessment is the identification and analysis of relevant risks to achievement of objectives, forming a basis for determining how the risks should be managed.
Because economic, industry, regulatory and operating conditions will continue to change, mechanisms are needed to identify and deal with the special risks associated with change.

8. Control Activities
Control activities are the policies and procedures that help ensure management directives and School Board Policies are carried out.
They help ensure that necessary actions are taken to address risks to the achievement of the district’s objectives.
Control activities occur throughout the district, at all levels and functions.
They include a range of activities as diverse as:
Approvals Reviews of operating performance
Authorizations Security of assets
Verifications Segregation of duties
Reconciliations
Control activities are not limited to the financial and budget areas. They exist throughout our organization and drive our processes.
Consider all the management reports, scorecards and other information that are critical to your funding, operations, and decision making.

9. Information
Pertinent information must be identified, captured and communicated in a form and timeframe that enable people to carry out their responsibilities.
Information systems produce reports containing operational, financial and compliance-related information that make it possible to run and control the organization.
They deal not only with internally generated data, but also information about external events, activities and conditions necessary to informed business decision- making and external reporting.
What information does your area need to be successful?
Think about what you generate in your areas that needs to be understood by you and your management team to make decisions as well as information that your team needs from outside (FDOE, state statutes, regulations, etc.)
The information you require should be managed within your control framework to ensure its reliability and timeliness.

10. Communication (1/2)
All personnel must receive a clear message from top management that control responsibilities must be taken seriously
They must understand their own role in the internal control system, as well as how individual activities relate to the work of others
This communication imperative is being addressed with the internal control brochures and with a new page of my department’s internet site.
The brochures will be distributed to any and all and you are welcome to as many copies as you would like for your team.
The brochures are intended to communicate the district’s internal control program. They are for all of us to use. If you have suggestions for additional content or revisions, please let me know before the next printing.

11. Communication (2/2)
They must have a means of communicating significant information upstream
There also needs to be effective communication with external parties, such as taxpayers, community members, suppliers, regulators and stakeholders

12. Monitoring
Internal control systems need to be monitored – a process that assesses the quality of the system’s performance over time. This is accomplished through ongoing monitoring activities, separate evaluations, or a combination of the two.
Ongoing monitoring occurs in the course of operations. It includes regular management and supervisory activities and other actions personnel take in performing their duties.
The scope and frequency of separate evaluations will depend primarily on an assessment of risks and the effectiveness of ongoing monitoring procedures.
Internal control deficiencies should be reported upstream, with serious matters reported to top management and the board.
This monitoring occurs primarily at the upper supervisory and management levels and secondarily via audits.

13. Preventative Controls
Preventative controls focus on preventing errors or exceptions. The following are types of preventative controls:
Standard policies and procedures
Proper segregation of duties
Firewalls and ID specific passwords
Authorizations levels/approvals
Most commonly implemented at the transaction level by front line employees. Some consider these to be the most effective.

14. Detective Controls
Detective controls are designed to identify an error or exception after it has occurred. Examples include:
Exception reports
Reconciliations
Periodic audits
Authorization levels/approvals
Most commonly implemented at a summary level by supervisory employees

15. Internal Control Methodology
Authorization/Approvals – who has the access or authorization to approve transactions? Transaction processing – who has the access or authorization to process transactions? Classification (student or financial reporting) Substantiation/Evaluation/Reconciliation – what current processes and procedures are in place to validate results? Physical safeguards – are all tangible and intangible district assets adequately safeguarded?
These are the key attributes addressed by the internal control system.

16. Segregation of Duties
Segregation of duties – separating incompatible duties within a given process. Each process can be broken down into five incompatible duties for which appropriate segregation should exist. They are as follows:
Initiation – a need is determined and a process is initiated
Approval – the appropriate individual approves a request
Execution – the request is processed
Recording – the financial implications of the transaction are processed
Reconciliation – the results of a transaction are validated against source documents
Are duties appropriately segregated in your area?

17. Questions to Ask Yourself
Are your processes & procedures sufficiently documented?
Have you established standard internal rules?
Who can and cannot execute transactions?
Are all incompatible duties appropriately segregated?
Do you really monitor what you are doing?
What sort of performance metrics do you use?
How does your area compare to similar ones?
Is all of your information and knowledge adequately protected?
These questions will aid in evaluating the adequacy of your internal controls.
What opportunities might exist for improvement?

18. Summary Internal controls help create stakeholder value
They involve people, technology, and processes
Individuals at every level can contribute to an efficient & effective control environment

19. Things to Ponder What major risks are associated with my area?
What controls are in place to mitigate those risks?
How effective are those controls?
How do I know???
As you consider these questions, you will see the risk assessment and control systems’ importance. Without a solid risk assessment or effective internal controls, the answers to these questions will elude you.