1. © 2011 Financial Operations Networks LLC AP Policies and Internal Controls for Running a Tight Ship Panel: Susan Tinkler-Muller Mike Iverson Rob Rogers Tuesday, April 13, 2011

2. www.TheAPNetwork.com Page 2 The Panel Susan Tinkler-Muller Vice President, Financial Services MTV Networks Viacom Mike Iverson CFO Financial Operations Networks Rob Rogers Vice President, Editorial Financial Operations Networks

3. www.TheAPNetwork.com Page 3 Session Objectives ** Warning: Interactive Session Ahead ** Internal Controls Defined State of AP Policies & Internal Controls: Audience Poll & TAPN Survey Results Policy & Internal Controls: The Problems & Challenges What to Do About it: IC Best Practice

4. www.TheAPNetwork.com Page 4 What Is Internal Control System process & procedures Prevent irregularities Minimize risk finances and operations Accuracy

5. www.TheAPNetwork.com Page 5 Key Internal Control Objectives Sarbanes-Oxley & IC Key Objectives Efficiency Safeguard Reliability Consistent Compliance SOx & Internal Control Public companies Private companies Management accountability and liability Management report

6. www.TheAPNetwork.com Page 6 Concept: Control Environment Foundation Management Tone Independence Organizational Structure Examples Code of Ethics Independent Audit Polices & Procedures Organizational Chart

7. www.TheAPNetwork.com Page 7 Concept: Control Activities Policies & Procedures Three Types Control Activity ―Preventive ―Detective ―Corrective

8. www.TheAPNetwork.com Page 8 Control Activity: Preventive Control Proactive Separation Process Safeguard

9. www.TheAPNetwork.com Page 9 Preventive Control in A/P Separation of Duties ―Check and Balance ―Separate Transaction Elements ―Organizational Chart

10. www.TheAPNetwork.com Page 10 Preventive Control in A/P (Cont’d.) Processing Controls ―Authorization ―Approval ―Matching

11. www.TheAPNetwork.com Page 11 Preventive Control in A/P (Cont’d.) Document Controls ―Written Evidence ―Recordkeeping Accuracy ―Compliance

12. www.TheAPNetwork.com Page 12 Preventive Control in A/P (Cont’d.) Safeguard Controls ―Physical Access ―Protection ―Disaster Planning

13. www.TheAPNetwork.com Page 13 Preventive Control in A/P (Cont’d.) System Controls ―Verification Edits ―Matching Edits ―Accuracy Edits

14. www.TheAPNetwork.com Page 14 Control Type: Detective Controls After the fact Find an error Prior to financial reporting

15. www.TheAPNetwork.com Page 15 Detective Controls in A/P Analysis Controls ―Comparison Financial Data ―Review Compliance ―Analyze Outlier Data

16. www.TheAPNetwork.com Page 16 Detective Controls in A/P (Cont’d.) Reconciliation Controls ―Account Balance Reconciliation ―Reporting Reconciliation

17. www.TheAPNetwork.com Page 17 Detective Controls in A/P (Cont’d.) Physical Controls ―Breach Physical Security ―Breach System Security

18. www.TheAPNetwork.com Page 18 Controls Type: Corrective Controls After the fact Prevent a repeat New design

19. www.TheAPNetwork.com Page 19 Corrective Controls in A/P Quality Controls ―Meet Standards ―Validation ―Assess Effectiveness

20. www.TheAPNetwork.com Page 20 Corrective Controls in A/P (Cont’d.) Budget Review ―Variance Analysis ―Ask “Why?” ―“Don’t Measure It, Can’t Manage It”

21. www.TheAPNetwork.com Page 21 Internal Control Strategies Periodic Reviews Personnel Training / Evaluation Design Guidelines by COSO

22. www.TheAPNetwork.com Page 22 Weakness in Controls Limited financial resources Limited staff resources Organizational size and complexity

23. www.TheAPNetwork.com Page 23 Compensating Control Strategy Compensate Missing Control Preventive, Detective, or Corrective Misguided Trust

24. www.TheAPNetwork.com Page 24 Internal Controls Survey Survey Results

25. www.TheAPNetwork.com Page 25 Survey Results Participant Profile Number of employees ―1 - 24919% ―250 - 49914% ―500 - 99915% ―1,000 - 4,99925% ―5,000 - 9,999 8% ―10,000 - 19,999 7% ―20,000 - 34,999 4% ―35,000+ 8% Annual Revenue ―1st Quartile $33,000,000 ―Median $264,527,614 ―3rd Quartile$1,225,000,000 ―Average$5,288,899,842

26. www.TheAPNetwork.com Page 26 Survey Results (Cont’d.) Does your accounts payable have written standard operating procedures? ― Yes84% ― No14% ― Not Sure 2% If you have a written set of standard operating procedures or AP policies & procedures, when where they last reviewed and updated? ― Within the last year54% ― Within the last 2 – 3 years30% ― Within the last 4 – 5 years 7% ― Are you serious? 9%

27. www.TheAPNetwork.com Page 27 Survey Results (Cont’d.) If you have written SOP, do they specify internal controls? (Are your AP controls documented in your policy?) ― Yes72% ― No18% ― Not sure 9% As a result of SOx, is anyone in your SSC or AP operations required to attest internally that appropriate controls are in place in the payables process? ― Yes60% ― No29% ― Not sure10%

28. www.TheAPNetwork.com Page 28 Survey Results (Cont’d.) Is your procure-to-pay process built around internal controls, or are your internal controls built around your process? ― Controls built around process36% ― Process built around controls46% ― Not sure11% ― We do not have documented controls 7% Do you follow up on open items from an internal audit? ― Yes, fully77% ― Yes, partially15% ― No 6% ― We’re supposed to follow up? 2%

29. www.TheAPNetwork.com Page 29 Survey Results (Cont’d.) When was the last time your company experienced fraud? ― Within the last 6 months17% ― Within the last year11% ― Within the last 2 years11% ― Within the last 3 – 5 years 8% ― More than 5 years ago20% ― Don’t know32% Was the fraud external or internal? ― Internal23% ― External32% ― Both 9% ― N/A36%

30. www.TheAPNetwork.com Page 30 Survey Results (Cont’d.) Which of the following best describes the fraud your company experienced? ― Check fraud31% ― Electronic payment fraud 4% ― Invoice fraud 8% ― Vendor fraud 5% ― Other16% ― N/A36% Has your company had to restate its financial reporting? ― Yes 4% ― No68% ― Don’t know27%

31. www.TheAPNetwork.com Page 31 Survey Results (Cont’d.) Who handles or manages accounts payable internal controls? ―Accounting Manager17% ―AP Director 7% ―AP Manager24% ―AP Supervisor 8% ―Controller20% ―Don't Know 1% ―Internal Audit 9% ―Other 8% ―SSC Director 3% ―VP, F&A 3%

32. www.TheAPNetwork.com Page 32 Survey Results (Cont’d.) Are you using technology to manage AP internal controls? ― Yes54% ― No38% ― Don't Know 8% If yes, what technology are you using? ―Audit software 4% ―Automated workflow with built-in rules and controls38% ―Fraud monitoring software 0% ―N/A36% ―Other10% ―No Answer12%

33. www.TheAPNetwork.com Page 33 Survey Results (Cont’d.) What is your biggest internal control challenge?

34. www.TheAPNetwork.com Page 34 Internal Controls Challenges

35. www.TheAPNetwork.com Page 35 Internal Controls Best Practices

36. www.TheAPNetwork.com Page 36 Wrap-Up Defined What & Why Internal Control Concepts/ Objectives / Strategies Not Absolute Continued Evaluation

37. © 2011 Financial Operations Networks LLC Thank You!