University at Albany Internal Control Program

1. University at Albany Internal Control Program Manager Training Internal Control Officer: Jonathan St Clair Internal Control Coordinator: Weisu Fudge NOTE: This PowerPoint presentation is designed for the slides to advance automatically. However, you may still right click with your mouse and click on next or previous if you find it necessary to advance or repeat a slide.

2. Objective Brief overview of internal controls - what they are and why we need them

3. Why Internal Controls?It is the LAW! The NYS Governmental Accountability, Audit and Internal Control Act of 1987 • Also called the “Internal Control Act” • Made permanent in Chapter 510 of Laws of 1999 • Requires all state agencies, including SUNY campuses, to institute an internal control program

4. Why Internal Controls?It is the LAW! The State Division of the Budget’s Budget Policy and Reporting Manual Item B-350, Governmental Internal Control and Internal Audit Requirements • Requires all state agencies to perform certain internal control responsibilities • Requires all state agencies to certify each year that they are in compliance with these internal control requirements and the Internal Control Act.

5. Definition of Internal Controls Internal controls are the integration of the activities, plans, attitudes, policies, and efforts of the people of an organization working together to provide reasonable assurance that the organization will achieve its mission.

6. Examples of Internal Controls Used Every Day • Separating duties among employees so that no one employee controls all aspects of any transaction or process • Locking office doors each evening • Not sharing user ID and password • Not storing personally identifiable information on mobile devices (USB drives, laptops, phones, etc.) • Securing valuable assets

7. In work environments, we use the term Internal Controls because: • They are used to ensure that our internal operations work the way we want so that we accomplish what we want • They are managed and used by people within the organization • They are built into our work activities

8. Internal Controls help us to: • Operate effectively and efficiently - or in other words to do the right things in the right way • Provide quality products and services • Ensure that we comply with all applicable laws, regulations, policies, and contracts • Protect our assets and resources • Develop, maintain, use, and provide data that is accurate and reliable

9. Internal Controls help protect us from risks - the things that could go wrong and prevent us from accomplishing our goals

10. Internal Controls and Risk Management • First we must identify our goals • Then we need to determine what could go wrong in trying to achieve those goals - those things are Risks • Next we decide how to manage those risks • Implement internal controls to decrease the chance that something will go wrong; OR • Live with the risk

11. People doing things Things put into place by people Internal Controls - What we use to decrease risks and help make sure things happen the way we want

12. Preventive - stop unwanted events from happening Detective - identify unwanted events that have occurred Internal Controls - What we use to decrease risks and help make sure things happen the way we want

13. Preventive Segregation of duties - dividing responsibilities so that no one person controls an entire activity and thereby could cause and conceal errors or fraud Safety procedures - precautions taken to help prevent accidents Detective Physical inventories - inspect assets on hand and match to assets recorded in the books to detect any missing items Supervisory reviews - review of work performed to detect any errors Examples of Internal Controls

14. Why Internal Controls?Good Business Sense • In order to succeed, an organization must manage its operations effectively • Internal controls provide reasonable assurance that an organization meets established objectives and goals • Internal controls decrease the risks to an organization

15. What if we do not have Effective Internal Controls? • We could fail to meet our goals and objectives • We might violate laws or regulations • We may lose assets and/or opportunities

16. Can Things Really Go Wrong Here? Unfortunately - Yes! They can and have. In the past few years, there have been a number of disciplinary and legal situations on campus that at their core involved a breach of internal controls.

17. Recent Examples of Internal Control Breaches at UAlbany 1. An employee falsely claimed to be going on a business trip and signed out a state vehicle for that trip. He actually went to visit family, and got into a car accident in the state vehicle. He attempted to cover it up but the vehicle was damaged and an investigation revealed there was no business purpose for the trip or vehicle use.

18. Recent Examples of Internal Control Breaches at UAlbany 2.An employee used a state vehicle to go off campus to dine without the knowledge or approval of his supervisor. The employee also did not use break time but rather stayed on the clock while dining off campus.

19. Recent Examples of Internal Control Breaches at UAlbany 3.State owned property and equipment is for official University business only. Several instances of inappropriate use of state assets have been uncovered, including use of fax machines and copiers to support a political candidate and use of laundry equipment for personal wash.

20. Recent Examples of Internal Control Breaches at UAlbany 4. Employees who are “on the clock” are expected to be working as they are being paid by the state to work. Several recent cases have arisen of employees being caught sleeping on the job either by other employees or by students.

21. Recent Examples of Internal Control Breaches at UAlbany 5. Employees are expected to be honest on their job applications, but supervisors must thoroughly check references and backgrounds before hiring an applicant. One employee checked on his application that he had never been convicted of a felony but then was overheard remarking that he had. An investigation revealed that he had in fact been convicted and falsified his application.

22. Recent Examples of Internal Control Breaches at UAlbany 6. Reports containing personal identifiable information for students were being left in recycling bins without any assurance or guarantee that the information was being shredded or properly secured before disposal.

23. Internal Controls are IMPORTANT for every area of the University • No matter how big or how small the department is • No matter whether or not the department handles money • No matter whether or not the department handles confidential information

24. Who has a role in Internal Controls? Everyone!

25. Who is responsible for Internal Controls? • Every employee has the responsibility to help ensure that internal controls are effective by following controls and reporting problems or suggesting improvements • The greatest amount of responsibility rests with deans, department chairs, and managers to assure appropriate controls are in place for all operations • The President has the ultimate responsibility, and must sign the annual certification that UAlbany is in compliance with the Internal Control Act

26. Internal Control Program Contacts Jonathan St. Clair, Internal Control Officer Phone: 956-8092 jstclair@albany.edu Weisu Fudge Internal Control Coordinator Phone: 956-8124 wfudge.@albany.edu http://www.albany.edu/internalcontrol/

27. Other Important Contacts Martin Manjak, Chief Information Security Officer Phone: 437-3813 E-mail: mmanjak@uamail.albany.edu http://www.albany.edu/its/besecure.htm Janet Thayer, Senior Managing Counsel Phone: 956-8050 E-mail: jthayer@uamail.albany.edu

28. To provide an audit trail of who has received this state-required Internal Control training, please click on the link below and complete the attached form before closing this presentation.http://www.albany.edu/internalcontrol/IC-Training-Record.php Thank you for your participation! Please note that the link may not work if you are using a browser other than Internet Explorer. In that case, you can copy and paste the link directly into your web browser.