Internal Controls

1. Internal Controls Katarina Bugariu, Associate Comptroller May 21, 2019

2. Internal Controls Definition • An entity’s system of internal control consists of policies and procedures designed to provide management with reasonable assurance that the company achieves its objectives and goals including: • Effectiveness and Efficiency of Operations • Compliance with Laws and Regulations • Reliability of Financial Reporting

3. Real world Summary Why Internal Controls are Important • Provides management with confidence that the entity is operating according to standards which are monitored-someone is watching. • Indicates to staff that what they are doing is important and that QUALITY is important. • Sends a signal that certain behaviors will not be tolerated.

4. Simple Definition • Internal control is what we do to see that the things we want to happen willhappen … • And the things we don’t want to happen won’thappen.

5. Risk and Internal Controls • Management assesses risk as part of designing and operating internal controls to minimize errors and fraud. Three steps involve: • Identify factors that may increase risk (Risk Assessment) • Determine significance of risk and likelihood of occurrence • Develop specific actions to reduce risk to an acceptable level (implementing controls)

7. Examples of Controls • Preventive • Reading and understanding applicable College policy and procedures • Review and approval process for POs and requisitions to make sure they are appropriate before the purchase • Use of computer passwords to access information • Detective • Cash counts and bank reconciliations • Monitoring expenditures against budget amounts • Review payroll reports (review your payroll statement) • Audits

8. Examples of Controls cont. • Controls can either be automated ormanual • Automated Controls – Incorporated into applications logic/algorithms • System automatically searches for a matching PO before paying an invoice • Manual Controls – Performed by individuals outside of the system or application • Supervisor’s signature on Expense Reports

9. Components of Internal Control • The internal control framework for most U.S. companies is the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control—Integrated Framework, issued in 1992 updated to include 17 principles (2013). • The Control Environment (5) • Risk Assessment (4) • Control Activities (3) • Information and Communication (3) • Monitoring (2)

11. Five Key Control Activities

12. 1) Segregation of Duties Divide responsibilities between different employees so one individual doesn’t control all aspects of a transaction. • Why separate duties. • Reduce the risk of errors • Reduce the risk of inappropriate action • What to Separate • Recording transactions • Authorizing transactions • Custody or handling of the related assets • “Two sets of eyes”

13. 2) Adequate Documents and Records Document & keep evidence to substantiate: • Critical decisions and significant events...typically involving the use, commitment, or transfer of resources. • Transactions…enables a transaction to be traced from its inception to completion. • Policies & Procedures…documents which set forth the fundamental principles and methods that employees rely on to do their jobs.

14. 2) Adequate Documents and Records cont. • Examples at South Texas College • Pre-numbered consecutive documents so missing items are noted • College wide and Departmental Policies and Procedures • Keep College records in accordance with record retention period

15. 3) Authorization and Approvals • What is authorization? • Define activities an employee can perform • Define transaction parameters • Define transactions that require approval • What is approval? • Verification and validation • Review of supporting documentation • Evidence of approval

16. 3) Authorization and Approvals cont. • Examples of authorization and approval in your personal life • A signature on a check provides authorization for funds to be withdraws from a checking account • A signed permission slip for a child’s field trip • Examples of authorization and approval at South Texas College • “ I question what I sign and review the supporting documentation to be sure that the transaction is valid, in line with College and departmental policy and procedure and is properly supported by sufficient documentation”. • “ I do not share my password with other people”.

17. 4) Safeguarding records and assets • How are records and assets safeguarded? • Access is physically restricted • Assets are periodically counted and compared to records (physical inventory) • Protect against unauthorized acquisition, use or disposition

18. 4) Safeguarding records and assets cont. • Examples of safeguarding records and assets in your personal life: • Locking the house when you leave • Keeping copies of tax documents, deed , your social security card in a secure location • Example of safeguarding records and assets at South Texas College • “I lock the door when I leave at night”. • “I have to enter a personalized user name and password to access information in Banner”. • “I perform a physical inventory of my department’s assets and compare it to the records. Differences are investigated and resolved”.

19. 5) Reconciliation and Review • What is reconciliation and review? • Identify reasons for unexpected results • Reconcile accounts by comparing different sets of data to one another • Review and compare current performance to benchmarks/measure the extent which objectives are being achieved • Take corrective action when necessary • Document review by signature and date

20. 5) Reconciliation and Review cont. • Examples of monitoring and review activities in your personal life: • Reviewing Credit card statements for erroneous charges • Reconciling your check register to you bank statement • Looking at a child’s report card and signing it • Examples of monitoring and review activities at South Texas College: • “I compare actual expenses to budget expenses”. • “ I perform monthly account reconciliations, and sign and date them to ensure proof of review and approval”. • “ I review the details of invoices before I sign them to make sure no extra charges are added to the invoices”.