Internal Controls

1. Internal Controls

2. Welcome • This training course was developed by WeComply, a leading provider of ethics and compliance training since 1999. The course is also available online from any Internet-connected computer. • WeComply offers 60+ courses on a wide range of business ethics and compliance topics. Each course helps employees spot key compliance issues and respond appropriately. • This course is designed and licensed for classroom use in parallel with WeComply's online course on the same topic. This course may not be hosted on a learning management system or distributed to employees individually by electronic or other means without WeComply's prior authorization. • For more information about this course or others, whether for classroom use or online access, please e-mail info@wecomply.com or call 1-866-WeComply.

3. Introduction • Thank you for participating in our Internal ControlsEssentials training course. This course is intended to increase your awareness and understanding of internal controls — what they are, why we have them, and how they affect your day-to-day job responsibilities. • Keep in mind that this material is provided for informational purposes only and is not intended as legal advice. If you have any questions regarding about how this material applies to your day-to-day job responsibilities, please contact your supervisor. 1 of 15

4. What Are Internal Controls? • Controls: Used to manage risks and make sure things happen the way we want them to • They are — • Intended to ensure that internal operations work as they’re supposed to • Managed/used by people inside the organization • Built into our business activities • Good internal controls help us make sure we — • Use and provide accurate/reliable information • Comply with laws, regulations, policies and procedures • Reduce exposure to fraud/theft 2 of 15

5. Types of Controls • Purposes: • Prevention: Preventive controls deter/prevent unwanted events from happening • Detection: Detective controls detect unwanted acts that have happened • Both types are integral to effective system • Preventive controls are proactive and emphasize quality • Detective controls provide evidence that preventive controls are working • Winning combination is a mix of strategically placed controls throughout/following transactions 3 of 15

6. Internal-Control Standards • Internal controls are developed to meet general or specific standards • General standards describe what objectives we want to achieve • Specific standards tell us how to achieve them • Examples of general standards: • Reasonable Assurance • Supportive Attitude • Competent Personnel • Control of Objectives 4 of 15

7. Internal-Control Standards (Cont’d) • Examples of specific standards: • Documentation • Authorization • Separation of Duties • Supervision • Security 5 of 15

8. Risk • Risk: Likelihood that an event or action will adversely affect our organization • Internal risks — lack of experience or training, personnel turnover, lost or incorrect information, theft, fraud/abuse • External risks — acts of nature, economic downturns, technological problems, lawsuits, restrictive legislation, changing needs • Each unit's risk is assessed in risk assessment • Rating is assigned to each unit • Ratings are considered in developing controls and scheduling reviews 6 of 15

9. Pop Quiz! • Please complete the following sentence: A primary purpose of internal controls is to identify risks associated with the achievement of an organization’s objectives and to do what is necessary to ______ . • Eliminate those risks. • Manage those risks. • Achieve those objectives. 7 of 15

10. Handling Risk • We need to balance risks and controls • Internal-control system decreases risk to an acceptable level • Goal is to attain reasonable assurance • Three ways of handling risk: • Accept the risk • Insure the risk • Control the risk 8 of 15

11. Security • Many controls are directed at keeping personnel or data more secure • Physical inventories • Computer security • Anti-theft • Limited access • Separation of duties 9 of 15

12. Admin Shares More than Cars • Internal Controls Expose Theft of City Funds • A former Aspen city employee pleaded guilty to stealing $5,600 in public funds from the Car Share program, which he administered. The employee was fired as the Car Share administrator in August after he admitted that he had transferred cash in increments of $800 from the Car Share bank account to his own personal credit card and checking accounts. The Car Share account and the administrator's accounts were both at the same bank. Because he was the sole signer of the Car Share account, the administrator used the same username and password as his personal account. 10 of 15

13. Employee Responsibilities • All employees are responsible for dealing with controls that apply to job duties • Ask probing questions, e.g. — • What are my risks and how are they controlled? • Does this control help me get my job done? • Does this internal control work correctly? • Is there too little or too much control? • How can we make internal controls better? 11 of 15

14. Employee Responsibilities (Cont’d) • All employees are expected to — • Fulfill responsibilities established in job description and meet performance standards • Attend appropriate education/training programs to increase awareness and understanding • Take steps to safeguard assets against waste, loss, unauthorized use, misappropriation • Exhibit ethical values and integrity in your daily activities • Report any breakdowns in or concerns about internal controls 12 of 15

15. Pop Quiz! • A university's employees are divided into two groups based on their job responsibilities: (1) managers (Deans, department chairs, center directors, supervisors, administrative office managers) and (2) employees. Who is expected to participate in training sessions? • Managers only. • Employees only. • Both managers and employees. 13 of 15

16. In Sum... • Without effective internal controls, we are more likely to • Violate laws or regulations • Lose assets and opportunities • Fail to meet key goals and objectives • With effective internal controls in place, we can • Boost our credibility • Position ourselves to seize opportunities • Minimize theft, fraud and wasted time • Thank you for your help! 14 of 15

17. Final Quiz 15 of 15

18. About WeComply • WeComply is a leading provider of customized ethics and compliance training solutions. We are committed to providing the best-of-breed training content, technology and customer service. • Specializing in ethics and compliance training since 1999 • 60+ ethics and compliance training courses in 42 languages • Content partners include the Association of Corporate Counsel (ACC), Proskauer Rose and White & Case • 500+ clients of all sizes and in all industries 1-866-WeComply

19. Course-Delivery Options • WeComply offers training courses in multiple delivery formats to reach all employees -- not just those with computers: 1-866-WeComply • Online – available 24/7 from any computer • Mobile – tablets and smartphones • Offline optionswhen Internet access is unavailable: • PowerPointwith presenter notes for classroom training • PDF booklets with tear-off certifications • CD-ROM/intranetwith tracking via e-mail • Phone-based training and certification

20. Online Training Benefits • While classroom training has certain advantages, it can be challenging to implement in large and/or geographically dispersed companies. Consider these advantages of online training: • Better Attendance • Higher Completion Rates • Less Impact on Productivity • Perfect for New Hires • Convenient for Remote Locations • Available in 42 Foreign Languages • Easy Access to Courses • Periodic Refreshers Blended Benefits Get the best of both worlds by providing classroom training where feasible and online training elsewhere – all centrally tracked and organized for easy monitoring and reporting.