RISKY BUSINESS: Monitoring Financial Reporting

1. 7/28/2012 1 RISKY BUSINESS: Monitoring Financial Reporting Barbara Reid, CPA LGC Government Finance Advisor and Sheri Rockburn, CPA LGC Annual Conference November 8, 2007 Overview of Internal Controls Discuss in general terms so you understand what IC are and Why IC are important IC framework - 5 elements Specific examples Checklist and suggestion on how to prioritize your review of IC in your own town/schoolOverview of Internal Controls Discuss in general terms so you understand what IC are and Why IC are important IC framework - 5 elements Specific examples Checklist and suggestion on how to prioritize your review of IC in your own town/school

2. 7/28/2012 2 The Landscape Has Changed! SAS 112: Communicating Internal Control Related Matters Identified in an Audit. Provides guidance to auditors on how to evaluate internal control deficiencies. Requires auditor to communicate significant deficiencies and material weaknesses in writing to management and those charged with governance.

3. 7/28/2012 3 Why Has the Landscape Changed? Sarbannes-Oxley Act of 2002 ASB decided to eliminate the auditors option to communicate significant internal control issues in writing. SAS 112 will most likely lower the reporting threshold and may increase the number of audit findings. Effective for audit periods ending on or after December 15, 2006.

4. 7/28/2012 4 SAS 112 Terminology �Those charged with governance� Control deficiency Significant deficiency Material weakness Eliminated the term �reportable condition�

5. 7/28/2012 5 SAS 112 Terminology �Those charged with governance� � the person(s) with responsibility for overseeing the strategic direction of the municipality and obligations related to the accountability of the municipality.

6. 7/28/2012 6 Those charged with governance� In most entities, governance is a collective responsibility carried out by: The Board of Selectmen or Council A committee of the Board or Council, such as an audit committee or finance committee A management team such as the manager/administrator, finance director, department heads, etc.

7. 7/28/2012 7 Control Deficiency A control deficiency exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis. Examples � reconciliations not performed or not timely completed.

8. 7/28/2012 8 Significant Deficiency A significant deficiency is a control deficiency, or combination of control deficiencies, that adversely affect the entity�s ability to initiate, authorize, record, process, or report financial data reliably in accordance with generally accepted accounting principles. A remote likelihood that a misstatement will not be prevented or detected. Example � lack of authorization or records for significant purchases.

9. 7/28/2012 9 Material Weakness A material weakness is a significant deficiency, or combination of control deficiencies, that results in a more that remote likelihood that a material misstatement of the financial statements will not be prevented or detected. Example � inadequate records of delinquent property taxes.

10. 7/28/2012 10 Definition of Internal Controls A process effected by those charged with governance, management, and others designed to provide reasonable assurance regarding the achievement of your entity�s objectives, including Reliable financial reporting Effective and efficient operations Compliance with laws, regulations, policies and procedures Safeguarding assets.

11. 7/28/2012 11 What Are Internal Controls? A process: a means to an end, not the end itself. Accomplished by people, not merely policy, procedures and forms. Reasonable, but not absolute, assurance that assets and resources are safeguarded. Process --- it�s going to change, not stagnant Just as people are the core of your operations, people are the foundation of your IC system Reasonable, not absolute -- there are limitations to any IC system Want REASONABLE assurance there are safeguards in placeProcess --- it�s going to change, not stagnant Just as people are the core of your operations, people are the foundation of your IC system Reasonable, not absolute -- there are limitations to any IC system Want REASONABLE assurance there are safeguards in place

12. 7/28/2012 12 What Are Internal Controls? Think about what YOU do: Lock your home and your vehicle. Keep ATM/debit card separate from PIN. Check your bills and credit card statement before paying. Don�t leave blank checks and cash lying around. Expect your children to ask permission before doing certain things. Balance checkbook Keep copies of important documents like tax returnsBalance checkbook Keep copies of important documents like tax returns

13. 7/28/2012 13 What Are Internal Controls? Municipal internal controls are similar: Offices, buildings, vehicles are locked . Computer passwords are changed periodically. Invoices are reviewed and approved before payment. Checks and cash are secured. Authorization is required for certain activities. You do very similar things in your towns and schoolsYou do very similar things in your towns and schools

14. 7/28/2012 14