Gap Analysis & Sub-Certification

1. Gap Analysis & Sub-Certification Internal Controls Overview FY2013

2. 2013 Annual Certification Process • Gap Analysis • Identify individuals who should be performing the gap analysis (FMT members to complete the overview spreadsheet). • Complete the M-Reports online gap analysis. • Document procedures / update existing procedures to include key controls noted in gap analysis. • Department Sub-Certification • Identify individuals who should be sub-certifying (both input and approval). • Complete the on-line sub-certification. • Management Oversight Reporting is an important part of the sub-Certification process. • Identify individuals who are running and reviewing the required reports.

3. Gap Analysis: • Should be completed with individuals involved in the process(i.e. handling cash, processing journal entries, hiring employees, etc.) • As of March 2013, all DSA units will be using the on-line tools in MReports, which is explained in detail in this document.

4. Howtogettothe Gap Analysis on-linetool? Ifyouwish tolookatthegap analysistool,theinstructions(quickversion)belowshould getyouthere. However,ifyouwant detail instructions, theITS instructions canbeuseful. selectWolverineAccess gototheFacultyandStafftab select M-Reports (under theReportingsection) choosetheCompliancetab select InternalControls Other Reports / Tools, then GapAnalysis selectyour dept.IDorputyour dept. IDinthesearchbox inyourdepartment's row, clickonthestatus link/ "notstarted" to reviewand/or start fillingoutthe questionnaire

5. Gap Analysis On-Line tool in M-Reports

6. Documented procedures = key control • Clarify roles and responsibilities • Ensure process is happening as intended • Help with employee turnover (expected/unexpected) Note: The Office of Internal Controls website: http://www.finance.umich.edu/controls provides some guidance and sample documents to assist with documentation. What is written procedure documentation?

7. Management Oversight Reporting • Monitoring/oversight = key control • Helps to highlight if operating controls are working • Identifies trends/exceptions • High level summaries (by month/year, comparing to prior years, etc.) Has time been entered timely and properly approved? Are overtime, temp and retro pay reasonable? Employment Are P-Card holders appropriate? Are credit limits appropriate compared to spend levels? P-Card Cash & Credit Card Handling Have proper individuals taken cash handling training? Are credit card merchants PCI compliant? Are proper individuals approving expenses? Are spending levels and patterns appropriate? Concur

8. ManagementReporting

9. ManagementReporting InternalControls-ManagementReporting(includedinannualcertification)-continued AddlComments