The Importance of EFFECTIVE INTERNAL CONTROLS

BRENT CLARK, CPAAudit Vice President

Pugh CPAs

In

Internal Controls –

Why Bother?Internal Controls

Protect the Plan:

• By minimizing opportunities for unintentional errors or intentional fraud (Preventative Controls)

• By discovering small errors before they become big problems (Detective Controls)

In

Where are the

Risks? Two Types of Fraud

Fraudulent Financial Reporting

Poor investment results (I)

Financial stability of the plan sponsor is

threatened (I)

Plan has invested in employer securities (I)

Non-readily marketable

investments (O)

Ineffective monitoring of

management (O)

Deficient internal control

components (O)

In

Where are the

Risks? Two Types of Fraud

Misappropriation of Assets

Personal financial pressures (I)

Known or anticipated future

layoffs (I)

Recent or expected changes

in benefits (I)

Lack of qualified outside service providers (O)

Inadequate internal controls over assets (O)

In

DOL Crim

inal

Enforcement Cases

Head of defense contractor steals

$186,000

Plan trustee convicted on 17 counts of wire fraud totaling approximately $5.3 million

Plan administrator steals $4.3 million from four plans for which he provided

administrative services

In

Internal control should bebased on a risk-oriented

approach to ensure adequate controls exist for high riskareas and that controls are

not excessive for areaswith low risk. - EBPAQC

Some high risk areas include:

Participant data input and change

administration

Processing payroll &

contributionsParticipant

distributions

Establish

ing a

Cost-Effectiv

e

Control Environment

In

Monitoring

Internal Controls

• Are the controls in place and operating

• Is the system working as designed

• Are the controls periodically reviewed

• Are identified exceptions and problems resolved

• Are you monitoring service organizations

Effective monitoring helps ensure your system of internal control continues to provide the

protections you envisioned.

In

Read Them!

Evaluate the ComplementaryUser Entity Controls

SOC Reports

In

Internal Controls

And Your Regulators

If a plan is selected for audit by the IRS,the EP agent conducting the retirement-plan

examination will begin by evaluating the effectiveness of the plan's internal controls

to determine whether to perform a focused audit—that is, just look at three to five issues or expand

the scope of the examination.In other words, based on the strength of the plan's internal controls, the agent will decide to examine more or less of the return than originally planned.

Monika Templeman, IRS Director of

Employee Plans Examinations

“

”

In

Internal Controls and

Your Auditor

Our audit of the financial statements will include obtaining an understanding of internal control sufficient to plan the audit and to determine the nature, timing and extent of audit procedures to be performed. An audit is not designed to provide assurance on internal control or to identify significant deficiencies or material weaknesses. Our review and understanding of the Plan's internal control is not undertaken for the purpose of expressing an opinion on the effectiveness of internal control.

In

Significant deficiency - A deficiency, or a combination of deficiencies, that is less severe than a material weakness yet important enough to merit attention.

Understanding the

Severity of Control

DeficienciesMaterial weakness - A deficiency, or a combination of deficiencies, such that there is a reasonable possibility that a material misstatement of the financial statements will not be prevented, or detected and corrected, on a timely basis.

How Your Auditor

Can Help

In

Example Control

Activitie

s

Participant Data1. Procedures exist to promptly identify and notify

eligible participants for enrollment2. Retain enrollment applications including signed

refusals3. Management should regularly review changes

made to the payroll master file Payroll Processing and Contributions4. Ensure adequate segregation of duties exist5. Current payrolls are compared with previous payrolls

and variances are investigated6. Access to the payroll system is appropriately

restrictedParticipant Distributions7. Signed distribution forms are used8. Withdrawal forms, including requests

for hardship withdrawals from401(k) arrangements, arereviewed by a responsibleofficial

InTreatment without prevention is simply

unsustainable.

- Bill Gates

“”

In

Resources/

Links

AICPA Employee Benefit Plan Audit Quality Center – The Importance of Internal Control in Financial Reporting and Safeguarding Plan Assets

AICPA EBPAQC Plan Advisory, Effective Monitoring of OutsourcedPlan Recordkeeping and Reporting Functions

IRS – Retirement Plan Operation and Maintenance