Developing Written Procedures for Internal Controls Presented by: Sharon B. Robinson, CPA, MBA Retired!!!!!!!! October 5, 2011

Developing Written Procedures for Internal Controls

Presented by:Sharon B. Robinson, CPA, MBA

Retired!!!!!!!!

October 5, 2011

2

Today’s Agenda

What internal controls are Internal Controls FrameworkTypes of Internal ControlsWhy and how policies and

procedures enhance internal controls

Government Finance Officers Association of LA ~ October 5, 2011

3

When all else fails, …..


4

…Read the directions?


5

Internal Controls

Internal controls are the structure, policies, and procedures used to provide reasonable assurance that an organization’s objectives are achieved in the following areas:

– Safeguard assets– Effective and efficient operations – Reliable financial reporting – Compliance with applicable laws and

regulations


6

Key Concepts

Internal control depends on people - People at every level are accountable and responsible for their own processes and transactions.

Managers are responsible for developing and implementing policies and procedures. They also monitor how well policies and procedures are adhered to.


7

Quotable Quote

“There are two ways to stop fraud—one is to lock up everything around you, and the other is to surround yourself with ethical people.”

--Chris Linton, CFENew Zealand’s Inland Revenue Department

Fraud Prevention and Investigationfrom GAO publication


8

Internal Control AdvantagesCan reveal and minimize errors and

omissionsDiscourages employee theftProtects assetsImproves public accountabilityStandardizes management practices

and procedures


9

Who’s Responsible for Internal Controls ?

ManagementAll EmployeesInternal Auditors?

◦Internal auditors evaluate the effectiveness of internal controls

External Auditors?◦Provide independent assessment on the

reasonableness of financial reports


10

Everyday Examples

Use a PIN with your ATM card.Lock your doors (house, car,

etc.).Review credit card statements

and other bills before you pay them.

Don’t leave blank checks and cash lying around.


11

COSO Integrated Control Framework


Components of Internal Control

1. Control Environment2. Risk Assessment3. Control Activities4. Information and Communication5. Monitoring


13

Control EnvironmentTone at the topPeople are the core of it all.

◦Ethics◦Competence◦Integrity

Make everyone conscious of controls

All of the other elements of internal control are based here.


14

Control EnvironmentIncludes:

◦Organizational structure◦Formal policies and procedures◦Delegation of authority and

responsibility◦Incentives and rewards◦Human resource management,

including commitment to personnel competency


15

Risk Assessment

The entire organization must be aware of and deal with all risks.

Identify, analyze and manage the risks related to each activity.


16

Information and Communication

Ensure that all staff are aware of and trained on policies and procedures (e.g., staff meetings; information systems)

Ensure that the right information is getting to the right personnel


17

Monitoring

Tests controls to ensure they are functioning as intended

Allows the organization to make corrections to controls where needed

Auditors (internal and external)

Audit CommitteesGovernment Finance Officers Association of LA ~ October 5, 2011

18

Control Activities

Control activities occur throughout the organization at all levels and in all functions.

They can be defined by policies and implemented through procedures.


19

Control Activities include:

ApprovalsSpending Limits ReconciliationsVerificationReviews ReportingSegregation of Duties


20

Controls Classifications

Internal Controls can be classified into two major categories:1. Preventive Controls—stop

problems before they happen.

2. Detective Controls—find problems after they happen


21

Controls Classifications • Preventive controls prevent errors or

exceptions.

Examples:

◦Standard policies and procedures

◦Proper segregation of duties

◦System limited access


22

Controls Classifications

Detective controls are designed to identify an error or exception after it has occurred.

Detective controls include:

◦Exception reports

◦Reconciliations

◦Periodic auditsGovernment Finance Officers Association of LA ~ October 5, 2011

23

For example: Hiring ,Contracts – ◦Approval for hiring a new employee◦Hiring checklist is completed◦Verification of contract terms◦Contract documentation is signed and kept

on file

Human Resources


24

Payroll

Timesheets for hourly employees are kept, reviewed, approved and submitted by supervisor

Reconcile payroll reports to timesheets and ISIS/HR audit reports

Review all changes to payroll on a monthly basis

Ensure that information on terminated employees is processed immediately.


25

Purchasing and TravelKnow what’s being purchased – approvalsSegregation of purchase, receipt and invoice

approvalDocumentation and approval of travel and

business expensesMonitoring and reconciliation of P-card

purchases – tracking through a budget process


26

Budgeting

Approved budgetMonitor and report on budget

varianceCommunication of budget issues to

appropriate levelEnsure proper subcoding for

expense type – remember P-card purchases!


27

Cash Management

Secure cash locationsUse of lockboxUse of receipt books Logs identifying receipts and those who

handle cashPetty cash log review/reconciliationBank reconciliations performed by

someone other than receiver of cash


28

Policies & Procedures: Who needs ‘em?

Properly established and implemented policies and procedures become invaluable for identifying and delegating responsibilities, preserving a consistent level of quality performance throughout an organization.


29

Part of the Internal Control Structure

Formal written documentation that instructs, informs, leads, and guides workers◦Written policies◦Formally developed and written

procedures◦Approvals◦Segregation of duties


30

Policy Defined A set of rules and principles

that provide guidance and require a course of action

Cover a wide range of issues Broad and apply to all WHAT needs to be done


31

Examples of PoliciesCity OrdinancesLeave policyConflict of interest

policy


32

Sample: Personnel PolicyStatement of Policy Employees of the agency are expected to perform their

specific duties and conduct themselves in a manner that fosters the achievement of the agency's purpose and goals. The conduct of each employee is expected to reflect a commitment to:◦ Putting forth the employee's best effort;◦ Managing the employee's work time for maximum effectiveness

and efficiency; and◦ Performing to the best of the employee's ability the duties and

responsibilities of the position. Disciplinary guidelines are established to communicate the

agency’s view regarding inappropriate conduct and to assure that fair and equitable disciplinary action is administered when an employee violates the standards of conduct.

(Source: Florida Employee Handbook)Government Finance Officers Association of LA ~ October 5, 2011

33

Procedures Defined


Detailed work steps that must be performed to accomplish the policy’s objective

Apply to specific work tasks, roles, and departments

34

Procedures ExamplesBank reconciliationsEnd-of-period closingsGrants processingBudget development processes


35

Why We Need ThemPart of the internal control structureTo guide employees and hold them

accountablePart of our accountability to the

publicMay be required by local ordinanceCan cause you to question the way

things are done


36

Who writes them? Management is responsible for

the internal control structure.◦ Finance Business Manager◦ Human Resources HR Director◦ Citywide Mayor and/or

governing body May hire a consultant Line workers with oversight


37

Policy and Procedure Development Cycle

Drafting

Verifying

Finalizing and

Approving

Publishing and Storing

Affirming

Monitoring

Data Collecting

Continuous Cycle


38

Development Process Upper management develops

policy.

Mid-level management develops procedures.


39

Development Process Multi-Step Process

1. Data Collection – Policies: regulations, laws Procedures: Talk to employees doing the work Understand where and how the

process interacts with other processes


40

Data Sources

State laws, rules, and regulationsFederal laws, rules, and

regulationsSearch the internetContact similar organizations

(i.e., other cities, universities, departments)


41

Development Process2. Prepare a draft of the policy and

related procedures. Add pictures, charts, examples, where possible.

3. Verify. Have management and users read for accuracy and clarity.

4. Finalize and approve. Upper management should sign off.


42

Development Process5. Publish and store.

Send to applicable workers and support staff

Remove out-dated policies and procedures Replace with new ones Keep in a central easily accessible place (i.e.,

library or intranet)

6. Affirmation – affected employees should acknowledge receipt and understanding

7. Monitoring – Update as needed


43

SAMPLE Policies and Procedures


44

EXAMPLE: Cash Handling Policy and Procedures

Mississippi State University


45

EXAMPLE: Bank Reconciliation Procedures

Bank Reconciliation


46

EXAMPLE: Purchasing Policy and Procedures

City of Oneida, New York


47

Effects of Ineffective Policies and Procedures


48

City of OpelousasCash Receipts Not Deposited

During our review, we noted deficiencies in cash management practices at

the Department of Public Works and the Department of Code Enforcement.

Both departments routinely made sales of scrap metal for cash. Reconciliation

of the scrap metal sales with the cash deposits showed approximately

$5,816 of cash from the scrap metal sales was not deposited into City

accounts. In addition to these amounts, we noted cash collections from the

scrap metal sales were routinely deposited into City accounts months

after the receipt of cash. Louisiana law requires daily deposits of funds

whenever practicable.

(Excerpt from Legislative Auditor’s Compliance Report – City of Opelousas- June 29, 2011)Government Finance Officers Association of LA ~ October 5, 2011

49

Procurement Practices Between May 5, 2008, and September 17, 2010, the City made 14

payments to Anderson Ironworks for 10 public works on City-owned structures. Three of these projects totaled over $7,500.

The City’s procurement policy requires three written or faxed quotes for projects over $7,500.

City records show only one of the three projects had quotes as required by the purchasing policy. In addition, only two of the projects were authorized using appropriate requisitions and purchase orders as required by the purchasing policy.

The project that included written quotes was approximately $42,000 to repair the roof and install siding for the City library. The City’s purchasing policy requires all projects over $10,000 to use formal sealed bids with invitations to bid and advertisements. In addition, the bids are to be opened, tabulated, and evaluated by the City Council before being forwarded to the Purchasing Department with a requisition.

Although the City obtained three written quotes, it had no documentation supporting the use of a formal sealed bid process or evaluation of bids by the City Council as required by its purchasing policy.


50

Contractual Services The City pays a contractor $1,200 a month to transport

City residents to doctor’s appointments. He currently transports two residents, but in the past he has transported as many as four residents. He works on Tuesdays, Thursdays, and Saturdays.

Contractor does not submit documentation supporting the services he performs for the City. He uses a City vehicle as well as a City Fuelman card to transport residents to their treatments. There is no documented City approval for this practice. The City does not document basic program activities such as how residents are selected, evidence of medical need, or residents enrolled. The City Clerk was unable to provide a formal, written contract detailing the contractual responsibilities of the parties.

There is no documentation of competitive procurement as required by the City’s purchasing policy.



51

Wrap-UpDevelop and publish formal

written policies and procedures for all major processes! Update them regularly.

Understanding your internal controls (structure, policies, procedures) is critical.

Ensure that all employees are trained and understand.

Hold people accountable! The whole system rests on the

PEOPLE.

52

Questions? Applause?

Documents

Developing Written Procedures for Internal Controls Presented by: Sharon B. Robinson, CPA, MBA Retired!!!!!!!! October 5, 2011