Internal Controls

Internal
Controls
Introduction
Internal Controls are to be an integral part of any organization's financial and business
policies and procedures. Internal controls consists of all the measures taken by the
organization for the purpose of; (1) protecting its resources against waste, fraud, and
inefficiency; (2) ensuring accuracy and reliability in accounting and operating data; (3)
securing compliance with the policies of the organization; and (4) evaluating the level of
performance in all organizational units of the organization. Internal controls are simply
good business practices.
Responsibility
Everyone within the University has some role in internal controls. The roles vary
depending upon the level of responsibility and the nature of involvement by the
individual. The Kansas Board of Regents, President and senior executives establish the
presence of integrity, ethics, competence and a positive control environment. The
directors and department heads have oversight responsibility for internal controls within
their units. Managers and supervisory personnel are responsible for executing control
policies and procedures at the detail level within their specific unit. Each individual
within a unit is to be cognizant of proper internal control procedures associated with their
specific job responsibilities.
The Internal Audit role is to examine the adequacy and effectiveness of the University
internal controls and make recommendations where control improvements are needed.
Since Internal Auditing is to remain independent and objective, the Internal Audit Office
does not have the primary responsibility for establishing or maintaining internal controls.
However, the effectiveness of the internal controls are enhanced through the reviews
performed and recommendations made by Internal Auditing.
Elements of Internal Control
Internal control systems operate at different levels of effectiveness. Determining whether

a particular internal control system is effective is a judgement resulting from an
assessment of whether the five components - Control Environment, Risk Assessment,
Control Activities, Information and Communication, and Monitoring - are present and
functioning. Effective controls provide reasonable assurance regarding the
accomplishment of established objectives.
Control Environment
The control environment, as established by the organization's administration,
sets the tone of an institution and influences the control consciousness of its
people. Leaders of each department, area or activity establish a local control
environment. This is the foundation for all other components of internal
control, providing discipline and structure. Control environment factors
include:
 Integrity and ethical values;

 The commitment to competence;
 Leadership philosophy and operating style;
 The way management assigns authority and responsibility, and
organizes and develops its people;
 Policies and procedures.
Risk Assessment
Every entity faces a variety of risks from external and internal sources that
must be assessed. A precondition to risk assessment is establishment of
objectives, linked at different levels and internally consistent. Risk
assessment is the identification and analysis of relevant risks to achievement
of the objectives, forming a basis for determining how the risks should be
managed. Because economics, regulatory and operating conditions will
continue to change, mechanisms are needed to identify and deal with the
special risks associated with change.
Objectives must be established before administrators can identify and take

necessary steps to manage risks. Operations objectives relate to effectiveness
and efficiency of the operations, including performance and financial goals
and safeguarding resources against loss. Financial reporting objectives
pertain to the preparation of reliable published financial statements,
including prevention of fraudulent financial reporting. Compliance
objectives pertain to laws and regulations which establish minimum
standards of behavior.
The process of identifying and analyzing risk is an ongoing process and is a

critical component of an effective internal control system. Attention must be
focused on risks at all levels and necessary actions must be taken to manage.
Risks can pertain to internal and external factors. After risks have been
identified they must be evaluated.
Managing change requires a constant assessment of risk and the impact on

internal controls. Economic, industry and regulatory environments change
and entities' activities evolve. Mechanisms are needed to identify and react to
changing conditions.
Control Activities
Control activities are the policies and procedures that help ensure
management directives are carried out. They help ensure that necessary
actions are taken to address risks to achievement of the entity's objectives.
Control activities occur throughout the organization, at all levels, and in all
functions. They include a range of activities as diverse as approvals,
authorizations, verifications, reconciliations, reviews of operating
performance, security of assets and segregation of duties.
Control activities usually involve two elements: a policy establishing what

should be done and procedures to effect the policy. All policies must be
implemented thoughtfully, conscientiously and consistently.
Information and Communication
Pertinent information must be identified, captured and communicated in a

form and time frame that enables people to carry out their responsibilities.
Effective communication must occur in a broad sense, flowing down, across
and up the organization. All personnel must receive a clear message from top
management that control responsibilities must be taken seriously. They must
understand their own role in the internal control system, as well as how
individual activities relate to the work of others. They must have a means of
communicating significant information upstream.
Monitoring
Internal control systems need to be monitored - a process that assesses the

quality of the system's performance over time. Ongoing monitoring occurs in
the ordinary course of operations, and includes regular management and
supervisory activities, and other actions personnel take in performing their
duties that assess the quality of internal control system performance.
The scope and frequency of separate evaluations depend primarily on an

assessment of risks and the effectiveness of ongoing monitoring procedures.
Internal control deficiencies should be reported upstream, with serious
matters reported immediately to top administration and governing boards.
Internal control systems change over time. The way controls are applied may
evolve. Once effective procedures can become less effective due to the
arrival of new personnel, varying effectiveness of training and supervision,
time and resources constraints, or additional pressures. Furthermore,
circumstances for which the internal control system was originally designed
also may change. Because of changing conditions, management needs to
determine whether the internal control system continues to be relevant and
able to address new risks.
Components of the Control Activity
Internal controls rely on the principle of checks and balances in the workplace. The
following components focus on the control activity:
Personnel need to be competent and trustworthy, with clearly established

lines of authority and responsibility documented in written job descriptions
and procedures manuals. Organizational charts provide a visual presentation
of lines of authority and periodic updates of job descriptions ensures that
employees are aware of the duties they are expected to perform.
Authorization Procedures need to include a thorough review of supporting

information to verify the propriety and validity of transactions. Approval
authority is to be commensurate with the nature and significance of the
transactions and in compliance with University policy.
Segregation of Duties reduce the likelihood of errors and irregularities. An

individual is not to have responsibility for more than one of the three
transaction components: authorization, custody, and record keeping. When
the work of one employee is checked by another, and when the responsibility
for custody for assets is separate from the responsibility for maintaining the
records relating to those assets, there is appropriate segregation of duties.
This helps detect errors in a timely manner and deter improper activities; and
at the same time, it should be devised to prompt operational efficiency and
allow for effective communications.
Physical Restrictions are the most important type of protective measures for
safeguarding University assets, processes and data.
Documentation and Record Retention is to provide reasonable assurance

that all information and transactions of value are accurately recorded and
retained. Records are to be maintained and controlled in accordance with the
established retention period and properly disposed of in accordance with
established procedures.
Monitoring Operations is essential to verify that controls are operating

properly. Reconciliations, confirmations, and exception reports can provide
this type of information.
Internal Control Limitations
There is no such thing as a perfect control system. Staff size limitations may obstruct
efforts to properly segregate duties, which requires the implementation of compensating
controls to ensure that objectives are achieved. A limited inherent in any system is the
element of human error, misunderstandings, fatigue and stress. Employees are to be
encouraged to take earned vacation time in order to improve operations through
crosstraining while enabling employees to overcome or avoid stress and fatigue.
The cost of implementing a specific control should not exceed the expected benefit of the
control. Sometimes there is no out-of-pocket costs to establish an adequate control. A
realignment of duty assignments may be all that is necessary to accomplish the objective.
In analyzing the pertinent costs and benefits, managers also need to consider the possible
ramifications for the University at large and attempt to identify and weigh the intangible
as well as the tangible consequences.
Internal controls should reduce the risks associated with undetected errors or
irregularities, but designing and establishing effective internal controls is not always a
simple task and cannot always be accomplished through a short set of quick fixes.
However, we hope this chapter has helped to explain the basic internal control concepts
and given you some ideas for improving your department's controls.

Internal Controls

Uploaded by

Copyright:

Available Formats

Internal Controls

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Internal Controls

Uploaded by

Copyright:

Available Formats

Internal

Elements of Internal Control

Internal control systems operate at different levels of effectiveness. Determining whether

 Integrity and ethical values;

Objectives must be established before administrators can identify and take

The process of identifying and analyzing risk is an ongoing process and is a

Managing change requires a constant assessment of risk and the impact on

Control activities usually involve two elements: a policy establishing what

Information and Communication

Pertinent information must be identified, captured and communicated in a

Internal control systems need to be monitored - a process that assesses the

The scope and frequency of separate evaluations depend primarily on an

Personnel need to be competent and trustworthy, with clearly established

Authorization Procedures need to include a thorough review of supporting

Segregation of Duties reduce the likelihood of errors and irregularities. An

Documentation and Record Retention is to provide reasonable assurance

Monitoring Operations is essential to verify that controls are operating

Internal Control Limitations

You might also like