Internal Controls
What Are Internal Controls?
Internal controls are measures that are put into place to manage risk and to provide reasonable assurance that the University鈥檚 objectives and goals will be achieved.
Internal controls help to:
- Conduct business in an effective and efficient manner
- Safeguard assets and resources
- Deter and detect errors, fraud, and theft
- Ensure the accuracy of accounting data
- Produce reliable and timely financial reporting
- Ensure compliance with University policies and applicable laws and regulations
Components of Internal Control
There are five components of internal control, some of which are discussed in more detail below.
- Control Environment 鈥� This sets the 鈥渢one at the top鈥� and is the foundation for internal controls.
- Risk Assessment 鈥� Recognizing potential risks and ensuring that there are procedures to deal with them.
- Control Activities 鈥� Establishing policies and procedures to help ensure that management鈥檚 processes for mitigating risks are carried out.
- Information and Communication 鈥� Systems or processes that support the identification, capture, and exchange of information in a form and time frame that enables employees to carry out their responsibilities.
- Monitoring 鈥� Processes used to assess the quality of internal performance over time. Ongoing monitoring occurs in the ordinary course of operations and includes regular management and supervisory activities.
Control Environment
The 鈥渢one at the top鈥� provides the foundation that includes the following elements:
- Demonstrates commitment to integrity and ethics
- Exercises oversight responsibility
- Establishes structure, authority, and responsibility
- Demonstrates commitment to competence
- Enforces accountability
Risk Assessment
There are four steps to risk assessment:
- Establish objectives 鈥� What do you want to achieve?
- Identify risk 鈥� What can happen?
- Plan risk management 鈥� What is your response?
- Plan for change 鈥� Implement control activities.
Internal Risk Factors
- New personnel
- Change in management responsibilities
- Revamped information systems
- New programs
- Communication
- Student needs or expectations
External Risk Factors
- Economic environment
- New legislation or regulations
- New technology
- Natural disasters, criminal, or terrorist actions
- Community needs or expectations
- Vendor and contractor performance and reliability
Control Activities
The two main types of internal controls are preventive and detective controls.
Preventive Controls 鈥� These are designed to prevent errors and irregularities from occurring. They are proactive controls that help prevent a loss.
- Segregation of Duties
- Approvals, Authorizations, and Verifications
- Security of Assets
Detective Controls 鈥� These are designed to find errors and irregularities after they have occurred. They are after-the-fact controls.
- Reviews of Performance
- Reconciliations
- Physical Inventory Counts
Management Responsibility
While all employees play a role in internal controls, management is responsible for ensuring that internal controls are established, implemented, and operating as intended. Management is also responsible for periodically evaluating the existing internal controls in their department to make sure they are still functioning as intended.
Internal Audit鈥檚 Responsibility
Internal Audit provides an independent evaluation of the adequacy of internal controls. The office works with department heads to identify areas of risk and internal controls that are not working properly.