Internal Control Document

1. OBJECTIVES OF INTERNAL CONTROL
   Internal control’s three objectives are to ensure the effectiveness and efficiency of operations, the reliability of financial reporting, and compliance with applicable laws and regulations. Asset safeguarding is a subset of all three objectives. Continuous monitoring and testing are needed to help identify poorly designed or ineffective controls. The administration is also responsible for communicating internal control objectives and ensuring the organization is committed to sustaining an effective internal control environment.

2. COMPONENTS OF INTERNAL CONTROLS
   The five components of internal controls include the control environment, the administration’s risk assessment, communication of the controls, control activities, and monitoring of the controls.
   1. CONTROL ENVIRONMENT:
      The control environment includes the organizational structure, the control framework, the district’s policies and procedures, and internal and external influences. The tone set by the school district’s board and administration determines the attitude toward the district’s controls.
   2. ORGANIZATIONAL STRUCTURE:
      The organizational structure determines the administration’s responsibilities and sets the relationship with the board, which sets the policies.
   3. CONTROL FRAMEWORK: Elements of a control framework include the following:
      1. Segregation of duties helps ensure the reliability of the organization’s internal controls. One person should not have access to all stages of a process. If proper segregation is not maintained, situations could arise where errors or irregularities occur and go undetected.
      2. Integrity and competence of the personnel performing the duties are key to achieving the desired controls. This includes hiring the proper people and continually training personnel. Ensuring that employees who perform financial tasks have the knowledge and skills to perform their duties is important.
      3. Communication by the administration of the controls and the employee’s responsibilities are as important as ensuring that employees know how to communicate irregularities that may arise.
      4. Proper supervision of employees is needed to ensure proper execution of control activities.

3. DISTRICT’S POLICIES AND PROCEDURES:
   The district’s policies set its overall direction. Procedures for all financial preparation, reporting, operations, transportation, maintenance, personnel, and payroll are needed. These policies and procedures will become the basis for determining compliance.

4. INTERNAL AND EXTERNAL INFLUENCES:
   The administration must be aware of internal and external factors affecting controls. Internally, Changes in the organizational structure and policies must be continuously evaluated. External influences could include political and legal aspects and technological changes.

5. ADMINISTRATION’S RISK ASSESSMENT: The administration has to assess risks relevant to the financial statements.This includes identifying potential risks, analyzing the potential impact of those risks on the ability to report the financial statements properly, and managing risks overall. Items to consider in the risk assessment of the district include, but are not limited to:
   1. New personnel or new duties for existing personnel
   2. How a change in accounting information system impacts controls and how effectively the training of personnel on the new system was conducted
   3. Changes in the regulations and laws that may affect the control environment
   4. Record storage is appropriate and secure (fireproof cabinets when needed for manual documents and proper passwords and access limitations for electronic information)
   5. District limits access to computers and data files
   6. Segregation of duties
   7. Transactions are recorded timely
   8. Cash is deposited timely
   9. Assets are physically safeguarded
   10. Transactions are performed by only authorized personnel
   11. Reconciliations are properly and promptly completed
   12. Occurrences of management override

6. ADMINISTRATION’S COMMUNICATION OF THE CONTROL: The administration needs to determine if the district’s information systems are adequate and relevant for their intended purpose. The district’s administration is responsible for communicating the district’s controls and the responsibilities of each employee in the control system. The administration is also charged with reviewing information that may indicate a flaw in the controls that would not allow the control to detect an error promptly.

7. CONTROL ACTIVITIES: Control activities include the policies and procedures to achieve the desired controls. Documentation of the control activities is vital to the overall control environment.

These activities include but are not limited to:

1. Segregation of duties
2. Transactions are recorded timely
3. Cash is deposited timely
4. Assets are physically safeguarded
5. Transactions are performed by only authorized personnel
6. Reconciliations are properly and promptly completed

Control activities can be categorized into one or more assertions. All assertions should be addressed for each process (payroll, cash disbursements, etc.).

1. Existence (E) /Occurrence (O) – Existence is whether the assets or liabilities of the district exist at any given point in time (cash, state aid receivable). Occurrence is whether the transaction took place (goods were received before the PO was moved to accounts payable from encumbrances)
2. Valuation (V) or Allocation (A) – Valuation is whether the asset or liability is included on the board secretary’s report at the proper value (the amount of cash or state aid receivable). Allocation is whether the revenue and expenditures were recorded in the proper amounts.
3. Accuracy/ Classification (A/CL) – transactions are recorded accurately and the classification of the transactions are proper.
4. Completeness (CO) – is whether all transactions are included (unrecorded purchase orders).
5. Cutoff © – Transactions are recorded at the proper time (purchase orders written in the proper year).

8. MONITORING OF CONTROLS
   The administration is charged with reviewing internal controls on an ongoing basis. Monitoring can include responding to the auditor’s recommendation for changes in the controls. Reviewing correspondence from outside sources, such as banks and vendors, for unusual items is part of monitoring.

9. AFTER THE CONTROLS ARE ESTABLISHED:
   Once the district establishes controls, they need to be evaluated at least annually and anytime circumstances dictate. Changes in personnel or regulations are examples of this.
   As controls are evaluated, they will either be effective or ineffective at achieving the proposed control. Controls are adequate when there are no material weaknesses in internal controls involved in financial reporting. Ineffective controls would be those where at least one material weakness exists. If a control is ineffective, the deficiency needs to be evaluated.

10. CONTROL DEFICIENCIES:
    A control deficiency exists when the design or operation of a control does not allow the administration to prevent or detect misstatements on a timely basis. A design deficiency exists when a necessary control is missing or is not designed to enable the control objective to be met. An operational deficiency exists when control is designed properly, but does not operate as designed or the person performing the control is not qualified to perform the control. An unavoidable deficiency may exist (segregation of duties in a small office). For these, compensating procedures should be put in place. These compensating procedures do not correct the deficiency.

11. REASONABLE ASSURANCE AND LIMITATIONS ON CONTOLS:
    Reasonable assurance is a high level of assurance but is not absolute. The district should understand that potential fraud could exist and not be detected timely in the following circumstances: when the district has poorly designed or operated internal controls, when there are too many overrides of controls, or when there is collusion between employees or between an employee and a third party.

MORRIS HILLS REGIONAL DISTRICT CONTROLS
The MHRD control questionnaire is listed in Appendix I of this manual.

Issued by Morris Hills Regional District - Business Office - All Rights Reserved