OBJECTIVES OF INTERNAL CONTROL
The three objectives of internal control are to ensure the effectiveness and efficiency of operations, reliability of financial reporting, and compliance with applicable laws and regulations. The safeguarding of assets is a subset of all of these objectives.
Continuous monitoring and testing is needed to help to identify poorly designed or ineffective controls. The administration is also responsible for communicating the objectives of internal control and ensuring the organization is committed to sustaining an effective internal control environment.
COMPONENTS OF INTERNAL CONTROLS
The five components of internal controls include the control environment, administration’s risk assessment, administration’s communication of the controls, control activities and monitoring of the controls.
A. CONTROL ENVIRONMENT:
The control environment includes the organizational structure, the control framework, the district’s policies and procedures and internal and external influences. The tone set by the school district’s board and administration determines the attitude toward the controls of the district.
ORGANIZATIONAL STRUCTURE:
The organizational structure determines the administration’s responsibilities and sets the relationship with the board, which sets the policies.
CONTROL FRAMEWORK:
Elements of a control framework include the following:
• Segregation of duties to help ensure the reliability of the organization’s internal controls, one person should not have access to all stages of a process. If there is not proper segregation situations could arise where errors or irregularities occur and go undetected.
• Integrity and competence of the personnel performing the duties are key to achieving the desired controls. This includes hiring the proper people and continually training personnel. It is important to ensure that employees who perform financial tasks have the knowledge and skill to perform their duties.
• Communication by the administration of the controls and the employee’s responsibilities are as important as ensuring that employees know how to communicate irregularities that may arise.
• Proper supervision of employees is needed to ensure proper execution of control activities.
DISTRICT’S POLICIES AND PROCEDURES:
The district’s policies set the overall direction of the district. Procedures for all areas of financial preparation, reporting, operations, transportation, maintenance, personnel and payroll are needed. These policies and procedures will become the basis for the determination of compliance.
INTERNAL AND EXTERNAL INFLUENCES:
The administration must be cognizant of internal and external factors that could affect controls. Internally, Changes in the organizational structure and policies must be continuously evaluated. External influences could include political and legal factors as well as changes in technology.
A. ADMINISTRATION’S RISK ASSESSMENT:
The administration has to conduct an assessment of risks relevant to the financial statements. This includes the identification of potential risks, the analysis of the potential impact of those risks on the ability to properly report the financial statements and the overall management of risks. Items to consider in the risk assessment of the district include, but are not limited to:
1. New personnel or new duties for existing personnel
2. How a change in accounting information system impacts controls and how effectively the training of personnel on new system was conducted
3. Changes in the regulations and laws that may affect the control environment
4. Record storage is appropriate and secure (fireproof cabinets when needed for manual documents and proper passwords and access limitations for electronic information)
5. District limits access to computers and data files
6. Segregation of duties
7. Transactions are recorded timely
8. Cash is deposited timely
9. Assets are physically safeguarded
10. Transactions are performed by only authorized personnel
11. Reconciliations are properly and promptly completed
12. Occurrences of management override
B. ADMINISTRATION’S COMMUNICATION OF THE CONTROL:
The administration needs to determine if the information systems utilized in the district are adequate and relevant for their intended purpose. The district’s administration is responsible for communicating the controls of the district and the responsibilities of each employee in the control system. The administration is also charged with reviewing information that may indicate a flaw in the controls that would not allow the control to detect an error in a timely fashion.
C. CONTROL ACTIVITIES:
Control activities include the policies and procedures that are in place to achieve the controls desired. Documentation of the control activities is vital to the overall control environment. These activities include, but are not limited to:
1. Segregation of duties
2. Transactions are recorded timely
3. Cash is deposited timely
4. Assets are physically safeguarded
5. Transactions are performed by only authorized personnel
6. Reconciliations are properly and promptly completed
Control activities can be categorized into one or more assertions. All assertions should be addressed for each process (payroll, cash disbursements, etc.).
1. Existence (E) /Occurrence (O) – Existence is whether the assets or liabilities of the district exist at any given point in time (cash, state aid receivable). Occurrence is the whether the transaction took place (goods were received before the PO was moved to accounts payable from encumbrances)
2. Valuation (V) or Allocation (A) – Valuation is whether the asset or liability is included on the board secretary’s report at the proper value (the amount of cash or state aid receivable). Allocation is whether the revenue and expenditures were recorded in the proper amounts.
3. Accuracy/ Classification (A/CL) – transactions are recorded accurately and the classification of the transactions are proper.
4. Completeness (CO) – is whether all transactions are included (unrecorded purchase orders).
5. Cutoff © – Transactions are recorded at the proper time (purchase orders written in the proper year).
MONITORING OF CONTROLS
The administration is charged with reviewing internal controls on an ongoing basis. Monitoring can include responding to the recommendation of the auditor in changes in the controls. Reviewing correspondence from outside sources such as banks and vendors for unusual items is part of monitoring.
AFTER THE CONTROLS ARE ESTABLISHED:
Once the district establishes controls, those controls need to be evaluated at least annually and anytime circumstances dictate. Changes in personnel or regulations are examples of these.
As controls are evaluated they will either be effective or ineffective at achieving the proposed control. Controls are effective when there would be no material weaknesses in internal controls involved in financial reporting. Ineffective controls would be those where at least one material weakness exists. If a control is determined to be ineffective, then the control deficiency needs to be evaluated.
CONTROL DEFICIENCIES:
A control deficiency exists when the design or operation of a control does not allow the administration to prevent or detect misstatements on a timely basis. A design deficiency exists when a necessary control is missing or is not designed to enable the control objective to be met. An operational deficiency exists when control is designed properly, but does not operate as designed or the person performing the control is not qualified to perform the control.
A deficiency may exist that is unavoidable (segregation of duties in a small office). For these, compensating procedures should be put in place. These compensating procedures do not correct the deficiency.
REASONABLE ASSURANCE AND LIMITATIONS ON CONTOLS:
Reasonable assurance is a high level of assurance, but is not absolute. The district should understand that potential fraud could exist and not be detected timely in the following circumstances: when the district has poorly designed or operated internal controls, or when there are too many overrides of controls, when there is collusion between employees or between an employee and a third party.
MORRIS HILLS REGIONAL DISTRICT CONTROLS
The MHRD control questionnaire is listed in the Appendix I of this manual.