TANNEHILL

INTERNAL CONTROLS

The Board of Education directs all school district personnel to maintain appropriate internal controls in accordance with this policy.  Internal Controls are to be an integral part of the school district’s financial and business policies and procedures.  The objectives of internal controls are:

• Protecting resources against waste, fraud, and inefficiency;
• Ensuring accuracy and reliability in accounting and operating data;
• Securing compliance with the policies of the organization;
• Ensuring compliance with applicable laws and regulations;
• Evaluating the level of performance in all organizational units of the organization; 
• Providing management with reasonable assurance that all leave and payroll transactions are authorized, valid, complete and accurate;
• Safeguarding leave and payroll documents from theft, loss and destruction; and
• Internal controls are simply good business practices.

   

  Internal controls are the practices performed by employees to provide the board of education with reasonable assurance that assets are safeguarded and transactions are authorized, valid, complete and accurate.

   

  Internal control systems operate at different levels of effectiveness.  Determining whether a particular internal control system is effective is a judgment resulting from an assessment of whether the five components – Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring – are present and functioning.  Effective controls provide reasonable assurance regarding the accomplishments of established objectives.

   

  The Superintendent or designee shall evaluate and monitor compliance with statute, regulations and the terms and conditions of federal awards.  When instances of noncompliance are identified, the Superintendent or designee shall take prompt action.  All school personnel shall take reasonable measures to safeguard personally identifiable information that is protected by state or federal law. 

   

  Control Environment

  The control environment, as established by the organization’s administration, sets the tone of an institution and influences the control consciousness of its people.  Leaders of each department, area or activity establish a local control environment. 

   

  Risk Assessment

  Every entity faces a variety of risks from external and internal sources that must be assessed.  A precondition to risk assessment is the establishment of objectives, linked at different levels and internally consistent.  Risk assessment is the identification and analysis of relevant risks to achievement of the objectives, forming a basis for determining how the risks should be managed.  Because economic, regulatory and operating conditions will continue to change, mechanisms are needed to identify and deal with the special risks associated with change.

   

  The process of identifying and analyzing risk is an ongoing process and is a critical component of an effective internal control system.  Attention must be focused on risks at all levels and necessary actions must be taken to manage.  Risks can pertain to internal and external factors.  After risks have been identified, they must be evaluated.

   

  Managing change requires a constant assessment of risk and the impact on internal controls.  Economic, industry and regulatory environments change and entities’ activities evolve.  Mechanisms are needed to identify and react to changing conditions.

   

  INTERNAL CONTROLS, Con’t

   

   

  Control Activities

  Control activities are the policies and procedures that help ensure management directives are carried out.  They help ensure that necessary actions are taken to address risks to achievement of the entity’s objectives.  Control activities occur throughout the organization, at all levels, and in all functions.  They include a range of activities as diverse as

  approvals, authorizations, verifications, reconciliations, reviews of operating performance, security of assets and segregation of duties.

   

  Control activities usually involve two elements: a policy establishing what should be done and procedures to effect the policy.  All policies must be implemented thoughtfully, conscientiously and consistently.

   

  Information and Communication

  Pertinent information must be identified, captured and communicated in a form and time frame that enables people to carry out their responsibilities.  Effective communication must occur in a broad sense, flowing down, across and up the organization.  All personnel must receive a clear message from top management that control responsibilities must be taken seriously.  They must understand their own role in the internal control system, as well as how individual activities relate to the work of others.  They must have a means of communicating significant information upstream.

   

  Monitoring

  Internal control systems need to be monitored – a process that assesses the quality of the system’s performance over time.  Ongoing monitoring occurs in the ordinary course of operations, and includes regular management and supervisory activities, and other actions personnel take in performing their duties that assess the quality of internal control system performance.

   

  The scope and frequency of separate evaluations depend primarily on an assessment of risks and the effectiveness of ongoing monitoring procedures.  Internal control deficiencies should be reported upstream, with serious matters reported immediately to top administration and governing boards.

   

  Internal control systems change over time.  The way controls are applied may evolve.  Once effective procedures can become less effective due to the arrival of new personnel, varying effectiveness of training and supervision, time and resources constraints, or additional pressures.  Furthermore, circumstances for which the internal control system was originally designed also may change.  Because of changing conditions, management needs to determine whether the internal control system continues to be relevant and able to address new risks.

   

  Responsibility

  It is the responsibility of the superintendent and board of education to work together to develop and implement a system of internal controls.  However, everyone within the school district has some role in internal controls.  The roles vary depending upon the level of responsibility and the nature of involvement by the individual.  The Board of Education, Superintendent, and administrative staff establish the presence of integrity, ethics, competence and a positive control environment.  The employees of the district have oversight responsibility for internal controls within their areas.  Each employee is to be cognizant of proper internal control procedures associated with their specific job responsibilities and is responsible for complying with internal controls.

   

   

   

   

  INTERNAL CONTROLS, Con’t

   

  Components of the Control Activity

   

  Internal controls rely on the principle of checks and balances in the workplace.  The following components focus on the control activity:

   

  Personnel need to be competent and trustworthy, with clearly established lines of authority and responsibility documented in written job descriptions and procedure manuals.  Organizational charts provide a visual presentation of

   

  lines of authority and periodic updates of job descriptions ensures that employees are aware of the duties they are expected to perform.

   

  Authorization Procedures need to include a thorough review of supporting information to verify the propriety and validity of transactions.  Approval authority is to be commensurate with the nature and significance of the transactions and in compliance with School District policy.

   

  Transactions should be authorized and executed by persons acting within the range of their authority.

   

• Policies and procedures should clearly identify which individuals have authority to approve different types of transactions.
• Authority comes with accountability and responsibility.
• Individuals should understand what they are approving.  Individuals should have firsthand knowledge of transactions being approved, or they should review supporting information to verify the propriety and validity of transactions.
• Authorization of adjustments should be timely.
• Authorization for leave, overtime and change of work schedule should be obtained in advance and in writing.
• Authorization should be from at least one level above.
• Employees should not authorize their own transactions.
• Adjustment documents should proceed directly for processing after approval by a supervisor and not return to the employee where it can be falsified.  Many frauds occur after approval.
• Supervisors should not sign blank forms.
• The supervisor and employee should initial corrections or adjustments.
• Delegation of authority in writing is required for grants and recommended for other budgets.
• Leave and payroll documents should proceed directly for processing after approval by a supervisor and not returned to the employee where they can be falsified.  Many frauds (i.e. unauthorized or excessive overtime hours charged) occur after approval.
• Supervisors should not sign blank timesheets or leave request forms.
• Corrections or adjustments should be initialed by the supervisor and employee.

   

  Segregation of Duties reduce the likelihood of errors and irregularities.  An individual is not to have responsibility for more than one of the three transaction components: authorization, custody, and record keeping.  When the work of one employee is checked by another, and when the responsibility for custody for assets is separate from the responsibility for maintaining the records relating to those assets, there is appropriate segregation of duties.  This helps detect errors in a timely manner and deter improper activities; and at the same time, it should be devised to prompt operational efficiency and allow for effective communications.

   

   

  INTERNAL CONTROLS, Con’t

   

   

  Physical Restrictions are the most important type of protective measures for safeguarding school district assets, processes and data.

   

  Documentation and Record Retention is to provide reasonable assurance that all information and transactions of value are clearly, thoroughly, and accurately recorded and retained.  Records are to be maintained and controlled in accordance with the established retention period and properly disposed of in accordance with established procedures.

   

  Monitoring Operations is essential to verify that controls are operating properly.  Reconciliations, confirmations, and exception reports can provide this type of information.

   

  Reconciliation is the process of comparing the entries in the general ledger to supporting documentation and resolving any discrepancies or differences.  Accounts Payable, Accounts Receivable, and Cash, Property depreciation, Interest Income and other.

   

  An independent person should perform a reconciliation of the district financial records at least annually and when an employee transfers, requests extended leave without pay, or separates employment from the school district.

   

  Risk Assessment

  The process of assessing risk is an opportunity for management and directors to look at their operations, determine the areas of significant risk, and evaluate what actions can be taken to minimize the risk and enhance the effectiveness and efficiency of the operation, while following applicable laws and regulations.  The risk assessment and internal control evaluation can be integrated into the strategic planning process and program review.

   

  All levels of the organization should participate in an annual risk assessment.  The process of assessing risk is an opportunity for review of operations, determination of the areas of significant risk, and evaluation of what actions can be taken to minimize the risk and enhance internal controls.

   

  Determination of an effective means of managing the risks, determining the likelihood of occurrence, minimizing the risks, and providing compensating controls is management’s responsibility.

   

  Managing an Audit

   

  These are suggestions when interacting with auditors, to expedite the audit process while minimizing disruptions to day-to-day departmental operations.  It is important to both the auditors and the departments to have accurate and objective audit results.

   

• Designate an audit liaison person (Department manager).
• Clarify the audit object and scope (areas to be tested and period covered by the audit).
• Determine auditor needs (records, workspace, and resources).
• Consider giving the auditor a general tour of your facilities.

   

  Access to Records by Auditor

  Ensure original documents do not leave department premises without prior approval.  If a request is ambiguous, ask the auditor for the purpose of reviewing the document.  Be prepared to recommend alternate documents that would achieve the auditor’s purpose.  Unless absolutely necessary, do not allow full access to your file drawers, storerooms, etc.  Auditors are expected to obtain permission and state their objective for accessing these areas. Have documents

   

  INTERNAL CONTROLS, Con’t

   

   

  available upon their arrival.  Maintain a list of records provided to the auditor. Review records you are providing to anticipate questions.  If records will hurt the School District’s interest, notify department management of the issue.

   

  Responding to Audit Findings

  Keep informed of issues throughout the audit. Ensure an exit interview is held.  Use it to verify facts and respond to the audit.  Ask a representative from the Treasurer’s Office to attend if there are questioned or disputed findings.

  Ask for time to review findings, and then re-verify calculations and source data. Concede valid findings, but do not speculate on whether they apply to other areas on campus. Discuss with the auditor the dispositions of audit issues, i.e.

  verbal comment, exit item, management summary or report item. If necessary, appeal the auditor’s conclusion with their supervisors. 

   

  “Must Do” Management Actions

   

  ‘Hard’ Controls (Mandatory Internal Control and Checks and Balances)

1. Use only original signatures to approve documents.
2. Provide departmental reports
   1. Review and document the reconciliations of the monthly department financial statements to the appropriate supporting documents to assure all items are authorized School District purchases/charges.
   2. Budget the best annual estimate of the department’s earnings and expenditures.
   3. Compare actual results to the budget and follow up significant variances.
3. Issue Payroll
   1. Reconcile labor distribution reports to timesheets/exception reports (including reconciling leave accrual amounts to leave slips).
   2. Collect from Staff & Administration a signed Attendance Leave Sheets for each pay period.
   3. Collect from nonexempt and exempt staff a signed Attendance Leave Sheets for each pay period.
   4. Collect from hourly classified and student employees a signed positive timesheet for each pay period.
   5. Have supervisors with direct knowledge of the actual time worked sign Attendance Leave Sheets and positive timesheets.
   6. Budget the best annual estimate of the department’s labor expenses.
4. Separate incompatible duties (e.g. pro-card holder/approval authority, cash receipts handling/accounts receivable posting, payroll preparation/verification, etc.) among different department staff members.
5. Identify active/inactive research accounts used by departmental faculty, and assure/implement a process through which the activity (including personnel requisitions, expenditures, and document retention) is approved by the Principle Investigator (PI) and periodically reviewed by the department chair and that this process is in accordance with School District and funding source (grant, department program, etc.) requirements (capital equipment approval, contract approval, etc.).  Ensure that inactive project grants are closed according to School District procedures.
6. Count and balance your petty cash/change fund as determined necessary, and reconcile (by another person) as appropriate.
7. Issue Cash Receipts
   1. Deposit daily or periodically with the Cashier’s Office any cash/checks received in your department as authorized in the policy and procedures manual.
   2. Issue a pre-numbered receipt for all cash transactions.
   3. Collect sales tax when taxable goods are sold.

       

      INTERNAL CONTROLS, Con’t

       

   4. Use a cash receipts form for all checks and cash and submit them to the central office for deposit. 
   5. Safeguard cash and checks against theft or loss.

      8.   Review purchases

1. Review in detail the supporting documentation for any action that you authorize, approve, review, or sign.
2. Establish a mechanism for ensuring that all departmental purchases are appropriate.
3. All contracts and credit applications require School Board approval.
4. Always submit original receipts as proof of payment.

1. List and account for each equipment asset and its location valued at less than $25,000 (assets not included on the School District’s inventory listing).
2.  Reconcile external bank accounts and credit card transactions (if applicable) at least monthly.

1.  Establish procedures to ensure that cardholders comply with the reimbursable business expense policy.

    

   ‘Soft’ Controls (Internal Controls to Strengthen Oversight and Encourage Compliance)

    

1. Complete an Annual Risk Assessment and/or Internal Control Review at least annually.
2. Be familiar with the Policies and Procedures of the School District.
3. Avoid circumventing any established internal controls over department operations.
4. Review operational processes on a continuous basis for duplication of effort.
5. Identify strengths/weaknesses within your employee pool and re-organize duties accordingly to develop a stronger team.  Encourage employees to participate in professional development activities.
6. Be alert to fraud risks and ‘red flags’ for fraud occurring in your unit’s operations.
7. On a regular basis compare/analyze the actual revenue and expenditures to the amount of budgeted revenue/expenditures (i.e. financial analysis).
8. Provide relevant financial reports/status updates to appropriate Dean/Director on a regular basis.
9. Document all reconciliation’s, verifications, approvals, etc. to assure a defined audit trail of all transactions exit.

    

    

   Legal Reference:  2 C.F.R. § 200.303