Internal Controls

7/18/2019 Internal Controls

1/28

Office of the ProvincialController Division

INTERNAL CONTROLS 101


2/28

2


Lets start the day with a quickrefresh Today we have some great speakers who are internal control

experts to provide presentations and answer your questions onInternal Controls

Lets get the day started with some general concepts andterminology to remind ourselves of the basics we already know

and use everyday.

As public sector managers and employees we are accountable forthe resources entrusted to us and for ensuring our programs andservices are administered eectively and e!ciently.

A signi"cant component in ful"lling this responsibility is ensuringthat an adequate system of internal control exists and work


3/28

3


The COSO* Denition of InternalControl

Internal control is a process# eected by an entity$sboard of directors# management# and other personnel#designed to provide reasonable assurance regarding theachievement of ob%ectives in the following categories&

'ectiveness and e!ciency of operations (eliability of "nancial reporting

Compliance with applicable laws and regulations

* Committee )f *ponsoring )rgani+ations of the TreadwayCommission


4/28

4


Simple Denition

Internal control is what we do to see that thethings we want to happen will happen ,

And the things we don$t want to happenwont happen.


5/28

5


Internal Controls re Common Sense

-hat do you worry about going wrong

-hat steps have been taken to assure it

doesn$t

/ow do you know things are under control


6/28

6


Internal Controls are e!erywhere"

0ou exercise internal control principles in your

personal life when you&

Lock your house when you leave

1eep copies of important papers in your safetydeposit box

2alance your checkbook

1eep your AT34debit card 5I6 number separate

from your card3ake travel plans


7/287


O#$ecti!es of Internal Controls

Strategic high-level goals and objectives, alignedwith and supporting the mission.

Operational effective and efficient use ofresources.

Reporting integrity and reliability of reporting. Compliance compliance with applicable laws and

regulations.

Stewardship protection and conservation of assets.


8/288


%usiness analysis& pro'ram desi'nor (

think C)))+)S) CCompliance with applicable laws and regulations. AAccomplishment of the entity$s mission 7ob%ectives

and goals8.

((elevant and reliable "nancial reporting. ''ective and e!cient operations.**afeguarding of assets.

Can anyone think of anything in the 5ublic *ervice that is notimpacted by internal controls


9/289


The #i' picture

Internal controls are a key comonent to Enterrise Risk !ana"ement

#ER!$%a process, effected by an entitys board of directors, management and other

personnel, applied in strategy setting and across the enterprise, designed to

identify potential events that may affect the entity, and manage risk to be within

its risk appetite, to provide reasonable assurance regarding the achievement of

entity objectives. The Provincial "overnment has em&race' a risk &ase' aroach thro("h

all asects of it)s oerationsRes(lts &ase' lans

Transfer Payment Acco(nta&ility Directive

*(arterly risk reortin"

Certificate of Ass(rance an' A('it

Acco(nta&ility an' Transarency #Acco(nta&ility Directive +AA, +TAA etc-$


10/2810


,eak Internal Controls Increase iskThrou'h(

2usiness Interruption 9 system breakdowns or catastrophes#

excessive re9work to correct for errors.

'rroneous 3anagement :ecisions 9 based on erroneous#inadequate or misleading information.

;raud# 'mbe++lement and Theft 9by management#

employees# customers# vendors# or the public9at9large.

*tatutory *anctions9 penalties arising from failure to complywith regulatory requirements# as well as overt violations.

'xcessive Costs4:e"cient (evenues 9 expenses which could

have been avoided# as well as loss of revenues to which theorgani+ation is entitled.

Loss# 3isuse or :estruction of Assets 9unintentional loss ofphysical assets such as cash# inventory# and equipment.


11/2811


2ut too much of a good thing,.

.hen lookin" at controls

!ore is not necessarily &etter

Controls that 'o not /ork to"ether leavin" holes

Cost of '(licate' or inefficient controls-

Controls that 'o not ali"n /ith the imortance of the risks

Comle an' oorly imlemente' controls

Not (n'erstoo' or follo/e'

Inconsistently alie'

Control effectiveness can 'e"ra'e over time

No val(e for money Controls cost money

D(lication of ineffective controls 'o not rovi'e &enefits


12/2812


COSOS Internal Control-ramework(

-i!e Inter.elated Standards"

iskssessment

Controlcti!ities

/onitorin'

Information 0Communication

Control+n!ironment


13/2813


1) Control +n!ironment

;oundation for all other standards of internal control. 5ervasive in


14/2814

Office of the Provincial

Controller Division

2u#lic Ser!ice of Ontario ct 32SO4

The follo/in" are the (roses of this Act2

1-To ens(re that the (&lic service of Ontario is effective in servin" the (&lic, the"overnment an' the Le"islat(re-

3-To ens(re that the (&lic service of Ontario is non4artisan, rofessional, ethical an'

cometent-

5-To set o(t roles an' resonsi&ilities in the a'ministration of the (&lic service of Ontario-

6-To rovi'e a frame/ork in la/ for the lea'ershi an' mana"ement of the (&lic service of

Ontario-7-To set o(t ri"hts an' '(ties of (&lic servants concernin" ethical con'(ct-

8-To set o(t ri"hts an' '(ties of (&lic servants concernin" olitical activity-

9-To esta&lish roce'(res for the 'isclos(re an' investi"ation of /ron"'oin" in the (&lic

service of Ontario an' to rotect (&lic servants /ho 'isclose /ron"'oin" from rerisals-


15/2815


Controller Division

5) isk ssessment

(isks are internal ? external events 7economicconditions# sta!ng changes# new systems#regulatory changes# natural disasters# etc.8 thatthreaten the accomplishment of ob%ectives.

(isk assessment is the process of identifying#evaluating# and deciding how to manage theseevents, What is the likelihood of the eventoccurring? What would be the impact if it were tooccur? What can we do to prevent or reduce the risk?

/ave any of you been through a risk assessment with Internal Audit or anoutside party


16/2816


Controller Division

6) Control cti!ities

Tools 9 policies# procedures# processes 9designed andimplemented to help ensure that managementdirectives are carried out.

/elp prevent or reduce the risks that can impede theaccomplishment of ob%ectives.

)ccur throughout the organi+ation# at all levels# andin all functions. Includes training# approvals# authori+ations#

veri"cations# reconciliations# security of assets#reviews of operating performance# and segregation of

duties. Types of Controls

5reventative :etective


17/2817


Controller Division

7) Communication and Information

5ertinent information must be captured# identi"edand communicated on a timely basis.

'ective information and communication systemsenable the organi+ation$s people to exchange the

information needed to conduct# manage# andcontrol its operations.


18/2818


Controller Division

8) /onitorin'

Internal control systems must be monitored toassess their eectiveness,Are they operating asintended?

)ngoing monitoring is necessary to reactdynamically to changing conditions,Have controls

become outdated, redundant, or obsolete? 3onitoring occurs in the course of everyday

operations# it includes regular management ?supervisory activities and other actions personnel

take in performing their duties. 5eriodic testing can be done by the process owner#

internal audit and external audit.


19/2819


Controller Division

%enets from Stron' InternalControls

(educing and preventing errors in a cost9eective manner.

'nsuring priority issues are identi"ed andaddressed.

5rotecting employees ? resources. 5roviding appropriate checks and balances. /aving more e!cient audits# resulting in

shorter timelines# less testing# and fewerdemands on sta.


20/2820


Controller Division

+9ecti!e Internal Controls(

3ake sense within each organi+ation$sunique operating environment.

2ene"t rather than encumbermanagement.

Are not stand9alone practices@ they arewoven into day9to9day responsibilities.

Are cost9eective.


21/2821


Controller Division

Important Concepts(

Internal control is a process@ it is a means to an end# not an end itself.

Internal control is eected by people@ it$s

not merely policy manuals and forms butpeople at every level of an organi+ation.

Internal control can be expected to only

provide reasonable assurance# not absoluteassurance.

-i : I l C l


22/2822


Controller Division

-i!e :ey Internal Controlcti!ities(


23/28

23


Controller Division

1) Separation of Duties

:ivide responsibilities between dierentemployees so one individual doesn$t controlall aspects of a transaction.

(educe the opportunity for an employee tocommit and conceal errors 7intentional orunintentional8 or perpetrate fraud.


24/28

24


Controller Division

5) Documentation

:ocument ? preserve evidence to substantiate& Critical decisions and signi"cant

events...typically involving the use#commitment# or transfer of resources.

Transactions,enables a transaction to betraced from its inception to completion.

5olicies ? 5rocedures,documents which setforth the fundamental principles and methodsthat employees rely on to do their %obs.


25/28

25


Controller Division

6) uthori;ation 0 ppro!als

3anagement documents and communicateswhich activities require approval# and by whom#based on the level of risk to the organi+ation.

'nsure that transactions are approved and

executed only by employees acting within thescope of their authority granted bymanagement.

:)A


26/28

26


Controller Division

7) Security of ssets

*ecure and restrict access to equipment#cash# inventory# con"dential information#etc. to reduce the risk of loss orunauthori+ed use.

5erform periodic physical inventories toverify existence# quantities# location#condition# and utili+ation.

2ase the level of security on the

vulnerability of items being secured# thelikelihood of loss# and the potential impactshould a loss occur.


27/28

27


Controller Division

8) econciliation 0 e!iew

'xamine transactions# information# and eventsto verify accuracy# completeness#appropriateness# and compliance.

2ase level of review on materiality# risk# and

overall importance to organi+ation$s ob%ectives. 'nsure frequency is adequate enough to detect

and act upon questionable activities in a timelymanner.

Timing of reconciliations and monitoring


28/28


Controller Division

Today# tomorrow and the next day

Think a&o(t C-A-R-E-S- /hen ever yo( arerovi'in" analysis or 'eveloin" olicies or

imlementin" ro"rams

:e/are of the itfalls ; more is not al/ays &etter,

controls m(st &e maintaina&le

Think a&o(t the thin"s that /orry yo( in yo(r

Internal Controls

Documents

Transcript of Internal Controls