Presented to President’s Cabinet

INTERNAL CONTROLS are the integration of the activities, plans, attitudes, policies and efforts of the people of an organization working together to provide reasonable assurance that the organization will achieve its mission.

Simply put -

Internal Controls are actions taken to make sure the right things happen ---

-- and the wrong things don’t.

Promote efficient and effective operations and produce quality products

and services

Promote efficient and effective operations and produce quality products

and services

Safeguard resources against loss due to waste, abuse, mismanagement,

errors and fraud

Safeguard resources against loss due to waste, abuse, mismanagement,

errors and fraud

Ensure adherence to laws, regulations, contracts and management directives

Ensure adherence to laws, regulations, contracts and management directives

Develop and maintain reliable data, and

accurately present the data in timely reports

Develop and maintain reliable data, and

accurately present the data in timely reports

Everyone in an organization has responsibility for internal control.

Senior Management sets the “tone at the top” that affects integrity, ethics and other factors of a positive control environment.

Compliance with laws and policies

Accomplishment of mission

Relevant and reliable data

Economical and efficient use of resources

Safeguard assets

Com

mun

icat

ion Inform

ation

Setting the proper control environment is crucial to the effective implementation of all the other elements of internal control. Staff will take their cue from the attitude and example displayed by management.

RISKS are events that threaten the accomplishment of objectives and can be either internal or external.

They ultimately impact an organization’s ability to accomplish

its mission.Examples of risks include:Human errorFraudSystem breakdownsNatural disasters

Identify each risk in terms of:

Likelihood

The probability that an unfavorable event would occur if there were no internal controls in place

Significance or Impact

The magnitude of the effect on the organization if the unfavorable event were to occur

Cause

The reason why the unfavorable event may occur

Risk assumption – impact and likelihood low (do not establish control activities)

Risk control – take action to lower the probability or eliminate the risk (establish control activities)

Risk avoidance – abandon plan; risks uncontrollable and unacceptable (do not carry out the function)

COSTS BENEFITS

Managing Risk Risk

The cost of internal control should not exceed the benefit derived

Control activities are tools – both manual and automated – that help identify, prevent or reduce the risks that can impede accomplishment of the unit’s objectives.

Documentation – preserving evidence to substantiate a decision, event, transaction or system

Approval and Authorization Verification – determination of the completeness,

accuracy, authenticity and/or validity of transactions, events or information

Supervision Separation of Duties – division of key tasks and

responsibilities among various employees Safeguarding Assets – restricting access to resources

and information to help reduce the risk of unauthorized use or loss

Reporting – helps promote accountability for actions and decisions

All Employees Have Responsibility for Internal Controls◦ Senior Management sets the “tone at the top” that

affects integrity, ethics and other factors of a positive control environment.

Management should consider risks to achieving established objectives and strategies and manage appropriately (accept, control or avoid).

Communication must occur up, down and across an organization.

An Internal Control Program is a good idea andIT’S THE LAW

Standards for Internal Control in New York State Government, Office of the State Comptroller.

Control Environment – Tone at the Top, New York State Internal Control Association