The Importance of EFFECTIVE INTERNAL CONTROLS

BRENT CLARK, CPAAudit Vice President

Pugh CPAs

In

Intern

al Contro

ls –

Why B

other?

Internal Controls

Protect the Plan:

• By minimizing opportunities for unintentional errors or intentional fraud (Preventative Controls)

• By discovering small errors before they become big problems (Detective Controls)

In

Where are

the

Risks? Two Types of Fraud

Fraudulent Financial ReportingPoor

investment results (I)

Financial stability of the plan sponsor is

threatened (I)

Plan has invested in employer

securities (I)

Non-readily marketable

investments (O)

In

Where are

the

Risks? Two Types of Fraud

Misappropriation of Assets

Personal financial pressures (I)

Known or anticipated future layoffs (I)

Recent or expected changes in benefits (I)

Lack of qualified outside service providers (O)

In

DOL Crim

inal

Enforcement C

ases

Head of defense contractor steals

$186,000

Plan trustee convicted on 17 counts of wire fraud totaling

approximately $5.3 million

Plan administrator

steals $4.3 million from four plans for which

he provided administrative

services

In

Internal control should bebased on a risk-oriented

approach to ensure adequate controls exist for high riskareas and that controls are

not excessive for areaswith low risk. - EBPAQC

Some high risk areas include:

Participant data input and change

administration

Processing payroll & contributions

Participant distributions

Establis

hing a

Cost-Effecti

ve

Control E

nvironment

In

Monitorin

g

Internal C

ontrols

• Are the controls in place and operating

• Is the system working as designed

• Are the controls periodically reviewed

• Are identified exceptions and problems resolved

• Are you monitoring service organizations

Effective monitoring helps ensure your system of internal control continues to provide the

protections you envisioned.

In

Read Them!

Evaluate the ComplementaryUser Entity Controls

SOC Reports

In

Intern

al Contro

ls

And Your R

egulators

If a plan is selected for audit by the IRS,the EP agent conducting the retirement-plan

examination will begin by evaluating the effectiveness of the plan's internal controls

to determine whether to perform a focused audit—that is, just look at three to five issues or expand

the scope of the examination.In other words, based on the strength of the plan's internal controls, the agent will decide to examine more or less of the return than originally planned.

Monika Templeman, IRS Director of

Employee Plans Examinations

“

”

In

Internal C

ontrols

and

Your A

uditor

Our audit of the financial statements will include obtaining an understanding of internal control sufficient to plan the audit and to determine the nature, timing and extent of audit procedures to be performed. An audit is not designed to provide assurance on internal control or to identify significant deficiencies or material weaknesses. Our review and understanding of the Plan's internal control is not undertaken for the purpose of expressing an opinion on the effectiveness of internal control.

In

Significant deficiency - A deficiency, or a combination of deficiencies, that is less severe than a material weakness yet important enough to merit attention.

Understanding th

e

Severity of C

ontrol

Deficiencie

sMaterial weakness - A deficiency, or a combination of deficiencies, such that there is a reasonable possibility that a material misstatement of the financial statements will not be prevented, or detected and corrected, on a timely basis.

How Your A

uditor

Can Help

In

Example Contro

l

Activitie

s

Participant Data1. Procedures exist to promptly identify and notify

eligible participants for enrollment2. Retain enrollment applications including signed

refusals3. Management should regularly review changes

made to the payroll master file

Payroll Processing and Contributions4. Ensure adequate segregation of duties exist5. Current payrolls are compared with previous payrolls

and variances are investigated6. Access to the payroll system is appropriately

restricted

Participant Distributions7. Signed distribution forms are used8. Withdrawal forms, including requests

for hardship withdrawals from401(k) arrangements, arereviewed by a responsibleofficial

InTreatment without prevention is simply

unsustainable.

- Bill Gates

“

”

In

Resource

s/

Links

AICPA Employee Benefit Plan Audit Quality Center – The Importance of Internal Control in Financial Reporting and Safeguarding Plan Assets

AICPA EBPAQC Plan Advisory, Effective Monitoring of OutsourcedPlan Recordkeeping and Reporting Functions

IRS – Retirement Plan Operation and Maintenance