THE POWER OF AN INTERNAL CONTROL SYSTEM

How is a green book powerful? If you stick around you’ll see how the ‘Green Book’ can be a powerful tool for any local government and its implementation could save you thousands of dollars over many years. Yes, chances are thousands of dollars will be saved! The ‘Green Book’ is actually what the GAO named the standards of internal controls for federal entities. If you’re not a federal entity, no worries. The ‘Green Book’ can also be adopted by a state, local, quasi-governmental, or not-for-profits. The basis of the ‘Green Book’ is COSO’s internal controls. What are internal controls? The Green Book defines it as a process used by management to help an entity achieve its objectives. How does it achieve its objectives? Good question! The point of an internal control system is to run operations efficiently and effectively, report liable information about its operations, and comply with applicable laws and regulations.

As a bonus, a strong internal control system fights against fraud, waste, and abuse. Fraud is defined as any illegal activity where the perpetrator intended to perform the activity. Waste is defined as the act of using or expending resources carelessly, extravagantly, or to no purpose. Abuse is defined as involves behavior deficient or improper when compared with behavior that a prudent person would consider reasonable and necessary operational practice given the facts and circumstances. Would it be awesome to tell the public not only is your local government running at top efficiency but also deterring, preventing, and detecting fraud, waste, and abuse? I think so.

CONTROL ENVIRONMENT

The five components are the following:

1. Control Environment
2. Risk Assessment
3. Control Activities
4. Information & Communication
5. Monitoring

Instead of showing each and every principle, we’ll show you how to implement the internal control system per the Federal Government Standards. Let’s review the first principle.

Control Environment

The control environment provides the framework of the entire system. The control environment should demonstrate a commitment to integrity and ethical values. Those charged with governance should oversee the entity’s internal control system. Management should have a practice in place to recruit, develop, and retain competent individuals. Generally speaking, the control environment is the tone at the top. How upper management and the board work and interact and the entire staff depicts how the rest of the entity will operate. If upper management and the Board lead by example and adhere to integrity and ethical values, much of the rest of the entity will follow integrity and ethical behavior. As the saying goes, if they don’t lead by example, any new system of processes and procedures will “fall on deaf ears”.

Upper management and the Board need to realize they affect many of the stakeholders and working with integrity and ethically will influence the entire system for good. The control environment is where management needs to create standards of conduct and an oversight structure. The oversight structure provides another layer of review by those which are deemed ‘Independent’. For smaller entities, this oversight board would likely be the Board members. There should be at least one person with knowledge of finance and accounting to understand the financial reporting and compliance objectives. This oversight board should provide input on the design of the entire internal control system.

Furthermore, management is to hold the staff and key stakeholders accountable. Generally speaking, the control environment is to establish ethics and integrity within the organization, establish an oversight board, develop expectations of staff, and maintain accountability throughout the whole entity.

If principle #1 is not adhered or followed, the entity’s internal control system will be deficient and susceptible to error, waste, abuse, or fraud.

RISK ASSESSMENT

Always consider fraud when identifying the risks. The three types of fraud are Financial reporting, misappropriation of assets, and corruption. As the environment changes, risks will change. Also, don’t forget to account for the change and re-assess periodically.

CONTROL ACTIVITIES

Control activities are the policies and procedures created by management to achieve entity goals. In other words, how does management want the staff to perform on a day to day basis? There should be documentation to show the staff how the day to day tasks should be performed. The documentation should be written and align with the control environment and risk assessment. Procedures should be written to mitigate the risk assessed in the previous step. Management needs to design the appropriate types of control activities:

Reviews of actual performance

• Reviews of management at the functional or activity level
• Physical controls over vulnerable assets
• Segregation of duties
• Proper execution of transactions
• Accurate and timely recording of transactions

Management needs to establish policies and procedures to ensure the day to day tasks of the staff are performed at the highest possible efficiency. In addition, remember to incorporate the risk of fraud when creating these policies/procedures. A system is inefficient if a staff member is using the entity for his/her personal gain.

Some examples of procedures to prevent or detect fraud are:

• Random periodic physical inventory of equipment and other valuable assets including ‘inventory’
• Payment spending limits of staff members
• Anti-fraud training of staff and employee assistance programs
• Review of third-party vendors (Ensure there are no ghost vendors)
• Management and Board need to be aware of business relationships and cost (ie watch out for vendor kick-backs or third-party transactions)
• Segregate duties of a process (ie Input of transaction, custody of assets, and reconciliation should be performed by separate personnel)

Make sure you document each and every policies/procedure and change them periodically as the environment changes.

INFORMATION AND COMMUNICATION

Quality information is key to a strong internal control system. Information needs to be relevant and reliable, and an avenue to which the entity communicates is equally important to internal and external stakeholders.

MONITORING

Finally, since the internal control system is dynamic and changes over time an efficient and effective monitoring system is necessary.

FINAL THOUGHTS

As you can see a strong internal control system is vital to the operations of any government. The standards provide us with a format to follow. This format includes five components: Control environment, risk assessment, control activities, information and communication, and monitoring. Each of these components need to be aligned and complement each other. If each component is not aligned, then there is a deficiency in the system. You can use the Green Book as a standard to create your own internal control system and if done correctly, the entity should run efficiently and effectively and fight against any fraud, waste, or abuse.