5/7/2014

1
Internal Control Systems
County Auditors Spring Conference
May 2014
How many of you can say that you
are reasonably certain that the
office: operates in a way that goals
are reached; reports materially
correct information; and materially
complies with laws and
regulations?
5/7/2014
2
Did the voters that elected you do
so because they thought you
would make sure things were done
right?

How are you making sure?
Internal controls
combat fraud and mistakes
Prevent
Opportunity

Detect Fraud,
Errors and
Omissions

Fraud Triangle
Pressure
Opportunity Rationalization
5/7/2014
3
Why do we talk about internal controls
then find it difficult to take action?

Control systems are not uniform.
They are not tangible.

They are not rocket science but in order to be
effective they have to be more than just
thoughts in the mind of management.

Summary of the Discussion
Understanding Internal Control
3 Categories of Objectives
5 Components on Internal Control Systems
New COSO 2013
Expanded guidance on the role of those in charge of
governance in Internal Control Systems
Adjusted for increased dependence on IT
17 principles under the 5 components
Implementation
5/7/2014
4
COSO Definition of Effective Internal
Control
An effective system of internal control requires
that:
Each of the 5 components and 17 principles
are present and functioning and,
The 5 components operate together in an
integrated manner.

A major deficiency exists if the county cannot
conclude that these are met.
Internal Control Framework
(COSO Cube 2013)
5/7/2014
5
Managements Objectives
Operations
Reporting
Compliance
Internal Control Components
Control Environment
Risk Assessment
Control Activities
Information &
Communication
Monitoring Activities
5/7/2014
6
Control Environment
Set of standards,
processes, and
structures
Tone at the top
Integrity and ethical
values of the county
Includes performance
measures, incentives,
and rewards


Acts as the foundation for
a sound system of internal
control
Risk Assessment
Risk assessment requires
management to consider
the impact of possible
changes in the external
environment and within
the county that may
render internal control
ineffective.
Many organizations,
take a risk-based
approach to internal
control
Includes:
Risk Identification
Risk Analysis
Risk Response
5/7/2014
7
Control Activities
Preventive or detective in nature
Manual and automated activities
Includes segregation of duties
Control activities are the actions established through
policies and procedures to mitigate risks to the
achievement of objectives.
Information and Communication
Emphasizes importance of quality information
Volume and sources
Complexity of processes
Technology advances
Greater interaction with 3
rd
party vendors
5/7/2014
8
Monitoring Activities
Ongoing Evaluations

Built into the business
process at various levels

Timely information
Separate Evaluations

Conducted periodically

Frequency will depend on
assessment of risks and
effectiveness of ongoing
evaluations
New Principles


COSO 2013 Update
clarifies requirements for
effective internal control
with the 17 new principles


Principles relate to a
component of the
internal control system
Not required
Common sense

5/7/2014
9
Control Environment
1. The county demonstrates a commitment to integrity
and ethical values.
2. Governing boards demonstrate independence from
management and exercises oversight of internal
control system.
3. Management establishes, with board oversight,
structures, reporting lines, and appropriate
authorities & responsibilities.
4. The county demonstrates a commitment to attract,
develop and retain competent individuals.
5. The county holds individuals accountable for their
internal control responsibilities.
Risk Assessment
6. The county specifies objectives with sufficient clarity
to enable the identification and assessment of risks
relating to objectives.
7. The county identifies risks to the achievement of its
objective across the entity and analyzes risks as a
basis for determining how the risks should be
managed.
8. The county considers the potential for fraud in
assessing risks to the achievement of objectives.
9. The county identifies and assesses changes that could
significantly impact the system of internal control.
5/7/2014
10
Control Activities
10. The county selects and develops control
activities that contribute to the mitigation of
risks to the achievement of objectives to
acceptable levels.
11. The county selects and develops general control
activities over technology to support the
achievement of objectives.
12. The county deploys control activities through
policies that establish what is expected and
procedures that put policies into place.
Information and Communication
13. The county obtains or generates and uses
relevant, quality information to support the
functioning of internal control.
14. The county internally communicates
information, including objectives and
responsibilities for internal control, necessary to
support the functioning of the internal control.
15. The county communicates with external parties
regarding matters affecting the functioning of
internal control.
5/7/2014
11
Monitoring Activities
16. The county selects, develops, and performs
ongoing and/or separate evaluations to
ascertain whether the components of internal
control are present and functioning.
17. The county evaluates and communicates
internal control deficiencies in a timely manner
to those parties responsible for taking corrective
action, including senior management and the
governing boards, as appropriate.
Implementation


Action!
5/7/2014
12
Take it Step by Step!
1. Control Environment
2. Risk Assessment
3. Control Activities
4. Information and Communication
5. Monitoring
Documentation
Start with documenting the 5 components in
significant areas first.
Cash handling
Managements Goals
Customer Service
Compliance with Laws and Regulations

5/7/2014
13
Find where there is risk that is not
mitigated by internal control
This is Risk
identification
Perform your risk
analysis
Respond to the risk
Implementing controls
Insurance
Acceptance of the Risk
LaGrange Clerk of the Circuit Court
Charged $23,253.31
Cash receipts not deposited
Transfers to cover the amount of missing cash
receipts
Cash shortages
Additional Audit Costs
President of the Clerks Association and named
Clerk of the Year just prior to this report being
made public
5/7/2014
14
Switzerland County School
Corporation
Charged Treasurer over $1.1 million (over 4 years)
Manually wrote checks to pay personal credit
cards
Used a different check series
Altered bank statements
Adjusted disbursement records
U.S. Attorney charged criminally and civil charges
brought by the school
Ashland Township
Charged Trustee $7,860.23
Consecutive audits reported unsupported disbursements for
utilities, travel expenses, office supplies and repairs.
Other Examination Results and Comments
Unapproved salary payments
Failure to remit payroll withholdings
Failure to provide board minutes for audit
Disbursements made in excess of appropriations
Late filing of the annual financial report
Failure to File 100R
Certified to Prosecuting Attorney and AG
Removed from office

5/7/2014
15
Town of Brownstown
Charged Clerk Treasurer $ 393,916.98
Over paid her salary by $369,054.70 over 4 years
Made unauthorized payroll payments to her son
for 3 years in the amount of $22,606.50
Charged $2,255.78 for penalties and interest
incurred with IRS and IDOR
Left town during the audit October 2009
April 2010 sheriff sold her residence under
foreclosure order
Town of North Judson
Charged Clerk-Treasurer $ 84,892.67
Cemetery lot receipts not deposited (required cash)
Utility receipts not deposited
Utility customer deposits not receipted
Ordinance Violations Collections not deposited
Police Dept receipts not deposited
Equipment purchased was not at the Town
Personal expenses paid by Town check
Paid herself without supporting documentation
Certified to the AG and Prosecuting Attorney

5/7/2014
16
Are you going to trust or make
sure things are done right in your
office?