Internal controls are a series of processes and procedures that can help your agency ensure
that its activities comply with all laws, regulations and accepted practices.
Internal controls are essential to the proper management and operation of any organization.
All personnel in your organization play important roles in supporting internal controls but
management is responsible for designing and implementing the controls based on related
cost and benefits.
Management also sets the objectives, puts the control mechanisms and activities in place,
monitors and evaluates the controls.
The principal objectives of internal controls are to ensure the effectiveness and efficiency
of operations, reliability of financial reporting, and compliance with applicable laws and regulations.
In addition, Federal-aid recipients, whether grantees or sub-grantees, should ensure that:
transactions are properly recorded and accounted for, transactions are executed in compliance
with the provisions of the grant, and funds, property, and other assets are safeguarded
against loss from unauthorized use, transfer, exchange, sale, or disposal.
The Committee of Sponsoring Organizations of the Treadway Commission developed the most
widely used Internal Control-Integrated Framework in the United States, known as the COSO Framework.
Public and private organizations use this framework to design, implement and evaluate
controls that facilitate management and compliance with regulations.
The five components of the COSO Framework include the Control Environment, Risk Assessment,
Control Activities, Information and Communication, and Monitoring.
These five components provide a clear and effective means to implement and analyze the
Internal Controls of an organization.
Let's look at each component, starting with the Control Environment.
Management and employees should have a positive and supportive attitude toward internal controls.
Management should: convey integrity and ethical values and ensure they are not compromised,
have a commitment to the competence of their staffs by improving their skills, knowledge
and experience, have a philosophy and operating style appropriate to the development and maintenance
of effective internal control, ensure the organizational structure and assignments of
authority and responsibility contribute to effective internal control, and monitor oversight
groups to ensure all audit reports and communications are received, and all findings and recommendations
are adequately addressed. All organizations and agencies have a purpose
or goal, and they achieve these goals by fulfilling specific objectives.
However, a risk can endanger achieving an objective.
Risk Assessment is the process used to identify, analyze, and manage potential risks.
Risk identification methods may include qualitative and quantitative ranking activities, management
conferences, forecasting and strategic planning, and consideration of previous audit findings.
Risk analysis methods may include prioritizing the probability and rate of occurrence, evaluating
the vulnerability of assets to any threats, and estimating the quantitative and qualitative
costs of those potential threats on assets or operations.
Risk management methods may include monitoring the situation, minimizing the risk, taking
preventative or corrective action, and continually or periodically reassessing the risk.
Control Activities include policies, procedures, techniques, and control mechanisms developed
and implemented to ensure that your organization's directives are followed.
Specific control activities should be established in every area and department to ensure these
directives are applied consistently.
Some examples of Control Activities are: Access Control provides the access a person may have
to an asset or resource. Examples are permission or controls to limit access to records and
documents, buildings and offices, and information systems.
Segregation of duties reduces the risk of error or fraud by one person. Your organization
should have adequate segregation of duties in review and authorization of transactions.
Authorization Control allows only authorized employees to execute and review specific transactions.
For example, a clerk may have reviewer authority while a supervisor would have sole approval authority.
Completeness Control verifies that all pertinent transactions are processed.
Accuracy Control verifies that transactions are accurate and calculated using acceptable
methodologies.
An organizationÕs information and communication systems must convey information clearly, completely
and in a timely manner.
Information may be shared formally, such as reporting to management or other agencies,
or it may be shared informally, perhaps as a communication with a supplier, customer
or internal employees.
Whatever the form, the information should be identified, captured, and communicated
in a way and time that give people the means to fulfill their duties.
Monitoring is a continuous process that assesses the performance quality of the five internal
control components over time.
Monitoring determines if internal controls are present, sufficient and effective.
External audits, reviews and internal assessments are forms of monitoring.
Any findings, observations or recommendations from monitoring activities should be addressed
promptly.
One of the most important concepts to remember is that internal control is a process, not
a single event, regulation or form.
Internal Controls are an ongoing process that involves everyone in an organization and provides
reasonable assurance that all objectives are met.
Because factors outside the control or influence of management can affect the agency's ability
to achieve all of its goals, no matter how well designed and operated, Internal Control
cannot provide absolute assurance that all objectives will be met.
Your agency and staff are responsible for understanding and implementing Internal Control.
Your agency will benefit from implementing internal controls that allow for effective
and efficient operations, increase the reliability of financial reporting, and ensure compliance
with applicable laws and regulations.
For more information about internal controls, contact your State department of transportation.