HomeMy WebLinkAbout69-16 Internal Controls Ordinance120ON COUNTY -CITY BUILDING
227 W. JEFFERSON BLVD.
SOUTH BEND, INDIANA 46601 -1830
CITY OF SOUTH BEND PETE BUTTIGIEG, MAYOR
PHONE 574/ 235 -7678
FAX 574/ 235 -9928
DEPARTMENT OF ADMINISTRATION AND FINANCE
November 1, 2016
Mr. Tim Scott, President
City of South Bend Common Council
227 W. Jefferson Boulevard, 4th Floor
South Bend, Indiana 46601
RE: Internal Controls Ordinance
Dear President Scott,
F=iled in Clerk's Office
NOV" 2 2016
KAREEMAH FOWLER
CITY CLERK, SOUTH BEND, IN
Indiana Code 5- 11- 1 -27(g) provides that the legislative body must adopt minimum internal control
standards as defined by the State Board of Accounts (SBOA). Additionally, the legislative body must
ensure that personnel receive training concerning the internal control standards and procedures
adopted by the political subdivision. Toward this end, the City Administration has prepared the attached
ordinance and policy with respect to internal controls.
The City Administration has undertaken a number of activities regarding internal controls during this
past year. On May 12, 2016, a total of 17 fiscal officers and staff participated in internal controls webinar
training provided by the SBOA. In addition, on March 30, 2016, eight fiscal officers participated in
internal controls webinar training presented by the Indiana Association of Cities and Towns ([ACT) and
Umbaugh & Associates. The City has a number of good financial policies in place that are available on
the City website. Utilizing some of these financial policies, the City is in the process of developing a
comprehensive procedure for internal controls that will be implemented during the first quarter of
2017.
I will present this bill to the Common Council at the appropriate committee and council meetings. It is
requested that this bill be filed for 1St reading on November 14, 2016 with 2 "d reading, public hearing
and 3`d reading scheduled for November 28, 2016.
Thank you for your attention to this request. If you should have any questions, please feel to contact me
at 574 - 235 -7678.
Regards,
Jo H. Murphy I_
City Controller
Excellence I Accountability I Innovation I Inclusion I Empowerment 0*�
ORDINANCE NO.
AN ORDINANCE OF THE COMMON COUNCIL OF THE CITY OF SOUTH BEND,
INDIANA, ESTABLISHING INTERNAL CONTROL STANDARDS AND
ESTABLISHING A MATERIALITY THRESHOLD.
STATEMENT OF PURPOSE AND INTENT
Indiana Code § 5- 11 -1 -27 requires all Indiana political subdivisions to adopt
minimum levels of internal control standards developed by the State Board of Accounts
as published in the Uniform Internal Control Standards for Indiana Political Subdivisions;
and
The City Controller has reviewed and recommends adoption of the proposed
internal control standards and materiality threshold.
NOW, THEREFORE, BE IT ORDAINED by the Common Council of the City of
South Bend, Indiana, that:
Section I. The City of South Bend, Indiana hereby adopts the Internal Control
Policy attached hereto and incorporated herein as Exhibit A.
Section II. The City Controller is directed to ensure that all personnel receive
training concerning the internal control procedures adopted and approved herein.
Section III. For reporting to the State Board of Accounts, the City of South
Bend, Indiana hereby adopts a materiality threshold of $10,000 for cash and $10,000 for
assets other than cash, for the internal control procedures adopted and approved herein.
All instances of suspected employee theft must be immediately reported to the State
Board of Accounts regardless of the dollar amount. There is no materiality threshold for
theft. Significant variances less than $10,000 will be investigated internally by the staff of
the City of South Bend.
Section IV. This ordinance shall be in full force and effect from and after its
passage by the Common Council and approval of the Mayor.
Member of the Common Council
Attest:
City Clerk
Presented by me to the Mayor of the City of South Bend, Indiana, on the
_ day of , 2016 at o'clock _ . m.
1 St READING
PUBLIC HEARING
3 rd READING
NOT APPROVED
REFERRED
PASSED
Deputy City Clerk
Approved and signed by me on the day of
o'clock . m.
, 2016 at
Mayor, City of South Bend, Indiana
Filed in Clerk's Office
NOV O 2 2016
KAREEMAH FOWLER
CITY CLERK, SOUTH BEND, IN
CITY OF SOUTH BEND, INDIANA
Internal Controls Policy Pursuant to I.C. 5- 11 -1 -27
October 26, 2016
I. Policy
The purpose of this policy is to communicate the Common Council's internal control objectives
to all employees and elected officials of the City of South Bend and to firmly commit the City to
the seventeen (17) key principles of internal controls as established by the Indiana State Board of
Accounts.
COMPONENT ONE: CONTROL ENVIRONMENT
Principle l: The oversight body and management demonstrate a commitment to integrity
and ethical values.
The City has the responsibility to establish and maintain an adequate system of internal control
and to furnish to the South Bend Common Council, various boards and commissions,
governmental agencies, creditors and others reliable financial information on a timely basis. An
adequate system of internal control is necessary for the City to discharge these responsibilities. For
purposes of this policy, the South Bend Common Council is the oversight body and the City
Administration and Finance Department is management.
Controls help ensure that assets are not exposed to unauthorized access and use, transactions are
properly recorded in the financial records, and the resultant financial information is reliable.
External organizations and stakeholders of the City rely on financial information to make decisions
toward appropriations, loans and other debt, grants, and other contractual relationships. City
resources are dependent upon the system of internal control. Auditors are required annually to
report upon the adequacy of the City's systems for control over financial reporting and compliance
per I.C. 5- 11- 1- 27(e). The safeguarding of City assets and the reliability which the City and others
can place upon its financial records is dependent upon the effectiveness of the internal control
process.
As the fiscal body, the Common Council expects the City Administration to effect an internal
control environment with policies and procedures necessary to provide reasonable assurance that
practices cause effective and efficient operations, reliable financial reporting, and compliance with
applicable laws and regulations.
The system of internal control is meant to keep the City on course toward its mission and to
minimize surprises. The system promotes efficiency, m;nimi es risks of asset loss, helps ensure
the reliability of financial information, and compliance with applicable laws, rules, and
regulations.
Internal control is a process; a means to an end, and not an end unto itself. The control environment
is the foundation upon which all components of internal control are based. It sets the tone for City
operations. Internal control is about people, operations, communications, and the work
environment. It is not about policies and forms though it takes shape through the implementation
1
CITY OF SOUTH SEND, INDIANA
of relevant policies, procedures, and practices. Internal control can provide reasonable assurance,
but no system of control can provide absolute assurance to the Common Council and other users
of financial information.
The Finance Department shall be charged with:
• Conveying periodic messages of the City's internal control philosophy and expectations to
all employees;
• Evaluating the City's internal control system for weaknesses on a periodic (but no less
frequently than annual) basis, providing solutions to any discovered weaknesses, and
inform, employees of necessary changes in procedures;
• Working with the Human Resources Department to establish a confidential reporting
system for individuals to report suspected fraud and abuse of internal control policies; and
• Working with the Human Resources Department to institute procedures to address
violations of policies and consequences for violations.
Principle 2: The oversight body oversees the entity's internal control system.
As the fiscal body for the City, the Common Council is responsible for setting the institutional
expectations, for internal control, ensuring management is aware of the those expectations,
requiring the upward communications channels are open through all levels of management, and
evaluating management's effectiveness toward monitoring the control environment and
implementing sound control policies and procedures. As the City's Chief Fiscal Officer, the City
Controller will be the Common Council's chief agent in implementing and managing the internal
control policies and procedures.
Principle 3: Management establishes an organizational structure, assigns responsibility, and
delegates authority to achieve the entity's objectives:
Individuals with delegated approval authority, e.g. Elected Officials and Department Heads are
responsible for establishing, maintaining, and supporting a system of internal controls within their
areas of responsibility and for creating the control environment that encourages compliance with
City policies and procedures.
Adequate supervision is necessary to monitor that internal controls are operating as intended, and
to help ensure the reliability of accounting and operational controls by pointing out errors,
omissions, exceptions, and inconsistencies in procedures. Staff in leadership roles are responsible
for the application of this policy and the design, development, implementation, and maintenance
of systems of internal controls focusing on the effectiveness of operations and the safeguarding of
assets within their respective areas of responsibility. All levels of management and supervision are
responsible for strengthening internal controls when weaknesses are detected. Department
managers should periodically review departmental procedures to ensure that the general principles
of internal control are being followed.
The Finance Department has the primary responsibility for internal control over financial reporting
and compliance with applicable laws, rules, and regulations. The City Controller is the City's chief
Internal Controls Policy Pursuant to I.C. 5- 11 -1 -27 2
CITY OF SOUTH BEND, INDIANA
source for information and assistance to staff and Department Heads on this topic and will make
resources available to assist in administering this policy.
The Human Resources Department is responsible for internal controls over employee recruitment,
hiring, separation, promotion, job classification, employee rights, and salary administration. The
Director of Human Resources (or his or her designee) and Corporation Counsel are the City
sources for information and assistance on this topic and will make resources available to assist in
administering this policy.
All levels of internal control are subject to examination by external auditors who are required to
report on the adequacy of internal controls over finance and compliance.
Department Heads are responsible for prompt corrective action on all internal control findings and
recommendations made by internal and external auditors. The audit process is completed only after
Department Heads receive the audit results and take action to correct internal control weaknesses,
improve systems, or demonstrate that management action is not warranted. Department Heads
have the responsibility to ensure that those who report to them have adequate knowledge, skills,
and abilities to function within, and contribute to, an effective internal control environment. This
includes providing access to appropriate training on topics relevant to their job responsibilities.
Principle 4: Management demonstrates a commitment to recruit, develop, and retain
competent individuals.
The City Employee Handbook provides a roadmap for recruiting and maintaining quality
employees. Prior to employment, individuals may be subject to pre - employment background
screening and/or a credit history check. While employed, City Employees are entitled to a benefits
package including Health Insurance and certain other Post - Employment Benefits. The City will
continue to assess the best recruitment tools for the different skill sets necessary to adequately
implement and maintain quality internal controls.
Job descriptions will be updated where necessary to reflect internal control responsibilities and
duties. Employees will be regularly trained in internal control methods and all training will be
documented in employees' personnel files. Employees will be regularly evaluated by their
supervisors on internal control duties and receive feedback on possible improvements.
Principle 5: Management evaluates performance and holds individuals accountable for their
internal control responsibilities.
Individuals are held accountable for their internal control responsibilities through a recognized
structure which includes relevant job descriptions, operating procedures, periodic reviews, regular
feedback, and a progressive disciplinary policy. Additionally, City Administration seeks to
address issues in specific departments and positions through regular meetings with Department
Heads.
Internal Controls Policy Pursuant to I.C. 5- 11 -1 -27 3
CITY OF SOUTH BEND, INDIANA
COMPONENT TWO: RISK ASSESSMENT
Principle 6: Management defines objectives clearly to enable the identification of risks and
risk tolerances.
Through the creation of standard operating procedures and accurate organizational reporting
charts, management conveys and identifies objectives, missions, policies, and risk tolerances to
employees. The Finance Department will lead a risk analysis of three major areas:
1. The effectiveness and efficiency of operations.
2. The reliability of reporting for internal and external use.
3. Compliance with applicable laws and regulations.
For each category, the Finance Department will define objectives in specific measurable terms in
order to enable the design of internal control for related risk, increase understanding at all levels,
assess performance, identify what is to be achieved, who is to achieve it, how it will be achieved,
when it will be achieved and incorporate external requirements.
Principle 7: Management identifies, analyzes, and responds to risks related to achieving the
defined objectives.
The Finance Department will identify, analyze and respond to the risks identified in Principle 6 by
determining:
1. How likely is the risk to occur?
2. How will it impact the objective?
3. Is the risk based on complex or unusual transactions?
4. Is the risk based on fraud?
Once each risk has been identified and analyzed, the Finance Department will work with
Department Heads to determine how to respond to each risk with a specific solution and action.
Principle 8: Management considers the potential for fraud when identifying, analyzing, and
responding to risks.
Management is committed to fraud prevention by utilizing a "trust but verify" approach. The
potential for fraud, misappropriation, and outright theft are contemplated as controls are designed
for various City divisions. Fraud responses will include statutorily required responses to fraud,
including, but not limited to Ind. Code § 5 -11 -1 -27(1) relating to the Report of Misappropriation
of Funds to State Board of Accounts (SBOA) and Prosecuting Attorney and Ind. Code
§ 5 -11 -1 -270) relating to the Report of Material Variances, Losses, Shortages or Thefts to the
SBOA. For reporting to the SBOA, the City shall utilize a materiality threshold of $10,000 for
cash and $10,000 for assets other than cash. All instances of suspected employee theft must be
immediately reported to the SBOA regardless of the dollar amount. There is no materiality
threshold for employee theft. Significant variances less than $10,000 will be investigated internally
by the staff of the City of South Bend.
Internal Controls Policy Pursuant to I.C. 5- 11 -1 -27 4
CITY OF SOUTH BEND, INDIANA
Principle 9: Management identifies, analyzes, and responds to significant changes that could
impact the internal control system.
The Finance Department, in coordination with Department Heads, will regularly evaluate and
adjust internal control policies in order to accommodate for the impact of future changes, including
but not limited to, personnel changes, newly elected officials, new programs, new technology, new
laws and regulations, and financial fluctuations.
COMPONENT THREE: CONTROL ACTIVITIES
Principle 10: Management designs control activities to achieve objectives and respond to
risks.
The Finance Department will establish and maintain a system of internal controls that satisfies the
City's objectives in the following categories:
1. Risks are identified and effectively managed
2. Safeguarding of City assets
3. Reliability and integrity of financial information
4. Compliance with City policy, plans, procedures, laws and regulations
5. Economical and efficient use of City resources
6. Meeting established objectives and goals for City operations and programs.
A. General internal control principles for Departments are:
1. Segregation of duties
a. Duties are separated so that one person's work routinely serves as a check
on another's work.
b. No one person has complete control over more than one key function or
activity (e.g., authorizing, approving, certifying, disbursing, receiving, or
reconciling).
2. Authorization and approval
a. Proposed transactions are authorized when proper and consistent with City
policy and the department's plans.
b. Transactions are approved by the person who has delegated approval
authority, which is usually delegated on the basis of special competency or
knowledge.
3. Custodial and security arrangements
a. Responsibility for physical security /custody of City assets is separated from
record keeping/accounting for those assets.
b. Unauthorized access to City assets and institutional data is prevented.
Internal Controls Policy Pursuant to I.C. 5- 11 -1 -27 5
CITY OF SOUTH BEND, INDIANA
4. Timely and accurate review and reconciliation
a. Departmental accounting records and documents are examined by
employees who have sufficient understanding of the City accounting and
financial systems to verify that recorded transactions actually took place and
were made in accordance with City policies and procedures.
b. Departmental accounting records and documentation are compared with
City accounting system reports and financial statements to verify their
reasonableness, accuracy, and completeness.
5. The general internal control principles should be applied to all departmental
operations, especially accounting records and reports, payroll,
purchasing /receiving/disbursement approval, equipment and supply inventories,
cash receipts, petty cash and change funds, billing and accounts receivable.
B. All City systems, processes, operations, functions, and activities are subject to evaluations
of internal control systems. The results of these evaluations provide information regarding
the City's overall system of control.
C. Information and communication — Information must be timely and communicated in a
manner that enables people to carry out their responsibilities.
1. All covered employees must be trained on Internal Controls according to Ind. Code
§ 5- 11- 1- 27(g). Covered employees are those employees who handle cash or have
access to assets other than cash that are covered by this policy.
All personnel must receive a clear message from the City's administration that
control responsibilities are to be taken seriously. Failure to comply with established
practices will subject individuals to the terms of disciplinary action or dismissal.
2. Employees must understand their own roles in the internal control system, as well
as how individual activities relate to the work of others. To this end, whenever a
new budgetary unit, financial activity, etc. is set up, the City Controller will provide
notification to the appropriate parties of the responsibilities incumbent on them for
good business practices and sound financial management, including reference to
the principles within this policy.
3. Employees must have a means of communicating significant information to the
City's administration.
4. The City must communicate effectively with external parties, such as auditors,
creditors, contractors, suppliers, regulators and other stakeholders.
D. Internal controls are meant to keep the City focused on achieving its mission while
avoiding surprises. There is a balance between effective controls and mission
accomplishment. Costs associated with internal controls should not exceed their benefit,
nor should controls be allowed to stifle mission effectiveness and timely action. All levels
Internal Controls Policy Pursuant to I.C. 5- 11 -1 -27 6
CITY OF SOUTH BEND, INDIANA
of management must assess the costs, benefits, and risks when designing controls to
develop a positive control environment and compensate for the risks of non - compliance,
loss of assets, or unreliable reporting while accomplishing the City mission.
The following specific internal control policies are adopted for use by City Departments:
Payroll Activities
• Salaries and wage rates are verified by the Human Resources Department.
• The responsibilities for hiring, terminating, and approving promotions are segregated from
those preparing payroll transactions or inputting data.
• The responsibilities for approving time sheets are segregated from those for preparing
payroll transactions or inputting data.
• Employees' time and attendance records are approved by their supervisors.
• Corrections to recorded time and attendance records are approved by the employee and
employee's supervisor.
• Procedures are in place to ensure that changes in employment status are promptly reported
to the payroll processing unit.
• Payroll disbursements are reviewed and approved by an authorized individual prior to
payment.
• Access to payroll applications is appropriately controlled by user logins and passwords.
• Changes to a payroll disbursement are approved by an individual other than the ones
authorized to process the changes.
• Access to the electronic signature used to sign payroll checks is adequately controlled.
• Check stock for printed checks is stored in a secure location.
• Unclaimed payroll checks are returned to Finance Department.
• Employees are cross - trained on the payroll process; those assigned to payroll take regular
vacations.
• The City uses a "positive pay" program with 1 St Source Bank to preauthorize payroll checks
to be honored by the bank and identify fraudulent checks issued by other parties attempting
to use City information.
Disbursement Activities
• The responsibility for approving claims is segregated from those preparing the claims
wherever possible.
• Checks are written by an individual other than the one approving the claim.
• Claims for payment (including trustee escrow payments) are reviewed and approved by the
Board of Public Works, Redevelopment Commission, or other appropriate public body
prior to payment.
• A reconcilement is completed between the claims for payment approved by the board and
the actual disbursements posted to the ledger.
• The responsibility for acknowledging the receipt of goods or services is segregated from
those preparing claims and writing checks.
• Vendor checks are accounted for in numerical order and reconciled to the disbursement
ledger.
• Invoices or other receipts are attached to each claim to support the disbursement.
Internal Controls Policy Pursuant to I.C. 5- 11 -1 -27 7
CITY OF SOUTH BEND, INDIANA
• A review is completed by an individual outside the disbursement process in which the
claim amount is compared to the supporting documentation attached to the claim and the
amount of the check. This review and approval is made at the departmental level.
• Access to disbursement applications is appropriately controlled by user logins and
passwords.
• The City Controller, or his/her designee, will review claims prior to payment.
• The Purchasing Manager, or his /her designee, will review requisitions submitted and
issue all purchase orders.
• With limited exceptions, all disbursements will require a properly approved invoice and a
purchase order prior to payment.
• The City uses a "positive pay" program with 1St Source Bank to preauthorize accounts
payable checks to be honored by the bank and identify fraudulent checks issued by other
parties attempting to use City information.
Receipting Activities
• The responsibility for collecting money and issuing receipts is segregated from those
preparing the bank deposit.
• The responsibility for 'making bank deposits is segregated from those preparing the
monthly bank reconcilement.
• Pre - numbered receipts are issued for all money collected and the receipt is retained with
supporting documentation.
• Receipts are reconciled to the cash receipts ledger by an individual other than the one
collecting money and issuing receipts.
• Posting of receipts to the ledger is completed by an individual other than the one who
collects money and makes the deposit.
• Receipts indicate the type of payment received (cash, check, etc.) and this is reconciled to
the make -up of the bank deposit.
• Accounts receivable records are maintained by an individual other than the one(s) involved
in the billing process.
• The billing process is completed by an individual other than the one who collects cash
payments from customers.
• Customer account adjustments above the $500 materiality threshold, stated in this policy,
are approved by the Board of Public Works only after review.
Cash Activities
• A reconcilement between the recorded cash balance and the bank balance is completed
monthly by an individual separate from the receipting and disbursing processes.
• A reconcilement between the receipts ledger and the credits to the bank account is
completed periodically by an individual separate of the receipting process.
• A reconcilement between the disbursement ledger and the debits to the bank account is
completed periodically by an individual separate of the disbursement process.
• The monthly reconcilement between the cash balance and the bank balance is thoroughly
reviewed and approved by the City Controller or his/her designee.
• Disbursements from and reimbursements to petty cash funds are periodically reviewed by
an individual other than the one responsible for maintaining the petty cash fund.
Internal Controls Policy Pursuant to I.C. 5- 11 -1 -27 8
CITY OF SOUTH BEND, INDIANA
Credit Cards Transactions
• A designated official or employee oversees the issuance and use of the credit cards.
• During the disbursement process, a designated person reviews transactions listed on the
credit card statements for sufficient documentation prior to payment.
Budgeting Activities
• The City Administration will budget all funds and accounts.
• Budget forecasts will be updated annually covering a multi -year time period.
• Budget vs actual reports for revenue and expenditures will be prepared monthly. The City
Finance Department will follow up on significant variations between budget and actual
results.
Information Technology
• The City Innovation & Technology (IT) Department will ensure that all users (employees)
have a unique username.
• The City Human Resources Department will immediately notify the IT Department when
an employee is terminated so that IT can deactivate the user's access to all computer related
applications.
• The IT Department will ensure that an authentication system (i.e. password) is in place so
access to the network and computer related applications is protected and limited to the
appropriate users.
• Users will be required to lock or log off their computer before stepping away from their
computer for an extended period of time.
• Users will be required to log off their accounts when they leave work.
• The IT Department will give a user access only to the specific applications and network
files the user needs to perform his or her job duties.
• The IT Department will monitor access to the network and audit the login for applications,
including the financial software.
Principle 11: Management designs the political subdivision's information system and related
control activities to achieve objectives and respond to risks.
The Finance Department and Department Heads will work with the Innovation and Technology
Department to ensure that information technology is used as an integral part of the internal control
system. This may include, but not be limited to:
• Setting permission such that only certain users may perform certain tasks
• Using technology to accomplish segregation of duties by forcing duties to be completed by
different users
• Automating certain processes and calculations
• Limiting the authority to access different components of various software to employees
with duties specifically related to that component
• Prohibiting user ID and password sharing among employees
• Restricting the authority to correct or make adjustments to records to key employees
• Requiring the use of prescribed forms or the approval of alternative forms
Internal Controls Policy Pursuant to I.C. 5- 11 -1 -27 9
CITY OF SOUTH BEND, INDIANA
Principle 12: Management implements control activities through policies.
The City has an employee handbook that is regularly updated to communicate policies to
employees. Additionally, the Finance Department regularly works with departments and
employees who handle financial transactions to recommend and ensure best practices. All
procedures are in writing and communicated frequently to all relevant employees. Policies are
available both electronically (via the City website) and in hard copy form. In addition, the City
Controller holds regular "Fiscal Officer" meetings where accounting and internal control issues
are discussed.
COMPONENT FOUR: INFORMATION AND COMMUNICATION
Principle 13: Management uses quality information to achieve the political subdivision's
objectives.
The City strives to lead in the areas of financial transparency and accountability. By adopting
standards and investing in systems that exceed State mandated minimums, City management
provides employees and stakeholders with high quality information and informatics systems.
The City Finance Department and Legal Department attend training and. industry seminars to stay
abreast of changes and developments in requirements and communicate that information
effectively to impacted employees. The City Finance Department issues a variety of financial
reports to the Mayor, Common Council and others, to ensure transparency and accountability.
Financial reports are posted on the City's website.
Principle 14: Management internally communicates the necessary quality information to
achieve the political subdivision's objectives.
Internal communications on internal controls are communicated through adoption of formal
policies by relevant boards and commissions and/or the legislative body or documented through
memos from the Finance, Legal or relevant Department Head. Internal memos and reports are
maintained to document communication.
Principle 15: Management externally communicates the necessary quality information to
achieve the entity's objectives.
Communications with the State Board of Accounts, other State agencies, grantor agencies, and
regulatory agencies are documented by email, memos, letters, and other forms of written
correspondence.
All documents are maintained in accordance with the City and state's record retention policies.
Reports and policies are cross checked for accuracy, relevancy, and timeliness of information.
Internal Controls Policy Pursuant to I.C. 5- 11 -1 -27 10
CITY OF SOUTH BEND, INDIANA
COMPONENT FIVE: MONITORING ACTIVITIES
Principle 16: Management establishes and operates monitoring activities to monitor the
internal control system and evaluate the results.
City Administration monitors and evaluates compliance with internal control policies via multiple
methods. Separation of duties, redundancy polices, layered approval systems, monthly reports,
and physical controls allow management to both review and evaluate control systems.
The Finance Department shall implement a system of monitoring that includes:
• Periodic checks to determine if controls are in place and working effectively
• Reviewing control activities to determine if the actual activities are in compliance with
established procedures
Documenting deficiencies in the internal control processes and remediating them quickly
Monitoring activities will be documented by signatures, initials, or other appropriate methods.
Principle 17: Management remediates identified internal control deficiencies on a timely
basis.
Breaches of internal controls are subject to significant levels of internal scrutiny. If informed of a
material breach of internal controls, the Finance Department and effected Department Head will
actively investigate and address said breach and adjust policies and procedures to prevent such
breaches in the future. Once breaches are identified and investigated, a formal or informal
corrective action plan will be developed.
Internal Controls Policy Pursuant to I.C. 5- 11 -1 -27 11
By: Vicki Urbanik, CGFM, CPA, EA
nternal control can greatly
enhance the success of govern-
ment units of any size, whether a
large metropolitan city or a small
rural library district. Local govern-
ment managers who establish a
control environment emphasizing
ethics, regulatory compliance and
high - quality staff performance send
a message to the public that they are
committed to accountability and
transparency. Local government
managers who implement risk assess-
ment procedures define their risk
tolerances, potential for fraud, and
external and internal influences that
could negatively impact accomplish-
ment of their objectives. Those who
require staff segregation of duties,
proper record keeping, administra-
tive oversight in payroll functions and
other control activities improve the
effectiveness and efficiency of their
offices. By enacting controls, local
government units can enhance their
financial management and overall
performance.
Recognizing the importance of
internal control in government,
Indiana state legislators passed
new control requirements affecting
government units statewide. Under
House Enrolled Act 1264, adopted
in 2015, municipalities, county
governments, schools and other
political subdivisions must adopt,
at minimum, the internal control
standards established by the Indiana
State Board of Accounts (SBOA).
Local government units must also
provide training on the standards to
practically all employees who handle
public money, specifically those
whose duties include "receiving,
processing, depositing, disbursing,
or otherwise having access to[public]
funds."' Furthermore, government
fiscal officers must certify compliance
with the internal control require-
ments when they submit their unit's
annual financial report, beginning in
earl . If t ey do not provide such
verification, or if the state auditing
body finds that the internal control
standards have not been adopted,
local government units could ulti-
mately face rejection of their annual
budgets. In short, local government
managers in Indiana must now get
serious about internal control, not
just because state law requires it, but
also because they have a very real
budgetary incentive to do so.
Implementation Challenges
Internal control can greatly
enhance accountability and trans-
parency, but implementing controls
can pose unique challenges for local
government.
For one, local government
managers may lack formal training
in accounting, auditing or other
academic areas that introduce
internal control. Local officials
unfamiliar with controls may feel
the topic is too broad or abstract in
scope to have relevance for their
departments. After all, a city park
superintendent's mission is to run
a park system, a county treasurer's
priority is the collection of local taxes
and a township manager's top objec-
tives include administering aid for
the indigent. These and other officials
at the most local levels of govern-
ment may feel they lack the time or
resources to implement control risk
assessment or monitoring. Even if
top managers enthusiastically adopt
internal controls, training their
employees could be quite a different
story. Office employees might recall
accounting scandals like Enron and
Tyco, but it's much more unreal-
istic to expect the rank-and-file in
local government to be versed in
the five control components or key
documents such as COSO's Internal
Control — An Integrated Framework or
the U.S. Government Accountability
Office's Standards for Internal Control
in the Federal Government. Training
DO Local government
managers in Indiana must
now get serious about
internal control, not just
because state law requires
it, but also because they
have a very real budgetary
incentive to do so.
staff on internal control standards.
can prove frustrating for managers
struggling with subpar employees
or long -time employees resistant to
change.
Demystifying Internal Control
Local government managers can
overcome the challenges of training a
staff unfamiliar with internal control
by introducing the topic in small,
but meaningful phases. That is the
approach being taken this year in
the county auditor's office in Porter
County, Indiana s ninth largest county
(population, 167,000), located in the
northwestern corner of the state. In
Indiana, county auditor offices are
often thought of as one of the busiest
in county government with responsi-
bilities that include county financial
reporting and property tax adminis-
tration. If any county office is in need
of a sound internal control system, it
is arguably a county auditor's office.
The Porter County Auditor's Office
early on embraced Indiana's new
internal control requirements, in
part because prior state audits found
material control weaknesses in finan-
cial reporting, payroll and grants
administration. The need for effective
FALL 2016 JOURNAL OF GOVERNMENT FINANCIAL MANAGEMENT 21
Figure 1. Internal Control: A Brief Timeline
controls was clear; the challenge,
however, was the introduction and
implementation of new controls in a
small but very busy office, in which
most employees were
unfamiliar with ,
control concepts. =z
Training began
at monthly staff
meetings, with
internal control
topics introduced
in small segments.
Initially, training
focused on the defi-
nition of internal
control as stated in
the Uniform Internal
Control Standards
for Indiana Political
Subdivisions, a docu-
ment prepared by
the SBOA following
adoption of the
2015 state law. The
SBOA's standards
emphasize the role — that employees play
in controls: "Ultimately, it is the
people at every level of the orga-
nization that are instrumental in
ensuring the success of the internal
control process. Accordingly, internal
controls integrate the attitudes and
actions of people within the orga-
nization into the processes .112 The
county auditor's office emphasized
that even though management has
profound responsibilities in internal
control, staff involvement is crucial.
By emphasizing that internal control
is not a set of rigid
rules but a process
that needs a buy -in
from staff to make
it work, employees
were given owner-
ship of this impor-
tant endeavor. It
makes little sense
for management to
adopt policies that
staff find unwork-
able. Employees
need to know that
their input is valu-
able and that for
controls to be effec-
tive, "we are all in
this together."
Early training
efforts in the county
- - - auditor's office also
introduced staff to
key developments in the regulatory
history of controls, as illustrated in
Figure 1. Staff discussions explored
the accounting scandals that led
to the Sarbanes -Oxley Act and the
internal control audit requirements
that resulted. By tying events that
had national significance to their
It makes little
sense for management
to adopt policies that
staff find unworkable.
Employees need to
know that their input
is valuable and that for
controls to be effective.
we are all
in this together!
daily workplace, the local auditor
staff gained a deeper understanding
of the need for, and benefits of,
internal control. Employees were
also introduced to the GAO's "Green
Book;' including the GAO's efforts
to make the federal standards appli-
cable to state and local governments .3
While internal control concepts
were presented to the auditor staff
in a concise, summary manner, the
topic wasn't dumbed down, either.
Employees were treated as profes-
sionals who were expected to help
make a significant contribution
toward the effective and efficient
operation of their office.
Implementation Challenges
Getting employees to understand
what internal control is, -and what it
isn't, is one matter. Actually imple-
menting controls is another. To intro-
duce the five control - components,
employees in-the- county- and -itor
office learned -about the- control
cube, as pictured in Figure -2, which
gives a visual representation of how
the components interrelate with
each other, with the entity's orga-
nizational structure, and with the
reporting, compliance and opera-
tions objectives. Discussion topics
included an analysis of how most of
us implement controls in our daily
22 JOURNAL OF GOVERNMENT FINANCIAL MANAGEMENT FALL 2016
lives. The simple act of locking our
doors at night or taking our vehicles
for routine oil changes are control
activities intended to achieve objec-
tives of keeping our home safe and
our cars in good order. Given that
most employees in the county audi-
tor's office are also parents, one
training exercise applied an internal
control thought process to an objec-
tive that parents have: Keeping their
children healthy. The environment
most parents have established in their
household incorporates personal
responsibility for one's well- being.
Parents assess the risk that their chil-
dren might get cavities, due to their
proclivity to like sweets and their
unwillingness to brush and floss as
often as their parents want them to.
To minimize this risk, parents take
their children to the dentist every
six months, even if nothing is wrong
with their teeth. Parents seek reli-
able information when choosing their
dentist or the treatment plans recom-
mended. And" parents monitor their
children's dental health; if repeated
cavities occur, parents might imple-
ment new activities, such as giving
their children incentives to brush and
floss more regularly.
By understanding how internal
control systems have relevance to
our daily lives, employees should be
more apt to recognize the need for
enhanced controls at the workplace.
Once employees are comfortable
with the definition and components
of internal control, they can then be
introduced to the 17 principles that
represent the requirements for an
effective control system.4 Staff can
then integrate these principles in their
daily responsibilities. For example,
one function in a county auditor's
office is to process payroll. The objec-
tive is clear: No employee should be
paid more or less than their approved
salary, and tax withholdings and
benefit deductions must be correct.
But what is the risk that this objective
will not be met? For some counties,
the risk of payroll errors might be
attributed to archaic or faulty payroll
software programs or to a lack of
available payroll staff. To minimize
this risk, staff can be cross - trained in
Analysts estimate the world's data will grow 50 fold
in the next five years. Federal government agencies
already produce and house massive amounts of data,
collected from a variety of sources. Most of this data is
unstructured, and deemed too large or raw for analysis.
Many federal agencies struggle with successfully
mining data out of separate systems to capture
processes and search for anomalies to understand
where internal controls are absent or weak.
We Partner with Industry Leaders to Implement
Innovative Continuous Monitoring Software
' A Service Disabled Veteran -Owned Business
Source: blog.aicpa.org /2012 /01 /internal-
co nt ro I -i me g rated - framework -20- years -I ate r.
htm1#sthashAXBB8Kt4.dpbs
payroll processing, and a non - payroll
employee could be assigned to cross
check payroll reports with the pay
levels set i.;i the annual salary ordi-
nance. Department heads could be
required to sign off on their employee
pay prior to the issuance of paychecks,
AOC Solutions brings a cadre of experienced federal
financial professionals who have successfully assisted
federal agencies in tackling "Big Data" challenges.
AOC is partnering with industry leaders to bring
Continuous Monitoring suites of applications to
federal Agencies in line with OMB's call for innovative
methods to identify, prevent, detect, and correct
erroneous and improper transactions.
With our Continuous Monitoring and data mining
solutions and our extensive experience in the design
and implementation of data, process and system
reviews, AOC Solutions can help Agencies gain traction
in leveraging their data for success.
�e
AOC
703.234.6300 1 www.aocsolutions.com
EXCELLENCE WITHOUT EXCEPTION
FALL 2016 JOURNAL OF GOVERNMENT FINANCIAL MANAGEMENT 23
Y
and a tracking system could be imple-
mented to keep tabs on which depart-
ment managers consistently meet this
responsibility. Communication with
department heads should', stress the
importance of administrative review
of timecards. The payroll process
should be monitored closely, with
adjustments enacted
immediately and a
strategy developed
to help prevent
the mistakes from
recurring.
Preparation of an
easy -to -read and readily
accessible document
on internal control
is also important,
since the document
can give employees
and management a
clear outline of their
responsibilities. In
Indiana, local govern-
ment units can comply
with the new internal
control requirements
by adopting the SBOA's
minimum standards, which encom-
pass both COSO's framework and the
GAO's Green Book. Local govern-
ment may also adopt other standards
or procedures tailor -made for their
own needs. The approach taken in
the Porter County Auditor's Office
has been to develop its own internal
control procedures
to augment the
standards adopted
i at the countywide
3 level. The func-
tions unique to the
auditor's office in
need of enhanced
controls were iden-
tified, and controls
i were developed for
each. At staff meet-
ings, employees
discuss the objec-
tives of each office
function and iden-
tify the threats
they feel could
impede the accom-
plishment of those
objectives. The
By understanding
how internal control
systems have
relevance to our daily f
lives, employees
should be more apt
to recognize the need
for enhanced controls
at the workplace
open discussion is important not just
to achieve staff acceptance of new or
enhanced controls, but also to help
employees understand the challenges
faced by their colleagues who may
have different job duties than their
own.
One component of internal control
that may be particularly helpful
in gaining staff acceptance is the
control environment, as explained in
Figure 3. By documenting in writing
a commitment to ethics, account-
ability and transparency, manage-
ment makes it clear what is expected
of staff. However, this expectation
works both ways. It is up to manage-
ment to set a responsible "tone at the
top." Employees who do not perceive
their managers as being engaged or
responsible may not feel they must
provide outstanding work. On the
other hand, managers who lead by
example provide the foundation
necessary for an effective internal
control system.
Local government managers who
emphasize to their employees that
internal control is an objective- driven
24 JOURNAL OF GOVERNMENT FINANCIAL MANAGEMENT FALL 2016
process that is ongoing and adaptable
may also gain greater staff involve-
ment. Control activities that aren't
working can be replaced or modi-
fied, and those that are functioning
well can be improved. If employees
are invited to play a role in continu-
ally improving office functions, they
may be more inclined' to share their
suggestions and take ownership in
their work product. Obtaining such
a buy -in from employees is a key
ingredient for an effective internal
control system.
Summary
Indianas law requiring adoption
of internal control standards in local
government is being implemented
for the first time this year. City coun-
cils, school boards, county commis-
sioners and other governing bodies
throughout Indiana must adopt
internal control standards identifying
their responsibilities over the control
environment; risk assessment; control
activities; information and communi-
cation; and monitoring. Local offi-
cials must adopt the minimum state
standards but may also implement
additional procedures they deem
necessary for a control system to suit
their needs. Employees who handle
public funds must undergo training
on the new standards by the end of
the year, and fiscal officers in each
unit must certify that training has
occurred. Government managers
and employees who previously
were unfamiliar with the concept of
internal control are now gaining the
knowledge necessary to implement
controls to help achieve their objec-
tives. Indiana's new requirement is
based in the principle that by demon-
strating a commitment to internal
control, managers and employees
at all levels of local government can
achieve greater accountability, trans-
parency and effectiveness on behalf
of the taxpayers they serve.
Already Achieved Your
DOD-fM Certification?
Let Management Concepts
help you maintain it.
We offer more than 100 courses aligned by the DoD, Office
of the Under Secretary of Comptroller, to the DoD approved
Financial Management and Leadership competencies.
www.ManagementConcepts.com /DoD
Haven't achieved your Certification yet?
FM Connect Use our free online tool, FM Connect, to determine
�- the courses you need to get certified.
www. ManagementConcepts .comlFMConnect
Endnotes
1. Indiana State Board of Accounts (2015).
Uniform Internal Control Standards for Indiana
Political Subdivisions, page 4.
2. Ibid. p. 1.
3. U.S. Government Accountability Office
(2014). Standards forInternal Control in the
Federal Government, p. 20.
4. Ibid. p. 8.
Vicki Urbanik,
CGFM, CPA, EA,
began her term as
Auditor of Porter
County, Ind. in
January 2015.
Prior to workingfor
county government,
she was a journalist
who reported extensively on local
government finance.
t
FALL 2016 JOURNAL OF GOVERNMENT FINANCIAL MANAGEMENT 25