Loading...
HomeMy WebLinkAboutEstablishing Internal Control Standards and Establishing a Materiality ThresholdORDINANCE No. 10482 -16 Passed by the Common Council of the City of South Bend, Indiana r 28, 20 16 Attest: Attest: Presented by me to the Mayor of the City of South Bend, Indiana November 28, 20 16 Approved and signed by me Deumh e - Cg 20 I lQ City Clerk President of Common Council City Clerk Mayor Substitute ORDINANCE NO. AN ORDINANCE OF THE COMMON COUNCIL OF THE CITY OF SOUTH BEND, INDIANA, ESTABLISHING INTERNAL CONTROL STANDARDS AND ESTABLISHING A MATERIALITY THRESHOLD. STATEMENT OF PURPOSE AND INTENT Indiana Code § 5- 11 -1 -27 requires all Indiana political subdivisions to adopt minimum levels of internal control standards developed by the State Board of Accounts as published in the Uniform Internal Control Standards for Indiana Political Subdivisions; and The City Controller has reviewed and recommends adoption of the proposed internal control standards and materiality threshold. NOW, THEREFORE, BE IT ORDAINED by the Common Council of the City of South Bend, Indiana, that: Section I. The City of South Bend, Indiana hereby adopts the Internal Control Policy attached hereto and incorporated herein as Exhibit A. Section II. The City Controller is directed to ensure that all personnel receive training concerning the internal control procedures adopted and approved herein. Section III. For reporting to the State Board of Accounts and the City of South Bend Common Council, the City of South Bend, Indiana hereby adopts a materiality threshold of $10,000 for cash and $10,000 for assets other than cash, for the internal control procedures adopted and approved herein. All instances of suspected employee theft must be immediately reported to the State Board of Accounts and the City of South Bend Common Council regardless of the dollar amount. There is no materiality threshold for theft. Significant variances less than $10,000 will be investigated internally by the staff of the City of South Bend. Section IV. This ordinance shall be i d effect from and after its passage by the Common Council and approval o e Mayor. Member of the Common Council Attest: City Cle Presented by me to the Mayor of the City of South Bend, Indiana, on the 2&— day of Of � 6&% , 2016 at 61: 05 o'clock t45.. m. Substitute 0 Dept &Y vcry Approved and signed by me on the day of kOO- ►' ILM , 2016 at 00 o'clock* m. __ '4�6� Mayor ity of th Bend, Indiana 1st READING 11- 14-1 o PUBLIC HEARING 1- J t -1 Le 3 rd READING 11 2S - I IV NOT APPROVED REFERRED 11-14-ILO PASSED 11 -2e -Ito 04: 29 PM Filed in Clerk's Office :E2 20 66 KAREEMtAH FOWLER CfTYCLERK, SOUTH BEND, IN CITY OF SOUTH BEND, INDIANA Internal Controls Policy Pursuant to I.C. 5- 11 -1 -27 October 26, 2016 I. Policy The purpose of this policy is to communicate the Common Council's internal control objectives to all employees and elected officials of the City of South Bend and to firmly commit the City to the seventeen (17) key principles of internal controls as established by the Indiana State Board of Accounts. COMPONENT ONE: CONTROL ENVIRONMENT Principle 1: The oversight body and management demonstrate a commitment to integrity and ethical values. The City has the responsibility to establish and maintain an adequate system of internal control and to furnish to the South Bend Common Council, various boards and commissions, governmental agencies, creditors and others reliable financial information on a timely basis. An adequate system of internal control is necessary for the City to discharge these responsibilities. For purposes of this policy, the South Bend Common Council is the oversight body and the City Administration and Finance Department is management. Controls help ensure that assets are not exposed to unauthorized access and use, transactions are properly recorded in the financial records, and the resultant financial information is reliable. External organizations and stakeholders of the City rely on financial information to make decisions toward appropriations, loans and other debt, grants, and other contractual relationships. City resources are dependent upon the system of internal control. Auditors are required annually to report upon the adequacy of the City's systems for control over financial reporting and compliance per I.C. 5- 11- 1- 27(e). The safeguarding of City assets and the reliability which the City and others can place upon its financial records is dependent upon the effectiveness of the internal control process. As the fiscal body, the Common Council expects the City Administration to effect an internal control environment with policies and procedures necessary to provide reasonable assurance that practices cause effective and efficient operations, reliable financial reporting, and compliance with applicable laws and regulations. The system of internal control is meant to keep the City on course toward its mission and to minimize surprises. The system promotes efficiency, minimizes risks of asset loss, helps ensure the reliability of financial information, and compliance with applicable laws, rules, and regulations. Internal control is a process; a means to an end, and not an end unto itself. The control environment is the foundation upon which all components of internal control are based. It sets the tone for City operations. Internal control is about people, operations, communications, and the work environment. It is not about policies and forms though it takes shape through the implementation 1 CITY OF SOUTH BEND, INDIANA of relevant policies, procedures, and practices. Internal control can provide reasonable assurance, but no system of control can provide absolute assurance to the Common Council and other users of financial information. The Finance Department shall be charged with: • Conveying periodic messages of the City's internal control philosophy and expectations to all employees; • Evaluating the City's internal control system for weaknesses on a periodic (but no less frequently than annual) basis, providing solutions to any discovered weaknesses, and inform employees of necessary changes in procedures; • Working with the Human Resources Department to establish a confidential reporting system for individuals to report suspected fraud and abuse of internal control policies; and • Working with the Human Resources Department to institute procedures to address violations of policies and consequences for violations. Principle 2: The oversight body oversees the entity's internal control system As the fiscal body for the City, the Common Council is responsible for setting the institutional expectations for internal control, ensuring management is aware of the those expectations, requiring the upward communications channels are open through all levels of management, and evaluating management's effectiveness toward monitoring the control environment and implementing sound control policies and procedures. As the City's Chief Fiscal Officer, the City Controller will be the Common Council's chief agent in implementing and managing the internal control policies and procedures. Principle 3: Management establishes an organizational structure, assigns responsibility, and delegates authority to achieve the entity's objectives. Individuals with delegated approval authority, e.g. Elected Officials and Department Heads are responsible for establishing, maintaining, and supporting a system of internal controls within their areas of responsibility and for creating the control environment that encourages compliance with City policies and procedures. Adequate supervision is necessary to monitor that internal controls are operating as intended, and to help ensure the reliability of accounting and operational controls by pointing out errors, omissions, exceptions, and inconsistencies in procedures. Staff in leadership roles are responsible for the application of this policy and the design, development, implementation, and maintenance of systems of internal controls focusing on the effectiveness of operations and the safeguarding of assets within their respective areas of responsibility. All levels of management and supervision are responsible for strengthening internal controls when weaknesses are detected. Department managers should periodically review departmental procedures to ensure that the general principles of internal control are being followed. The Finance Department has the primary responsibility for internal control over financial reporting and compliance with applicable laws, rules, and regulations. The City Controller is the City's chief Internal Controls Policy Pursuant to I.C. 5- 11 -1 -27 2 CITY OF SOUTH BEND, INDIANA source for information and assistance to staff and Department Heads on this topic and will make resources available to assist in administering this policy. The Human Resources Department is responsible for internal controls over employee recruitment, hiring, separation, promotion, job classification, employee rights, and salary administration. The Director of Human Resources (or his or her designee) and Corporation Counsel are the City sources for information and assistance on this topic and will make resources available to assist in administering this policy. All levels of internal control are subject to examination by external auditors who are required to report on the adequacy of internal controls over finance and compliance. Department Heads are responsible for prompt corrective action on all internal control findings and recommendations made by internal and external auditors. The audit process is completed only after Department Heads receive the audit results and take action to correct internal control weaknesses, improve systems, or demonstrate that management action is not warranted. Department Heads have the responsibility to ensure that those who report to them have adequate knowledge, skills, and abilities to function within, and contribute to, an effective internal control environment. This includes providing access to appropriate training on topics relevant to their job responsibilities. Principle 4: Management demonstrates a commitment to recruit, develop, and retain competent individuals. The City Employee Handbook provides a roadmap for recruiting and maintaining quality employees. Prior to employment, individuals may be subject to pre - employment background screening and/or a credit history check. While employed, City Employees are entitled to a benefits package including Health Insurance and certain other Post - Employment Benefits. The City will continue to assess the best recruitment tools for the different skill sets necessary to adequately implement and maintain quality internal controls. Job descriptions will be updated where necessary to reflect internal control responsibilities and duties. Employees will be regularly trained in internal control methods and all training will be documented in employees' personnel files. Employees will be regularly evaluated by their supervisors on internal control duties and receive feedback on possible improvements. Principle 5: Management evaluates performance and holds individuals accountable for their internal control responsibilities. Individuals are held accountable for their internal control responsibilities through a recognized structure which includes relevant job descriptions, operating procedures, periodic reviews, regular feedback, and a progressive disciplinary policy. Additionally, City Administration seeks to address issues in specific departments and positions through regular meetings with Department Heads. Internal Controls Policy Pursuant to I.C. 5- 11 -1 -27 3 CITY OF SOUTH BEND, INDIANA COMPONENT TWO: RISK ASSESSMENT Principle 6: Management defines objectives clearly to enable the identification of risks and risk tolerances. Through the creation of standard operating procedures and accurate organizational reporting charts, management conveys and identifies objectives, missions, policies, and risk tolerances to employees. The Finance Department will lead a risk analysis of three major areas: 1. The effectiveness and efficiency of operations. 2. The reliability of reporting for internal and external use. 3. Compliance with applicable laws and regulations. For each category, the Finance Department will define objectives in specific measurable terms in order to enable the design of internal control for related risk, increase understanding at all levels, assess performance, identify what is to be achieved, who is to achieve it, how it will be achieved, when it will be achieved and incorporate external requirements. Principle 7: Management identifies, analyzes, and responds to risks related to achieving the defined objectives. The Finance Department will identify, analyze and respond to the risks identified in Principle 6 by determining: 1. How likely is the risk to occur? 2. How will it impact the objective? 3. Is the risk based on complex or unusual transactions? 4. Is the risk based on fraud? Once each risk has been identified and analyzed, the Finance Department will work with Department Heads to determine how to respond to each risk with a specific solution and action. Principle 8: Management considers the potential for fraud when identifying, analyzing, and responding to risks. Management is committed to fraud prevention by utilizing a "trust but verify" approach. The potential for fraud, misappropriation, and outright theft are contemplated as controls are designed for various City divisions. Fraud responses will include statutorily required responses to fraud, including, but not limited to Ind. Code § 5 -11 -1 -27(1) relating to the Report of Misappropriation of Funds to State Board of Accounts (SBOA) and Prosecuting Attorney and Ind. Code § 5 -11 -1 -270) relating to the Report of Material Variances, Losses, Shortages or Thefts to the SBOA. For reporting to the State Board of Accounts and the City of South Bend Common Council, the City shall utilize a materiality threshold of $10,000 for cash and $10,000 for assets other than cash. All instances of suspected employee theft must be immediately reported to the State Board of Accounts and the City of South Bend Common Council regardless of the dollar amount. There is no materiality threshold for employee theft. Significant variances less than $10,000 will be investigated internally by the staff of the City of South Bend. Internal Controls Policy Pursuant to I.C. 5- 11 -1 -27 4 CITY OF SOUTH BEND, INDIANA Principle 9: Management identifies, analyzes, and responds to significant changes that could impact the internal control system. The Finance Department, in coordination with Department Heads, will regularly evaluate and adjust internal control policies in order to accommodate for the impact of future changes, including but not limited to, personnel changes, newly elected officials, new programs, new technology, new laws and regulations, and financial fluctuations. COMPONENT THREE: CONTROL ACTIVITIES Principle 10: Management designs control activities to achieve objectives and respond to risks. The Finance Department will establish and maintain a system of internal controls that satisfies the City's objectives in the following categories: 1. Risks are identified and effectively managed 2. Safeguarding of City assets 3. Reliability and integrity of financial information 4. Compliance with City policy, plans, procedures, laws and regulations 5. Economical and efficient use of City resources 6. Meeting established objectives and goals for City operations and programs. A. General internal control principles for Departments are: Segregation of duties a. Duties are separated so that one person's work routinely serves as a check on another's work. b. No one person has complete control over more than one key function or activity (e.g., authorizing, approving, certifying, disbursing, receiving, or reconciling). 2. Authorization and approval a. Proposed transactions are authorized when proper and consistent with City policy and the department's plans. b. Transactions are approved by the person who has delegated approval authority, which is usually delegated on the basis of special competency or knowledge. 3. Custodial and security arrangements a. Responsibility for physical security /custody of City assets is separated from record keeping/accounting for those assets. b. Unauthorized access to City assets and institutional data is prevented. Internal Controls Policy Pursuant to I.C. 5- 11 -1 -27 CITY OF SOUTH BEND, INDIANA 4. Timely and accurate review and reconciliation a. Departmental accounting records and documents are examined by employees who have sufficient understanding of the City accounting and financial systems to verify that recorded transactions actually took place and were made in accordance with City policies and procedures. b. Departmental accounting records and documentation are compared with City accounting system reports and financial statements to verify their reasonableness, accuracy, and completeness. 5. The general internal control principles should be applied to all departmental operations, especially accounting records and reports, payroll, purchasing /receiving /disbursement approval, equipment and supply inventories, cash receipts, petty cash and change funds, billing and accounts receivable. B. All City systems, processes, operations, functions, and activities are subject to evaluations of internal control systems. The results of these evaluations provide information regarding the City's overall system of control. C. Information and communication — Information must be timely and communicated in a manner that enables people to carry out their responsibilities. 1. All covered employees must be trained on Internal Controls according to Ind. Code § 5- 11- 1- 27(g). Covered employees are those employees who handle cash or have access to assets other than cash that are covered by this policy. All personnel must receive a clear message from the City's administration that control responsibilities are to be taken seriously. Failure to comply with established practices will subject individuals to the terms of disciplinary action or dismissal. 2. Employees must understand their own roles in the internal control system, as well as how individual activities relate to the work of others. To this end, whenever a new budgetary unit, financial activity, etc. is set up, the City Controller will provide notification to the appropriate parties of the responsibilities incumbent on them for good business practices and sound financial management, including reference to the principles within this policy. 3. Employees must have a means of communicating significant information to the City's administration. 4. The City must communicate effectively with external parties, such as auditors, creditors, contractors, suppliers, regulators and other stakeholders. D. Internal controls are meant to keep the City focused on achieving its mission while avoiding surprises. There is a balance between effective controls and mission accomplishment. Costs associated with internal controls should not exceed their benefit, Internal Controls Policy Pursuant to I.C. 5- 11 -1 -27 6 CITY OF SOUTH BEND, INDIANA nor should controls be allowed to stifle mission effectiveness and timely action. All levels of management must assess the costs, benefits, and risks when designing controls to develop a positive control environment and compensate for the risks of non - compliance, loss of assets, or unreliable reporting while accomplishing the City mission. The following specific internal control policies are adopted for use by City Departments: Payroll Activities • Salaries and wage rates are verified by the Human Resources Department. • The responsibilities for hiring, terminating, and approving promotions are segregated from those preparing payroll transactions or inputting data. • The responsibilities for approving time sheets are segregated from those for preparing payroll transactions or inputting data. • Employees' time and attendance records are approved by their supervisors. • Corrections to recorded time and attendance records are approved by the employee and employee's supervisor. • Procedures are in place to ensure that changes in employment status are promptly reported to the payroll processing unit. • Payroll disbursements are reviewed and approved by an authorized individual mior to payment. • Access to payroll applications is appropriately controlled by user logins and passwords. • Changes to a payroll disbursement are approved by an individual other than the ones authorized to process the changes. • Access to the electronic signature used to sign payroll checks is adequately controlled. • Check stock for printed checks is stored in a secure location. • Unclaimed payroll checks are returned to Finance Department. • Employees are cross - trained on the payroll process; those assigned to payroll take regular vacations. • The City uses a "positive pay" program with 1st Source Bank to preauthorize payroll checks to be honored by the bank and identify fraudulent checks issued by other parties attempting to use City information. Disbursement Activities • The responsibility for approving claims is segregated from those preparing the claims wherever possible. • Checks are written by an individual other than the one approving the claim. • Claims for payment (including trustee escrow payments) are reviewed and approved by the Board of Public Works, Redevelopment Commission, or other appropriate public body prior to payment. • A reconcilement is completed between the claims for payment approved by the board and the actual disbursements posted to the ledger. • The responsibility for acknowledging the receipt of goods or services is segregated from those preparing claims and writing checks. • Vendor checks are accounted for in numerical order and reconciled to the disbursement ledger. • Invoices or other receipts are attached to each claim to support the disbursement. Internal Controls Policy Pursuant to I.C. 5- 11 -1 -27 7 CITY OF SOUTH BEND, INDIANA • A review is completed by an individual outside the disbursement process in which the claim amount is compared to the supporting documentation attached to the claim and the amount of the check. This review and approval is made at the departmental level. • Access to disbursement applications is appropriately controlled by user login and passwords. • The City Controller, or his/her designee, will review claims prior to payment. • The Purchasing Manager, or his /her designee, will review requisitions submitted and issue all purchase orders. • With limited exceptions, all disbursements will require a properly approved invoice and a purchase order prior to payment. • The City uses a "positive pay" program with 1St Source Bank to preauthorize accounts payable checks to be honored by the bank and identify fraudulent checks issued by other parties attempting to use City information. Receipting Activities • The responsibility for collecting money and issuing receipts is segregated from those preparing the bank deposit. • The responsibility for making bank deposits is segregated from those preparing the monthly bank reconcilement. • Pre - numbered receipts are issued for all money collected and the receipt is retained with supporting documentation. • Receipts are reconciled to the cash receipts ledger by an individual other than the one collecting money and issuing receipts. • Posting of receipts to the ledger is completed by an individual other than the one who collects money and makes the deposit. • Receipts indicate the type of payment received (cash, check, etc.) and this is reconciled to the make -up of the bank deposit. • Accounts receivable records are maintained by an individual other than the one(s) involved in the billing process. • The billing process is completed by an individual other than the one who collects cash payments from customers. • Customer account adjustments above the $500 materiality threshold, stated in this policy, are approved by the Board of Public Works only after review. Cash Activities • A reconcilement between the recorded cash balance and the bank balance is completed monthly by an individual separate from the receipting and disbursing processes. • A reconcilement between the receipts ledger and the credits to the bank account is completed periodically by an individual separate of the receipting process. • A reconcilement between the disbursement ledger and the debits to the bank account is completed periodically by an individual separate of the disbursement process. • The monthly reconcilement between the cash balance and the bank balance is thoroughly reviewed and approved by the City Controller or his/her designee. • Disbursements from and reimbursements to petty cash funds are periodically reviewed by an individual other than the one responsible for maintaining the petty cash fund. Internal Controls Policy Pursuant to I.C. 5- 11 -1 -27 CITY OF SOUTH BEND, INDIANA Credit Cards Transactions • A designated official or employee oversees the issuance and use of the credit cards. • During the disbursement process, a designated person reviews transactions listed on the credit card statements for sufficient documentation prior to payment. Budgeting Activities • The City Administration will budget all funds and accounts. • Budget forecasts will be updated annually covering a multi -year time period. • Budget vs actual reports for revenue and expenditures will be prepared monthly. The City Finance Department will follow up on significant variations between budget and actual results. Information Technology • The City Innovation & Technology (IT) Department will ensure that all users (employees) have a unique username. • The City Human Resources Department will immediately notify the IT Department when an employee is terminated so that IT can deactivate the user's access to all computer related applications. • The IT Department will ensure that an authentication system (i.e. password) is in place so access to the network and computer related applications is protected and limited to the appropriate users. • Users will be required to lock or log off their computer before stepping away from their computer for an extended period of time. • Users will be required to log off their accounts when they leave work. • The IT Department will give a user access only to the specific applications and network files the user needs to perform his or her job duties. • The IT Department will monitor access to the network and audit the logins for applications, including the financial software. Principle 11: Management designs the political subdivision's information system and related control activities to achieve objectives and respond to risks. The Finance Department and Department Heads will work with the Innovation and Technology Department to ensure that information technology is used as an integral part of the internal control system. This may include, but not be limited to: • Setting permission such that only certain users may perform certain tasks • Using technology to accomplish segregation of duties by forcing duties to be completed by different users • Automating certain processes and calculations • Limiting the authority to access different components of various software to employees with duties specifically related to that component • Prohibiting user ID and password sharing among employees • Restricting the authority to correct or make adjustments to records to key employees • Requiring the use of prescribed forms or the approval of alternative forms Internal Controls Policy Pursuant to I.C. 5- 11 -1 -27 CITY OF SOUTH BEND, INDIANA Principle 12: Management implements control activities through policies. The City has an employee handbook that is regularly updated to communicate policies to employees. Additionally, the Finance Department regularly works with departments and employees who handle financial transactions to recommend and ensure best practices. All procedures are in writing and communicated frequently to all relevant employees. Policies are available both electronically (via the City website) and in hard copy form. In addition, the City Controller holds regular "Fiscal Officer" meetings where accounting and internal control issues are discussed. COMPONENT FOUR: INFORMATION AND COMMUNICATION Principle 13: Management uses quality information to achieve the political subdivision's objectives. The City strives to lead in the areas of financial transparency and accountability. By adopting standards and investing in systems that exceed State mandated minimums, City management provides employees and stakeholders with high quality information and informatics systems. The City Finance Department and Legal Department attend training and industry seminars to stay abreast of changes and developments in requirements and communicate that information effectively to impacted employees. The City Finance Department issues a variety of financial reports to the Mayor, Common Council and others, to ensure transparency and accountability. Financial reports are posted on the City's website. Principle 14: Management internally communicates the necessary quality information to achieve the political subdivision's objectives. Internal communications on internal controls are communicated through adoption of formal policies by relevant boards and commissions and/or the legislative body or documented through memos from the Finance, Legal or relevant Department Head. Internal memos and reports are maintained to document communication. Principle 15: Management externally communicates the necessary quality information to achieve the entity's objectives. Communications with the State Board of Accounts, other State agencies, grantor agencies, and regulatory agencies are documented by email, memos, letters, and other forms of written correspondence. All documents are maintained in accordance with the City and state's record retention policies. Reports and policies are cross checked for accuracy, relevancy, and timeliness of information. Internal Controls Policy Pursuant to I.C. 5- 11 -1 -27 10 CITY OF SOUTH BEND, INDIANA COMPONENT FIVE: MONITORING ACTIVITIES Principle 16: Management establishes and operates monitoring activities to monitor the internal control system and evaluate the results. City Administration monitors and evaluates compliance with internal control policies via multiple methods. Separation of duties, redundancy polices, layered approval systems, monthly reports, and physical controls allow management to both review and evaluate control systems. The Finance Department shall implement a system of monitoring that includes: • Periodic checks to determine if controls are in place and working effectively • Reviewing control activities to determine if the actual activities are in compliance with established procedures • Documenting deficiencies in the internal control processes and remediating them quickly Monitoring activities will be documented by signatures, initials, or other appropriate methods. Principle 17: Management remediates identified internal control deficiencies on a timely basis. Breaches of internal controls are subject to significant levels of internal scrutiny. If informed of a material breach of internal controls, the Finance Department and effected Department Head will actively investigate and address said breach and adjust policies and procedures to prevent such breaches in the future. Once breaches are identified and investigated, a formal or informal corrective action plan will be developed. Internal Controls Policy Pursuant to I.C. 5- 11 -1 -27 11 120ON COUNTY -CITY BUILDING 227 W. JEFFERSON BLVD. SOUTH BEND, INDIANA 46601 -1830 CITY OF SOUTH BEND PETE BUTTIGIEG, MAYOR PHONE 574/ 235 -7678 FAX 574/ 235 -9928 DEPARTMENT OF ADMINISTRATION AND FINANCE November 1, 2016 Mr. Tim Scott, President City of South Bend Common Council 227 W. Jefferson Boulevard, 4th Floor South Bend, Indiana 46601 RE: Internal Controls Ordinance Dear President Scott, Filed in Clerk's Office N0 2016 KAREEMAH FOWLER CITY CLERK, SOUTH BEND, IN Indiana Code 5- 11- 1 -27(g) provides that the legislative body must adopt minimum internal control standards as defined by the State Board of Accounts (SBOA). Additionally, the legislative body must ensure that personnel receive training concerning the internal control standards and procedures adopted by the political subdivision. Toward this end, the City Administration has prepared the attached ordinance and policy with respect to internal controls. The City Administration has undertaken a number of activities regarding internal controls during this past year. On May 12, 2016, a total of 17 fiscal officers and staff participated in internal controls webinar training provided by the SBOA. In addition, on March 30, 2016, eight fiscal officers participated in internal controls webinar training presented by the Indiana Association of Cities and Towns ([ACT) and Umbaugh & Associates. The City has a number of good financial policies in place that are available on the City website. Utilizing some of these financial policies, the City is in the process of developing a comprehensive procedure for internal controls that will be implemented during the first quarter of 2017. I will present this bill to the Common Council at the appropriate committee and council meetings. It is requested that this bill be filed for 1s' reading on November 14, 2016 with 2nd reading, public hearing and 3rd reading scheduled for November 28, 2016. Thank you for your attention to this request. If you should have any questions, please feel to contact me at 574 -235 -7678. Regards, Jo H. Murphy _�f `" City Controller Excellence I Accountability I Innovation I Inclusion I Empowerment yi CITY OF SOUTH BEND, INDIANA Internal Controls Policy Pursuant to I.C. 5- 11 -1 -27 October 26, 2016 I. Policy The purpose of this policy is to communicate the Common Council's internal control objectives to all employees and elected officials of the City of South Bend and to firmly commit the City to the seventeen (17) key principles of internal controls as established by the Indiana State Board of Accounts. COMPONENT ONE: CONTROL ENVIRONMENT Principle 1: The oversight body and management demonstrate a commitment to integrity and ethical values. The City has the responsibility to establish and maintain an adequate system of internal control and to furnish to the South Bend Common. Council, various boards and commissions, governmental agencies, creditors and others reliable financial information on a timely basis. An adequate system of internal control is necessary for the City to discharge these responsibilities. For purposes of this policy, the South Bend Common Council is the oversight body and the City Administration and Finance Department is management. Controls help ensure that assets are not exposed to unauthorized access and use, transactions are properly recorded in the financial records, and the resultant financial information is reliable. External organizations and stakeholders of the City rely on financial information to make decisions toward appropriations, loans and other debt, grants, and other contractual relationships. City resources are dependent upon the system of internal control. Auditors are required annually to report upon the adequacy of the City's systems for control over financial reporting and compliance per I.C. 5- 11- 1- 27(e). The safeguarding of City assets and the reliability which the City and others can place upon its financial records is dependent upon the effectiveness of the internal control process. As the fiscal body, the Common Council expects the City Administration to effect an internal control environment with policies and procedures necessary to provide reasonable assurance that practices cause effective and efficient operations, reliable financial reporting, and compliance with applicable laws and regulations. The system of internal control is meant to keep the City on course toward its mission and to minimize surprises. The system promotes efficiency, minimizes risks of asset loss, helps ensure the reliability of financial information, and compliance with applicable laws, rules, and regulations. Internal control is a process; a means to an end, and not an end unto itself. The control environment is the foundation upon which all components of internal control are based. It sets the tone for City operations. Internal control is about people, operations, communications, and the work environment. It is not about policies and forms though it takes shape through the implementation 1 CITY OF SOUTH BEND, INDIANA of relevant policies, procedures, and practices. Internal control can provide reasonable assurance, but no system of control can provide absolute assurance to the Common Council and other users of financial information. The Finance Department shall be charged with: • Conveying periodic messages of the City's internal control philosophy and expectations to all employees; • Evaluating the City's internal control system for weaknesses on a periodic (but no less frequently than annual) basis, providing solutions to any discovered weaknesses, and inform. employees of necessary changes in procedures; • Working with the Human Resources Department to establish a confidential reporting system for individuals to report suspected fraud and abuse of internal control policies; and • Working with the Human Resources Department to institute procedures to address violations of policies and consequences for violations. Principle 2: The oversight body oversees the entity's internal control system. As the fiscal body for the City, the Common Council is responsible for setting the institutional expectations, for internal control, ensuring management is aware of the those expectations, requiring the upward communications channels are open through all levels of management, and evaluating management's effectiveness toward monitoring the control environment and implementing sound control policies and procedures. As the City's Chief Fiscal Officer, the City Controller will be the Common Council's chief agent in implementing and managing the internal control policies and procedures. Principle 3: Management establishes an organizational structure, assigns responsibility, and delegates authority to achieve the entity's objectives. Individuals with delegated approval authority, e.g. Elected Officials and Department Heads are responsible for establishing, maintaining, and supporting a system of internal controls within their areas of responsibility and for creating the control environment that encourages compliance with City policies and procedures. Adequate supervision is necessary to monitor that internal controls are operating as intended, and to help ensure the reliability of accounting and operational controls by pointing out errors, omissions, exceptions, and inconsistencies in procedures. Staff in leadership roles are responsible for the application of this policy and the design, development, implementation, and maintenance of systems of internal controls focusing on the effectiveness of operations and the safeguarding of assets within their respective areas of responsibility. All levels of management and supervision are responsible for strengthening internal controls when weaknesses are detected. Department managers should periodically review departmental procedures to ensure that the general principles of internal control are being followed. The Finance Department has the primary responsibility for internal control over financial reporting and compliance with applicable laws, rules, and regulations. The City Controller is the City's chief Internal Controls Policy Pursuant to I.C. 5- 11 -1 -27 2 CITY OF SOUTH BEND, INDIANA source for information and assistance to staff and Department Heads on this topic and will make resources available to assist in administering this policy. The Human Resources Department is responsible for internal controls over employee recruitment, hiring, separation, promotion, job classification, employee rights, and salary administration. The Director of Human Resources (or his or her designee) and Corporation Counsel are the City sources for information and assistance on this topic and will make resources available to assist in administering this policy. All levels of internal control are subject to examination by external auditors who are required to report on the adequacy of internal controls over finance and compliance. Department Heads are responsible for prompt corrective action on all internal control findings and recommendations made by internal and external auditors. The audit process is completed only after Department Heads receive the audit results and take action to correct internal control weaknesses, improve systems, or demonstrate that management action is not warranted. Department Heads have the responsibility to ensure that those who report to them have adequate knowledge, skills, and abilities to function within, and contribute to, an effective internal control environment. This includes providing access to appropriate training on topics relevant to their job responsibilities. Principle 4: Management demonstrates a commitment to recruit, develop, and retain competent individuals. The City Employee Handbook provides a roadmap for recruiting and maintaining quality employees. Prior to employment, individuals may be subject to pre - employment background screening and/or a credit history check. While employed, City Employees are entitled to a benefits package including Health Insurance and certain other Post - Employment Benefits. The City will continue to assess the best recruitment tools for the different skill sets necessary to adequately implement and maintain quality internal controls. Job descriptions will be updated where necessary to reflect internal control responsibilities and duties. Employees will be regularly trained in internal control methods and all training will be documented in employees' personnel files. Employees will be regularly evaluated by their supervisors on internal control duties and receive feedback on possible improvements. Principle 5: Management evaluates performance and holds individuals accountable for their internal control responsibilities. Individuals are held accountable for their internal control responsibilities through a recognized structure which includes relevant job descriptions, operating procedures, periodic reviews, regular feedback, and a progressive disciplinary policy. Additionally, City Administration seeks to address issues in specific departments and positions through regular meetings with Department Heads. Internal Controls Policy Pursuant to I.C. 5- 11 -1 -27 3 CITY OF SOUTH BEND, INDIANA COMPONENT TWO: RISK ASSESSMENT Principle 6: Management defines objectives clearly to enable the identification of risks and risk tolerances. Through the creation of standard operating procedures and accurate organizational reporting charts, management conveys and identifies objectives, missions, policies, and risk tolerances to employees. The Finance Department will lead a risk analysis of three major areas: 1. The effectiveness and efficiency of operations. 2. The reliability of reporting for internal and external use. 3. Compliance with applicable laws and regulations. For each category, the Finance Department will define objectives in specific measurable terms in order to enable the design of internal control for related risk, increase understanding at all levels, assess performance, identify what is to be achieved, who is to achieve it, how it will be achieved, when it will be achieved and incorporate external requirements. Principle 7: Management identifies, analyzes, and responds to risks related to achieving the defined objectives. The Finance Department will identify, analyze and respond to the risks identified in Principle 6 by determining: 1. How likely is the risk to occur? 2. How will it impact the objective? 3. Is the risk based on complex or unusual transactions? 4. Is the risk based on fraud? Once each risk has been identified and analyzed, the Finance Department will work with Department Heads to determine how to respond to each risk with a specific solution and action. Principle 8: Management considers the potential for fraud when identifying, analyzing, and responding to risks. Management is committed to fraud prevention by utilizing a "trust but verify" approach. The potential for fraud, misappropriation, and outright theft are contemplated as controls are designed for various City divisions. Fraud responses will include statutorily required responses to fraud, including, but not limited to Ind. Code § 5 -11 -1 -27(1) relating to the Report of Misappropriation of Funds to State Board of Accounts (SBOA) and Prosecuting Attorney and Ind. Code § 5 -11 -1 -270) relating to the Report of Material Variances, Losses, Shortages or Thefts to the SBOA. For reporting to the SBOA, the City shall utilize a materiality threshold of $10,000 for cash and $10,000 for assets other than cash. All instances of suspected employee theft must be immediately reported to the SBOA regardless of the dollar amount. There is no materiality threshold for employee theft. Significant variances less than $10,000 will be investigated internally by the staff of the City of South Bend. Internal Controls Policy Pursuant to I.C. 5- 11 -1 -27 4 CITY OF SOUTH BEND, INDIANA Principle 9: Management identifies, analyzes, and responds to significant changes that could impact the internal control system. The Finance Department, in coordination with Department Heads, will regularly evaluate and adjust internal control policies in order to accommodate for the impact of future changes, including but not limited to, personnel changes, newly elected officials, new programs, new technology, new laws and regulations, and financial fluctuations. COMPONENT THREE: CONTROL ACTIVITIES Principle 10: Management designs control activities to achieve objectives and respond to risks. The Finance Department will establish and maintain a system of internal controls that satisfies the City's objectives in the following categories: 1. Risks are identified and effectively managed 2. Safeguarding of City assets 3. Reliability and integrity of financial information 4. Compliance with City policy, plans, procedures, laws and regulations 5. Economical and efficient use of City resources 6. Meeting established objectives and goals for City operations and programs. A. General internal control principles for Departments are: 1. Segregation of duties a. Duties are separated so that one person's work routinely serves as a check on another's work. b. No one person has complete control over more than one key function or activity (e.g., authorizing, approving, certifying, disbursing, receiving, or reconciling). 2. Authorization and approval a. Proposed transactions are authorized when proper and consistent with City policy and the department's plans. b. Transactions are approved by the person who has delegated approval authority, which is usually delegated on the basis of special competency or knowledge. 3. Custodial and security arrangements a. Responsibility for physical security /custody of City assets is separated from record keeping/accounting for those assets. b. Unauthorized access to City assets and institutional data is prevented. Internal Controls Policy Pursuant to I.C. 5- 11 -1 -27 5 CITY OF SOUTH BEND, INDIANA 4. Timely and accurate review and reconciliation a. Departmental accounting records and documents are examined by employees who have sufficient understanding of the City accounting and financial systems to verify that recorded transactions actually took place and were made in accordance with City policies and procedures. b. Departmental accounting records and documentation are compared with City accounting system reports and financial statements to verify their reasonableness, accuracy, and completeness. 5. The general internal control principles should be applied to all departmental operations, especially accounting records and reports, payroll, purchasing /receiving /disbursement approval, equipment and supply inventories, cash receipts, petty cash and change funds, billing and accounts receivable. B. All City systems, processes, operations, functions, and activities are subject to evaluations of internal control systems. The results of these evaluations provide information regarding the City's overall system of control. C. Information and communication — Information must be timely and communicated in a manner that enables people to carry out their responsibilities. 1. All covered employees must be trained on Internal Controls according to Ind. Code § 5- 11- 1- 27(g). Covered employees are those employees who handle cash or have access to assets other than cash that are covered by this policy. All personnel must receive a clear message from the City's administration that control responsibilities are to be taken seriously. Failure to comply with established practices will subject individuals to the terms of disciplinary action or dismissal. 2. Employees must understand their own roles in the internal control system, as well as how individual activities relate to the work of others. To this end, whenever a new budgetary unit, financial activity, etc. is set up, the City Controller will provide notification to the appropriate parties of the responsibilities incumbent on them for good business practices and sound financial management, including reference to the principles within this policy. 3. Employees must have a means of communicating significant information to the City's administration. 4. The City must communicate effectively with external parties, such as auditors, creditors, contractors, suppliers, regulators and other stakeholders. D. Internal controls are meant to keep the City focused on achieving its mission while avoiding surprises. There is a balance between effective controls and mission accomplishment. Costs associated with internal controls should not exceed their benefit, nor should controls be allowed to stifle mission effectiveness and timely action. All levels Internal Controls Policy Pursuant to I.C. 5- 11 -1 -27 6 CITY OF SOUTH BEND, INDIANA of management must assess the costs, benefits, and risks when designing controls to develop a positive control environment and compensate for the risks of non - compliance, loss of assets, or unreliable reporting while accomplishing the City mission. The following specific internal control policies are adopted for use by City Departments: Payroll Activities • Salaries and wage rates are verified by the Human Resources Department. • The responsibilities for hiring, terminating, and approving promotions are segregated from those preparing payroll transactions or inputting data. • The responsibilities for approving time sheets are segregated from those for preparing payroll transactions or inputting data. • Employees' time and attendance records are approved by their supervisors. • Corrections to recorded time and attendance records are approved by the employee and employee's supervisor. • Procedures are in place to ensure that changes in employment status are promptly reported to the payroll processing unit. • Payroll disbursements are reviewed and approved by an authorized individual prior to payment. • Access to payroll applications is appropriately controlled by user logins and passwords. • Changes to a payroll disbursement are approved by an individual other than the ones authorized to process the changes. • Access to the electronic signature used to sign payroll checks is adequately controlled. • Check stock for printed checks is stored in a secure location. • Unclaimed payroll checks are returned to Finance Department. • Employees are cross - trained on the payroll process; those assigned to payroll take regular vacations. • The City uses a "positive pay" program with 1st Source Bank to preauthorize payroll checks to be honored by the bank and identify fraudulent checks issued by other parties attempting to use City information. Disbursement Activities • The responsibility for approving claims is segregated from those preparing the claims wherever possible. • Checks are written by an individual other than the one approving the claim. • Claims for payment (including trustee escrow payments) are reviewed and approved by the Board of Public Works, Redevelopment Commission, or other appropriate public body prior to payment. • A reconcilement is completed between the claims for payment approved by the board and the actual disbursements posted to the ledger. • The responsibility for acknowledging the receipt of goods or services is segregated from those preparing claims and writing checks. • Vendor checks are accounted for in numerical order and reconciled to the disbursement ledger. • Invoices or other receipts are attached to each claim to support the disbursement. Internal Controls Policy Pursuant to I.C. 5- 11 -1 -27 7 CITY OF SOUTH BEND, INDIANA • A review is completed by an individual outside the disbursement process in which the claim amount is compared to the supporting documentation attached to the claim and the amount of the check. This review and approval is made at the departmental level. • Access to disbursement applications is appropriately controlled by user logins and passwords. • The City Controller, or his/her designee, will review claims prior to payment. • The Purchasing Manager, or his/her designee, will review requisitions submitted and issue all purchase orders. • With limited exceptions, all disbursements will require a properly approved invoice and a purchase order prior to payment. • The City uses a "positive pay" program with 1St Source Bank to preauthorize accounts payable checks to be honored by the bank and identify fraudulent checks issued by other parties attempting to use City information. Receipting Activities • The responsibility for collecting money and issuing receipts is segregated from those preparing the bank deposit. • The responsibility for making bank deposits is segregated from those preparing the monthly bank reconcilement. • Pre - numbered receipts are issued for all money collected and the receipt is retained with supporting documentation. • Receipts are reconciled to the cash receipts ledger by an individual other than the one collecting money and issuing receipts. • Posting of receipts to the ledger is completed by an individual other than the one who collects money and makes the deposit. • Receipts indicate the type of payment received (cash, check, etc.) and this is reconciled to the make -up of the bank deposit. • Accounts receivable records are maintained by an individual other than the one(s) involved in the billing process. • The billing process is completed by an individual other than the one who collects cash payments from customers. • Customer account adjustments above the $500 materiality threshold, stated in this policy, are approved by the Board of Public Works only after review. Cash Activities • A reconcilement between the recorded cash balance and the bank balance is completed monthly by an individual separate from the receipting and disbursing processes. • A reconcilement between the receipts ledger and the credits to the bank account is completed periodically by an individual separate of the receipting process. • A reconcilement between the disbursement ledger and the debits to the bank account is completed periodically by an individual separate of the disbursement process. • The monthly reconcilement between the cash balance and the bank balance is thoroughly reviewed and approved by the City Controller or his/her designee. • Disbursements from and reimbursements to petty cash funds are periodically reviewed by an individual other than the one responsible for maintaining the petty cash fund. Internal Controls Policy Pursuant to I.C. 5- 11 -1 -27 CITY OF SOUTH BEND, INDIANA Credit Cards Transactions • A designated official or employee oversees the issuance and use of the credit cards. • During the disbursement process, a designated person reviews transactions listed on the credit card statements for sufficient documentation prior to payment. Budgeting Activities • The City Administration will budget all funds and accounts. • Budget forecasts will be updated annually covering a multi -year time period. • Budget vs actual reports for revenue and expenditures will be prepared monthly. The City Finance Department will follow up on significant variations between budget and actual results. Information Technology • The City Innovation & Technology (IT) Department will ensure that all users (employees) have a unique username. • The City Human Resources Department will immediately notify the IT Department when an employee is terminated so that IT can deactivate the user's access to all computer related applications. • The IT Department will ensure that an authentication system (i.e. password) is in place so access to the network and computer related applications is protected and limited to the appropriate users. • Users will be required to lock or log off their computer before stepping away from their computer for an extended period of time. • Users will be required to log off their accounts when they leave work. • The IT Department will give a user access only to the specific applications and network files the user needs to perform his or her job duties. • The IT Department will monitor access to the network and audit the logins for applications, including the financial software. Principle 11: Management designs the political subdivision's information system and related control activities to achieve objectives and respond to risks. The Finance Department and Department Heads will work with the Innovation and Technology Department to ensure that information technology is used as an integral part of the internal control system. This may include, but not be limited to: • Setting permission such that only certain users may perform certain tasks • Using technology to accomplish segregation of duties by forcing duties to be completed by different users • Automating certain processes and calculations • Limiting the authority to access different components of various software to employees with duties specifically related to that component • Prohibiting user ID and password sharing among employees • Restricting the authority to correct or make adjustments to records to key employees • Requiring the use of prescribed forms or the approval of alternative forms Internal Controls Policy Pursuant to I.C. 5- 11 -1 -27 9 CITY OF SOUTH BEND, INDIANA Principle 12: Management implements control activities through policies. The City has an employee handbook that is regularly updated to communicate policies to employees. Additionally, the Finance Department regularly works with departments and employees who handle financial transactions to recommend and ensure best practices. All procedures are in writing and communicated frequently to all relevant employees. Policies are available both electronically (via the City website) and in hard copy form. In addition, the City Controller holds regular "Fiscal Officer" meetings where accounting and internal control issues are discussed. COMPONENT FOUR: INFORMATION AND COMMUNICATION Principle 13: Management uses quality information to achieve the political subdivision's objectives. The City strives to lead in the areas of financial transparency and accountability. By adopting standards and investing in systems that exceed State mandated minimums, City management provides employees and stakeholders with high quality information and informatics systems. The City Finance Department and Legal Department attend training and. industry seminars to stay abreast of changes and developments in requirements and communicate that information effectively to impacted employees. The City Finance Department issues a variety of financial reports to the Mayor, Common Council and others, to ensure transparency and accountability. Financial reports are posted on the City's website. Principle 14: Management internally communicates the necessary quality information to achieve the political subdivision's objectives. Internal communications on internal controls are communicated through adoption of formal policies by relevant boards and commissions and/or the legislative body or documented through memos from the Finance, Legal or relevant Department Head. Internal memos and reports are maintained to document communication. Principle 15: Management externally communicates the necessary quality information to achieve the entity's objectives. Communications with the State Board of Accounts, other State agencies, grantor agencies, and regulatory agencies are documented by email, memos, letters, and other forms of written correspondence. All documents are maintained in accordance with the City and state's record retention policies. Reports and policies are cross checked for accuracy, relevancy, and timeliness of information. Internal Controls Policy Pursuant to I.C. 5- 11 -1 -27 10 CITY OF SOUTH BEND, INDIANA COMPONENT FIVE: MONITORING ACTIVITIES Principle 16: Management establishes and operates monitoring activities to monitor the internal control system and evaluate the results. City Administration monitors and evaluates compliance with internal control policies via multiple methods. Separation of duties, redundancy polices, layered approval systems, monthly reports, and physical controls allow management to both review and evaluate control systems. The Finance Department shall implement a system of monitoring that includes: • Periodic checks to determine if controls are in place and working effectively • Reviewing control activities to determine if the actual activities are in compliance with established procedures • Documenting deficiencies in the internal control processes and remediating them quickly Monitoring activities will be documented by signatures, initials, or other appropriate methods. Principle 17: Management remediates identified internal control deficiencies on a timely basis. Breaches of internal controls are subject to significant levels of internal scrutiny. If informed of a material breach of internal controls, the Finance Department and effected Department Head will actively investigate and address said breach and adjust policies and procedures to prevent such breaches in the future. Once breaches are identified and investigated, a formal or informal corrective action plan will be developed. Internal Controls Policy Pursuant to I.C. 5- 11 -1 -27 11