Understanding Internal Controls

Overview

How can you, in your role at the university, safeguard assets and be part of a structure that enhances fiscal accountability?  Does your department have a standard practice in place to prevent fraudulent activity or errors that everyone in your area is aware of and understands?  Internal controls, when properly designed and executed, will help ensure your area has optimal safeguards against loss, errors, or fraud.

The internal control definition, as defined by the Committee of Sponsoring Organizations of the Treadway Commission (COSO), has three key points.  Internal control is:

1. An ongoing process (not just checking a box one time)
2. Effected by people from the board of trustees, to managers, to front-line employees (the people and their actions are what is important, not the form, system or procedure manual)
3. Designed to provide reasonable assurance regarding the achievement of the University’s objectives (absolute assurance is not possible)

It is important to note how adaptable and flexible the definition is – it can be applied university-wide, or an operating unit.

Framework

COSO issued the original internal control framework in 1992, which is still widely accepted worldwide.  The framework includes five components with underlying principles, which combine and interact to create a strong system of internal control. The five components of the internal control framework are shown below:

1. Control Environment: The control environment is just that – the environment of standards, processes and structures in the University.  Together, these guide people at all levels in carrying out their responsibilities for internal control and decision-making. A foundation of the control environment is the “Tone at the Top,” which tells employees what the University of Florida values and the importance placed on ethical, honest, behavior. It is set by the Board of Trustees and senior management, and reinforced by leaders at all levels.
2. Risk Assessment: Management must determine what risks are possible and what risk can be tolerated.  Risk assessment is a dynamic process based on objectives, although sometimes (like with financial reporting) there are external requirements that must be taken into consideration as well.
3. Control Activities: Control activities are the policies and procedures that take place to ensure risks are minimized and objectives are accomplished.  It is important to understand the “why” behind the control! Remember, controls do not prevent fraud or errors –   it is the people that effectively understand and execute those controls on a daily basis.
4. Information & Communication: Relevant and quality information is essential to carry out internal control responsibilities and achieve objectives.  Internally, communication allows employees to understand their internal control responsibilities, potential risks, the “Tone at the Top” and the objectives of the University.  Externally, the University can obtain and share relevant information with stakeholders.
5. Monitoring Activities: Monitoring is performed to assess the effectiveness of the controls and determine if a change is needed.  Unmonitored controls tend to break down over time, so monitoring is needed to identify and correct potential issues on a timely basis.  In addition, the system of internal control will evolve as objectives change or controls become obsolete.  If controls are created and then unmonitored, then the functioning system is likely to break down at some point.

Responsibility

As the definition says, internal controls depend on the participation of all employees at every level.  Therefore, all of us share the responsibility of establishing and following appropriate policies and procedures on internal control.  Employee competence and professional integrity are essential components of a sound internal control program, and the training class PRO303 – Internal Controls at UF is highly recommended for all fiscal staff.

Employees are responsible for complying with internal controls by:

1. Successfully fulfilling the duties and responsibilities established in the job description;
2. Monitoring work to ensure it is done properly and that errors are corrected promptly;
3. Meeting applicable performance standards;
4. Taking all reasonable steps to safeguard assets against waste, loss, unauthorized use and misappropriation;
5. Adhering to all applicable policies and procedures;
6. Attending education and training programs to increase awareness and understanding; and
7. Reporting concerns, including breakdowns in internal controls, missing internal controls, or other issues, to the supervisor or manager

Managers and supervisors are responsible for executing control policies and procedures within their departments by:

1. Maintaining a positive office environment that encourages internal controls through the “tone at the top,”
2. Documenting policies and procedures that are to be followed in performing work functions;
3. Encouraging and supporting employees who report concerns or opportunities for improvement;
4. Ensuring employees attend education and training programs applicable to their jobs;
5. Understanding all applicable regulations, policies and directives that impact the work functions;
6. Identifying the control objectives for each function and implementing effective controls designed to meet those objectives, and
7. Regularly testing the controls to verify they are performing as intended.

Our office does not have the goal to make each person an expert in internal controls, but to increase awareness and understanding of why we need them and how to use them.

For questions, assistance or concerns, please do not hesitate to reach out to either Internal Controls, Anti-Fraud, and Advisory Services (controller-office@ad.ufl.edu, (352) 392-1321) or the Office of Internal Audit (auditor@ufl.edu or (352) 392-1391).

Last Reviewed

Last reviewed on 03/20/2024

Contacts

Internal Controls, Anti-Fraud, and Advisory Services: (352) 392-1321