What are Effective Internal Controls?
Everyone in the work place has a role in making sure that internal controls are working. It is up to mangers to set them up and check that they are working but unless all employees are aware of their responsibilities in the process, the internal control system will not function completely. Internal controls help to ensure that we are doing the right job in the right way to achieve effective, efficient operations in the work place in compliance with laws and regulations. Here is a five-step process to follow when developing and implementing effective internal controls in an organization:
- Step 1: Establish an Appropriate Control Environment
- Step 2: Assess Risk
- Step 3: Implement Control Activities
- Step 4: Communicate Information
- Step 5: Monitor
The core of any organization is its people – their individual attributes, including integrity, ethical values and competence – and the environment in which they operate. They are the engine that drives the organization and the foundation on which everything rests. Effectively controlled organizations set a positive "tone at the top" and strive to:
- Train staff to understand and use appropriate management controls in all areas.
- Provide structure and process for implementing these controls.
Management must be aware of and deal with the risks the organization faces. It must set objectives, integrated with other activities so that the organization is operating in concert. Management must also establish mechanisms to identify, analyze and manage the related risks.
- Identify Potential Problems
- Review goals and objectives.
- Determine potential problem areas, for example, areas that receive complaints or have had problems in the past.
- Areas that have undergone recent changes in staff or structure.
- Complex activities.
- Determine severity of risks by asking both, Where do we face the greatest possible harm? What types of losses are most likely to occur?
- A moderate loss that is likely to occur presents as much danger as a more serious loss that is less likely to occur.
- Use this evaluation to prioritize your efforts.
Identify and Analyze Cycles
- A cycle is a group of interrelated processes used to initiate and perform an activity. Event cycles can be programmatic or financial. Programs usually contain several event cycles. For example, a human services program might include the following five cycles: outreach, eligibility determination, record keeping, service delivery, and monitoring.
- The eligibility determination cycle might include interview, application form, verification, approval or denial, supervisory review, and initiate services or mail denial explanation.
- Determine cycles of likely problem areas.
- Prepare a written narrative or flow chart explaining how the cycle is supposed to be handled by describing each activity or transaction within the cycle.
- Describe in the narrative: Who is performing each step? What is involved in the step? Any resulting documentation, for example, reports.
- Review the information available in policy and procedure manuals. Also, use written materials such as organizational charts, job descriptions, reviews, checklists, department records, and reports.
- Supplement written sources through conversations with and observations of appropriate staff.
- Finally, "walk through" the process to be sure every item is understood.
Control policies and procedures must be established and executed to help ensure that management directives are carried out. They help ensure that necessary actions are taken to address risks to achievement of the organization’s objectives. Control activities occur throughout the organization, at all levels and in all functions. They include a range of activities as diverse as approvals, authorizations, verifications, reconciliations, reviews of operating performance, security of assets and segregation of duties.
- Review each cycle to determine whether existing controls are sufficient to avoid potential problems.
- Identify any outside policies or procedures in place to offset potential risks.
- If controls do not exist or appear ineffective, establish new controls.
- Identify any controls that are excessive or unnecessary and modify or eliminate them.
- Remember that a good control environment is the first step toward establishing effective controls.
Control activities are surrounded by information and communication systems. These systems enable the organization’s people to capture and exchange the information needed to conduct, manage and control its operations.
- Obtain external and internal information, and provide management with necessary reports on the organization’s performance relative to established objectives.
- Provide information to the right people in sufficient detail and on time to enable them to carry out their responsibilities efficiently and effectively.
- Develop or revise information systems based on a strategic plan, linked to the organization’s overall strategy, and responsive to achieving the entity-wide and activity-level objectives.
- Demonstrate support for developing necessary information systems by committing adequate human and financial resources.
The entire process must be monitored, and modifications made as necessary. This way, the system can react dynamically, changing as conditions warrant. Ongoing monitoring occurs in the course of operations. It includes regular management and supervisory activities, and other actions personnel take in performing their duties. The scope and frequency of separate evaluations will depend primarily on an assessment of risks and the effectiveness of ongoing monitoring procedures.
- Schedule monitoring on a regular basis.
- Test controls at least annually to determine whether they continue to be adequate and are still functioning as intended.
- Use program monitors, auditors and reviewers as a resource in monitoring controls.
- Select a sample. Review all documentation. Visit outside sites, if appropriate. Supplement sample with special tests of sensitive items and problem areas.
- Always follow up to insure that any identified problems are corrected.