Under the Microscope

1
Under the Microscope
Internal Control

• Business Officers Meeting
• March 7, 2006
• Presented by Randy Van Dyke

2
Overview

• Quiz
• Background
• Internal Control Defined
• Internal Control Framework
• Self Assessment Checklist

3
Quiz Handout Pages 2-4
First, get your facts. Then you can distort em
as you please.
Mark Twain
4
Background

• A Rough Ride for Business
• War on Terrorism / Natural Disasters
• Economic downturn / Aftermath
• Financial frauds / Business failures

5
Sarbanes Oxley Act
This law says to every dishonest corporate
leader you will be exposed and punished the era
of low standards is over.
George W. Bush
6
Sarbanes Oxley Act

• Audit Committee organization and function
• Companies must document and evaluate the
  effectiveness of internal controls
• CEOs and CFOs must personally certify financial
  statement accuracy

7
Sarbanes Oxley Act

• Outside audit reports must include a statement on
  the effectiveness of internal controls
• Companies must have in place mechanisms for
  reporting and investigating wrongdoing (including
  anonymous reports)

8
Impact on U

• Board of Regents Policy
• Trustees Audit Committee
• Level of Involvement
• Scope of Oversight

9
Impact on U

• Ethical Conduct Guidance
• Ethics Compliance Hotline
• 585-1593
• hotline_at_admin.utah.edu

10
Core Process Assessments
This assessment focused on internal controls for
15 business processes.
192 risks and related controls were evaluated.
11
Core Process Assessments
12
Core Process Assessments
Potential Risk Unauthorized access to check
stock and printing capability.
Primary Control A secured laser printer is used
to print checks at the time they are issued.
13
College-Wide Reviews
Reviewed 44 potential issues in each of the
Colleges 14 organizational units.
14
College-Wide Reviews
15
Audit Follow-Up
Responsible Person Peggy Halliday Completion
Date March 1, 2006
16
Internal Control Defined

• Activities undertaken to increase the likelihood
  of achieving management objectives in three
  areas
• Efficiency and effectiveness of operations
• Financial accountability
• Compliance with laws and regulations

17
Internal Control Defined
Internal control gets us where we want to go,
with no surprises along the way. Internal
control is everyones responsibility. . . .
Internal control is me.
Cargill Corporation
18
Internal Control Framework
Monitoring
Information Communication
Information Communication
Control Activities
Risk Assessment
Control Environment
Adapted from Committee of Sponsoring
Organizations of the Treadway Commission (COSO)
19
Control Environment

• Integrity and ethical values
• Commitment to Competence
• Management Operating Style
• Organizational Structure
• Assignment of Authority and Responsibility
• Human Resource Policies and Practices

20
Risk Assessment

• Organizational Goals and Objectives
• Risk Identification and Prioritization
• Managing Change

21
Control Activities

• Written Policies and Procedures
• Control Procedures
• Controls over Information Systems

22
Information Communication

• Access to Information
• Communication Patterns

23
Monitoring

• Management Supervision
• Outside Sources
• Response Mechanisms
• Self-assessment Mechanisms

24
Quiz

• Internal control starts with a strong set of
  policies and procedures.

False Internal control starts with a strong
control environment.
25
Quiz

• Internal and external auditors are responsible to
  develop and monitor internal controls.

False While auditors play an important role,
management is the owner of internal control.
26
Quiz

• Internal controls are mostly concerned with
  control over assets, cash receipts, and cash
  disbursements.

False Internal control is integral to every
aspect of business.
27
Quiz

• Internal controls are essentially negative, like
  a list of thou-shalt-nots.

False Internal control makes the right things
happen the first time.
28
Quiz

• Internal controls take time away from core
  activities, such as serving faculty and students.

False Internal control should be built into,
not onto business processes.
29
Quiz

• When delegating authority and empowering
  employees, it is necessary to give up a certain
  amount of internal control.

False Decentralized decision-making requires
different forms of control.
30
Quiz

• If controls are strong, we can be assured
  employees will be prevented from committing fraud.

False Internal control provides reasonable, but
not absolute assurance.
31
Quiz

• What are some impediments to establishing
  effective internal controls?

• Lack of knowledge and ownership
• Lack of creativity
• Lack of interest

32
Links Contact Information

• Internal Audit Department
• http//www.utah.edu/Internal Audit/
• Ethics and Compliance Hotline
• 585-1593 hotline_at_admin.utah.edu
• Ethical Standards and Code of Conduct
• http//www.hr.utah.edu/ethicalstandards/
• University of Utah Policies and Procedures
• http//www.admin.utah.edu/ppmanual/
• COSO http//www.coso.org/
• Randy.VanDyke_at_admin.utah.edu, 581-5988
• Chuck.Piele_at_admin.utah.edu, 581-6561
• Pamela.Mollner_at_admin.utah.edu, 585-3529