Internal control, as defined by the Committee of Sponsoring Organizations of the Treadway Commission (COSO), is “a process, effected by an entity’s board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: effectiveness and efficiency of operations, reliability of financial reporting, and compliance with applicable laws and regulations.”
All of us share the responsibility of ensuring our working environment is safe and effective. One important way we can help achieve this goal is to establish and follow appropriate policies and procedures on internal control.
The purpose of Understanding Internal Controls is to provide employees with internal control guidelines that will help identify the methods and measures adopted by System Administration to promote the thoughtful and efficient use of state resources.
Given that internal controls depend on the participation of all employees at every level, every employee should be aware of the University’s goals and their role in attaining these goals. Employee competence and professional integrity are essential components of a sound internal control program. By knowing what our responsibilities are, we can help provide reasonable assurance that our internal control systems are adequate and operating in an efficient manner.
System Administration's Internal Control Program, in conjunction with Understanding Internal Controls, is designed to provide reasonable assurance that:
A successful internal control environment requires management's commitment and support. Management's goal is not to make each person an expert in internal controls, but to increase awareness and understanding of why we need them and how we use them.
Executive management is committed to System Administration's Internal Control Program and strongly encourages adherence to the program for the betterment of the University.
The Office of the University Controller is assigned the responsibility to oversee and coordinate System Administration's Internal Control Program.
Although management is primarily responsible for implementing internal controls, every employee participates in establishing, properly documenting and maintaining internal controls.
Employees are responsible for complying with internal controls by:
Managers and supervisors are responsible for executing control policies and procedures within their departments by:
Internal control systems are basic management practices that usually involve two elements: a policy establishing what should be done and procedures used to support the policy. Internal control systems typically come from senior management's interpretation of the University's strategic initiatives, laws and regulations, or industry standards and practices.
University policies and procedures are used to:
Each employee is expected to adhere to established internal controls and all applicable management policies and standards issued by the State of New York, the State University and System Administration pertaining to (but not limited to):
In addition to System Administration's system of internal controls, the Governmental Accountability, Audit and Internal Control Act of 1987 (Act) formalizes New York State's commitment to efficient and effective business practices, quality services, and ethics in the operations of state government. The provisions of the Act intend to ensure State funds are spent properly and that state agencies including SUNY, function effectively to meet its objectives.
Under this legislation, System Administration must annually certify to the Chancellor, who in-turn reports to the Division of Budget, that the University’s Internal Control Program is in compliance with each of the Act’s requirements
Controls can be either preventative or detective. Preventative controls attempt to deter or prevent undesirable events from occurring. Separation of duties, proper authorization, adequate documentation, passwords and physical control over assets and even traffic signs are all examples or preventative controls.
Detective controls attempt to detect errors or irregularities which have already occurred. Reviews, analyses, reconciliations, periodic physical inventories, audits and surveillance cameras are all examples of detective controls.
Both types of controls are essential to an effective internal control system. From a quality standpoint, preventative controls are essential because they are proactive. However, detective controls play a critical role providing evidence that preventative controls are functioning effectively.
The following internal controls can be used to ensure management policies and procedures are adhered to:
Information related to University policies and procedures.
As you carry out your routine job responsibilities or are thinking about implementing a new procedure or process, ask yourself the following questions:
There are always inherent limitations to internal controls and risk can't always be foreseen or eliminated. Each time we make a change to an existing system, we run the risk of weakening the underlying internal controls. No matter how well internal controls are designed, they can only provide reasonable assurance that a positive outcome can be achieved.
There are five basic components of internal controls, as defined in the Committee of Sponsoring Organizations of the Treadway Commission’s (COSO) Internal Control Framework:
In order to achieve a balance between risks and controls, internal controls should be proactive, value-added and cost-effective. Excessive control can be costly and counterproductive while too little control presents undue risk. The cost of implementing a control shouldn't outweigh its benefit. For example, staff size limitations may obstruct efforts to properly segregate duties, but it may be possible to implement compensating controls such as random testing or document review.
The underlying theme throughout Understanding Internal Controls is to identify risks that may prevent objectives from being achieved and determine what controls are necessary to manage those risks. Thus, setting goals and objectives is a precondition to internal controls. The SUNY Board and Chancellor have established four priority pillars - student success; research and scholarship; diversity, equity, and inclusion; economic development and upward mobility - that outline the University's main goals and objectives for advancing the mission of the University. SUNY's four priority pillars involve a number of University-wide goals that include investments in proven student support programs, collaborating with government partners, entrepreneurs and businesses, attracting top-tier diverse faculty, investments in SUNY research and scholarship, and removing barriers to student success.
Each department within System Administration must align their objectives to support SUNY's strategy. As such, these departments must assess and monitor the risks associated with these goals, and implement adequate controls to help achieve these objectives. This includes a commitment to excellence in operational and fiscal stewardship on behalf of the students and taxpayers we serve.
The process of identifying and analyzing risk is ongoing, and is a critical component of an effective internal control system. Attention must be focused on risks at all levels, as well as the necessary actions that must be taken to effectively manage them. Risk can pertain to both internal and external factors, such as:
External factors:
Internal factors:
The framework for the Internal Control Program is based on identifying and testing the programs and administrative functions necessary for System Administration to carry out its mission. Functions can be identified through organizational charts, departmental budgets, policy and procedural manuals, job descriptions, and information systems. The identified functions are referred to as "assessable units".
To properly assess the current level of risk associated with a function, risk assessments address such factors as:
The need for a more in-depth internal control review of a function relates to the level of risk determined by the risk assessment. SUNY has identified several pre-defined areas considered to be of high risk, such as Revenue and Cash Management, Property Control, Procurement, Personnel & Payroll, Information Technology, Emergency Management, Financial Aid, and the General Control Environment. In addition, functions identified as more vulnerable could be candidates for a more formal internal control review regardless of whether the risk assessment identified any internal control weaknesses. System Administration's internal control review process typically includes staff interviews, analysis of policies and procedures, observations of functions and operations, and testing of controls currently in place to determine adequacy and effectiveness. For any material weaknesses identified during the review process, the respective department manager is notified and must submit a corrective action plan to the Internal Control Officer along with a timeframe for resolution. Follow-up measures are utilized to ensure corrective actions are implemented. Implementation of these actions is monitored using tools such as Excel spreadsheets, Outlook calendar reminders, and email.
We are all responsible for creating and maintaining a compliance-conscious environment. This includes asking questions if you’re not sure what to do and raising concerns if you see something you don’t think is right. Early recognition of a problem can prevent something small from becoming big. Please report your concerns to one of the following:
Internal controls are a part of our daily operations. The controls developed and exercised by managers and their staff are the substance of the Internal Control Program. System Administration's Internal Control Program and related training and testing helps to ensure that the controls are properly documented and functioning as intended.
As available resources decline, the need for adequate internal control is more important than ever. Fewer people are doing more work with less time and less funding. Opportunities for fraud, waste, and abuse increase significantly in a weak internal control environment. The single most important success factor of the Internal Control Program is a high level of individual awareness and understanding. Internal controls are everyone's responsibility; therefore we are all responsible for knowing what internal controls exist and how to evaluate their effectiveness.
A successful Internal Control Program will help streamline our processes and improve the quality of our services. The result will be a better, more enjoyable work place and a quality institution of higher education.
Please feel free to contact us for more information regarding System Administration’s Internal Control Program