segregation of duties in office of three, two, or one

Matt MalinowskiSusan Green

Segregation of Duties in Office of Three, Two, or One

MYTHS• Internal control starts with a strong

set of policies and procedures• Internal control – That’s why we

have external/internal auditors.• Internal control is a finance thing• Internal controls are essentially

negative, like a list of “thou-shalt-nots.”

• Internal controls take time away from our core activities – serving students.

Internal Control Myths and Facts

FACTS• Internal control starts with a strong

control environment•While external/internal auditors

play a key role in the system of control, management is the primary owner of internal control

• Internal control is integral to every aspect of business

• Internal control makes the right things happen the first time

• Internal controls should be built “into,” not “onto” business processes.

•Benefit payment receipt

•County Official – Post office refunds

•Do you have a fraud policy?

Could this Happen to You? Examples of Fraud

• Money• Reputation• Public Trust• Acceptable Practice / prevalent in other

areas

Costs of Fraud

• Definition from Merriam Webster Online Dictionary:a: deceit, trickery; specifically: intentional perversion of truth in order to induce another to part with something of value or to surrender a legal right b: an act of deceiving or misrepresenting : trick

Fraud

• Payroll Fraud• Benefit Fraud• Double Payments• Charge Off Fraud• Disposal Fraud• Travel Claim Fraud

Common Types of Public Sector Fraud

• Simply what it sounds like –

Separating Duties

What is “Segregation of Duties”

• Segregation of duties means separating the recordkeeping function from the operational responsibility of that activity and from those who exercise physical control over the records.

• Categories of duties: – Authorization– Custody– Record keeping– Reconciliation

Segregation of Duties

•Do I have to add more people to make this work?

NO

Segregation of Duties

A Balanced Assessment should take into account the following:

• Significance- The degree of harm that could result

• Likelihood of Occurrence- What is the probability that a given risk will materialize?

• Inherent Risk – Where will there always be risk?

Assessment Criteria

• Rotation of duties– Mandatory vacation– Job rotation periodically / cross training

• Management oversight – Open the mail twice a month– Reconcile the checking account periodically– Review, review, review

• Third party help such as consultants

Ways to Implement Solutions with Less Staff?

• Receipts– Manual checks and cash– Electronic receipts

• Disbursements– Board checks– Payroll

Key Cycles

• Transaction –– Initiation– Approval – Recording– Reconciliation– Asset handling– Review of reports

• You don’t have 6 employees in your business office. Now what?

Key Duties

• Person #1 issues a purchase order based on a requisition completed beforehand.

• Person who ordered the item verifies that the goods are received (Sign off on PO copy)

• Separate Person in the business office issues or authorizes payment.

Example of Maintaining the Three Separate Functions

• After the fact review• Review of the bank reconciliation is a

compensating control vs. review of the check register before checks are cut

Compensating Controls

• Control related policies to compensate for risks. • Examples: – Purchases orders must be approved by department head or

other designated official. – Policy to only pay off of an original invoice– Reconcile encumbrances to open purchase orders– Leave approval and leave posting– Technology for efficiency = sub calling / electronic leave

recording

Compensating Controls

• Separate – approval, – accounting/reconciliation– Safeguarding

• Reduce/eliminate those that accept and disburse funds

Focus on Major Areas

Assertions to ensure that all significant risks are identified in a purchasing cycle:

1) Has a purchase been recorded for goods not yet received? Has a vendor been paid twice?

2) Have purchases been made, but not recorded?

3) Were all purchases properly authorized?4) Were charges to appropriate accounts?

Identifying Potential Risks

• Treasurers Report on all Cash Balances• Special Fund Reports (Food Service, Capital,

Special Revenue, Activity)• YTD Budget Report• Budget Transfers• All Tax Exonerations• Bill List (Include monthly, emergency, wires)

What are you reporting to your board?

• Budget preparation, monitoring• Purchasing/Payroll functions• Tax Collection/Reporting – (tax collector’s

course)• Investments• Records

Examples of Internal Controls

• U.S. Government Accountability Office (GOA) – New Edition Yellow Book – http://www.gao.gov/govaud/ybk01.htm download. See pages 81-87.

• Roslyn School District, New York -• http://www.osc.state.ny.us/localgov/audits/2006/schools/ros

lynfoll.pdf (a real life scandal)

• GFOA article "Evaluating Internal Controls"•

http://goliath.ecnext.com/coms2/gi_0199-2938675/Evaluating-internal-controls-control-self.html

Additional Resources/Information