Internal Audit Department

Internal Control

Internal control is broadly defined as a process, effected by an entity's board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories:

• Effectiveness and efficiency of operations;
• Reliability of financial reporting;
• Compliance with applicable laws and regulations.

This definition reflects certain fundamental concepts:

• Internal control is a process.  It is a means to an end, not an end in itself.
• Internal control is effected by individuals.  It is not policy manuals and forms, but people at every level of an organization.
• Internal control can be expected to provide only reasonable assurance, not absolute assurance, to an entity's management and board.
• Internal control is geared to the achievement of objectives.

Internal controls can be categorized as either accounting or administrative controls.

Accounting controls are designed to safeguard a University's assets and ensure the accuracy of financial records.

 

Administrative controls are designed to promote operational efficiency and adherence to laws, regulations, and the University's policies and procedures.

Internal Control comprises five interrelated components:

Control Environment

The tone of an organization is set by its people (their individual attributes including integrity, ethical values, competence, how risks and controls are viewed), and the environment in which they operate (management's philosophy and operating style, the organizational structure, and how the assignment of authority and responsibility are handled).

 

Risk Assessment

The entity must be aware of and deal with risks it faces.  It must establish mechanisms to identify, assess, and manage its risks.

 

Control Activities

Policies and procedures must be established and implemented to help ensure achievement of the entity's objectives are effectively carried out.

 

Information and Communication

Relevant information must be identified, captured, and appropriately communicated in a form and timeframe to conduct, manage, and control its operations and to enable people to carry out their responsibilities.

 

Monitoring

The entire process must be monitored, and modifications made as necessary in order to react dynamically, changing as conditions warrant.