University at Albany Internal Control Program

1
University at Albany Internal Control Program

• Employee Training
• Internal Control Officer Steve Beditz
• Internal Control Coordinator Darri Scalzo
• NOTE This PowerPoint presentation is designed
  for the slides to advance automatically.
  However, you may still right click with your
  mouse and click on next or previous if you find
  it necessary to advance or repeat a slide.

2
Objective

• Brief overview of internal controls - what they
  are and why we need them

3
Why Internal Controls?It is the LAW!

• The NYS Governmental Accountability,
• Audit and Internal Control Act of 1987
• Also called the Internal Control Act
• Made permanent in Chapter 510 of Laws of 1999
• Requires all state agencies, including SUNY
  campuses, to institute an internal control program

4
Why Internal Controls?It is the LAW!

• The Division of Budgets Budget Policy and
• Reporting Manual Item B-350,
• Governmental Internal Control and Internal
• Audit Requirements
• Requires all state agencies to perform certain
  internal control responsibilities
• Requires all state agencies to certify each year
  that they are in compliance with these internal
  control requirements and the Internal Control Act.

5
History of Internal Controls at UAlbany

• Internal Control Program on campus since 1989,
  but not very far reaching in the late 1990s and
  early 2000s.
• Nearly found non-compliant in spring 2005
• Program revamped, Steering Committee appointed,
  action plan put into place as required by System
  Administration
• Currently in second phase of action plan
  Employee training and internal control reviews

6
Definition of Internal Controls

• Internal controls are the integration of the
  activities, plans, attitudes, policies, and
  efforts of the people of an organization working
  together to provide reasonable assurance that the
  organization will achieve its mission.

7
Examples of Internal Controls Used Every Day

• Separating duties among employees so that no one
  employee controls all aspects of any transaction
  or process
• Locking office doors each evening
• Traffic lights and stop signs located at each
  intersection
• Painted signs or stickers on glass doors and
  plate glass windows

8
In work environments, we use the term Internal
Controls because

• They are used to ensure that our internal
  operations work the way we want so that we
  accomplish what we want
• They are managed and used by people within the
  organization
• They are built into our work activities

9
Internal Controls help us to

• Operate effectively and efficiently - or in other
  words to do the right things in the right way
• Provide quality products and services
• Ensure that we comply with all applicable laws,
  regulations, policies, and contracts
• Protect our assets and resources
• Develop, maintain, use, and provide
  data that is accurate and reliable

10
Internal Controls help protect us from risks -
the things that could go wrong and prevent us
from accomplishing our goals
11
Internal Controls and Risk Management

• First we must identify our goals
• Then we need to determine what could go wrong in
  trying to achieve those goals - those things are
  Risks
• Next we decide how to manage those risks
• Implement internal controls to decrease the
  chance that something will go wrong
• OR
• Live with the risk

12
Internal Controls - What we use to decrease
risks and help make sure things happen the way we
want

• People doing things

• Things put into place by people

13
Internal Controls - What we use to decrease
risks and help make sure things happen the way we
want

• Preventive - stop unwanted events from happening

• Detective - identify unwanted events that have
  occurred

14
Examples of Internal Controls

• Preventive
• Segregation of duties - dividing responsibilities
  so that no one person controls an entire activity
  and thereby could cause and conceal errors or
  fraud
• Safety procedures - precautions taken to help
  prevent accidents

• Detective
• Physical inventories - inspect assets on hand and
  match to assets recorded in the books to detect
  any missing items
• Supervisory reviews - review of work performed to
  detect any errors

15
Why Internal Controls?Good Business Sense

• In order to succeed, an organization must manage
  its operations effectively
• Internal controls provide reasonable assurance
  that an organization meets established objectives
  and goals
• Internal controls decrease the risks to an
  organization

16
What if we do not have Effective Internal
Controls?

• We could fail to meet our goals and objectives
• We might violate laws or regulations
• We may lose assets and/or opportunities

17
Can Things Really Go Wrong Here?

• Unfortunately - Yes!
• They can and have.
• In the past few years, there have been a
  number of disciplinary and legal situations on
  campus that at their core involved a breach of
  internal controls.

18
Recent Examples of Internal Control Breaches at
UAlbany

• 1. An employee falsely claimed to be going on a
  business trip and signed out a state vehicle for
  that trip. He actually went to visit family, and
  got into a car accident in the state vehicle. He
  attempted to cover it up but the vehicle was
  damaged and an investigation revealed there was
  no business purpose for the trip or vehicle use.

19
Recent Examples of Internal Control Breaches at
UAlbany

• 2. An employee used a state vehicle to go off
  campus to dine without the knowledge or approval
  of his supervisor. The employee also did not use
  break time but rather stayed on the clock while
  dining off campus.

20
Recent Examples of Internal Control Breaches at
UAlbany

• 3. State owned property and equipment is for
  official University business only. Several
  instances of inappropriate use of state assets
  have been uncovered, including use of fax
  machines and copiers to support a political
  candidate and use of laundry equipment for
  personal wash.

21
Recent Examples of Internal Control Breaches at
UAlbany

• 4. Employees who are on the clock are expected
  to be working as they are being paid by the state
  to work. Several recent cases have arisen of
  employees being caught sleeping on the job either
  by other employees or by students.

22
Recent Examples of Internal Control Breaches at
UAlbany

• 5. Employees are expected to be honest on their
  job applications, but supervisors must thoroughly
  check references and backgrounds before hiring an
  applicant. One employee checked on his
  application that he had never been convicted of a
  felony but then was overheard remarking that he
  had. An investigation revealed that he had in
  fact been convicted and falsified his
  application.

23
Recent Examples of Internal Control Breaches at
UAlbany

• 6. Reports containing personal identifiable
  information for students were being left in
  recycling bins without any assurance or guarantee
  that the information was being shredded or
  properly secured before disposal.

24
Internal Controls are IMPORTANT for every area
of the University

• No matter how big or how small the department is
• No matter whether or not the department handles
  money
• No matter whether or not the department handles
  confidential information

25
Who has a role in Internal Controls?
Everyone!
26
Who is responsible for Internal Controls?

• Every employee has the responsibility to help
  ensure that internal controls are effective by
  following controls and reporting problems or
  suggesting improvements
• The greatest amount of responsibility rests with
  deans, department chairs, and managers to assure
  appropriate controls are in place for all
  operations
• The President has the ultimate responsibility,
  and must sign the annual certification that
  UAlbany is in compliance with the Internal
  Control Act

27
What can you do?

• Follow the policies and procedures in place for
  your job.
• Always lock the door when you leave.
• Keep documents containing confidential or
  sensitive data in secure files.
• Shred documents containing confidential or
  sensitive data when no longer
  needed.

28
What can you do?

• Save files containing Personal Identifiable
  Information on your departmental drive, not your
  PCs hard drive.
• Do not share or post computer passwords.
• Always turn off your computer when you leave for
  the day.
• Use password-protected screensavers.
• Do not download any free items or software from
  the Internet.

29
What can you do?

• Communicate problems with current procedures or
  suggestions for improvement to your supervisor.
• Report any suspicious persons or activities to
  your supervisor, to the Internal Control
  Coordinator, or to the Internal Control Hotline.

30
Internal Control Program Contacts

• Darri Scalzo, Internal Control Coordinator
• Phone [phone]
• E-mail dscalzo_at_uamail.albany.edu
• http//www.albany.edu/internalcontrol/

31
Other Important Contacts

• Martin Manjak, Information Security Officer
• Phone [phone]
• E-mail mmanjak_at_uamail.albany.edu
• http//www.albany.edu/its/besecure.htm
• Janet Thayer, Associate Counsel
• Phone [phone]
• E-mail jthayer_at_uamail.albany.edu

32
Internal Control Hotline

• Confidential and anonymous means of
• reporting observed or suspected wrongdoing,
• maintained by the Office of Audit and Management
  Services.
• 437-4738
• ichotline_at_uamail.albany.edu
• http//www.albany.edu/ichotline/

33
To provide an audit trail of who has
received this state-required Internal Control
training, please click on the link below and
complete the attached form before closing this
presentation.www.albany.edu/internalcontrol/ICTra
iningRecord.shtml
Please note that the link may not work if you are
using a browser other than Internet Explorer. In
that case, you can copy and paste the link
directly into your web browser.

• Thank you for your participation!