Documenting Internal Controls Over Financial Reporting

1
Documenting Internal Controls Over Financial
Reporting

• Scott Heid, Sharon Salembier, Theresa Lawrence,
  Heather Pratt

2
Background

• KPMGs Management Letter Comment in the 2004-2005
  CAFR Internal controls in place at State
  agencies that report financial information to the
  Office of the State Comptroller (OSC) are not
  sufficiently documented nor tested by management

3
Background (cont.)

• DOB, KPMG, OSC agreed to address comment by.
• Eight audits of State agencies, documentation of
  internal controls over key financial areas!!!!!!

4
Agencies and Key Areas

• State Education Dept
• Tax and Finance
• Health
• Labor
• Court Administration
• Corrections
• Transportation
• Temporary Disability Assistance

• State Aid
• Personal Income Tax
• eMedNY system
• Unemployment Ins
• Payroll
• Payroll
• Capital Assets
• Automated Claiming System

5
COSO !!!

• We used OSCs Standards for Internal Controls in
  NYS Government (which includes the five COSO
  elements) to judge the adequacy of documentation
  of each COSO element for the selected key area

6
What are the COSO Elements?

• Control Environment
• Information and Communication
• Risk Assessment
• Control Activities
• Monitoring

7
What did we find?

• Overall, agencies had good support for internal
  controls over the areas we looked at
• Butheres what agencies can do better

8
Areas We Can Work On

• Risk Assessment
• Agencies didnt always have their risk assessment
  process in writing
• Agencies either didnt do risk assessments for
  what they considered low-risk areas, or they did
  risk assessments but didnt document them well
• Some risk assessments were not current
• Not all risk assessments included a section for
  identifying and evaluating new risks

9
Areas We Can Work On (cont.)

• Control Environment
• Survey of control environment we didnt see
  these performed at any agencies. Surveys can
  help management form a conclusion about whether
  its control environment supports or detracts from
  its mission and objectives.

10
Best Practices

• Commissioner involvement/support of Internal
  Control efforts
• Frequent Risk Assessments based on level of risk
  (i.e. high-risk issues are evaluated more often)

• Internal Control Unit
• Website/page dedicated to Internal Controls
• Highly involved Internal Control Officer (higher
  level officials)
• Internal Control training available to all
  employees via various media

11
The Team (minus Scott)