Internal control comprises the plan of organization and all of the coordinate methods and measures adopted to safeguard assets, check the accuracy and reliability of accounting data, promote operational efficiency, and encourage adherence to prescribed managerial policies. This definition possibly is broader than the meaning sometimes attributed to the term, It recognizes that a "system" of internal control extends beyond those matters which relate directly to the functions of the accounting and financial departments.

           Internal control, in the broad sense, includes controls which may be characterized as either accounting or administrative as follows:

          a.      Accounting controls comprise the plan of organization and   all methods and   procedures that are concerned mainly with, and related directly to, the safeguarding of assets and the reliability of the financial records. They generally include such controls as the system of authorization and approval, separation of record keeping duties so that one person does not have control over a complete transaction, accounting reports from those concerned with operations or asset custody, physical controls over assets, and internal auditing.

          b.      Administrative controls comprise the plan of organization and all methods and procedures that are concerned mainly with operational efficiency and adherence to managerial policies, and usually relate only indirectly to the financial records, They generally include such controls as statistical analyses, time and motion studies, performance reports, employee training programs, and quality controls.

          The ultimate responsibility for good internal controls rests with management, Internal controls should not be viewed as a separate specialized system, but rather should be recognized as an integral part of each system that management uses to regulate and guide operations.

          Internal controls, however, have limitations, They cannot provide absolute assurances that errors, omissions, or commissions of improper acts will not occur. Moreover, while internal control systems are necessary, each element must be weighed in terms of the cost benefit to be derived.

          Officials are often defensive when alerted to shortcomings in their internal control systems. The following are common reactions,

          a.      No defalcation or misappropriation was discovered.

          At audit closing conferences, after listening to control weaknesses and the problems which can develop, officials often comment that ",,.you didn't find any fraud." Because the audit disclosed no fraud there is a feeling of vindication. But there are no future guarantees, This attitude is an invitation to a future fraudulent act, sometimes by senior staff who realize the potential. Weak controls provide the breeding ground for the development of fraud and theft.

          b.      We're too busy providing program services.

          Officials frequently assert they are too busy providing program services to be bothered with internal controls. They are in business, they say, to provide health care, education or other essential government services, not to do bank reconciliation's.

          While their primary responsibility is indeed to pursue program goals, there is a collateral fiscal responsibility which cannot be disregarded .

          c.      There is not enough staff.

          This is perhaps the most common response given to deficiencies. However, in many cases a redistribution of tasks among existing staff can improve control. Also, where there is minimal staff, periodic supervisory review of tasks is essential.

          d.      There are outside controls.

          Many times officials ask, "Why restrictively endorse checks 'for deposit only'?" or "Why remove the signature space on voided checks?". They say that the banks would be liable for forgeries, so why bother? Taking these steps is a precaution,- It sets a climate in which potentially dishonest employees have no opportunity to steal.

          e.      Our employees are bonded,

          This may be true, but only after a $100,000 deductible per occurrence, and then recoupment occurs only if the fraud is detected, An agency's program(s) will be charged with any unrecovered loss as a matter of State policy.

          Decreasing government resources require that managers place greater emphasis on internal controls. The protection they provide will enable an agency to get the most benefit from available resources. Some fundamental internal controls plus additional control techniques are discussed in subsequent sections. However, it is incumbent upon managers to establish, and become familiar with, a system of internal control that will safeguard the assets under their responsibility. Detailed internal controls and internal control systems are described in many accounting and auditing texts and in publications of the American Institute of Certified Public Accountants and the Government Accounting Office.

          Once an adequate system of internal controls has been established, managers must continually monitor and test transactions for accuracy, -authorization, validity and accountability. For example, a manager might: trace a sample of receipts from source documents to bank deposits; review documentation supporting a sample of disbursements for reasonableness and propriety; make surprise cash counts; and participate in an inventory count of supplies or financial stationery. Other steps such as timely review of bank reconciliation are really not optional; these steps must be exercised, Managerial oversight of this nature provides for early identification of problems and corrective action. It also provides a deterrent to improprieties and early detection if improprieties are committed.

          The following sections contain internal control guidelines for: