Grants - Internal Controls

Auditors conduct their audit work in accordance with standards for the professional practice of internal auditing, as promulgated by the Institute of Internal Auditors (IIA). The IIA standards require examination and evaluation of the audited organization or function's system of internal control as part of an audit. Generally, the evaluations and the recommendations in audit report are presented within the context of the following definition and description of internal control.

Definition

Internal control is a process, effected by the Central Washington University Board of Trustees, administration, and especially line management. It is designed to provide reasonable assurance regarding the achievement of objectives in the following categories:

• effectiveness and efficiency of operations
• reliability of financial reporting
• compliance with applicable laws and regulations

Roles and Responsibilities

Line management, more than any other function, is directly responsible for Central Washington University activities, including its internal control system. The control system forms a framework of safeguards line management creates as part of its operating responsibilities to protect assets and use resources wisely. Financial and accounting officers provide direct help for management in establishing internal controls as well as influence the way management exercises oversight. The President of the institution, the departments heads, or Vice Presidents of divisions influence the control environment. They usually do not have direct responsibility for implementing and managing the control system, except among their individual office staffs.

Similarly, internal auditors contribute to the ongoing effectiveness of the internal control system. Governing boards provide important oversight to the internal control system. Other parties, such as external auditors, often provide information useful in affecting internal control. However, none of these has direct responsibility for internal control systems in the same manner as line management.

Line employees have responsibility for complying with internal controls. Employees should recognize when they comply with established internal controls, the controls actually protect them from accusations of misfeasance or malfeasance. Since line employees also carry out the day-to-day activities of Central Washington University, they should also recognize and note areas in which internal controls may be weak or non-functional. They and their managers may then devise remedies or change processes so employees can carry out their duties efficiently and effectively, while appropriately safeguarding the College's resources. Those who notice deficiencies but do bring the problem to management's attention can be considered somewhat culpable if those deficiencies lead to losses. It is management's responsibility to balance the risks and probability of loss against the cost of implementing controls to mitigate the risk.

Limitations

Internal controls, no matter how well designed and operated, can provide only reasonable assurance regarding the achievement of objectives in the areas mentioned above. The concept of reasonable assurance recognizes the cost of internal controls should not exceed the benefits derived and also recognizes evaluation of these factors requires estimates and judgement by management. For objectives related to the effectiveness and efficiency of operations, internal control can only help to ensure management is aware of the entity's progress or lack of it.

Limitations which may hinder the effectiveness of an otherwise adequate system of controls include:

• resource constraints
• inadequate skill, knowledge, or ability
• degree of motivation by management and employees
• faulty judgements
• unintentional errors

Additionally, controls can be circumvented by collusion of two or more people. Even more important to recognize, management has the ability to override the internal control system.

These factors, combined with changing needs and personnel, make it risky to project any evaluation of internal control to future periods. Management must evaluate on an on-going basis to keep controls effective. Management evaluation generally leads to periodic adjustments and corrective action; which also helps assure the continuing effectiveness of the internal control system.