Internal control is an ongoing process designed to provide reasonable assurance regarding the achievement of objectives such as effective and efficient operations, reliable financial reporting, compliance with laws and regulations and safeguarding assets.
- Types of Internal Controls
- Internal Control Components
- Why Do We Need Internal Controls?
- What Can Happen When Internal Controls Are Weak or Non-Existent?
- Who Is Responsible for Internal Controls?
- Limitations of Internal Controls
Types of Internal Controls
- Preventive: Designed to keep errors or irregularities from occurring in the first place. Example: Adequate separation of duties -- not having the same person authorize and process transactions.
- Detective: Designed to detect errors or irregularities that may have occurred. Example: Periodic audits -- independent external and internal audits help to uncover errors, irregularities and noncompliance with laws and regulations.
- Corrective: Designed to correct errors or irregularities that have been detected. Example: Training employees on new policies and procedures developed as part of corrective actions.
Internal Control Components
- Control Environment is the organizational structure and culture created by management and employees to sustain organizational support for effective internal control.
- Risk Assessment is a process of analyzing potential risks and determining what impact they may have on achieving NOVA’s objectives.
- Control Activities are policies and procedures established and implemented to help ensure the risk responses are effectively carried out. Control activities occur throughout an organization, at all levels and in all functions.
- Information and Communication entails communicating relevant information in a timeframe to enable people to carry out their responsibilities.
- Monitoring Activities is the process of assessing the presence and functioning of internal control components and making continuous improvements.
Why Do We Need Internal Controls?
Internal controls are essential to the success of NOVA's business operations. They help management in carrying out their duties and operating responsibilities. Internal controls assist in the following:
- Facilitate the preparation of timely and accurate financial reports and information.
- Ensure that NOVA complies with applicable federal and state laws and regulations.
- Foster effective and efficient campus operations.
What Can Happen When Internal Controls Are Weak or Non-Existent?
Weak or non-existent internal controls allow for potential fraud, errors and unintentional mistakes to go undetected for a long period of time. A weakness in internal control may expose NOVA to one or more of the following type of risks:
- Destruction of assets (both physical assets and information).
- Theft of assets.
- Corruption of information or the information system (containing errors).
- Inaccurate financial reporting.
Indication of weak or non-existent controls include:
- Equipment, supplies, inventory, cash and other assets that are not protected.
- Responsibility for custody of assets not separate from record keeping responsibility.
- Control records not maintained.
- College policy and procedure manuals not available or outdated.
- No formal back up procedures exist.
- Relevant information not available.
- Signature authority delegated without adequate consideration.
- Documentation does not exist or is out of date.
Who Is Responsible for Internal Controls?
Auditors, right? Wrong! Everyone plays a part in NOVA’s internal control system. Ultimately, it is NOVA management's responsibility to ensure that controls are in place. That responsibility is delegated to each area of operation, which must ensure that internal controls are established, properly documented and maintained. Every employee has some responsibility for making the internal control system function.
Limitations of Internal Controls
No matter how well internal controls have been designed, they cannot eliminate all risks -- they can only provide reasonable assurance that objectives have been achieved. Some limitations are inherent in internal control systems.