This article assists the University community with questions about internal controls checklist provided from the Blink page: Best Practices in Internal Controls.
Q: How many months of performance and review do we need to go back and complete?
A: Departments will be required to document performance and certification for accounting periods starting with the effective date of the Internal Controls Policy in the Campus Policy and Procedure Manual. The effective date of the policy is February 29, 2024, so the March 2024 ledger is the appropriate starting point.
Q: Are departments required to complete all of the control activities listed in the checklist?
A: Yes, unless the control activity does not apply to the department’s operations and documentation to support explanations must exist. For example, some departments do not have sponsored awards or petty cash, so those activities will be marked as Not Applicable on the checklist.
Q: Do I need to review a report or transactions that were previously reviewed by myself or others?
A: No, but documentation of the prior review needs to be stored for use when the checklist is completed.
Q: Can I use alternative reporting that is not specifically identified in the checklist?
A: Yes, in some cases. Please document in the checklist the alternative reporting used and why it is used.
Q: How should documentation of performance and review be stored?
A: Certifiers will store documentation in a designated location electronically (for example, shared network drive, Google Drive, or SharePoint). Warning: Do not save to your personal computer.
Q: Will Audit and Management Advisory Services (AMAS) audit the checklist completed by departments to ensure all control activities are being reviewed and documented?
A: The internal controls policy establishes the requirement for departments to document the performance and certification of control activities and AMAS will audit the documentation. The checklist provided on Blink is the tool used to identify and capture the evidence of performance and certification. Alternative methods to capture the required documentation of evidence may be used by departments. Evidence must be retained by departments and available for audit by AMAS.
Q: How should my department complete the checklist?
A: Department heads establish and delegate responsibilities to performer and certifiers within the departments. Department heads are ultimately responsible for ensuring control activities have been completed.
Q: Do you know if the University or if schools have a certain materiality threshold? If they do what is the amount?
A: Overall, there are different materiality thresholds for different purposes, and its application across our campus community will be different and subjective.
Examples of materiality in use:
Q: Can sampling methods be used to review high risk transactions?
A: Yes. If errors are identified and need corrective action, then the department is required to identify the root cause of the error and document how internal controls will be strengthen and eliminate probability of future errors with the same cause.
Q: Which control activities can use an alternative report and which cannot?
A: Monthly Reporting tab reports are intended to be required reporting to ensure that all transactions and errors are being reviewed and corrected. It is possible an alternative report is used if it matches the requirements of the reports already listed there. Monthly UC Policy tab reports are intended to be done as required by UC policies, so I don't think there are alternative reports to use there, but we can discuss any concerns there. The Quarterly tab has some alternatives in the control activities.
Q: Can we combine our financial units into one workbook, or will we need to produce separate workbooks each month, one for each separate financial unit?
A: Yes, you can combine all results in one workbook. The checklist is a tool to help departments keep track of the work done.
Q: Several of the requested reports (like DOPEs) have sensitive payroll information on them, and we only use these reports when questions arise. Are we required to save these to cloud storage as well?
A: The reports can be saved in the place where required by the department's leadership. The intent is that documentation can be easily retrieved for audit purposes.
Q: Can a non-director (or non-manager) certify control activities?
A: Yes, if that is an approved delegation from the department's leadership, and approval is documented. Note: There should be appropriate separation of duties to ensure the work is not being done by the same person and the review can be carried out by someone with the appropriate skills and knowledge to detect errors.
Q: Can quarterly control activities be performed more frequently?
A: Yes. Each department can determine the need to complete quarterly activities more frequently, like monthly, based on risk assessment of their operations.
Q: How do I get help if I have questions about this checklist or its content?
A: Several options are available for obtaining support: