- Does your management philosophy and style communicate high expectations regarding integrity and ethical values? Are your directives and actions consistent with these expectations?
- Is the organizational structure in your area clearly defined?
- Are human resources policies clearly communicated to your personnel?
- Have all important expectations or “policies” been formalized and communicated to your personnel?
- Do you reprimand inappropriate behavior in a consistent manner regardless of the individual’s position or status? Is this done in a timely and direct manner?
- Have you identified your organization’s customers and/or clients? Is your area perceived by these groups as one where there are fair and honest dealings?
- Do you expect full compliance with laws, regulations and policies?
- Are the number of requests to approve exceptions to established policy kept to a minimum? Are such approvals always documented?
- Are realistic performance objectives set for your personnel?
- Are job descriptions accurate and up to date? Do they include all major expectations?
- Do your personnel have the knowledge and skills required for their positions?
- Do you provide adequate training for all categories of personnel?
- Is employee turnover in your area at an acceptable level? If turnover is excessive, do you know the root causes?
- Are accounting and budgeting activities an integral part of your decision making processes?
- Do management reports tell the whole story? Are they timely and do they raise “red flags” where appropriate?
- Are your employees appropriately empowered and given adequate resources to fulfill their responsibilities?
Risk Assessment
- Have department or division objectives been established?
- Have activity-level objectives also been established?
- Are there documented objectives for all key activities?
- Do they include statements of purpose regarding operations, reporting and compliance?
- Are they realistic and consistent with past practices and performance, or with relevant benchmarks?
- Are they periodically reviewed and updated?
- Do they include measurement criteria?
- Have the objectives been prioritized?
- Were all employee levels represented in establishing the objectives?
- Have risks or obstacles to achieving each objective been identified?
- Were risks from external sources (suppliers, technology changes, economic and political conditions, regulations, etc.) adequately considered? Were risks from internal sources (employee turnover, morale and commitment to objectives, performance of information systems, etc.) adequately considered?
- Have the risks been prioritized?
- Was there an evaluation of the likelihood of occurrence?
- Has the potential monetary impact been estimated?
- Have the risks been categorized as (a) tolerable or (b) requiring action?
- Were appropriate levels of management involved in analyzing the risks?
- Have overall strategies for managing important risks been established?
- Have specific assignments and activities necessary to implement the strategies been identified and communicated to the responsible employees?
Control Activities
Have you considered necessary control activities for each of your operations? For example:
- Do you and your employees evaluate performance with regard to established objectives? Are these evaluations based on previously agreed upon standards?
- Are all new programs or activities formally authorized in advance?
- Are you currently operating within budget? Did you complete last year within budget?
- Are important financial and operating reports routinely reviewed and shared with your key personnel?
- Are key reconciliations prepared and reviewed?
- Do you or your key managers review and approve all financial transactions?
- Do you track the location and use of all equipment? Is missing equipment investigated? Are there additional controls for equipment checked out to individuals or taken off campus?
- Do you provide adequate physical security for cash and other assets subject to theft?
- Do you provide adequate guidance and training for personnel who have responsibility for cash and similar assets?
- Are individuals who control assets prohibited from also recording transactions related to those assets? For example, is the cashier not allowed to handle record keeping for accounts receivable?
Please list the primary control activities you rely upon in managing your organization.
Information and Communication
- Do you receive relevant information regarding legislation, regulatory developments, economic changes, or similar external factors that may affect your organization?
- Is key information about your organization’s operations identified and regularly reported?
- Do managers receive sufficient information to carry out their responsibilities?
- Is the information understandable and usable?
- Is information available in a timely manner?
- Is there a means for you to identify emerging information needs?
- Are plans for the effective use of information technology developed and linked with strategic initiatives? Are the plans consistent with available resources?
- Are training, meetings, seminars, on-the-job supervision sufficient to communicate to the employees their duties and responsibilities?
- Is there a way to communicate suspected improprieties upstream through someone other than a direct superior? Is the complainant protected from retaliation?
- Is trust actively promoted between employees, supervisors and departments?
- Are employees encouraged to provide recommendations for improvement? Are they recognized or rewarded for suggestions?
- Have you communicated your organization’s standards and expectations to key outside groups or individuals?
- Are client complaints taken seriously, investigated, and acted upon?
- Is there follow-up communications with the complainant?
- Is management aware of the nature and volume of complaints?
Monitoring
- Do you routinely evaluate the overall effectiveness of your internal control system?
- How do you monitor the control environment?
- Do you assess employee attitudes?
- Do you review your organization structure for effectiveness?
- Do you review and evaluate policies and procedures?
- Do you periodically evaluate the effectiveness of your risk assessment procedures?
- Do you regularly monitor the effectiveness of key control activities?
- Do you spot-check transactions, records, and reconciliations to ensure they meet your expectations?
- Do you randomly compare assets on hand (cash, inventories, etc.) to recorded amounts and investigate discrepancies?
- Are all information and communication systems periodically evaluated for accuracy, timeliness and relevance?
- Do you question financial and management reports that appear unusual or inconsistent?
- Does management encourage employees to provide feedback on whether controls operate effectively?
- Are there performance evaluations, at least annually, where employees and supervisors discuss expectations, goals and performance?