2013-14 Internal Control Questionnaire

flutheronioneyedSoftware and s/w Development

Dec 13, 2013 (3 years and 6 months ago)

71 views




107 East Madison Street



Caldwell Building


Tallahassee, Florida 32399


www.floridajobs.org









2013
-
14 Internal Control Questionnaire


Bureau of Financial Monitoring
and

Accountability

Florida Department of Economic Opportunity


September 9
, 2013







Florida
Department of Economic Opportunity

201
3
-
1
4

Internal Control Questionnaire



September 9
,
2013











Page
2

of
21



TABLE OF CONTENTS

OVERVIEW

................................
................................
................................
................................
.....................

3

PART 1: CONTROL ENVIRONMENT

................................
................................
................................

7

PART 2: RISK ASSESSMENT

................................
................................
................................
.................

10

PART 3: CONTROL ACTIVITIES

................................
................................
................................
........

13

PART 4: INFORMATION AND COMMUNICATION

................................
................................
.

16

PART 5: MONITORING ACTIVITIES

................................
................................
...............................

19


Florida Department of Economic Opportunity

201
3
-
1
4

Internal Control Questionnaire


September 9
,
2013













Page
3

of
21

OVERVIEW


I
ntroduction and Purpose

The Internal Control Questionnaire (ICQ) has been developed by the
Department of Economic
Opportunity

(
DEO
) as a self
-
assessment tool
to help
evaluat
e

whether a system of sound internal control

exi
s
ts

within the

Regional Workforce Board (RWB)
. A
n
effective

system of internal control provides
reasonable assurance that management’s goals are being properly pursued.

Each
RWB
’s
management team
sets the tone and has
ultimate responsibility for a strong system of internal control
s.



The ICQ should be
submitted by the Executive Director
. R
esponses
should
reflect
the
controls in place
when

the questionnaire is completed.


Overview of Internal Controls

Definition
and Objectives
of Internal Controls


I
nternal control
is

a process, effected by an entity’s board of directors, management and other personnel,
designed to provide "reasonable assurance" regarding the achievement of objectives in the following
categories:




Effectiveness and efficiency of operations



Reliability
of financial reporting



Compliance with applicable laws and regulations


The concept of reasonable assurance implies that the internal control system for any entity, will offer a
reasonable level of assurance that operating objectives can be achieved.




Florida Department of Economic Opportunity

201
3
-
1
4

Internal Control Questionnaire


September 9
,
2013













Page
4

of
21

Need for Internal Controls


Internal controls help to ensure the direction, policies, procedures, and practices designed and approved by
management and the governing board are put in plac
e and are functioning as designed/desired
.
In addition,
t
he A
-
102
Common Rule and OMB Circular A
-
11
0

(2 CFR Part 215) require that non
-
Federal entities
receiving Federal awards establish and maintain
effective control over and accountability for all funds
,

property
,

and other assets.


I
nternal control
s should be

designed

to
achieve the objectives described above,
adequately safeguard assets
from loss or unauthorized use or disposition,
and
to provide
assur
ance that
these assets

are used solely for authorized purposes in

compliance with Federal laws, regulations, and
progr
am compliance requirements.


What Internal Controls Cannot Do


As important as an internal control system is to an organization, an effective system will not guarantee an
organization
’s

success.

Effective internal controls can keep the right people
, such as management and the
governing board members,
informed about the organization’s operations and progress toward goals and
objectives.

However, these controls cannot protect against economic downturns or make an understaffed
entity operate at full c
apacity.

Internal controls can
only
provide
reasonable
, but not absolute,

assurance

that the
entity’s objectives can be met
. D
ue to limitations inherent t
o all internal controls systems, b
reakdowns in
the internal control system
may be caused by
a simple

error or mistake,

or by

faulty judgments made at any
level of management.

In addition, controls
may
be circumvented by collusion or by management override.

T
he design of th
e internal controls system is dependent upon
the resources available,
which
mean
s

there
must be a cost
-
benefit analysis performed
as part of
design
ing

the
internal control
system.





Florida Department of Economic Opportunity

201
3
-
1
4

Internal Control Questionnaire


September 9
,
2013













Page
5

of
21

Five
Components

of Internal Control




Control Environment



is the set of standards, processes, and structures that provide the basis for
carrying out internal control across the organization.

The board of directors and senior
management establish the tone at the top regarding the importance of internal control a
nd expected
standards of conduct.



Risk Assessment



involves a dynamic and iterative process for identifying and analyzing risks to
achieving the entity’s objectives, forming a basis for determining how risks should be managed.
Management considers possibl
e changes in the external environment and within its own business
model that may impede its ability to achieve objectives.



Control Activities



are the actions established by policies and procedures to help ensure that
management directives to mitigate ri
sks to the achievement of objectives are carried out.


Control
activities are performed at all levels of the entity and at various stages within business processes, and
over the technology environment.



Information and Communication



are

necessary for the entity to carry out internal control
responsibilities in support of achievement of its objectives.

Communication occurs both internally
and externally and provides the organization with the information needed to carry out day
-
to
-
day
int
ernal control activities.

Communication enables personnel to understand internal control
responsibilities and their importance to the achievement of objectives.



Monitoring



are ong
oing evaluations, separate evaluations, or some combination of the two use
d
to ascertain whether each of the five components of internal control, including controls to effect the
principles within each component, are present and functioning.

Findings are evaluated and
deficiencies are communicated in a timely manner, with serio
us matters reported to senior
management and to the board.




Florida Department of Economic Opportunity

201
3
-
1
4

Internal Control Questionnaire


September 9
,
2013













Page
6

of
21

Makeup

of the Questionnaire

S
ubsequent sections of this document
emphasize

the “17 Principles” of internal control

developed by the
Committee of Sponsoring Organizations of the Treadway Commission (COSO) and presented in the
Internal Control


Integrated Framework (2013)
. The principles are

reflected in
groupings of questions
related to major areas of control focus w
ithin the organization.
The sections

of the ICQ
are:




Control Environment



Risk Assessment



Control Activities



Information and Communication



Monitoring


E
ach
question

represents an element or characteristic of control that is or can be used to promote the
assurance that operations are executed as management intended.


It should be noted that entities may have adequate internal controls even though some or all of the
listed
characteristics are not present. Entities could have other appropriate internal controls operating effectively
that are not included here. The entity will need to exercise judgment in determining the most appropriate
and cost effective internal co
ntrol in a given environment or circumstance to provide reasonable assurance
for compliance with Federal program requirements.


Completing the Document

S
elect Yes, No, N/A
,

or provide a response for

each
question as it relates to your
RWB
. An
swers should
r
eflect
your

current
operating
environment.

R
eplies marked "No" or "N/A" should include an explanation

which details a
ny
compensating
controls

which are in place.




Certification
of Self
-
Assessment of Internal Controls

Attachment
A
,
i
ncludes a certification which should be completed and signed by the Executive Director,
and
uploaded to SharePoint.


Florida Department of Economic Opportunity

201
3
-
1
4

Internal Control Questionnaire


September 9
,
2013













Page
7

of
21

PART 1: CONTROL ENVI
RONMENT



Purpose:


The questions provide a framework for performing a
self
-
assessment

of the inter
nal control environment of
the
entity.


Principles

of the Control Environment
:


Principle 1: The organization demonstrates a commitment to integrity and ethical values.


Principle 2: The board of directors demonstrates indepe
ndence from management and exercises oversight
of the development and performance of internal control.


Principle 3: Management establishes, with board oversight, structures, reporting lines, and appropriate
authorities and responsibilities in the pursuit
of objectives.


Principle 4: The organization demonstrates a commitment to attract, develop, and retain competent
individuals in alignment with objectives.


Principle 5. The organization holds individuals accountable for their internal control responsibil
ities in the
pursuit of objectives.









Florida Department of Economic Opportunity

201
3
-
1
4

Internal Control Questionnaire


September 9
,
2013


















Page
8

of
21

Control Environment

Is the control present?


Yes

No

N/A

Comments/Explanations

Principle 1. The organization demonstrates a commitment to integrity and ethical values.


1.

Are management and
the board of directors expectations translated
into an organizational statement of beliefs, values, and standards of
conduct for staff to adhere to?











2.

Are the
RWB’s

standards of conduct communicated and reinforced
not only to all levels of the
RWB

but also to outsourced service
providers?











3.

Are processes in place to evaluate the performance of staff and
outsourced service providers against the entity’s expected standards
of conduct?










Principle 2. The board of directors demonstrates independence from management and
exercises oversight of the development and performance of internal control.


4.

Does the Board of Directors define, maintain, and periodically
evaluate the skills and
expertise needed among its members to enable
them to question and scrutinize management’s activities

and p
resent
alternate views?










5.

Is there a committee that oversees
internal control over financial
reporting

and

the integrity and transparency of
those

report
s
?










6.

Does the board establish the expectations and evaluate the
performance of the chief executive o
fficer or equivalent role?










Principle 3. Management establishes, with board oversight, structures, reporting lines, and
appropriate authorities and responsibilities in the pursuit of objectives.


7.

Is the organizational structure appropriate for the size and
complexity of the
RWB
?










8.

Have specific lines of authority and responsibility been established to
ensure compliance with federal and state laws and regulations?










9.

Does RWB management/board understand the importance of
internal controls, including the division of responsibility
?











Florida Department of Economic Opportunity

201
3
-
1
4

Internal Control Questionnaire


September 9
,
2013


















Page
9

of
21

Control Environment

Is the control present?


Yes

No

N/A

Comments/Explanations


Principle 4. The organization demonstrates a commitment to attract, develop, and retain
competent individuals in alignment with objectives.


10.

Are there regular evaluations of employee job
performance
documented and shared with the employee?










11.

Does the RWB
provide the mentoring and training needed to attract,
develop, and retain sufficient and competent personnel
?










12.

Does the RWB check credentials and references of new employees?










Principle 5. The organization holds individuals accountable for their internal control
responsibilities in the pursuit of objectives.


13.

Does the RWB hold periodic training to ensure
employees are aware
of their duties pertaining to internal control (e.g. segregation of
duties, safeguarding RWB assets)?










14.

Can the RWB substantiate that employees are aware of their duties
pertaining to internal control? How?







15.

Are disciplinary action measures documented and available for
employee review?












Florida Department
of Economic Opportunity

201
3
-
1
4

Internal Control Questionnaire


September 9
,
2013













Page
10

of
21

PART 2:
RISK
ASSESSMENT


Purpose:


The questions provi
de a framework for identifying and analyzing risks to achieving the entity’s objectives
.


Principles of
Risk
Assessment
:



Principle 6: The organization specifies objectives with sufficient clarity to enable the
identification and
assessment of risks relating to objectives.


Principle 7: The organization identifies risks to the achievement of its objectives across the entity and
analyzes risks as a basis for determining how the risks should be managed.


Principle
8: The organization considers the potential for fraud in assessing risks to the achievement of
objectives.


Principle 9: The organization identifies and assesses changes that could significantly impact the system of
internal control.


Florida Department of Economic
Opportunity

201
3
-
1
4

Internal Control Questionnaire


September 9
,
2013
















Page
11

of
21


Risk Assessment

Is the control present?


Yes

No

N/A

Comments/Explanations

Principle
6. The organization specifies with sufficient clarity to enable the identification and
assessment of risks relating to objectives.


16.

Does the RWB specify objectives with sufficient clarity to enable
the identification and assessment of risks that
threaten the
achievement of objectives?










17.

Does management use operations objectives as a basis for allocating
resources needed to attain desired operations

and financial
performance
?










18.

How does
management consider materiality in financial statement
presentation
?







Principle 7. The organization identifies risks to the achievement of its objectives across the
entity and analyzes risks as a basis for determining how the risks should be managed.


19.

Does
management ensure that risk identification considers both
internal and external factors and their impact on the achievement of
objectives?










20.

Does management ensure that the
risk assessment includes
considering how risks should be managed and whether to accept,
avoid, reduce, or share the risks?










21.

Does the RWB develop performance indicators for key objectives
and monitor the status of those indicators on a regular basis?










Principle 8. The organization considers the potential for fraud in assessing risks to the
achievement of o
b
jectives.


22.

Does the RWB periodically perform an assessment of its
susceptibility to fraudulent activity and whether any exposure could
materially impact operations?










23.

Does the RWB periodically perform
an assessment of each
operating location’s susceptibility to fraudulent activity in
determining how those locations should be monitored?










24.

Does the assessment of fraud risk consider opportunities for
unauthorized acquisition, use, or disposal of assets, altering of the
entity’s reporting records, or committing other inappropriat
e acts?










Florida Department of Economic
Opportunity

201
3
-
1
4

Internal Control Questionnaire


September 9
,
2013
















Page
12

of
21

Risk Assessment

Is the control present?


Yes

No

N/A

Comments/Explanations


Principle 9. The organization identifies and assesses changes that could significantly impact
the system of internal

control.


25.

Does the RWB have mechanisms in place to anticipate, identify,
and react to risks presented by changes in government, regulatory,
economic, operating, or other conditions that could affect the
achieveme
nt of its goals and objectives?










26.

Identify the three most significant risks to the RWB.







2
7
.

Considering the risks identified above, have controls been designed
and implemented that mitigate risks associated with each?











Florida Department of Economic Opportunity

201
3
-
1
4

Internal Control Questionnaire


September 9
,
2013













Page
13

of
21

PART 3: CONTROL ACTI
VITIES


Purpose:


The questions provide a framework for performing a
self
-
assessment of the Control
Activities

within your
entity.


Principles of Control Activities
:



Principle 10: The organization selects and develops control activities that contribute to the mitigation o
f
risks to the achievement of objectives to acceptable levels.


Principle 11: The organization selects and develops general control activities over technology to support the
achievement of objectives.


Principle 12: The organization deploys control activit
ies through policies that establish what is expected and
procedure
s that put policies into action.












Florida Department of Economic Opportunity

201
3
-
1
4

Internal Control Questionnaire


September 9
,
2013


















Page
14

of
21

Control Activities

Is the control present?


Yes

No

N/A

Comments/Explanations

Principle 10. The organization selects and develops control activities that contribute to the
mitigation of risks to the achievement

of objectives to acceptable levels.


2
8
.

Does management determine which relevant business processes
require control activities?










29
.

Does management consider control activities at various levels in
the RWB?










3
0
.

Does management segregate incompatible duties, and where such
segregation is not practical, does management selec
t and develop
alternative control activities?










Principle 11. The organization selects

and develops general control activities over technology
to support the achievement of

objectives.


3
1
.

Does management select and develop control activities that are
designed and implemented to restrict technology access rights to
authorized users
commensurate with their job responsibilities and
to protect the entity’s assets from external threats?










3
2
.

Does management select and develop control activities over the
acquisition, development, and maintenance of technology and its
infrastructure to achieve management’s objectives?










33.

Does the RWB have a process that requires regular back
-
up of
computer files and testing of the back
-
up files to ensure proper
functionality?










Principle 12. The organization deploys

control activities through policies that establish what
is expected and in procedures that put policies into action.


34.

Does the RWB have policies and procedures addressing proper
segregation of duties between the authorization, custody, and
recordkeeping for the following tasks, if applicable: Prepaid
Program Items (Participant Support Costs), Cash/Rec
e
ivables,
Equipment, Payables/Disbursements, Procurement/Contracting,
and Payroll/Human Resources? If no, please identify which
function(s) may

be lacking the appropriate separation of duties
and describe any compensating controls in place.












Florida Department of Economic Opportunity

201
3
-
1
4

Internal Control Questionnaire


September 9
,
2013


















Page
15

of
21

Control Activities

Is the control
present?


Yes

No

N/A

Comments/Explanations

35.

Does management periodically review policies and procedures to
determine their continued relevance, and refresh them when
necessary?










36.

Does the RWB have policies and procedures in place to facilitate
transactions being recorded, accounted for, and executed in
compliance with laws, regulations, and provisions of contracts and
grant agreements?










Florida Department of Economic Opportunity

201
3
-
1
4

Internal Control Questionnaire


September 9.

2013












Page
16

of
21

PART 4:
INFORMATION AND COMM
UNICATION


Purpose:


The questions provide a framework for performing a self
-
assessment of the Information and
Communication processes within your

entity.


Principles of
Information and Communication:


Principle 13: The organization obtains or generates and uses relevant, quality information to support the
functioning of other components of internal control.


Principle 14: The organization internall
y communicates information, including objectives and
responsibilities for internal control, necessary to support the functioning of other components of internal
control.


Principle 15: The organization communicates with external parties regarding matters a
ffecting the
functioning of other components of internal control.



Florida Department of Economic Opportunity

201
3
-
1
4

Internal Control Questionnaire


September 9
,
2013

















Page
17

of
21

Information and Communication

Is the control present?


Yes

No

N/A

Comments/Explanations

Principle 13. The organization obtains or generates and uses relevant, quality information to
support the functioning of
other components of
internal control.


37
.

Are new federal, state, or grant program rules or regulations reviewed
with one or more of the following: governing board, audit, finance or
other committee?










38
.

Does the RWB maintain and follow procedures for record filing,
retention, and dispos
al

of
accounting
records and supporting
documentation in accordance with applicable regulations?










39
.

Does the RWB’s accounting system provide for separate
identification of federal grant transactions and non
-
federal
transactions and allocations of transactions that benefit both
?










Principle 14. The organization internally communicates information, including objectives and
responsibilities for internal control, necessary to support the functioning of
other components of
internal control.


40.

What communication exists between
management and the board of
directors so that both have information needed to fulfill their roles
with respect to the RWB’s objectives?







4
1
.

Does the Code of Conduct, or other
policies, expressly prohibit
override of internal controls by management?










4
2
.

Does management have a process for the development, approval and
implementation of policy updates, including communication of those
updates to staff?










Principle 15. The organization communicates with external parties regarding matter
s

affecting
the functioning of
other components of
internal control.


4
3
.

Does the RWB have a Whistleblower policy for people to report
suspected improprieties regarding fraud; errors in financial reporting,
procurement, and contracting; improper use or disposition of
equipment; and misrepresentation or false statements?










4
4
.

Are processes in place to communicate relevant and timely
information to external parties?












Florida Department of Economic Opportunity

201
3
-
1
4

Internal Control Questionnaire


September 9
,
2013

















Page
18

of
21

Information and Communication

Is the
control present?


Yes

No

N/A

Comments/Explanations

45
.

Does the RWB have processes in place to
communicate the results
of

reports provided by the following external parties:
Independent
Auditor,
DEO Bureau of Financial Monitoring and Accountability
(FMA), DEO Bureau of One
-
Stop and Program Support, DEO
Office of Inspector General, Florida Auditor General, and Federal
Awarding Agencies (USDOL, USDHHS, and USDA)

to the Board
of Directors
?










Florida Department of Economic Opportunity

201
3
-
1
4

Internal Control Questionnaire


September 9
,
2013












Page
19

of
21

PART 5:
MONITORING
ACTIVITIES


Purpose:


The questions provide a framework for performing a self
-
assessment of the Monitoring Activities within
your entity.


Principles of Monitoring Activities:


Principle 16: The organization selects, develops, and performs ongoing and/or
separate evaluations to
ascertain whether the components of internal control are present and functioning.


Principle 17: The organization evaluates and communicates internal control deficiencies in a timely manner
to those parties responsible for taking co
rrective action, including senior management and the board of
directors, as appropriate.



Florida Department of Economic Opportunity

201
3
-
1
4

Internal Control Questionnaire


September 9
,
2013

















Page
20

of
21

Monitoring Activities

Is the control present?


Yes

No

N/A

Comments/Explanations

Principle 16. The organization selects, develops, and performs ongoing and/or separate
evaluations to ascertain whether the components of internal control

are present and functioning.


46
.

Does the RWB periodic
ally

evaluat
e

business processes such as

cash
management, budget to actual results, repayment or reprogramming
of interest earnings, draw down of funds, procurement, and
contracting activities?










47.

How does the RWB ensure compliance with period of availability
requirements?







48
.

Does RWB management periodically visit One
-
Stop locations and
other decentralized locations (including subrecipients) to determine
whether policies and procedures are being followed as intended?










Principle 17. The organization evaluates and communicates internal control deficiencies in a
timely manner to those parties responsible for taking corrective action, including senior
management
and the board of directors, as appropriate.


49
.

Does
the
RWB periodically evaluate internal controls, test for
compliance with federal requirements, and communicate the results
of those evaluations to the RWB’s Board of Directors?










5
0
.

Does the RWB monitor subrecipients
to ensure the federal funds
provided are expended only for allowable activities
,

goods
,

and
services and communicate the monitoring results to the RWB’s
Board of Directors?













Florida Department of Economic Opportunity

201
3
-
1
4

Internal Control Questionnaire


September 9
,
2013












Page
21

of
21

Attachment A


Department of Economic Opportunity

Certification
of Self
-
Assessment of Internal Controls


Regional Workforce Board
:







To be completed by the Executive Director


A self
-
assessment of internal controls has been conducted for the fiscal period beginning July 1, 201
3

(fiscal
period 201
3
/1
4
). As part of this self
-
as
sessment, the Internal Control Questionnaire developed by the
Department of Economic Opportunity
has been completed and is available for review. Any items noted
with “
N/A
” or “
N
o” answers have been explained in the Comments sections included with this
I
nt
ernal
C
ontrol Questionnaire.


Signature: ____________________________


Printed Name:







Title:







Date:








Please scan and
upload to SharePoint
an executed copy of this certification on or before
October 2
, 201
3
.