Insuring an effective internal control environment does not rest with one person. The board and administration establish specific internal control policies and procedures that are carried out by line staff, verified by internal auditors, and reviewed by external auditors. Each must do their part to ensure the effectiveness and continued refinement and reinforcement of internal controls.
Steps Toward Solid Internal Controls
School districts can establish solid internal controls by following these principles:
Segregation of duties is critical. No one person should be responsible for multiple facets of a single process, such as recording and processing a transaction, issuing checks and conducting the bank reconciliation, and closing out the daily revenue and making the bank deposit. A chain of accountability should involve several individuals.
In small offices with a limited number of employees, segregating duties can be difficult. Administrators might take on duties normally conducted by line staff to mitigate the risk, such as opening all mail to review invoices and bank statements. In all offices, regardless of size, requiring two signatures on checks will mitigate the risk of fraud.
Authorization and approvals should be restricted to administrators and those whom management has designated to perform authorizations and approvals.
Safeguarding of assets can be accomplished by using various controls, depending on whether the assets are inventory, cash, equipment, checks, credit and debit cards, and so forth.
Review and reconciliation can detect differences that require further investigation. Review and reconciliation should be applied to cash accounts, inventory, accounts receivable, accounts payable balances, and payroll, to mention a few.
Training and supervision mandate that controls be followed precisely; cross-training employees is a critical internal control that will expose irregularities should work be conducted by other employees.
Cost–benefit analysis should be conducted by administrators to determine whether the cost of implementing an internal control exceeds the value of the asset it is safeguarding.
Guidelines into Action
In developing internal controls, administrators should review and address each process in the context of the principles above. For example, the following procedures for cash receipts incorporate the guidelines:
- A specific employee is responsible for the following duties: (a) receiving and recording cash and (b) verifying that deposits agree with the general ledger and department records via bank reconciliations.
- One individual collects food service revenue while another reconciles cash register receipts and makes the deposit.
- Authorization and approvals
- Supervisors verify cash draw counts, cash shortages, and cash overages.
- Supervisors approve all voided transactions.
- Refunds require the individual’s name and address as well as a supervisor’s approval.
- Cash is kept in locked drawers or safes.
- If applicable, safe combinations are changed when staffing changes.
- Checks are endorsed immediately upon receipt.
- Review and reconciliation
- One staff member reviews daily revenue receipts with deposit slips. Another staff member reconciles deposit information with bank statements.
- If there are no internal auditors, the accounting staff accepts this role to review, reconcile, and verify that internal controls are followed throughout the year. Student-based activity accounts should be reviewed annually as an internal audit function.
- Variance audits of revenue and expenditures are conducted and analyzed regularly.
- External auditors review and reconcile yearly.
- Administration ensures that line staff members understand the importance of internal controls and receive the necessary training.
- Supervisor responsibilities are adequately delineated.
- Administration determines which costs are associated with hiring adequate staff to delineate responsibilities.
- Administration determines whether funds are adequate to provide for the segregation of duties.
Finance administrators can do everything right in planning and implementing internal controls, but it is up to the line staff to execute and maintain the integrity of the controls.
Finance administrators can do everything right in planning and implementing internal controls, but it is up to the line staff to execute and maintain the integrity of the controls. Unfortunately, well-intentioned individuals often thwart internal controls for a variety of reasons, including the following:
- Inadequate staffing levels prompt people to take shortcuts to save time.
- Ineffective communication about the control leads to misapplication.
- Inadequate reinforcement training sessions lead to a breakdown of the control over time.
- Employees modify controls because they think their way is better.
We have all read and heard about financial mismanagement in school districts; a few of us might have experienced it. Although members of the education sector are always eager to claim ownership of the great things they do, they are understandably reluctant to share their negative experiences. Unfortunately, the lack of sharing has consequences.
Consider the following case studies as an opportunity to learn from others’ mistakes.
Case Study: Multimillion Dollar Scandal
In his article “The Bad Superintendent,” New York magazine reporter Robert Kolker details the story of the largest school district theft in the nation—an estimated $11.2 million stolen over eight years.
The Roslyn, New York, school district had a reputation for stellar academic achievement, with many graduates going on to attend Ivy League schools. However, after a high school newspaper reporter followed up on a tip about a former assistant superintendent who had resigned for “health reasons,” the multiple layers of collusion, loose to no internal controls, and failure by the board of education and the external audit firm to fulfill their responsibilities came to light.
Although health was cited as the reason for the assistant superintendent’s departure, in truth, she had been caught embezzling $250,000. After consulting with a criminal lawyer, the superintendent chose not to report the theft to the police. Not wanting the negative publicity to affect the students, the board agreed to allow the assistant superintendent to resign and repay the stolen funds.
Two years after the resignation, anonymous letters were sent to political figures and law enforcement agencies, including the Nassau County district attorney’s office, which launched a criminal investigation. The letters made allegations against the assistant superintendent as well as the superintendent. As the investigation progressed, the school board members admitted they knew about the embezzlement and that the assistant superintendent may have stolen closer to $1 million.
The board fired the independent auditing firm and its general law firm. The school board filed an $11 million lawsuit against 10 former and current board members who had served when the embezzlement occurred.
The district sued the auditing firm, its partners, and the software firm controlled and operated by one of the partners for $12 million, leading to its dissolution.
The board vice president, who headed the audit committee, resigned. The superintendent and assistant superintendent were arrested on charges of first-degree larceny. The business clerk was arrested on charges of second-degree larceny. In addition, several district employees and board members were suspended or reassigned because of questionable expenses.
How did this happen? Lack of internal controls allowed fraud to occur in several processes. For example,
- Procurement—faked invoices, unauthorized credit card usage, no-bid contracts awarded to family and friends, contracts with no services rendered, personal items billed to district accounts
- Payroll—inflated salaries, false salary reports to pension systems to inflate retirement payments, illegal raises, and bonuses
- Financial software—vulnerabilities that allowed officials to manipulate the system to hide the thefts as legitimate spending
With district finances in the spotlight, the governor of New York signed the school fiscal accountability legislation into law, tightening fiscal controls for schools, requiring financial training for all board members, and mandating that the state comptroller audit all schools at least once.
Case Study: The Trusted Grandmother
Many irregularities come to light in a business when someone takes a vacation or retires. In this instance, after 42 years of service, the 74-year-old grandmother decided to retire as the bookkeeper for the school in a community with a population of 1,998.
While reviewing bank reconciliations, her replacement noticed what appeared to be altered checks. In a 10-year look-back, she discovered that the images of hundreds of unauthorized checks that had been written on the district account were intercepted after they cleared and altered to reflect a legitimate expense. Since most of the checks were for amounts under $400, and no deficit spending occurred in any budgeted line item, no red flags appeared.
The final tally came to $1,189,000; however, the true amount will never be known because the district’s look-back was limited to 10 years and the bookkeeper’s service spanned 42 years.
This case study is a prime example of how the internal control for segregation of duties might have prevented this theft. Certainly not being discovered emboldened the individual to continue the practice. She was sentenced to eight years in prison and ordered to pay $250,000 in immediate restitution, with the remainder being paid after her release from prison. Because she will be 82 years old upon release, it’s unlikely the district will ever see that money. Not only did the community suffer the loss of revenue, trust was destroyed.
Case Study: The Temptation of Cold Hard Cash
Internal audits should be conducted without alerting or involving those parties involved in the process being audited. The element of surprise is not detrimental to those staff members who are honest and display integrity.
During a routine revenue collection audit, an internal auditor discovered that event gate receipts had not been deposited. A surprise audit of the school’s process uncovered the fact that there was no documentation of amounts collected and that all the cash was being kept in unlocked filing cabinets in a room accessible by other staff members. The school had a safe, but it could not hold $42,000 in mostly $1 bills.
In this instance, theft (skimming) could have been done by ticket booth personnel, by the athletic department personnel who collected the gate receipts from the booths, by staff members who could access the filing cabinets, and in the business office where someone could deposit arbitrary amounts with no one being the wiser.
The district immediately implemented a ticket system for cash verification and established additional internal controls to segregate various aspects of the collection process.
Lines of Communication
The board of education, administration, and staff should be well versed on internal controls and policies. They should monitor controls, listen to external auditors’ recommendations, support board and staff training, and keep an open-door policy so staff members can feel free to communicate new ideas or to report a process or procedure that is not working as intended. These open lines of communication are key to the success or failure of internal controls.
Resources
Kolker, R. 2004. The bad superintendent. New York, September 17. https://nymag.com/nymetro/urban/features/9908/.
Schuster, K., and E. Laikin. 2020. How the Roslyn School scandal, depicted in “Bad Education” played out. Newsday, April 24. www.newsday.com/entertainment/movies/bad-education-true-story-long-island-frank-tassone-1.44082077.