This huge endeavor involved many people within our department. (When you mention auditors, things tend to become a high priority.) Drawing from that experience, I address here three challenges to working with your team to create an all-encompassing internal control document: clarity, detail, and time.
Be Clear About the Purpose
When you ask someone to document what they do, ensure that they know exactly what you are looking for. Should they document every single task? Should they focus on the primary job responsibilities that others might need to perform in times of emergency? Work with your team to clarify the purpose and your expectations.
Our internal control documentation covered the following areas: attendance, debt, budget, cash management, federal programs, fixed assets, human resource functions, inventory, technology, nutrition services, payroll, purchasing and accounts payable, transportation, and tuition. We decided to concentrate on specific aspects of each area. For example:
- For payroll, we focused on the process for creating pay assignments and verifying salary information, processing time sheets, and running the actual payroll process.
- For human resources, we focused on all HR functions, including hiring and background checks.
- For nutrition services, we focused on the free and reduced-price meal application process, financial reporting, and claim submission and reimbursement.
- For accounts payable, we focused on the process for adding a vendor, obtaining the W-9, approving and processing invoices for payment, and cutting AP checks.
Team members asked themselves: If someone had to do my job for a day or a week, what would they need to know to get the job done? We documented the processes that were performed regularly as well as those that the auditors examine when assessing internal controls.
The district’s federal programs' internal control document was adequate until the implementation of the compliance supplement of the Uniform Grant Guidance in 2017. Luckily, we were able to modify the existing document to meet the updated guidelines.
The Missouri Department of Elementary and Secondary Education interpreted federal regulations as requiring an entity to have written procedures as a precondition to receiving federal funds. We examined each area noted below and documented applicable board policies, district procedures, control environment, risk assessment, control activities, information and communication, and monitoring:
- General accounting and financial management
- Fraud risk assessment and monitoring program
- Cash management
- Purchasing and procurement
- Professional development
- Travel
- Conflict of interest
- Payroll and timekeeping
- Human resources procedures
- Annual audit
- Grant compliance
- Federal grant compliance
- Nutrition service program
- Asset/equipment management
- Budgets and budgetary compliance
- Computer security
- Debt service
The manual details general business procedures and the policies and procedures for administering federal awards for the Francis Howell School District.
Determine Level of Detail
As we created these internal control documents, we discussed how much detail was necessary. Since most internal audit programs include a risk assessment component, we decided to add that element to each area. Therefore, after individuals documented their procedures, we worked as a team to add risk assessments and control activities or key controls to the document.
For example, in the case of accounts payable, adding the risk assessment component might look like this:
Risk: Resources lost or stolen through improper or fraudulent cash disbursements.
Key Controls:
- Staff members handling disbursements are separate from those handling payables, receivables, bank reconciliation, and other incompatible duties.
- Physical security over check writing/printing facilities, material, and capabilities (including check stock) is ensured.
- Bank statements are reconciled promptly.
- Petty cash records are reconciled periodically to authorized balance.
- Reconciliation variances are rigorously pursued promptly.
- Documentation of the expenditure of petty cash advances is required (receipts returned by employees to show how advances were spent).
Recommendations: Review accounts payable procedures to ensure adequate segregation of duties.
Invest the Time
Compiling internal control documentation that satisfies auditors and serves as a procedures guide for district staff can be a daunting task. The time necessary can vary from minutes to days; however, the long-term benefit cannot be minimized.
Although the school business office is busy and time seems insufficient, ensuring the documentation of these procedures is in the best interest of the district and each department. Taking the time to document procedures and to update them regularly can help reduce the training time necessary for future staff members to learn how to get the job done. The commitment to investing the time should be strongly communicated to your staff. Once the procedures are documented, then updating them is much easier and efficient. FHSD is committed to updating its internal control documentation each March/April prior to the auditor’s interim visit.
Find What Works
Work with your staff to create a system that works for your team. Our district maintains a shared drive folder where we save everything and make it accessible to staff members to update their documents, as well as to the auditors to access what they need. We formerly had one comprehensive document; however, we determined over time that it was too hard to update. So we broke down the document into the various areas specified for individuals who then knew which folders they were responsible for updating.
This process has worked well for us the past few years; however, as school districts adopt a Google environment, it might make more sense for your district to put all of its documentation in a Google folder that can be accessed and updated as needed. It’s important to document the work in a manner that works best for your district.