Components of the Internal Control Activity

Internal controls rely on the principle of checks and balances in the workplace. The following components focus on the control activity:

Personnel need to be competent and trustworthy, with clearly established lines of authority and responsibility documented in written job descriptions and procedures manuals. Organizational charts provide a visual presentation of lines of authority and periodic updates of job descriptions ensures that employees are aware of the duties they are expected to perform.

Authorization Procedures need to include a thorough review of supporting information to verify the propriety and validity of transactions. Approval authority is to be commensurate with the nature and significance of the transactions and in compliance with University policy.

Segregation of Duties reduce the likelihood of errors and irregularities. An individual is not to have responsibility for more than one of the three transaction components: authorization, custody, and record keeping. When the work of one employee is checked by another, and when the responsibility for custody for assets is separate from the responsibility for maintaining the records relating to those assets, there is appropriate segregation of duties. This helps detect errors in a timely manner and deter improper activities; and at the same time, it should be devised to prompt operational efficiency and allow for effective communications.

Physical Restrictions are the most important type of protective measures for safeguarding University assets, processes and data.

Documentation and Record Retention is to provide reasonable assurance that all information and transactions of value are accurately recorded and retained. Records are to be maintained and controlled in accordance with the established retention period and properly disposed of in accordance with established procedures.

Monitoring Operations is essential to verify that controls are operating properly. Reconciliations, confirmations, and exception reports can provide this type of information.