What are Internal Controls?
Internal controls are operating practices used to help ensure the achievement of an objective. Internal controls help assure that departments operate according to plan. They are tools used every day by the managers, from the departmental levels to the Chancellor of the University. The internal control structure of the University includes such things as written policies and procedures, organizational design, and physical barriers. Simply put, internal controls are good business practices. For example, the following are internal controls used to achieve objectives:
- Implementing procedures to encourage compliance.
- Using passwords to restrict computer access.
- Locking your office or filing cabinets to discourage theft.
- Reviewing your monthly accounting reports to verify transactions.
Internal controls can provide assurance that:
- Data reported to management is reliable.
- University assets are safeguarded from loss.
- Operating practices are sound and help to ensure compliance with laws, regulations and policies.
- University resources are used efficiently and economically.
- Established objectives and goals of a unit or department are being accomplished.
Most internal controls can be classified as preventive or detective. Preventive controls are designed to discourage errors or irregularities. For example: A manager's review of purchases for propriety and validity prior to approval prevents inappropriate expenditures.
Detective controls are designed to identify an error or irregularity after it has occurred. For example: A comparison of deposit slips to monthly accounting reports will detect deposits posted to erroneous account numbers.
Through careful design, the system of internal controls can help departments operate more efficiently and effectively and provide a reasonable level of assurance that the processes, services, or assets for which they are responsible are adequately protected.
Management is responsible for ensuring that internal controls are established and functioning to achieve the missions and objectives of their unit or department. Changes in existing conditions may cause the effectiveness of a control to deteriorate or the degree of compliance to change. Management must respond to these changes by creating additional controls or alter existing controls to protect against loss.
Office of Internal Audit's Responsibility
The Office of Internal Audit provides an independent evaluation of the adequacy of internal controls and reports the results to University management, as well as UW-System Internal Audit. The internal audit function is an internal control itself, in that it evaluates and appraises other University controls. The audit department reviews the effectiveness of internal controls and makes specific recommendations for improvement.