Internal Control Structure

Transcription

1 Internal Control Structure June 30, 2010

2 Internal Control Structure Table of Contents Section Title Page 1. Background 3 2. Internal Controls Overview 3 2.A. Stewardship and Ethics 4 2.B. Reliance on Internal Controls 4 2.C. Ohio Ethics Law 5 3. Governance 5 3.A Organization Structure 5 3.B Office of Student Life Control Environment 8 3.C Reporting Errors and Problems 9 3.D. Delegation of Authority 9 3.E. Controls Monitoring 10 3.F. Training Requirements 11 3.G. Document Retention Policies 11 3.H. Policy Exception Process 11 3.I. Roles and Responsibilities of Transaction Approvers Processes 15 4.A. Standardized Fiscal Processes 15 4.B. Payroll Processes 16 4.C. Reconciliations 17 4.D. Equipment 18 4.E. Inventories 18 4.F. Identity Theft Red Flags Access to Facilities Business Continuity Planning Contacts for Additional Information/Issues Accountability Approvals 20 Appendices: Appendix A: Student Life Controls Monitoring Team Listing Appendix B: Office of Student Life Fiscal Training Requirements & Recommendations Appendix C: University and Student Life Fiscal Process Flowcharts Version 6/30/2010 Page 2

3 1. Background Internal Control Structure As a major public institution, The Ohio State University is held to a high level of accountability for its business practices. Accordingly, every reasonable effort must be made by all employees to ensure that funds are used in a responsible and appropriate manner consistent with the university s mission, applicable laws, and ethical practices. At the core of this effort is a formalized system of internal controls designed to mitigate the risk of financial impropriety and any resulting damage to institutional reputation. Purpose: This Office of Student Life (Student Life) Internal Controls Structure document addresses our internal control structure, our roles and responsibilities, and our procedures for achieving our stewardship obligation of ensuring that university funds are used in a responsible and appropriate manner consistent with our mission, applicable laws and ethical practices. Effective Date: The effective date of this Internal Control Structure document and its outlined procedures and responsibilities is effective July 1, 2010, unless specifically stated otherwise. University Policies and Procedures Compliance: Employees who have been delegated the authority and privilege to purchase approved goods and services on behalf of the university, approve human resources activity, and/or maintain custody over university resources must agree to abide by all policies/procedures set forth by Student Life and by the university, associated with but not limited to the following: Financial Code of Ethics, Internal Controls, Travel, Purchasing, Purchasing, Travel, and Group Extend Travel Cards, Expenditures, Cash Handling and Deposits, Check Acceptance, Credit Cards, Equipment, and Human Resources. The university s policies for each are available from the university policies website at: As of this ICS date, the Financial Code of Ethics can be obtained through the following link: 2. Internal Controls Overview Internal controls are defined as the mechanisms that reduce the probability of errors and inappropriate transactions and formally establish accountability. According to the Statement on Auditing Standards No. 1 (Section ), Internal control comprises the plan of organization and all of the coordinate methods and measures adopted within a business to safeguard its assets, check the accuracy and reliability of its accounting data, promote operational efficiency, and encourage adherence to prescribed managerial policies. Version 6/30/2010 Page 3

4 Internal Control Structure University internal control polices state that department managers or administrators are responsible, on a periodic basis, for reviewing the official record of who is accountable for the various financial functions, ensuring that each person assigned tasks that involve financial accountability is performing their duties with competence and honesty, and for monitoring the effectiveness of the accountability structure. Through effective controls, the unit should be able to Safeguard assets, Prevent, detect, and correct errors and irregularities, Ensure reliability of financial statements, and Ensure compliance with various regulations. A. Stewardship and Ethics All employees of The Ohio State University, regardless of rank or position, have a stewardship responsibility with regard to university funds and other assets. University employees are responsible for safeguarding university rules, polices, and applicable Federal and State laws. It is a violation of university policy for any employee, regardless of rank or position, to receive or use university resources for non-university purpose or personal gain. B. Reliance on Internal Controls The following identifies our primary constituents or customers that rely on Student Life to have implemented effective internal controls: Public including all tax payers, our students and their families, and state and federal administration to ensure effective use of resources, reliance on the accuracy of our financial statements used for decision making, and compliance with federal and state laws and regulations, including IRS requirements and compliance with Generally Accepted Accounting Principles (required under the Ohio Revised Code). University Contributors and Investors including companies and individuals that contribute or donate money to the university, invest in the university through research projects and grants, or invest in the university by purchasing bonds (that we often use to fund our capital projects). Contributors and investors require effective use of resources and reliance on the accuracy of our financial statements, along with compliance with federal and state laws and regulations, and development, research, and bond-specific legal requirements. Senior University Management including the various central university operations and all university management up-through and including the board of trustees. Senior university management rely on Student Life s internal controls to ensure accuracy of financial statements used for decision making, compliance with federal, state, and university policies and procedures, and effective use of resources. Student Life Management including the Vice President, Associate VPs, and Assistant VPs, rely on internal controls to ensure compliance with policies, procedures, and regulations; accurate and timely financial statements for decision making, effective use of resources, and efficient processing. Student Life Units/Staff rely on internal controls to help ensure compliance with policies, procedures, and regulations, accurate and timely financial statements for decision making, effective use of resources, and efficient transaction processing. Version 6/30/2010 Page 4

5 Internal Control Structure Vendors rely on Student Life to comply with the Ohio Ethics Laws to ensure they are able to effectively compete for our goods and services, that they are paid in a timely and accurate manner, and that we have given adequate consideration to Ohio vendors and to State Certified Minority and EDGE vendors. C. Ohio Ethics Law The Ohio Ethics Law, enacted in 1973, prohibits public employees (which include all university full or part-time employees and student employees) from Using authority or influence to secure something of value, Soliciting or accepting something of value, Receiving compensation from anyone other than their employer for doing their job duties, Using authority to secure public contract for self, family members or business associates, Having an interest in profits/benefits of public contract, or Profiting from self-approved contracts. The above situations are referred to as conflict of interest. Conflict of interest is considered as receiving a premium or other incentive, regardless if the employee receives any personal benefits or not. Two other key elements required by the State are as follows: Every employee must be held to the highest degree of public trust, and All vendors must be given equal consideration to compete for providing goods and services. 3. Governance To achieve our stewardship obligations, the following are the primary leadership and management structures, responsibilities, and procedures to provide consistent management and cohesive policies and processes for Student Life to implement and administer internal controls. Student Life management, at all levels, is responsible for setting the tone at the top and consistently demonstrating commitment, support, and the importance of implementing university policies and procedures and the procedures outlined in this Internal Control Structure document. For individuals having fiscal responsibilities, support and compliance with internal controls is to be included in the individual s annual performance reviews. A. Organization Structure Our Student Life organization structure and overview of responsibilities is outlined below to support and oversee our stewardship/internal controls responsibilities: Everyone in Student Life is responsible for the implementation of internal controls. The Vice President (VP) has overall responsibility for the establishment and maintenance of a financial and operational environment that is focused on appropriate internal controls, including, but not limited to o Segregation of duties in the processing of every financial transaction, o Mandatory approvals, Version 6/30/2010 Page 5

6 Internal Control Structure o o o Appropriate procedures to maintain effective custody over university resources, Monitoring and oversight, and General ledger reconciliations. Associate/Assistant Vice Presidents (AVPs) are responsible for the financial status and compliance of internal controls in their operations. The Senior Associate Vice President serves as the Student Life Chief Administrative Officer (CAO) and oversees the directors responsible for managing the Student Life fiscal and human resource service centers. The CAO reports directly to the Student Life VP, has a dotted-line relationship with the Office of Academic Affairs Senior Fiscal Officer, and represents the fiscal and human resources directors, procedures, and internal controls at Student Life senior leadership meetings. o The Student Life Controller (Controller) oversees the fiscal/payroll service center and is responsible for maintaining and submitting updates to this Internal Control Structure document through the CAO for review and approval by the VP. The Controller is responsible for designing and implementing Student Life fiscal processes to ensure (in priority sequence) (1) compliance to fiscal/payroll policies and procedures, (2) financial statement accuracy and reports for decision makers, and (3) efficient fiscal processing to support Student Life units. The Controller reports to the CAO and has a dotted reporting relationship to the various Student Life Fiscal Advisory Council members (AVP-level business managers) and oversees the following Fiscal Support Services teams: Controls Monitoring Team performs centralized general ledger reconciliations using university approved sampling techniques, and other risk-based review techniques and performs various tests and procedures to determine compliance with policies and procedures. The Associate Director Internal Controls is responsible for producing quarterly internal controls status reports and recommendations to the VP, AVPs, and Fiscal Advisory Council members. The Associate Director Internal Controls also serves as the Student Life primary contact for fiscal-related policies, procedures, internal controls, and coordinate and review all internal/external audit support. Accounting Team performs the centralized processes of accounting, payroll, and deposits. All Student Life accounting transactions flow to the accounting team for compliance reviews prior to entry of the transaction into the general ledger or payroll systems. Under the direction of the Associate Director Accounting, the accounting team also assists the Student Life CFO by coordinating and consolidating budgets and coordinating earnings-related fees and rates. The Associate Director - Accounting has a solid line relationship to the Controller and to the Student Life CFO, and serves as the primary accounting-related customer service contact for the fiscal service center. Procurement Team performs centralized purchasing for Student Life and serves as a university satellite accounts payable processing center. The procurement functions include reviewing purchasing requests for compliance, determining the best purchasing method, and working with the units, University Purchasing, and vendors to assist with obtaining the approved goods and services. The Associate Director Procurement leads the fiscal service center procurement team, serves on the university s accounts payable and various university purchasing councils, and serves as the primary customer contact for procurement-related services. Records Management Team coordinates the filing, scanning, retrieval, and document retention of all financial records coming into the fiscal service center. Version 6/30/2010 Page 6

7 Internal Control Structure o The Student Life Director of Human Resources (Director HR) oversees the Student Life human resources service center to ensure compliance to University human resources policies and procedures and to provide human resources (excluding payroll) support for Student Life operations. The Director of Human Resources reports to the CAO and has a dotted reporting relationship to the various Student Life human resource managers. The Student Life Chief Financial Officer (CFO) serves as the Student Life Senior Fiscal Officer (SFO), reporting directly to the Student Life VP. The CFO has overall responsibility for financial planning and budgets. To assist with the budgets and financial planning the CFO has a solid line reporting relationship with the Fiscal Support Services Associate Director Accounting, and has a dotted line relationship with the University CFO, the Office of Academic Affairs SFO, the Student Life AVPs, and their business managers. Fiscal Advisory Council (FAC) consists of the CAO, CFO, Controller, and primary business managers for each of the AVPs. The council will meet monthly to communicate, advise, and coordinate fiscal activities. The AVP business managers serve as the primary liaisons between the various units, the fiscal service center, and senior Student Life leadership, to help ensure consistent communications and processes and to assist with unit-level fiscal training and training tracking. Unit Directors are o Responsible for unit-level compliance with university, Office of Academic Affairs, and Student Life policies and procedures, as outlined in this document. o Responsible for unit application systems that serve as sub-systems for tracking detail transactions and activities from which accounting transactions are summarized and entered into the university s financial system. As the system owner, the unit director is responsible for the system s data accuracy and controls, and for providing verified supporting documentation that is complete, accurate, and authorized to fiscal service center staff for transaction review and entry. The Fiscal Support Services controls monitoring team and accounting team are to be involved in the planning/design of these application systems and upgrades to help ensure accuracy and appropriate controls. Some of the required key system related controls include system segregation of duties, data and application security, and application system controls. Examples of unit application systems include: Micros (Campus Dining and BuckID), Pyramed (Student Health Services), Event Master (Recreational Sports and Ohio Union), and StarRez (University Housing). o Responsible for reviewing the unit s financial condition (budget-to-actual) monthly and informing fiscal service center accountants of any questionable activities or balances. o Responsible for unit-level assistance to the controls monitoring team in order for the team to complete their assigned activities. Student Life staff members filling the below listed positions, are Responsible for oversight and maintenance of the established financial and operational processing environment to ensure adherence to established internal control structures. This should include, but not be limited to appropriate segregation of duties in the processing of all financial transactions, appropriate mandatory approvals, appropriate procedures to maintain effective custody over university resources, appropriate monitoring Version 6/30/2010 Page 7

8 Internal Control Structure and oversight and appropriate mandatory reconciliations. (from Internal Controls Policy #1.11) o CAO, o SFO, o Assist Vice Presidents, o Controller, o Director HR, o Fiscal Service Center Associate Directors, and o Fiscal Advisory Council members. The position descriptions of the above staff members will be coordinated/updated by Student Life HR prior to December 31, 2010 to reflect the above language in the summary of duties portion of the position descriptions. AVPs may elect to include the above standard language at lower levels, as appropriate. B. Office of Student Life Control Environment The Office of Student Life has streamlined the processes and internal controls by designing controls into standardized processes and by implementing a centralized fiscal service center. A human resources service center is being planned for implementation in the near future. The primary focus of our controls is to identify and correct errors (accuracy and compliance) prior to the transaction entry and transaction finalization into the university s financials systems. Through this practice, overtime, processes will be more efficient and timely at all levels, by resources being devoted to processing and not diverted to researching and resolving potential problems. The primary controls that have been designed into the Student Life fiscal processes and service center structure include: Segregation of duties, Approvals (business and budget) at unit-level, Compliance reviews by trained service center staff members, Financial transactions entered into the financials systems by trained service center staff members, Independent controls monitoring, Training, System access controls, Unit reviews of financial plans and status (comparisons of budget-to-actual), and Fluctuation analysis and other analytics. Transactions originate at the units and once approved by unit members listed on the Student Life delegation of authority listings, the transaction flows to the service center for compliance reviews and processing. The trained service center staff members review the transaction for compliance to policies and procedures and check for accuracy. If the transaction meets requirements, it is entered into the university s financials or Student Life payroll systems. Higher-risk transactions are also reviewed and approved by someone other than the individual that entered the transaction. Once the transaction is complete and appears on the general ledger, our independent controls monitoring team members review a sample of the transactions against source documents provided by the units, to obtain reasonable assurance that the transactions are both accurate and comply with policies and procedures. The controls Version 6/30/2010 Page 8

9 Internal Control Structure monitoring teams focus is to be proactive in identifying and helping correct potential problems, thereby minimizing overall financial and compliance risks. C. Reporting Errors and Problems University policy states that any employee who has reason to believe, or has knowledge that financial fraud has occurred, is obligated to report the incident(s) and all relevant information to an appropriate university authority. When financial fraud is suspected, observed, or otherwise made known to an employee, the employee must report the activity to his/her supervisor. If the employee has reason to believe his/her supervisor may be involved in the financial fraud, the employee is obligated to report the activity to the next higher level of management or to other university officials such as the Department of Internal Audit, University Police, or the university s confidential reporting line at: Phone: Web: The reporting employee shall refrain from further involvement in the matter unless directed otherwise by Internal Audit or University Police. Management responsibility includes determining whether an error or misunderstanding occurred or whether financial fraud may possibly exist. If a member of management has reason to believe that financial fraud has occurred, the manager is responsible for the following: Reporting the information up the chain-of-command to the Vice President, Contacting Internal Audit, who will consult with Legal Affairs and University Police. Internal Audit and/or University Police will conduct an investigation, Contacting Human Resources Consulting Services, who in conjunction with University Police and Legal Affairs will determine the appropriate administrative action, Cooperate with Internal Audit, University Police, or Legal Affairs and other departments and law enforcement agencies in the detection, reporting, and investigation of the fraud, and Refrain from any involvement in the investigation unless directed otherwise by Internal Audit, University Police, or Legal Affairs. D. Delegation of Authority Delegation of Signature Authority documents from Student Life s operations have been approved by the Vice President of Student Life. These operations are: Career Connection Recreational Sports Counseling and Consultation Services Research and Assessment Disability Services Student Advocacy Center Diversity and Community Development Student Health Insurance Facility Management & Logistics Student Health Services Fiscal Support Services Student Housing Legal Clinic Human Resources Student Judicial Affairs Information Technology and BuckID Student Life Administration Multicultural Center Student Wellness Center Off Campus Student Services University Residences and Dining Services (separate listings) Ohio Union, Student Activities, and Younkin Success Center Version 6/30/2010 Page 9

10 Internal Control Structure Operations Only staff members that have been given the authority by the Vice President, through the Delegation of Authority documents, are authorized to approve transactions or perform stated responsibilities for the Vice President. E. Controls Monitoring The Fiscal Support Services controls monitoring team will assist Student Life leadership and operations by Performing independent general ledger reconciliations as documented in section 3 (below), Providing independent reviews, assessments and reports of financial statement accuracy and compliance with internal controls, policies, and procedures, Identifying potential risks to the university and to Student Life management and operations, and recommending and assisting Student Life operations with risk mitigation procedures. As resources are available, the team will perform such activities as Performing reviews of other transactions, processes, and procedures to provide Student Life management with an independent assessment of compliance with the university s required internal controls, Designing and implementing a risk-based controls monitoring plan to identify transactions, accounts, or operations that pose the greatest financial and compliance risk to Student Life. The plan will be reviewed annually by the VP for approval. Once approved, the controls monitoring plan serves as the authorization for the controls monitoring team to conduct review procedures throughout Student Life, Providing internal controls-related training, Conducting unannounced cash counts, Spot-checking inventory counts to compare inventories on hand with inventory values listed on the unit s balance sheets, and Spot-checking equipment locations per university records, etc. Because of the centralized nature of the fiscal service center, nearly all of the financial transaction processing occurs within the service center. Therefore, the majority of all reviews will be to validate that the service center and transaction processing is operating as designed. Unit-specific fiscal processing, such as cash handling, credit card processing, accounts receivable recording and collections, transaction approvals, timekeeping approvals, and payroll certifications will be reviewed independently by the controls monitoring team. The controls monitoring team will be granted access to all Student Life financial/payroll records, will be granted read-only access to all Student Life financial/payroll data, and will have two-party (one member from the unit and the controls monitoring staff member) access to unit safes, cash, inventory, equipment, etc. By having read-only access to all Student Life financial/payroll data, the monitoring team will be able to maximize both unit and controls monitoring team efficiencies by developing and performing automated monitoring techniques and procedures. Units are responsible to assist the controls monitoring team by providing requested supporting documentation and/or data in a timely manner. To support green initiatives, electronic versions of the documentation/data are preferred. If requested documentation and/or data are not received within a twoweek period from the initial request, the controls monitoring team will move-on with their review and assume that the documentation is not available. Additionally, the controls monitoring team will take a Version 6/30/2010 Page 10

11 Internal Control Structure conservative view of compliance to reduce overall compliance risk to Student Life. The Controller will work with the control monitoring team to communicate findings and recommendations to unit and Student Life leadership. Monitoring activities may be expanded beyond fiscal processes and internal controls, based on the needs and priorities of Student Life leadership. See Appendix A for a listing of the Student Life Controls Monitoring team members. Please confirm their identity on their university identification card to those listed in Appendix A prior to granting access to unit secured areas. If there are questions regarding the identity and purpose, please contact the Student Life Controller at F. Training Requirements The Office of Student Life has submitted a list of required and recommended training for staff involved in fiscal processes to the University Controller. On March 31, 2010 the University Controller approved the Student Life list. See Appendix B for the university-approved Office of Student Life Fiscal Training Requirements and Recommendations by General Responsibility. The Student Life Controller is responsible for tracking and ensuring the completion of the required training for the fiscal service center staff members. AVPs are responsible for tracking and ensuring the completion of the required training for their assigned units. AVPs are authorized to add additional training requirements to the approved list, based on the unique needs of their operations. G. Document Retention Policies The Office of Student Life will implement and comply with the records retention and management procedures as outlined by the University Archives and available at: Fiscal Support Services is the owner of Student Life fiscal documentation that is used to support and enter transactions into the university s financials system and payroll-related transactions into the Student Life payroll processing system. A document management system that is maintained by fiscal service center staff members will be used to electronically file many of the original documents. AVPs will identify individuals to be granted access to read these electronic documents. H. Policy Exception Process The university recognizes that there will be extenuating or emergency situations for which operations must continue to operate, therefore, requiring some flexibility with university fiscal policies. To achieve flexibility for extenuating or emergency situations, the Vice President is authorized to review and approve policy exceptions and to delegate policy exception approval. Fiscal policy exception approval has been delegated to the CAO and the SFO (as backup to the CAO). General Policy Exception Process: Prior to exceptions being reviewed at the college-level by the VP, CAO, or SFO, exception requests should be reviewed and approved by unit management and as appropriate, AVP-level management. Once reviewed and approved by unit/avp management, the following should be provided ( ed) to the Student Life Controller for logging and coordination with the VP, CAO, or SFO for review and approval: Appropriate transaction supporting documentation, Version 6/30/2010 Page 11

12 Justification for the exception, and Internal Control Structure The unit s remediation steps and timelines to minimize the risk of the same exception happening in the future. For true emergency situations, (i.e., risk of life, damage to property, etc.) and for pre-approval requests to purchase restricted commodities, the remediation steps and timelines are not required. After receiving these items, the Controller will assign a log number and will submit the request with unitprovided documentation to the CAO. After receiving the exception approval or denial by the VP or CAO, the Controller will log the status. If approved, transaction processing will continue by service center staff. Unapproved policy exceptions will be returned to the AVP for follow-up and/or for communication with the requestor. In the event that the policy exception is identified by fiscal service center staff or other university operations, the Controller or one of the Fiscal Support Services Associate Directors will the appropriate FAC member (copy the AVP and CAO) with the situation, requesting assistance with investigating the situation and as appropriate, obtaining the above listed (bulleted) items. Historically, the most common policy exceptions are as follows: After-the-Fact (ATF) Purchase Orders. ATF purchase orders are generally identified when an invoice is received by a vendor, and no purchase order has been pre-established to pay for the goods/services that were received. This situation generally reflects that a contract or commitment may have been established between the unit and someone outside of the university (in writing or verbal). The university requires that all contracts be in writing and that only select Business and Finance and Legal Affairs staff members are permitted to review and approve contracts or make commitments of university resources. Missing Original Receipts/Documentation. To comply with IRS and other rules, various university policies require original receipts and documentation to be submitted and retained to document the transactions. Transaction Pre-Approvals. Prior to any purchase or commitment, i.e. via purchasing card, blanket purchase order release, purchase using petty cash, travel, etc., transactions are to be reviewed and approved by someone that has been delegated the approval authority by the Vice President. Contract Violation. Because the university has exclusive contracts with select vendors, such as Coke, any purchases that are in violation of university contracts are policy exceptions. Sales Taxes Paid. The university does not pay sales tax or use tax in Ohio or other states that have a sales tax exemption. Various University policies provide specific requirements about sales taxes, such as the purchasing card policy, travel card and group/extended travel card, and expenditure policies. Non-compliance with the appropriate policy should be treated as a policy exception. Restricted Commodities. The university has a number of commodities for which pre-approvals are to be obtained at the college or university-level. The purchase of alcohol is the most common restricted commodity by Student Life operations. Travel Reimbursements Not Processed within 90 Days of Travel. Upon completion of the trip, and within 90 days, university policies require that the traveler submit a Travel Reimbursement Form and supporting documentation to obtain reimbursement of expenses. The traveler s signature is required. Cash Advances or Group/Extended Travel Card Not Reconciled within 30 Days of Trip. Expenses associated with a cash advance or a group/extended travel card must be documented by original, itemized receipts (or equivalent documentation) and must be reconciled and Version 6/30/2010 Page 12

13 Internal Control Structure substantiated within one month of the return date. Any cash in excess of the approved reimbursable expenses must be returned to the appropriate departmental account. Split Purchasing Card Transactions. A split purchasing card transaction is one where two or more payments are made with a purchasing card to satisfy what a reasonable person would consider a single/distinct purchase, and where the cost of that purchase exceeds the card s transaction limit (generally $1,000). Split Purchase Order Transactions. A split purchase order transaction is one where any purchase exceeds the university s bid limits ($25,000 for goods and $50,000 for services) for every combination of Fund, ORG, Program, Project, and Vendor, regardless of the purchase method used or account. I. Roles and Responsibilities of Transaction Approvers As identified in the Internal Controls section (above), every transaction must be approved for business purpose by individuals who have the business knowledge and authority to determine the appropriateness of the transaction without gratuitous influence or interference by the transaction initiator. Additionally, every transaction is approved for compliance by individuals who have received training on university business policies. Both business and compliance reviewers must be in a position to say no to the transaction. Key Approval Requirements/Responsibilities No individual is authorized to approve their own transactions; transactions must be approved at a higher level, Unit management is responsible to ensure that each listed individual has the necessary skills/training to properly complete the assigned tasks in accordance with appropriate policies and procedures, and The Provost will provide approvals for the Vice President. Approvers should consider the following types of questions when reviewing and approving transactions (more specific guidelines appear in subsequent sections): Is this an appropriate use of the public s funds? Is this something we are comfortable defending publicly? Is this fair to all vendors that may want to compete for our business? Is this aligned with our business plan? Are we in compliance with policies and procedures? Are we getting the best goods/services for the best price?, and Is this something the Vice President would approve? If there are questions related to policies and procedures, units should first contact their Fiscal Advisory Council member for fiscal or payroll-related questions; Student Life Human Resources for human resources-related questions or issues; Student Life Facility Management & Logistics for equipment and inventory-related questions or issues; and Student Life Information Technology for cell phone questions or issues. The following are other considerations for approvers when reviewing and approving transactions: Procurement The goods/services or travel are required to support the mission of the unit/university, Version 6/30/2010 Page 13

14 Internal Control Structure There is no conflict of interest, gratuities, premiums, or other incentives involved, The costs/prices are the best prices (not necessarily the lowest prices), considering overall longterm support and maintenance costs, There is adequate budget or funds available, The accounting chartfield is appropriate for the transaction, Ohio businesses, and State certified minority business and EDGE vendors have been adequately considered for the purchase of goods/services, The expenditure complies with policies and procedures, The purchase does not split bidding, purchase card, or petty cash limits, No unauthorized agreement or contract has been made with the vendor to provide goods/services (generally identified as an after-the-fact purchase order ) where a purchase order must be created to pay the vendor, after the goods/services have already been received, The purchase complies with the university s beverage contract for all beverage purchases, Services are not being purchased using petty cash, Alcohol will only be purchased after receiving prior approval by an authorized delegated approver and that available discretionary funds will be used and are available for the expenditure, The expenditure complies with any fund restrictions, and Adequate security and safeguards are available to secure goods that will be received. Accounts Payable (Invoices/Vouchers) The goods/services have been received (by reviewing the receiving documents) as detailed by the invoice and the purchasing contract/purchase order, The prices are accurate on the invoice, according to quotes and the purchase order, Ohio sales tax and tax in other tax exempt states (see are not being paid, Invoice has been stamped with an appropriate payment authorization stamp and has been completed and signed by a delegated unit business approver, and The receiving document is provided with the original approved invoice to the fiscal service center for processing, filing, and records retention. Accounts Receivable/Journal Entries There is adequate documentation to support the charges (billing to customer) or journal entry. Payroll Certification The employee who received pay worked as an employee during the pay period. Timekeeping The employee worked the reported hours/days (period), and Version 6/30/2010 Page 14

15 Internal Control Structure Vacation, sick time, etc. are appropriately reported as documented on approved leave forms. 4. Processes University fiscal processes frequently change as a result of changes to university policies and procedures, and technology enhancements. To the extent possible, Student Life operations will participate in university process implementation planning to help ensure that Student Life is represented and is aware of university process changes. Student Life will implement university-identified and resourced processes and technologies. In the event that the university has not established standardized processes and procedures, standardized Student Life processes and procedures will be identified and implemented to comply with university requirements as follows: The Student Life Controller is responsible for designing and implementing fiscal processes for procurement, accounts payable, accounting, and payroll, The Facility Management & Logistics AVP is responsible for designing and implementing equipment, asset management, and surplus processes and procedures, The Director of Information Technology is responsible for designing and implementing procedures for cell phones and general document management/retention tools and procedures, and The Director of Human Resources is responsible for designing and implementing processes and procedures for human resource activities. A. Standardized Fiscal Processes Student Life standardized fiscal processes are included in Appendix C, which includes both universityprovided procurement and Student Life flowcharts for fiscal processes not specifically provided by the university. University-provided procurement-related process flowcharts for purchase requests and department-level approvals, and service center processes associated with blanket purchase order releases, internal orders, estores purchases, petty cash purchases, purchasing card purchases, standard requisition/purchase orders, reimbursements, refunds and non-purchase order payments: Department erequest Process (University Process Flowchart), Fiscal Service Center erequest Process (University Process Flowchart). Other Student Life specific process flowcharts include: Travel Requests and Reimbursements, Accounts Payable, Accounts Receivable, Cash Receipts/Deposits, Credit Card Payments by Customers, Journal Entries, and General Ledger Reconciliations & Controls Monitoring. The standardized flowcharts are intended to Document the process flows, including required documentation and approvals, and Version 6/30/2010 Page 15

16 Internal Control Structure Document segregation of duties between transaction initiators and approvers and approval for business purpose (unit) and policy compliance (service center). Specific Student Life Expenditure Guidelines: Employee Recognition; Appreciation of Service Programs - Gifts. For anyone retiring with 25 years or more of service, gifts up to $400 is consistent with past practices. Gifts of $100 or less, depending on the situation, have been permitted where staff members are leaving The Ohio State University without retiring. Specific Student Life Purchasing Card Requirements: Misuse of Purchasing Card. Progressive disciplinary steps for purchasing card infractions are required, by university policy, to be included in the Internal Control Structure document a. 1 st infraction - verbal and/or written counseling, b. 2 nd infraction written counseling with copy being placed in personnel file and a signed copy sent to the Student Life Controller, and c. 3 rd infraction permanent revocation of card use. AVPs are responsible to ensure that the appropriate disciplinary steps for infractions are performed. If there are specific fiscal policy/ethics questions, please contact your AVP-designated business manager. B. Payroll Processes In September 2009, to be consistent with the university s shift of payroll to the university controller s office, Student Life payroll responsibilities transitioned from Student Life Human Resources to Student Life Fiscal Support Services. The following identify the payroll, timekeeping, and various human resource responsibilities and activities: Timekeeping: All timekeeping entry and approval will be retained by the individual unit in the Student Life timekeeping system. Assigned supervisors will enter, review for business purpose, compliance, and appropriateness, and approve time for their units. Student Life Fiscal Support Services will provide ongoing training and materials to the individual units on how to enter, review, and approve timekeeping in the Student Life timekeeping system. Student Life Information Technology provides security for the Student Life timekeeping system. Student Life Fiscal Support Services will transmit time from the Student Life timekeeping system to the university s human resources system. Exceptions generated by transmission to the university s system from timekeeping, reconciliations between the two timekeeping systems, leave request and balance audits, corrections, and validation will be completed by Student Life Fiscal Support Services. Position Data: Student Life Human Resources is responsible for all entry and approval of position data. Entry and approval levels are assigned to separate individuals. Job Data: Student Life Human Resources is responsible for all Job Data entry. All transactions will be reviewed by Human Resources by using the Job Data Activity Report. Version 6/30/2010 Page 16

17 Internal Control Structure Additional Pay: Individual units will be responsible for all Additional Pay entries that are business expenses. Units will review and approve for their respective areas. Transactions entered will be reviewed by the individual units by using the Additional Pay Activity reports. Student Life Fiscal Support Services will be responsible for all Additional Pay entries that are additional/supplemental compensation, bonuses and staff awards. Transactions entered will be reviewed by Student Life Fiscal Support Services staff members by using the Additional Pay Activity reports. Payroll Certification: Student Life Fiscal Support Services is responsible for providing access to Payroll Certification documents on the Student Life timekeeping system. Each individual unit is responsible for completing their on-line payroll certification within two weeks of the end of each pay cycle. C. Reconciliations General ledger reconciliations serve as a primary internal control and control monitoring technique that helps detect (and possibly prevent) a wide range of fiscal-related risks. The Student Life Controller is responsible for completing the general ledger and payroll reconciliations by using university approved sampling techniques. The reconciliation process is documented in the standardized fiscal processes located in Appendix C. General Ledger Reconciliations The term reconciliation is used in many ways and has many different meanings throughout the university. For that reason, this document refers to general ledger reconciliation as the process of comparing source documents (electronic or paper) provided by a unit, to the general ledger transaction details, as depicted on the university s general ledger detail 91 report (electronic). As a result of Student Life s implementation of a centralized fiscal service center with standardized fiscal processes having front-end controls, and the establishment of a controls monitoring team, Student Life is able to streamline the reconciliation process from the traditional tick-and-tie every transaction in the general ledger to its source documentation. The university Controller s Office has approved for Student Life to perform risk-based sampling techniques to identify transactions for general ledger reconciliations. Through approved sampling techniques, Student Life will select samples and perform detail testing of each transaction selected, to obtain reasonable assurance, not absolute assurance, that transactions are both accurate and comply with policies. Reasonable is defined as having a 95% confidence level with +/- 5% confidence interval. All types of transactions including cash, accounts receivable, IDBs, payroll, purchasing card, travel, etc are included in the transaction population for sample selections. Members from the Student Life Research and Assessment department will assist in the sample selection process by designing and performing sampling techniques for the selection of general ledger transactions to be reviewed and reconciled. In general, all of the monthly Student Life general ledger transactions (from our 91 report data) will be made available electronically to Research and Assessment. Using the criteria of 95% confidence level with +/- 5% confidence interval, Research and Assessment staff members will ensure that all transactions receive equal consideration for selection, and will provide our controls monitoring team with the samples to be reviewed. The controls monitoring team will work with the various units to obtain supporting documentation for each selected transaction, and will perform detailed tests to confirm accuracy and compliance with policies and procedures. Should errors in accuracy, processing, and policies be identified during the sample-based reconciliation process, the situation will be investigated, the cause identified, and the service center will work with appropriate staff members to resolve the situation as quickly as possible. Version 6/30/2010 Page 17

18 Internal Control Structure As indicated in the governance section of this document, unit directors are responsible for ensuring (and verifying) the accuracy of unit application systems that serve as sub-systems for tracking detail transactions and activities from which accounting transactions are summarized and entered into the university s financial system. Payroll Reconciliations The controls monitoring team will perform payroll reconciliations for all Student Life operations, using the above procedures. Payroll transactions are included in the samples for general ledger reconciliations. D. Equipment The Office of Student Life will comply with the university s equipment policies. Units are responsible for assigning an equipment coordinator who will work with the Student Life Equipment Coordinator to ensure compliance. Questions related to equipment inventories, procedures, and disposal/surplus of equipment should contact the Student Life Equipment Coordinator. E. Inventories Units having inventories recorded on their unit financial statements, such as pharmaceuticals, will conduct a fiscal year-end inventory. Pharmaceutical inventories should be valued using the first-in, first-out basis, and other Student Life inventories should be valued at the lower of moving average cost or market. Inventory counts and valuations will be documented by the unit, reviewed and approved by the unit director, and a copy of the inventory will be forwarded to the Student Life Controller. The controls monitoring team may be able to assist units to conduct, value, and validate inventories and inventory processes as needed. F. Identity Theft Red Flags The Office of Student Life will comply with the university s identity theft red flags policy intended to help safeguard identifying information of our customers in order to prevent identity theft from occurring. Within Student Life, the identity theft red flags policy applies to employees and supervisors involved with establishing or processing accounts receivable, patient financial accounts, medical records, health insurance plans, memberships, payroll deductions, ID Center, BuckID, etc. Employees involved in these processes are responsible for Safeguarding identifying information in order to prevent identity theft from occurring, Completing the university s Identity Theft Red Flags Policy training, available at Verifying the identification of the individual establishing the account, requiring the accounts be established in-person, and an acceptable form of photo identification as identified from the University Account Establishment Red Flags Guidelines and complying with the specified employee actions, Complying with the University Billing and Account Payments Red Flags Guidelines, and Immediately reporting proven or suspected disclosure or exposure of personal information, financial fraud, and suspected or actual identity theft to their supervisor. Supervisors of employees involved in these processes are responsible for Identifying employees who must complete training and ensure that training is completed, Version 6/30/2010 Page 18

19 Internal Control Structure Protecting identifying information collected in accordance with University policies, including o Institutional Data, o Health Insurance Privacy, o Credit Card, o Privacy and Release of Student Education Records, and o Payment Card Industry standards. Reporting proven or suspected disclosure or exposure of personal information in accordance with the Disclosure or Exposure of Personal Information policy, Reporting suspected or actual identity theft to the appropriate AVP, the Student Life Controller, and University Police Department as deemed appropriate based on the circumstances, and Ensuring unit training materials for appropriate processes include Identity Theft Red Flags information. Student Life fiscal service center staff will Assist units with compliance when processing or reviewing transactions and when performing internal controls monitoring activities, and Assist units with providing training as requested and available. Student Life Controller will be responsible for Updating the Student Life Internal Control Structure document to reflect changes to university policies and procedures, and Work with AVP business managers and fiscal service center staff members to annually review internal processes and procedures. 5. Access to Facilities Access to Student Life facilities is managed by the Facility Management & Logistics operation. For questions related to facilities access, contact Facility Management & Logistics. 6. Business Continuity Planning Completion, periodic reviews and updates, and testing of department-level business continuity plans is a key element in our Student Life risk management and internal controls programs. In the event that operations, key staff members, or processes are not available due to such events as fire, tornadoes, flood, power failure, epidemics, computer or telecommunications outages, it is critical that Student Life is able to quickly recover and provide the level of services and controls that are expected. University business continuity planning is lead by Business and Finance and is coordinated within Student Life by the Student Life Controller. AVPs are responsible for ensuring their units complete their business continuity plans and once finished, update them at least semi-annually, and test the plans at least annually. A member of Fiscal Support Services and Facility Management & Logistics should observe the test of the unit plans for an overall understanding of the plans and to help integrate the plans throughout Student Life. Version 6/30/2010 Page 19

20

21 Internal Control Structure Appendix A: Student Life Controls Monitoring Team List The below listed Student Life Fiscal Support Services staff members will be granted access to all Student Life financial records, will have two-party access to unit safes, cash, inventory, equipment, etc. Please confirm their identity on their university identification card to those listed on this Student Life Internal Control Structure appendix prior to granting them access to unit secured areas. If there are questions regarding the identity and purpose, please contact the Student Life Controller, Dan Allen, at Name Krisher, Meredith Ann Latham, Alexander L Nash, Daniel E Sabo, Rae A Simpson, Linda Marie Position Finance Manager/Associate Director Internal Controls Fiscal Associate/Internal Control Specialist Fiscal Associate/Internal Control Specialist Fiscal Associate/Internal Control Specialist Fiscal Associate/Internal Control Specialist Version 6/30/2010 Page 1

22 Unit and Management Staff Office of Student Life Fiscal Training Requirements and Recommendations by General Responsibility Appendix B Internal Control Structure Document Est. Time (Minutes) Refresher Period A B C D E F Unit Mgmt Traveler Cash Handling/Mgmt Purchase Request or Approver Accounts Receivable Processors Purchasing Card Managers Training/Course Source Institutional Data Policy Carmen 60 min 3 Yrs REQ REQ REQ REQ REQ REQ Business Responsibilities Carmen 30 min 3 Yrs REQ REQ REQ REQ REQ REQ Business Expenditures SL Web 30 min 3 Yrs Recm Recm REQ REQ Understand & Prevent Fraud Carmen 30 min 3 Yrs Recm Recm Recm Recm Recm Internal Controls SL Web 20 min 3 Yrs Recm Recm Recm Recm Travel Policy * Carmen 30 min 2 Yrs Recm REQ Recm Traveler Training * Carmen 30 min 2 Yrs Recm REQ Recm Travel Approver Carmen 30 min 2 Yrs Recm Recm Travel Portal & Search Tool Carmen 15 min 2 Yrs Recm Recm Recm Stewardship of Endowment & Gift Funds Univ Ctlr 8 hrs 4 Yrs Recm Recm Tax Obligations & Compliance at OSU Univ Ctlr 3.5 hrs 4 Yrs Recm Recm Accounts Receivable & Accounts Receivable Collection Services Univ Ctlr 4 hrs 4 Yrs Recm Recm Recm Buying 101 SL Web 7 hrs 3 Yrs Recm Recm Recm Recm SL Web or Cash Handling Unit 90 min 1 Yr Recm REQ REQ Identity Theft Red Flags Carmen 45 min 3 Yrs Recm REQ REQ Using ereports Portal Financial Univ Ctlr 4 hrs 3 Yrs Recm Using General Ledger Reports Univ Ctlr 10 hrs 3 Yrs Recm Earnings Operations at OSU Univ Ctlr 7 hrs 4 Yrs Recm Recm Pcard Policy Overview Carmen 15 min 2 Yrs Recm Recm REQ Pcard Travel & GET Card Holder Carmen 15 min 2 Yrs Recm REQ Purchasing Card Manager Carmen 15 min 2 Yrs Recm REQ Timekeeping SL Payroll 2 hrs 2 Yrs Recm Payroll Certification OJT 3 Yrs Recm Leave Policies OHR Web 3 Yrs Recm Hiring/Terminating Staff TBD 3 Yrs Recm Background Checks SLHR 2 hrs 3 Yrs REQ Performance Evaluations TBD 3 Yrs Recm Managing OSU Records OHR 2 hrs 3 Yrs Recm Recm Recm Recm Recm Recm * Required by University for those using the on line travel system. Carmen = web based training available on the University's Carmen web pages at SL Web = web based training available on the Student Life fiscal web pages at Univ Ctlr = lecture based training provided by the University Controller's Office. To register, go to state.edu/ftd/ftd home.shtm OJT = On Job Training training provided by department or AVP identified staff members SLHR = Student Life Human Resources SL Payroll = Student Life Payroll Team OHR Office of Human Resources 1

23 Fiscal Service Center Office of Student Life Fiscal Training Requirements and Recommendations by General Responsibility Appendix B Internal Control Structure Document Est. Time (Minutes) Refresher Period A B C D E F G G Training/Course Source Institutional Data Policy Carmen 60 min 3 Yrs REQ REQ REQ REQ REQ REQ REQ REQ Business Responsibilities SL Web 30 min 3 Yrs REQ REQ REQ REQ REQ REQ REQ REQ Business Expenditures SL Web 30 min 3 Yrs REQ REQ REQ REQ REQ REQ REQ Understand & Prevent Fraud Carmen 30 min 3 Yrs REQ REQ REQ REQ REQ REQ REQ REQ Internal Controls Carmen 15 min 3 Yrs REQ REQ REQ REQ REQ REQ REQ REQ Travel Policy Carmen 30 min 2 Yrs Recm REQ REQ Recm Recm Traveler Training Carmen 30 min 2 Yrs Recm REQ Recm Recm Travel Approver Carmen 30 min 2 Yrs Recm REQ Recm Travel Portal & Search Tool Carmen 15 min 2 Yrs Recm REQ Recm Stewardship of Endowment & Gift Funds Univ Ctlr 8 hrs 4 Yrs Recm Recm Recm Tax Obligations & Compliance at OSU Univ Ctlr 3.5 hrs 4 Yrs Recm Recm Recm Accounts Receivable & Accounts Receivable Collection Services Univ Ctlr 4 hrs 4 Yrs Recm Recm Buying 101 SL Web 7 hrs 3 Yrs Recm Recm Recm Recm Recm Cash Handling SL Web or Unit 90 min 1 Yr REQ REQ Recm Identity Theft Red Flags Carmen 45 min 3 Yrs REQ REQ REQ Earnings Operations at OSU Univ Ctlr 8 hrs 4 Yrs Recm Recm Recm Deposits Univ Ctlr 4 hrs 3 Yrs REQ Recm Recm Journal Entry, Inquiry & Approval Univ Ctlr 5.5 hrs 4 Yrs REQ Recm Recm Debits & Univ Ctlr 8 hrs 4 Yrs Recm Recm Accounting at OSU Univ Ctlr 8 hrs 4 Yrs Recm Recm Using ereports Portal Financials Univ Ctlr 4 hrs 4 Yrs Recm Recm Using General Ledger Reports Univ Ctlr 10 hrs 4 Yrs Recm Recm Budget & Fund Transfers Univ Ctlr 4 hrs 4 Yrs Recm Recm Recm PCard Policy Overview Carmen 15 min 2 Yrs Recm REQ REQ Recm PCard Travel & GET Card Holder Carmen 15 min 2 Yrs Recm REQ Recm Purchasing Card Manager Carmen 15 min 2 Yrs Recm REQ Recm PCard Reallocator Carmen 15 min 2 Yrs Recm REQ Recm PCard Approver Carmen 20 min 2 Yrs REQ Recm Requisition 1 Univ Ctlr 4 hrs 1 Yr REQ Requisition 2 Univ Ctlr 3 hrs 1 Yr REQ Requisition 3 Univ Ctlr 3 hrs 1 Yr REQ Purchase Order 1 Univ Ctlr 4 hrs 1 Yr REQ Purchase Order 2 Univ Ctlr 4 hrs 1 Yr REQ Procurement Inquiry and Approval Univ Ctlr 4 hrs 1 Yr Recm Recm Recm Procurement & Payment Process Univ Ctlr 12 hrs 1 Yr Recm Recm REQ Prep Training Carmen 1.5 hrs 3 Yrs REQ Health Insurance Portability & Accountability (HIPAA) TBD TBD 1 Yr REQ REQ REQ Managing OSU Records OHR 2 hrs 2 Yrs Recm Recm Recm Recm Recm REQ REQ REQ GRA:Overview & Practice OHR TBD 4 Yrs REQ Payroll Processing OJT TBD 4 Yrs REQ Payroll Certification OJT 15 min 4 Yrs REQ Hire an Employee OHR 8 hrs 4 Yrs REQ Manage Additional Pay OHR 3.5 hrs 4 Yrs REQ Manage Job Data OHR 8 hrs 4 Yrs REQ Manage Position & Create Job Openings OHR 3.5 hrs 4 Yrs REQ Manage Timekeeping OHR 7 hrs 4 Yrs = Assumes accountants have a basic understanding of debits and credits Accountants Depositors Buying/Purchasing Travel Arranger/Reviewers Accounts Payable Processors Controls & Reconciliations Records Coordinators Payroll Technicians REQ = Required Recm = Recommended 2

24

25

26 Appendix C Standardized Fiscal Processes Revised: 6/30/2010 1

27 Flowchart/Process Diagrams Standardized Fiscal Processes 6/30/2010 Appendix C The following table identifies the fiscal processes that are documented in the University s erequest process flowcharts, located in Appendix C, page 2, of the Student Life Internal Control Structure document. Page Type erequest Process 2 Payments Reimbursements & non-purchase order payments (Prep Voucher) 2 Purchasing Requisitions/Purchase Orders (Standard d Request) 2 Purchasing Blanket Purchase Order Release 2 Purchasing Internal Orders 2 Purchasing estores Items 2 Purchasing Purchasing Card 2

28 Flowchart/Process Diagrams Standardized Fiscal Processes 6/30/2010 Appendix C The following table identifies the Student Life fiscal processes for which the university has not yet provided standardized process documentation. The page numbers represent the pages located in this document and are included in this Appendix of the Student Life Internal Control Structure document. Page Type Process 5 Priorities Emergency, Critical & Routine 6 Purchasing Petty Cash 7 Purchasing Emergency Purchasing Card 8-12 Travel Travel/Reimbursements 13 Payments Accounts Payable/Invoice Payment 14 Accounts Receivable Accounts Receivable (Initial Billing Revenue Recognition) 15 Accounting Cash Receipts/Deposits 16 Accounting Credit Card Payments by Customers 17 Accounting Journal Entries 18 Controls General Ledger Reconciliation & Controls Monitoring 3

29 Flowchart/Process Diagrams Standardized Fiscal Processes The following process flowcharts are intended to identify the responsibilities, forms, action steps (process flows), and relationships for the various fiscal processes. The highlighted/darkened boxes indicate key approvals in the process. Generally, the unit-level approvals are business purpose p and budgetary approvals, whereas the approvals by service center staff members are compliance reviews and approvals. Key notes about the flowcharts: 1. Unit represents the Student Life (or supported unit). 2. Service Center represents the fiscal support services team providing accounting, procurement, payroll, and internal controls/monitoring support for Student Life. The Service Center is located at 830 Lincoln Tower. 6/30/2010 Appendix C Flowchart Symbols: Document Process or Key Review Computer System Go To box Coordination Action Approval (by delegated approver) or Database Files (Identifying next steps or Activity (if needed) activities) Process Flow Directional Arrow Coordination Process Flow Directional Arrow (if needed) Purchase Request Form (PRF) is a generic term for a paper or electronic method of documenting a request to purchase items. 4