Governmental Internal Controls

Below I provide useful summary of governmental internal controls.

Why am I providing this list of useful controls? Most small governments struggle with establishing sound internal controls. So, the list provides a beginning point for preventing theft in your government. While not a comprehensive list, it will help. 

Many of the internal controls listed below are also pertinent to nonprofits and small businesses as well. You will find this same checklist in The Little Book of Local Government Fraud Prevention (available on Amazon) which provides many more fraud prevention ideas.

I am providing general fraud prevention controls and then transaction-level controls for:

• Cash receipts and billing
• Cash payments and purchasing
• Payroll

General Governmental Internal Controls

Here are some general governmental internal controls.

1. Have bank statements mailed directly to someone outside of accounting; recipient should peruse bank statement activity before providing it to accounting
2. Perform surprise audits (use outside CPA if possible)
3. Elected officials and management should review the monthly budget to actual reports (and other pertinent financial reports)
4. Map internal control processes by transaction cycle (preferably done by a seasoned CPA); once complete, provide the map to all employees involved in the cycle; when control weaknesses exist, institute additional controls (see 11. below)
5. Use a whistleblower program (preferably use an outside whistleblower company)
6. Reconcile bank statements monthly (have a second person review and initial the reconciliation)
7. Purchase fidelity bond coverage (based on risk exposure)
8. Periodically request from the government’s bank a list of all bank accounts in the name of the government or with the government’s federal tax I.D. number; compare the list to bank accounts set up in the general ledger
9. Secure computer access physically (e.g., locked doors) and electronically (e.g., passwords)
10. Do not allow the electronic transmission (e.g., email) of sensitive data (e.g., social security numbers) without the use of protected transmission technology (e.g. Sharefile); create policy and train staff
11. Where possible, segregate who (1) authorizes transactions, (2) records transactions, (3) reconciles records, and (4) has custody of assets; when segregation of duties is not possible, require documented second-person review and/or surprise audits

Transaction Governmental Internal Controls

Here are transaction level governmental internal controls.

Cash Receipts and Billing Controls

1. Use a centralized receipting location (when possible)
2. Assign each cash drawer to a separate person; require daily reconciliation to receipts; require second person review
3. Deposit cash timely (preferably daily); require the composition of cash and checks to be listed on each deposit ticket (to help prevent check-for-cash substitution)
4. Immediately issue a receipt for each payment received; a duplicate of the receipt or electronic record of the receipt is to be retained by the government
5. A supervisor should review receipting-personnel adjustments made to accounts receivable
6. Do not allow the cashing of personal checks (e.g., from cash drawers)

Cash Payments and Purchasing Controls

1. Guard all check stock (as though it were cash)
2. Do not allow hand-drawn checks; only issue checks through the computerized system; if hand-drawn checks are issued, have a second person create and post the related journal entry
3. Do not allow the signing of blank checks
4. Limit check signing authorization to as few people as possible
5. Require two employees to effectuate each wire transfer
6. Persons who authorize wire transfers should not make related accounting entries
7. Require a documented bidding process for larger purchases (and sealed bids for significant purchases or contracts); specify procedures for evaluating and awarding contracts.
8. Limit the number of credit cards and the chargeable maximum amount on each card
9. Allow only one person to use an individual credit card; require receipts for all purchases
10. Require a street address and social security or tax I.D. numbers for each vendor added to accounts payable vendor list (P.O. box numbers without a street address should not be accepted)
11. Signed vendor checks should not be returned to those who authorized the payment; mail checks directly to vendors
12. Compare payroll addresses with vendor addresses for potential fictitious vendors (usually done with electronic audit tools such as IDEA or ACL)

Payroll Controls

1. Provide a departmental overtime budget/expense report to governing body or relevant committee
2. Use direct deposit for payroll checks
3. Payroll rates keyed into the payroll system must be supported by proper authorization in the employee personnel file
4. Immediately remove terminated employees from the payroll system
5. Use biometric time clocks to eliminate buddy-punching
6. Check for duplicate direct-deposit bank account numbers
7. A department head should provide written authorization for overtime prior to payment

Your Recommendations

What additional controls do you recommend? Share your thoughts below.

Related

Reporting Duties When No Internal Control Issues are Noted

This article tells you what to report when there are no internal control issues. I discuss AICPA and Yellow Book guidance.

Accounting and Auditing

Accounting and Auditing for CPAs Understanding accounting and auditing is key to becoming an outstanding CPA. There’s no way...

See Payroll Audit Mistakes and Right Approaches

Learn to audit payroll with this article. Sometimes, payroll is more than 50% of your expenses, so it's important that you address this appropriately.