Governmental Internal Controls

By Charles Hall | Fraud , Local Governments

Below I provide useful summary of governmental internal controls.

Why am I providing this list of useful controls? Most small governments struggle with establishing sound internal controls. So, the list provides a beginning point for preventing theft in your government. While not a comprehensive list, it will help. 

Many of the internal controls listed below are also pertinent to nonprofits and small businesses as well. You will find this same checklist in The Little Book of Local Government Fraud Prevention (available on Amazon) which provides many more fraud prevention ideas.

I am providing general fraud prevention controls and then transaction-level controls for:

• Cash receipts and billing
• Cash payments and purchasing
• Payroll

General Governmental Internal Controls

Here are some general governmental internal controls.

1. Have bank statements mailed directly to someone outside of accounting; recipient should peruse bank statement activity before providing it to accounting
2. Perform surprise audits (use outside CPA if possible)
3. Elected officials and management should review the monthly budget to actual reports (and other pertinent financial reports)
4. Map internal control processes by transaction cycle (preferably done by a seasoned CPA); once complete, provide the map to all employees involved in the cycle; when control weaknesses exist, institute additional controls (see 11. below)
5. Use a whistleblower program (preferably use an outside whistleblower company)
6. Reconcile bank statements monthly (have a second person review and initial the reconciliation)
7. Purchase fidelity bond coverage (based on risk exposure)
8. Periodically request from the government’s bank a list of all bank accounts in the name of the government or with the government’s federal tax I.D. number; compare the list to bank accounts set up in the general ledger
9. Secure computer access physically (e.g., locked doors) and electronically (e.g., passwords)
10. Do not allow the electronic transmission (e.g., email) of sensitive data (e.g., social security numbers) without the use of protected transmission technology (e.g. Sharefile); create policy and train staff
11. Where possible, segregate who (1) authorizes transactions, (2) records transactions, (3) reconciles records, and (4) has custody of assets; when segregation of duties is not possible, require documented second-person review and/or surprise audits

Transaction Governmental Internal Controls

Here are transaction level governmental internal controls.

Cash Receipts and Billing Controls

1. Use a centralized receipting location (when possible)
2. Assign each cash drawer to a separate person; require daily reconciliation to receipts; require second person review
3. Deposit cash timely (preferably daily); require the composition of cash and checks to be listed on each deposit ticket (to help prevent check-for-cash substitution)
4. Immediately issue a receipt for each payment received; a duplicate of the receipt or electronic record of the receipt is to be retained by the government
5. A supervisor should review receipting-personnel adjustments made to accounts receivable
6. Do not allow the cashing of personal checks (e.g., from cash drawers)

Cash Payments and Purchasing Controls

1. Guard all check stock (as though it were cash)
2. Do not allow hand-drawn checks; only issue checks through the computerized system; if hand-drawn checks are issued, have a second person create and post the related journal entry
3. Do not allow the signing of blank checks
4. Limit check signing authorization to as few people as possible
5. Require two employees to effectuate each wire transfer
6. Persons who authorize wire transfers should not make related accounting entries
7. Require a documented bidding process for larger purchases (and sealed bids for significant purchases or contracts); specify procedures for evaluating and awarding contracts.
8. Limit the number of credit cards and the chargeable maximum amount on each card
9. Allow only one person to use an individual credit card; require receipts for all purchases
10. Require a street address and social security or tax I.D. numbers for each vendor added to accounts payable vendor list (P.O. box numbers without a street address should not be accepted)
11. Signed vendor checks should not be returned to those who authorized the payment; mail checks directly to vendors
12. Compare payroll addresses with vendor addresses for potential fictitious vendors (usually done with electronic audit tools such as IDEA or ACL)

Payroll Controls

1. Provide a departmental overtime budget/expense report to governing body or relevant committee
2. Use direct deposit for payroll checks
3. Payroll rates keyed into the payroll system must be supported by proper authorization in the employee personnel file
4. Immediately remove terminated employees from the payroll system
5. Use biometric time clocks to eliminate buddy-punching
6. Check for duplicate direct-deposit bank account numbers
7. A department head should provide written authorization for overtime prior to payment

Your Recommendations

What additional controls do you recommend? Share your thoughts below.

Theft of Capital Assets in Local Governments

By Charles Hall | Asset Misappropriation

Theft of Capital Assets

In businesses, nonprofits, and governments, the theft of capital assets happens often. Today I explain how these thefts occur and how you can prevent them.

A USA Today article began with, “Stolen and sensitive U.S. military equipment, including fighter jet parts wanted by Iran…have been available to the highest bidder on popular Internet sales sites.” The article went on to say that the equipment, “purchased with taxpayer money,” was available for purchase on eBay and Craigslist and included “components from F-14 fighter jets” and “used Nuclear Biological Chemical protective suit.”

Capital assets often go missing because no one is paying attention, and the thief knows it. Such assets can be stolen with the intent to sell and convert to cash or simply for personal use.

The thefts often occur when employees place equipment or other capital assets in their vehicles and drive home. If the employee wants to cover their tracks, they might complete accounting paperwork for disposal of assets (saying the equipment was junked). More often than not, however, the asset is just stolen because the employee knows that no one will notice, or, if someone does, he can say, “I don’t know what happened to that piece of equipment.”

Long-term employees realize that the external auditors seldom audit existing capital assets. Yes, the auditor will examine an invoice, but how many auditors physically inspect plant, property and equipment?

Capital Asset Control Weakness

The main enabling factor is usually a lack of accountability. Many companies, nonprofits, and small governments do not perform periodic fixed asset inventories. Often equipment is purchased and added to the depreciation schedule, but no one–at a later date–compares this master list of fixed assets to what is (or should be) physically present.

Correcting Capital Asset Control Weakness

Performing periodic inventories is the key to lessening the threat of capital asset theft.

First assign each capital asset to a person (usually a department head or a supervisor); let this person know that he or she is personally responsible for the item. Then have someone external to each department perform periodic inventories of departmental assets.

Also, install security cameras to record all activity.

See my article: Auditing Plant, Property, and Equipment.

Omitting the MD&A in Governments

By Charles Hall | Auditing , Local Governments

Omitting the MD&A in governments is not common, but it does occur.

According to AU-C 730, the auditor’s report on the financial statements should include an other-matter paragraph that refers to the required supplementary information (RSI). In governmental financial statements, the management, discussion, and analysis (MD&A) is considered RSI. Though the MD&A is “required” supplementary information, governments can–strangely enough–exclude it from the financial statements.

Omitting the MD&A – Effect on an Audit Opinion

If the required supplementary information is omitted, the auditor should include an other-matter paragraph in the opinion such as the following:

Management has omitted the management, discussion, and analysis that accounting principles generally accepted in the United States of America require to be presented to supplement the basic financial statements. Such missing information, although not a part of the basic financial statements, is required by the Governmental Accounting Standards Board, who considers it to be an essential part of financial reporting for placing the basic financial statements in an appropriate operational, economic, or historical context. Our opinion on the basic financial statements is not affected by this missing information.

Notice the omission of the MD&A does not affect the opinion rendered (in other words, it does not result in a modified report).

RSI Audit Standard

AU-C 730 is the audit standard for required supplementary information. Click here for an overview of the supplementary information audit standards. The former supplementary information standards were SASs 118, 119 and 120; those standards are now–under the Clarity Standards–AU-C sections 720, 725, and 730.

Omitting the MD&A – Effect on a Compilation Report

The MD&A is sometimes omitted in financial statements subject to a compilation report. 

In compilation reports, the relevant language when omitting the MD&A is as follows:

Management has omitted the management, discussion and analysis that accounting principles generally accepted in the United States of America require to be presented to supplement the basic financial statements. Such missing information, although not a part of the basic financial statements, is required by the Governmental Accounting Standards Board which considers it to be an essential part of financial reporting and for placing the basic financial statements in an appropriate operational, economic, or historical context. 

Theft of Government Property: Stealing Tax Money

By Charles Hall | Asset Misappropriation

Theft of government property happens. Cash. Equipment. Vehicles. Inventory. You name it. Today, we take a look at how one elected governmental official took a substantial amount of cash.

Theft of Government Property

Some twenty years ago, I was working on an audit of a county tax commissioner’s office. We were noticing differences in the receipts and the cash collections.

So one day I walk into the Tax Commissioner’s office. As I step in, I see several thousand dollars of cash laying on her desk. So, I remarked to her, “Haven’t made a deposit lately?” She laughed and said, “No, I’ve been too busy lately.”

I thought to myself, “Strange. She knows we’re here for the annual audit, and she has all this undeposited cash in open view. It’s as though she has no fear.”

The next day a gentleman comes into the room where we (the auditors) were working and whispers to me, “The Commissioner has a cocaine habit.” I did not know the fellow, so I wondered if the assertion had any merit. Regardless, this was shaping up to be an interesting audit.

The Damages

Our audit disclosed unaccounted-for funds of over $300,000 in the year one. Year two, the differences continued and exceeded $500,000. After three years, the unaccounted-for amount was in the $800,000 range.

Why was she not removed? Tax Commissioners are elected in Georgia, so the only person that could remove her was the governor. The local county commissioners could not dismiss her.

Finally, the FBI was brought in. But even they could not prove who was stealing the money. Why? The tax office had two cash drawers and eight clerks. All eight worked out of both drawers. So when cash went missing, you could not pin the differences on any one person.

In addition, the books were a disaster, postings were willy-nilly. There was no rhyme or reason–what I call “designed smoke.” The smoke covers up theft of government property.

The tax commissioner eventually went to prison for tax evasion. She made the mistake of depositing some of the stolen cash into her personal bank account, and the Feds were able to prove she had not reported the income.

Control Weakness Allowing Theft of Government Property

The primary weakness was the lack of design in the collection process. Two or more people should never work from one cash drawer. Deposits were not timely made (and in many cases, not made at all). And then the books (mainly the tax digest) was not appropriately posted as collections were received.

So, let’s see how to lessen theft of government property.

Fixing the Control Weakness

The primary fix was to remove the tax commissioner.

Next, each cash drawer should be assigned to only one person at a time.

Cash receipts should be written and the tax digest should be posted as tax payments are received.

Finally, deposits should be made daily.