Professionals Reviewing Internal Controls

A few simple best practices can help strengthen your institution’s segregation of duties, account reconciliations, and proper access to IT systems.

Reducing risk

Three Internal Control Weaknesses in Higher Education and How to Fix Them

  • Chrissy Bowman
  • 6/12/2017

One of the most common questions our higher education clients ask is, “How do our institution’s internal controls stack up?” Most colleges and universities actually have very good controls in place, but we consistently see three common areas where they run some risks:

  • Segregation of duties
  • Timely and accurate reconciliations
  • Controlled access to technology systems

Organizations that are deficient in any of these essential controls usually can trace their decline back to routine changes in personnel. As people come and go or take on new positions in the organization ― and as responsibilities are shuffled to accommodate tighter budgets or growing departments ― these things can fall through the cracks. Here’s what you can do to keep that from happening.

Segregation of duties

A lack of segregation of duties doesn’t just occur in small organizations. Often, when duties within a department are reassigned, or when budgetary constraints limit hiring for vacant positions, employees take on roles previously performed by other individuals. As they absorb more functions, the lines of duty segregation begin to erode.

But you can — and must — prevent this blurring of lines, even with limited staff. A good rule of thumb is to ensure that the responsibility for recording a transaction, authorizing a transaction, and keeping custody of the assets are assigned to different people. For example, when making payments for cash disbursements, Person #1 approves the invoice, Person #2 enters the transaction into the system, and Person #3 signs the check. If you have fewer than three people, consider involving board members to perform certain functions and increase separation.

It’s also important to keep in mind not just what your employees are responsible for performing, but also what they have the ability to do. For your key processes that require segregation of duties, consider developing a matrix that lists out each step in the process, then the individuals who can perform the duty across the top. You will quickly see where there are vulnerabilities in the process.

Timely and accurate reconciliations

Account reconciliations are one of the most important controls for any organization. When performed regularly and accurately, they can be among the best tools for preventing and detecting errors or fraud.

When there are problems, however, it’s usually because an account wasn’t reconciled in a timely manner. If reconciliations are not regularly performed, your information is incomplete and that hinders the accurate reconciling of certain items. This can lead to some accounts, such as a new one in the general ledger, never being reconciled at all. This situation can expose you to significant risk of error or fraud.

As a best practice, we recommend that someone in the organization is assigned to compare the listing of reconciliations being performed to the general ledger trial balance. This will help ensure that all accounts are reconciled. In addition, all items should have a date so that stale reconciling items are easily identified. These simple practices will help improve the quality of reconciliations.

Access to technology systems

Internal controls over information technology are of paramount importance. You must keep tabs on which employees have access rights to your systems and programs.

Generally, institutions have strong processes for system access when on-boarding new employees. But over time, employees change positions or leave the organization, and the system rights are not always kept up. At least once a year, we recommend comparing your employee listing to the system user listing to ensure that only current employees are included. In addition, individual departments should review the access rights granted to employees and confirm that they are commensurate with the job duties they currently perform.

How we can help

CLA’s professionals understand the internal control issues specific to higher education institutions. This is particularly important when an institution has gone through a period of growth, contraction, or reorganization. We can assess your current processes and help you understand the areas and internal controls that may require some improvement.