RWB 08 2012-13 ICQ Workforce Template

RWB 08 - First Coast Workforce Development, Inc.
2012/13 Internal Control Questionnaire for Workforce Organizations/Programs
Prepared by: Financial Monitoring and Accountability Section Date: August 10, 2012
Introduction and Purpose

The Internal Control Questionnaire (ICQ) has been developed by the Department of Economic Opportunity (DEO) as a self-assessment tool for the agencys subrecipients to help evaluate whether a system of sound internal control exists within their organization. An effective system of internal control provides reasonable assurance that managements goals are being properly pursued. Each organizations management team sets the tone and has ultimate responsibility for a strong system of internal controls. However, everyone in an organization has responsibility for internal control, and this message should be communicated to all staff. The ICQ should be submitted by the Executive Director of the organization. Responses should reflect the entitys management teams knowledge and perspective of the controls in place as of the time the questionnaire is completed. The span of questions is designed to give a broad viewpoint of the organization and its internal control processes which impact operations. After review of the questions, the management team may determine not all the controls included in the ICQ are in place for the organization, and there may be factors (e.g., organization size, etc.) and/or compensating controls which the organization employs in providing safeguards. The ICQ document provides a means for entity management to describe such constraints and/or compensating controls and, therefore, the entire document should be reviewed by any reader.
Overview of Internal Controls

Definition and Objectives of Internal Controls Internal control is a process, effected by an entitys board of directors, management and other personnel, designed to provide "reasonable assurance" regarding the achievement of objectives in the following categories: Effectiveness and efficiency of operations Reliability of financial reporting Compliance with applicable laws and regulations The concept of reasonable assurance implies that the internal control system for any entity, will offer a reasonable level of assurance that operating objectives can be achieved. Need for Internal Controls Internal controls help to ensure the direction, policies, procedures, and practices designed and approved by management and the governing board are put in place and are functioning as designed/desired. In addition, the A-102 Common Rule and OMB Circular A-110 (2 CFR Part 215) require that non-Federal entities receiving Federal awards establish and maintain effective control over and accountability for all funds property and other assets. Internal controls should be designed to achieve the objectives described above, adequately safeguard assets from loss or unauthorized use or disposition, and to provide assurance that these assets are used solely for authorized purposes in compliance with Federal laws, regulations, and program compliance requirements. What Internal Controls Cannot Do As important as an internal control system is to an organization, an effective system will not guarantee an organizations success. Effective internal controls can keep the right people, such as management and the
1 | Page
Internal Control Questionnaire 2012/13
governing board members, informed about the organizations operations and progress toward goals and objectives. However, these controls cannot protect against economic downturns or make an understaffed entity operate at full capacity. Internal controls can only provide reasonable, but not absolute, assurance that the entitys objectives can be met. Due to limitations inherent to all internal controls systems, breakdowns in the internal control system may be caused by a simple error or mistake, or by faulty judgments made at any level of management. In addition, controls may be circumvented by collusion or by management override. The design of the internal controls system is dependent upon the resources available, which means there must be a costbenefit analysis performed as part of designing the internal control system. Elements of Internal Control These are the elements of internal control. Control Environment Sets the tone of the organization, influencing the control consciousness of its people. It is the foundation for all other elements of internal control and can significantly impact all other elements if compromised. Risk Assessment The identification and analysis of relevant risks to achieve the entitys objectives and the activity of forming a basis for determining how risks of the entity should be mitigated. This should be a perpetual process, with review and assessment of risks mirroring the dynamic conditions of the organization and its operating environment. Control Activities The policies and procedures that help ensure managements directives are carried out. These can include approvals, authorizations, segregation of duties, or security and safeguarding of assets. Information and Communication The process of identification, capture, and exchange of information in a form and time frame that enable people to carry out their responsibilities. Employees must have a clear understanding of managements expectations and management must hear and understand employees concerns. Monitoring A process that assesses the quality of internal performance over time and emphasizes achieving timely resolution for instances of noncompliance identified.
Parts of the Questionnaire

Subsequent sections of this document contain the Parts of the ICQ. The Parts reflect groupings of questions related to major areas of control focus within the organization. The groupings of major operating areas are also included in annual onsite monitoring activities performed by DEO. The Parts of the ICQ are: Part 1 - Control Environment Part 2 - Administrative Operations Part 3 - Subrecipient Monitoring Part 4 - Information Technology Each Part of the ICQ begins with an introduction, explaining the purpose and general information about the contents of the Part. Immediately following is an Objectives and Risks table which provides a list of Objectives, which describe the goals of management within each major area (i.e., what is trying to be accomplished by the
2 | Page
controls put in place by management). For each Objective there is Risk or list of Risks which are being addressed by the controls put in place to meet the Objective. The final section of each Part contains the questions. Each question represents an element or characteristic of control that is or can be used to promote the assurance that operations are executed as management intended. It should be noted that entities may have adequate internal controls even though some or all of the listed characteristics are not present. Entities could have other appropriate internal controls operating effectively that are not included here. The entity will need to exercise judgment in determining the most appropriate and cost effective internal control in a given environment or circumstance to provide reasonable assurance for compliance with Federal program requirements.
Definitions
Cancelled Checks Hard copies of canceled checks and/or electronic check images. Cash Receipts Checks, EFTs, or cash received by the entity. Entity Locations Administrative and operating sites of the organization. Entity Management Board staff leadership (i.e., Executive Director, Chief Financial Officer, Chief Operating Officer, etc.) and/or Board members or committees. Material Service Organization - An entity that performs specialized tasks or functions for another entity is known as a service organization. A material service organization is a service organization that performs services which are significant to the organizations operations (e.g., payroll processing and other services), which are necessary for conducting business. Program Income Gross income earned as a direct result of a supported activity or earned as a result of the award. Program income includes, but is not limited to: income from fees for services performed (e.g. training or conference fees); income generated from the use or rental of real or personal property acquired under federally funded projects/activities; proceeds from the sale of, or license fees for software or web-based programs; and income from similar activities which result of services performed under a particular funding source.
Completing the Document

After careful consideration, select the response (Yes, No, or N/A) which best answers each question as it relates to your entity. There are no 'right' or 'wrong' answers. Answers should simply reflect the current operating environment of your entity. Any replies marked "No" or "N/A" should include an explanation which details any compensating controls which are in place to help address the risk factors noted for the specific operating area described. Also, include narrative descriptions explaining any "Yes" replies that may help explain controls currently in place at your entity. 3 | Page Internal Control Questionnaire 2012/13
Please use the Comments/Explanations section at the right of the questions to record your narrative or explanation. Tips for Completing the ICQ: Simply click on the appropriate box to mark or unmark an answer. Yes or No Replies In some instances, a Yes or No response is sufficient. Other questions may require additional information. When completing such a question, select the answer that is most prevalent or most common based on current operations and provide a narrative in the Comments/Explanations section which will clarify the response. The Comments/Explanations section will stay with each question and is often times essential to providing a complete and clearer picture of the controls in place for your organization. Control is In Process There may be questions which are appropriately answered no at the time of completing the questionnaire, but the control is under development by the organization. In those instances, select No and add a narrative in the Comments/Explanations section to describe the control that is In the process of being developed and include the targeted implementation date. No When the Entity intentionally has No Such Control There may be controls described in the ICQ which, after careful consideration and evaluation, are intentionally not employed by the organization, based on the organizations current operating structure. For these questions, select No as the answer and provide a narrative in the Comment section to indicate the control was considered but not implemented. Also, include a description of any factors and supporting documentation, if available, that would be important to share or document about that decision. Remember, if there are compensating controls or other procedures that are utilized to help provide reasonable assurance that a particular risk is addressed, please also describe those in the Comments/Explanations section. Comments/Explanations When completing the Comments/Explanations section, remember that many of the readers will be individuals outside of the organization: DEO staff, fiscal and programmatic monitoring staff, independent auditors, governing board members, media, etc. Therefore, narratives should be written as if the reader does not know the acronyms or abbreviations used by those within your organization. Use complete sentences to ensure references or terms used within the narrative can stand alone and are clear to the reader.
Certification of Self-Assessment of Internal Controls

Attachment A, includes a certification which should be completed and signed by the entitys Executive Director, and attached to the completed ICQ submission. Both the certification page and completed ICQ should be submitted to DEO to the following e-mail address: FMA-RWB@deo.myflorida.com.
4 | Page
Part 1: Control Environment

Purpose: The attached questions provide a framework for performing a self-assessment of the internal control environment of the entity. These questions, unlike other Parts, do not focus on any one particular operational or administrative area, but are designed to gain an understanding of the overall tone and processes in place to set the internal control environment of the organization. The Control Environment The control environment sets the tone of an organization, influencing the control consciousness of its people. It is the foundation for all other elements of internal control, providing discipline and structure. As the foundation, if the control environment of an organization is compromised, all internal control elements will face severe problems. Elements of the Control Environment The control environment is impacted by the following factors: A. B. C. D. E. F. G. H. Governance and Oversight Integrity and Ethical Values Commitment to Competence Managements Philosophy and Operating Style Organizational Structure Assignment of Authority and Responsibility Human Resource Policies and Practices Risk Assessment
5 | Page
Control Environment
Objectives Management philosophy and attitude recognizes the importance of and commitment to the establishment and maintenance of a strong system of internal control as communicated to all employees through actions and words. Management adheres to a code of conduct and other policies regarding acceptable business practices, conflicts of interest, or expected standards of ethical and moral behavior, and communicates these polices to all employees. Organizational structure is clearly defined, current, defines performance of the necessary functions, and demonstrates appropriate reporting relationships have been established. Personnel are qualified and properly trained in order for control procedures to operate in the manner intended. Current job descriptions are established detailing the responsibilities and qualifications for each position. Delegation of authority and/or limitation of authority exists to provide assurances that responsibilities are effectively discharged. Policies and procedures that are documented provide a basis for reviews, follow-up evaluations and audits. Risks Tone at the top regarding managements view of internal controls is not set and communicated and therefore creates an environment where employees do not understand the importance of internal controls. Appropriate business conduct is not established or understood.
Organizational chart is not current. Employees are unaware of reporting relationships in the organizational structure. Duplication of functions by units. Personnel are not qualified to perform tasks assigned. Personnel are not adequately trained. Job descriptions are not coordinated with actual job activities and performances. One employee controls all phases of a transaction or carries out functions without appropriate oversight. Functions are not performed uniformly among units. Federal, state or entity requirements are not met. Lack of support for functions and transactions performed. Management cannot communicate expectations to organizational units. Unusual transactions or events go undetected. Management cannot determine if goals are being achieved. Ability for staff or management to override internal controls.
Budgetary and reporting practices provide benchmarks by which management can measure accomplishments.
Organizational checks and balances provide authority for certain functions that minimize the potential for waste, fraud, abuse or mismanagement.
6 | Page
Control Environment
A. Governance and Oversight 1. Does the governing board meet on a regular basis? 2. 3. 4. 5. Are minutes of the governing board kept and available for review? Does the audit, finance or other similar committee meet on a regular basis? Are minutes of the audit, finance or other similar committee kept and available for review? Is the entitys annual operating budget approved by: Governing board? Chief Elected Official(s) for the entity? 6. 7. 8. 9. 10. 11. 12. Are unusual variances between budget and actual examined during the year and at year-end by the governing board and management? Does the organization have a method for ensuring that obligations do not exceed funds that are available? Are policies and procedures (new or revised) reviewed and approved by the governing board or appropriate committee? Are bonus, incentive, merit, and/or performance payments to key employees reviewed and approved by the governing board or appropriate committee? Are changes in program operating activities and/or service delivery models reviewed and approved by the governing board or appropriate committee? Are external audits performed on a periodic basis? Are audit and monitoring results reviewed with the governing board or appropriate committee?
Is the control present?
Yes
No
N/A
Comments/Explanations
Conducted through Executive Committee.
7 | Page
Control Environment
13. 14. 15. 16. 17. 18. 19. 20. Is information (i.e., findings, recommendations, etc.) provided by external auditors considered and acted upon in a timely manner? Are periodic management reports reviewed with the governing board or appropriate committee? Are new board member orientation materials provided, including an overview of program operations and activities? Are new board member expectations and duties clearly defined? Is the audit, finance or other committee responsible for the review and/or selection of the contracts for auditing, monitoring, or review services? Are issues encountered during the audit (delays, research issues, disagreements with management, etc.) reviewed by the audit, finance or other committee? Are identified instances of possible fraud or misappropriation addressed by the audit, finance or other committee? Are new federal, state, or grant program rules or regulations reviewed with one or more of the following; governing board, audit, finance or other committee?
Yes
No
N/A
B. Integrity and Ethical Values 21. Does management have a formal Code of Conduct applicable to all employees that addresses ethical behavior and appropriate business practices? 22. Does the Code of Conduct expressly prohibit override of internal controls by management? Behavior is not adhering to the code of conduct, which states follow procedures and policies.
23. 24.
Is the Code of Conduct effectively communicated to all employees? Is the Code of Conduct periodically updated and reviewed (i.e., on an annual basis)?
8 | Page
Control Environment
25. Does the entity have an anonymous and confidential Whistleblower policy for communicating and receiving information regarding fraud, errors in financial reporting and misrepresentation or false statements made by management? Has the Whistleblower policy been clearly communicated to employees, customers and service providers? Are Whistleblower results periodically reported on and reviewed by management and/or the governing board?
Yes
No
N/A
26. 27. 28.
No whistleblower complaints.
Have transactions (accounting, procurement, contracting, etc.) been executed in accordance with the Code of Conduct and the approved written policies and procedures? C. Commitment to Competence 29. Does management analyze and document the knowledge and skills (job descriptions) required to accomplish tasks? 30. 31. 32. 33. Are job responsibilities formally documented and reviewed annually by management and other individuals in position of significant influence over the employee's area of operation? Are sufficient training opportunities to improve competency and update employees on new policies and procedures available? Do entity policies reflect current processes?
Does management have a process for the development, approval and implementation of policy updates, including communication of those updates to staff? D. Management's Philosophy and Operating Style 34. Has the governing board or top management established overall objectives in the form of a mission statement, goals or other written operating statement(s)? 35. 36. Are objectives established for key areas (i.e., operations, finance, compliance, etc.)? Have objectives been clearly communicated to all employees? Internal Control Questionnaire 2012/13
9 | Page
Control Environment
37. 38. Does the entity compare its actual performance with its goals and objectives? Does management prohibit the use of personal loans to all employees and to staff of providers or material service organizations?
Yes
No
N/A
E. Organizational Structure 39. Is there an organizational chart that clearly defines the lines of management authority and responsibility? 40. On a least an annual basis, does senior management review and approve the organizational structure of the entity?
F. Assignment of Authority and Responsibility 41. Have specific lines of authority been communicated throughout the organization? 42. 43. 44. 45. 46. Have managers been provided with clear responsibilities from the governing board or top management? Are responsibilities segregated so that no single employee controls all phases of a transaction? (e.g. segregation of authorization, custody, and record keeping). Are there adequate policies and procedures for authorization and approval of transactions at the appropriate level, as applicable? Are specific limits established for certain types of transactions and delegations clearly communicated and understood by employees within the entity? Is the internal control structure monitored and reviewed by management to determine if it is operating as intended?
G. Human Resource Policies and Practices 47. Does the entity maintain updated position descriptions for all full-time and key parttime positions? 48. Are employees cross-trained to ensure the uninterrupted performance of all functions and entity operations? To the extent possible.
10 | Page
Control Environment
49. 50. Does the entity have documented processes for both voluntarily and involuntarily terminated employees (return of credit/debit cards, office keys, laptops, etc.) and are the processes consistently followed? Has the entity identified key positions that may require mandatory annual vacations?
Yes
No
N/A
CEO Regular periodic fiscal and programmatic monitoring done by 3rd parties. Regular periodic fiscal and programmatic monitoring done by 3rd parties.
H. Risk Assessment 51. Does management periodically perform an assessment of the entity's vulnerabilities to fraudulent activity and whether any of these exposures could materially impact operations? 52. Does management periodically perform an assessment of the susceptibility of the entity's operating locations to fraud and how those locations are monitored? 53. 54. Have processes and controls been implemented to address any specifically identified fraud risks or to otherwise help prevent, deter, and detect fraud? Does management have fidelity bonds or commercial insurance in place that would cover: misuse of funds by key management/staff positions? errors and omissions? 55. 56. Does periodic communication occur with the audit, finance or other equivalent committees about how the entity's internal controls serve to prevent, deter, and detect fraud? Is risk identification incorporated into management's short-term and long-term forecasting and strategic planning?
$100,000 per employee
11 | Page
Part 2: Administrative Operations

Purpose: The attached questions provide a framework for performing a self assessment of the internal controls in place surrounding daily administrative operations of the entity. Administrative Operations: The daily administrative operating functions of the organization are controlled via control activities, monitoring, and information and communication. The questions in this Part of the Questionnaire inquire as to whether controls in place for the following specific functions: A. B. C. D. E. F. G. H. General Revenue and Other Income Cash Prepaid Program Items (Participant Support Costs) Fixed Assets Payables and Disbursements Procurement and Contracting Payroll and Human Resources
12 | Page
Administrative Operations
Objectives All transactions are properly accumulated, classified and summarized in the accounts. Risks Financial records do not reflect all current year revenue and disbursement transactions. General ledger is not in balance. Subsidiary ledgers are not in balance with general ledger. Inconsistent application of accounting policies and procedures. Misclassifications, omissions, unacceptable delays, and excessive/unnecessary work performed. Inadequate documentation to show benefit to the grant or other funding source. Repayment of funds due to lack of supporting documentation. Improper or incomplete reporting to governing board, grantor, and/or other entities. Errors in transaction postings may not be detected in a timely manner. Improper or incomplete reporting to governing board, grantor, or other entities. Improper expenditure of funds. Incomplete review of data, permitting possible errors or omissions. Lack of management knowledge and oversight of entity operations/transactions. Failure to record daily receipts/revenue and failure to properly account for program income. Withholding or delaying the recording of receipts/revenue. Diversion of revenue/receipts for personal use. Misappropriated cash or petty cash funds; diverted cash receipts or other revenues; unauthorized disbursements; loss of funds. Potential questioned costs that could be subject to repayment of grant funds. Covering unauthorized transactions by substituting unsupported credits or fictitious expenditures to cover misappropriated collections. Under or over estimating cash or other receivables.
All necessary data is obtained and processed in accordance with established policies and procedures. All transactions are adequately documented.
All transactions are recorded in the appropriate general ledger code. Revenues, collections and receivables are properly accumulated, classified and summarized in accounts. All transactions are properly approved or authorized by management.
All collections are properly identified, control totals developed, and collections properly deposited intact.
All bank accounts and cash on hand are subject to effective custodial accountability procedures and physical safeguards. All cash and receipts transactions (revenue) are promptly and accurately recorded in adequate detail.
13 | Page
Objectives All cash and receipts transactions are properly accumulated, correctly classified and summarized in the general ledger; balances are properly and timely reconciled with bank statement balances. Assets are subject to effective custodial accountability procedures and physical safeguards to prevent loss, damage or theft. Risks Misstating cash balances; covering unauthorized transactions by falsifying bank reconciliation. Underreporting of program income and/or other revenues to governing board, grantor, and/or other entities. Assets are lost or expire. Assets are used inappropriately (e.g., not according to grantor instructions or in accordance with management direction). Insufficient insurance coverage. Theft of assets. Grant terms and conditions are violated by exceeding the period of availability. Questioned costs subject to repayment of funds. Payments made incorrectly for goods/services not received or only partially received. Payment based on improper price or terms. Payments made incorrectly after contract closeout. Accounting distribution of cost is inaccurate or inappropriate. Potential questioned costs subject to repayment of funds. Incorrect or duplicate payments. Alteration of checks. Disbursements for materials or services not properly documented and/or approved. Improper cash or accounts payable balances. Increased risk of duplicate payments made in error. Loss of possible credits or discounts available for timely payment. Purchases made in violation of conflict of interest policy. Purchases violate entitys policy or, if funded by grant program funds, purchase of unallowed item per federal, state or grant program regulations. Purchases are not timely and/or are outside the period of availability. Purchases are not in accordance with budget. Lack of cost/price analysis; payment in excess of optimum price. Purchases violate entitys policy or, if funded by Internal Control Questionnaire 2012/13
Assets are timely utilized. All invoices processed for payment represent goods and services received and are accurate as to terms, quantities, prices and extensions; account distributions are accurate and agree with established account classifications, and costs are allocated to programs commensurate with the benefit received.
All checks are prepared on the basis of adequate and approved documentation, compared with supporting data and properly approved, signed and mailed. All disbursement and accounts payable transactions are promptly and accurately recorded as to payee and amount.
All requests for goods and services are initiated and approved by authorized individuals, and are in accordance with policy and budget guidelines.
All purchases are based on valid, approved requests and are properly executed as to price, quantity and vendor.
14 | Page
Objectives Risks grant program funds, purchase is for unallowed item per federal, state or grant program regulations. Quantities are not adequate or in excess of need. Payment for materials or services not received. Damaged or missing goods not reported. Potential questioned costs for salaries charged to grant programs if documentation is incorrect or incomplete. Costs charged to inappropriate programs or in inappropriate amounts (i.e., not based on afterthe-fact determination of the actual level of effort expended by the employee). Employees are paid for time which they did not work. Employees are paid for time which was unnecessary or unauthorized. Risk of duplicated work efforts. Impaired ability by management to analyze operating results if reported data is untimely or incomplete. Costs were charged to inappropriate programs or activities, or charged in inappropriate amounts, based on the actual level of effort expended by the employee.
All materials and services received agree with the original orders. Employees' time and attendance data (including PARs) are properly prepared and submitted by all staff.
Employees' time and attendance data (including PARs) are properly reviewed and approved.
15 | Page
A. General 1. Do written accounting policies and procedures exist and are the policies and procedures available and communicated to all applicable personnel? 2. 3. 4. 5. 6. Is the general ledger chart of accounts maintained by authorized personnel? Are balances in the general ledger periodically substantiated, evaluated, reviewed, or supported by account reconciliations? Are the reconciliations of subsidiary ledgers to control accounts reviewed by someone other than the preparer on a monthly basis? Are journal entries reviewed by someone other than the preparer? Does the entity maintain and follow procedures for record filing, retention, and disposition in accordance with applicable regulations?
Yes
No
N/A
No subsidiary ledgers exist. Lack of manpower, but auditors and monitors review.
B. Revenues and Other Income 7. Does the entity have current policy disclosures for revenues and other income? 8. 9. 10. 11. 12. Is adequate information about applicable federal and state program requirements provided to staff that allow them to properly record revenues and other income? Are revenue and other income summary schedules and supporting files complete, periodically reviewed by management and reconciled to the general ledger? Has the entity identified and documented all sources of program income (e.g., fees for service, use fees, conference fees, honoraria, training, etc.)? (See definition of Program Income on page 3.) Does the organization and its subrecipients use funds from program income activities before requesting additional federal grant funds (cash draws)? Is program income generated properly allocated and recorded in the general ledger? 16 | Page Internal Control Questionnaire 2012/13
13. 14. Is interest income appropriately returned to DEO or treated as program income, as dictated by the grant terms and conditions? Does the entity have procedures and/or cost allocation methodologies in place that address the treatment of shared space for the following: Receipt of program income from shared space? Offset(s) against expenditures billed to DEO? C. Cash 15. Does the entity have appropriate segregation of duties for the following functions? Staff that have the ability to process daily receipts (cash, checks, EFTs) are different from staff responsible for cash or receivables recordkeeping (including reconciling the bank statement) or disbursement functions? Staff that have the ability to make disbursements are different from staff assigned to recordkeeping (including reconciling the bank statement), cash receipts, and receipts of other revenue? Staff that prepare and approve bank statement reconciliations and investigate unusual reconciling items are different from staff responsible for daily receipts (revenue) and disbursement functions? 16. Does the entity rotate personnel that have physical custody of daily receipts (cash, checks, EFTs) on a periodic basis? 17. 18. 19. Is the daily receipts log reconciled on a regular basis with the amounts actually deposited in the bank? Are there policies in place to restrict access to deposits that must be held onsite overnight? Does the entity deface and secure voided checks?
Yes
No
N/A
Comments/Explanations Cost exceeds low interest rate.
No partners in centers.
Lack of manpower, but there are seperation of duties.
17 | Page
20. Does a member of management or the governing board, independent of all assigned cash duties, regularly receive the unopened bank statements and review the statements for unusual activity? Does the entity have an independent review (such as by the governing board Treasurer) of the bank reconciliation each month? Are any reconciling items addressed (followed up on) promptly? Does someone other than staff performing disbursement of funds or assigned custody of check stock or with signatory authority, periodically review cancelled checks? Are all wire transfers, EFT, and all other non-check, electronic disbursements appropriately documented, reviewed and approved? Does management periodically review wire transfers, EFT, and all other non-check, electronic disbursements for appropriate support, purpose, and to identify any unusual or questionable activity?
Yes
No
N/A
21. 22. 23. 24. 25.
D. Prepaid Program Items (Participant Support Costs) 26. Is the ability to purchase prepaid items assigned to staff different from those that approve participants to receive prepaid items and/or reconcile prepaid inventories? 27. Is the ability to approve participants to receive prepaid items assigned to staff different from staff that purchase and/or reconcile prepaid inventories? 28. 29. Are prepaid inventory items (e.g., gas cards) periodically reconciled to accounting records? Does the entity have prepaid program costs policies in place as follows? Policies for participants are current and are adhered to? Policies describe the eligibility and issuance policies and practices for prepaid program costs items? Policies define allowable costs and activities if funded by federal grant 18 | Page Internal Control Questionnaire 2012/13
programs? Policies describe the processes for preparing and maintaining supporting records for prepaid items? Policies describe the processes for performing periodic reconciliations, including follow-up on any questionable activities? Do the prepaid program costs policies describe the processes for custody and safeguarding of prepaid items? Do the prepaid program costs policies describe the processes for issuing items on a first-in, first-out (FIFO)?
Yes
No
N/A
30. 31.
E. Fixed Assets 32. Does management have current, written policies for fixed assets, including the appropriate use and prohibited use of entity property? 33. 34. 35. 36. 37. 38. 39. 40. Is a custodian assigned to each asset or asset location? Is access to assets limited to staff requiring access as part of their job responsibilities? Is there adequate physical security surrounding assets? Is the staff responsible for performing inventory functions different from staff assigned custody of the asset? Is the staff responsible for performing inventory functions different from staff responsible for property records? Is the staff responsible for performing inventory functions different from staff responsible for disbursements? Is there appropriate insurance coverage on significant asset items? Are assets tagged when procured? Asset listing is kept per OMB
19 | Page
41. When an employee or contractor is terminated, either voluntarily or involuntarily, does the entity have procedures in place to remove access to entity assets (i.e., facilities, computers, financial records, client records, etc.)? Do the entity's property records include approved prior approval requests, if required, for any equipment purchases in the applicable program year? Does the entity perform and document performance of a physical inventory of equipment at least once every two years? Does inventory include all assets at all locations including: Warehouse/storage? Awaiting disposal? Issued to subrecipients? Issued to participants? Issued to telecommuters? 45. 46. 47. 48. 49. Does the entity maintain and provide current procedures or instructions for employees involved in the inventory process? Does the entity perform and document performance of the investigation and resolution of any differences between the physical inventory and the master inventory list? Does the entity perform and document performance of a reconciliation of the inventory records to the general ledger as of its fiscal year end? Does the appropriate level of management review the reconciliation and is this review documented? Does the appropriate level of management approve any adjustments to inventory records? 20 | Page
Yes
No
N/A
42. 43. 44.
Asset not issued. Asset not issued.
Reviewed; not documented. If there are any.
50. Do the entity's property records contain the required data elements, in accordance with OMB Circular A-110 (.34(f)(1)), for any property purchased with federal funds as follows? A description of the equipment. Manufacturers serial number, model number, Federal Stock number, national stock number, or other identification number (as applicable). Funding source, including the award number. Whether title vests with recipient or Federal Government. Acquisition date (or date received) and cost. Information from which the percentage of Federal participation (e.g., the portion of costs for any item paid for by the Federal grant program(s)) can be calculated in the cost of the equipment. Location and condition of the equipment and the date information was reported. Unit acquisition cost. Ultimate disposition data, including date of disposal and sales price or the method used to determine the current fair market value where the recipient compensates the Federal awarding agency for its share. F. Payables and Disbursements 51. Do procedures exist: For processing invoices? To ensure accurate account distribution (proper GL coding) of all entries resulting from invoice processing? For disbursement approval and check-signing? 21 | Page
Yes
No
N/A
To flag duplicate invoice numbers submitted for payment by vendors? To ensure that all voided checks are properly accounted for and effectively cancelled? For corporate credit or debit card usage and safeguarding, including identification of staff eligible for cards, allowable expenditures, required documentation, payment, and reconciliation? For employee reimbursements, including allowable expenditures, required documentation, and payment? Does the entity segregate the ability to sign checks from staff responsible for payables and disbursement processing?
Yes
No
N/A
52.
Signatures are printed on checks by accounting software, but appropriate controls are in place for review.
53. 54. 55. 56. 57. 58. 59. 60.
Does the entity segregate the ability to approve purchases from staff responsible for payables and disbursement processing? Do all the entitys locations prohibit the signing of blank checks? Does the entity prohibit making checks pauable to "cash"? Does management or the governing board perform periodic review of payees to identify unusual or questionable activity? Does the entity secure and limit access to check stock to only key staff? Does management document and periodically review the list of staff with access to check stock? Does the entity prohibit the use of dual signature stamps to process checks? Are signature plates or other facsimile signatures only under the signer's control and separated physically from the blank checks?
Except for checks greater than $10,000.00. Signatures are printed on checks by accounting software, but appropriate controls are in place for review. Internal Control Questionnaire 2012/13
22 | Page
61. 62. 63. 64. 65. 66. 67. 68. 69. Are limits set on amounts that can be paid by signature plates or facsimile signature? Does the entity have a policy that requires purchasing authorization, original invoices and receiving reports as supporting documentation prior to making disbursements? Do invoice payment procedures include comparison of invoice quantities, prices, and terms with those indicated on the procurement document (i.e., purchase order, etc.)? Do invoice payment procedures include comparison of invoice quantities with those indicated on the receiving report? Are payments made only on the basis of original invoices and to suppliers identified on the supporting documentation? Does the entity require signatures of both the Executive Director and an officer of the governing board for any disbursements in excess of a set threshold established by the governing board? Are disbursements approved for payment only by properly designated officials? Are invoices (vouchers) reviewed for accuracy and completeness of supporting documents and properly approved? Are all invoices received from vendors in a central location, such as the accounting department?
Yes
No
N/A
Executive Director and Board Treasurer reviews all checks processed.
Invoice have to be approved by authorized purchasing Director/VP who are located in different locations. Lack of manpower but appropriate controls are in place.
70. 71. 72.
Are signed checks delivered directly to the mailroom, making them inaccessible to persons that requested, prepared, authorized or recorded them? Are all records, checks and supporting documents retained according to the applicable record retention policy? Does management periodically review instructions about safeguarding credit and debit cards and cardholder duties? 23 | Page
73. 74. 75. Are staff responsible for corporate credit card payments or employee reimbursements not authorized to make and approve purchases? Are corporate credit cards and/or debit cards reconciled monthly by someone other than the cardholder? Are credit card, debit card, or employee reimbursements for entity management purchases reviewed by the appropriate level of supervising (not subordinates) management or governing board member? Does management maintain a list of employees with credit and/or debit cards, which is reviewed periodically to ensure only appropriate staff have continued access to those cards? Does management or a member of the governing board review activities and purchases by credit card, debit card, or employee reimbursement to ensure these purchases are allowable, are not being split to stay below established spending thresholds, and are in accordance with entity procurement policies? Does the entity have policies and procedures addressing Petty Cash: To designate, in writing, a specific employee as custodian? To establish the amount to be kept in Petty Cash? To determine the maximum amount, per instance (or invoice), that can be paid using Petty Cash? To ensure cash is kept in a locked, secure location? To ensure payments are made through vouchers completely and accurately filled out? To ensure payments are supported by original invoices or receipts? To ensure documents are effectively cancelled (marked paid) when the expense is paid? 24 | Page
Yes
No
N/A
76.
77.
78. 77997
To ensure travel reimbursement expenses or advances are not made from Petty Cash? To ensure only entity employees can receive reimbursements from Petty Cash? G. Procurement and Contracting 79. Does the entity have procedures: Related to procurement of goods and services, including verification that contractors have no suspension and/or debarment violations? To ensure cost/price analysis is performed on all procurement transactions? To describe what is acceptable cost/price analysis for each type of procurement? To ensure analysis of lease vs. purchase alternatives are performed? To ensure procurement actions are appropriately documented in the procurement file? Related to contract preparation and execution, including required provisions, approvals, etc.? Does the entity have policies in place that address conflict-of-interest issues with regard to procurement of goods and services? Are conflict of interest statements maintained for individuals with responsibility for procurement of goods or services (e.g., evaluation team, project managers, or board members)? Does management perform a periodic review to ensure the entity's procurement procedures are in compliance with federal procurement requirements when utilizing federal or state funds? Does management conduct periodic reviews of procurement and contracting activities to determine whether policies and procedures are being followed as intended? Are staff responsible for executing the entity's procurement policy periodically trained to ensure they are aware of current entity procurement policies? 25 | Page
Yes
No
N/A
80. 81. 82. 83. 84.
85. 86. Does the entity's procurement policy provide clear instruction on when sole-sourced procurements are appropriate, including required documentation and approvals? Are thresholds established or criteria set (e.g., high dollar value, lengthy agreements, or other sensitive procurements agreements) which trigger management or governing board level approval for a procurement transaction? Are procurement functions (requisitioning, purchasing, and receiving) assigned to staff who do not perform accounting functions (invoice processing, accounts payable, and general ledger)? Are staff with purchasing responsibilities different from staff with requisitioning and receiving responsibilities? Are thresholds established above which management or governing board level signature is required for contract execution? Is staff responsible for contract solicitation prohibited from signing contracts? Does the entity have written contract administration policies?
Yes
No
N/A
87. 88. 89. 90. 91. 92.
Do the entitys written contract administration policies include the following closeout procedures? Receive and review, within 90 calendar days after the completion of the award, all financial, performance and other reports to determine whether all good/services were completed / received per contract terms? Liquidate, within 90 days, all obligations and/or accrued expenditures incurred under the award? Perform a final cost-price/budget analysis to determine whether excess/unobligated cash has been returned? Provide disposition instructions for real and personal property acquired with Federal funds? Receive and review the final audit to determine whether there are any disallowed costs identified in the audit? H. Payroll and Human Resources 26 | Page Internal Control Questionnaire 2012/13
93. 94. 95. 96. 97. 98. 99. Does the entity perform background/verification checks on all new hires? Does the entity periodically perform background verification/checks on existing staff? Does the entity reconcile the total amount and number of paychecks and/or direct deposits to the payroll registers? Does the entity separate the duties of payroll account check stock custody and check signing? Does entity management periodically review and approve the payroll register? Does the entity have a policy for staff describing the procedures for preparing Personnel Activity Reports (PARs)? Does the entity have a policy describing the procedures for review and approval of staff PARs by supervisors? Does the entity have process for ETA Salary and Bonus CAP to ensure the following: Reconciliation to total actual compensation, (i.e. tie to W-2 information or equivalent data from calendar year payroll files)? Ensure reduction in the level of ETA funding if instances in excess of the limit is determined?
Yes
No
N/A
Comments/Explanations Only as needed.
Time studies and timesheets are the approved methods used. Time studies and timesheets are the approved methods used.
27 | Page
Part 3: Subrecipient Monitoring

Purpose: The attached questions provide a framework for performing a self assessment of the subrecipient monitoring processes within your entity. Subrecipient Monitoring: Subrecipients must comply with all of the requirements of the executed grant, contract or agreement, as well as applicable federal, state or grant program laws, rules and regulations. The questions for this Part of the Questionnaire inquire as to whether controls are in place related to the following specific functions: A. Annual Monitoring Plan and Procedures B. Tracking and Resolution of Monitoring Issues Identified C. Communications from Pass-through Entities
28 | Page
Subrecipient Monitoring
Objectives Obtain reasonable assurance that subrecipients are achieving stated performance goals and are in compliance with laws, regulations and provisions of the grant agreement. Risks Subrecipient is not expending funds in compliance with appropriate federal administrative requirements, federal cost principles, and in accordance with the terms and conditions of the agency's grant agreement with the entity. Subrecipient is unaware of contract terms and conditions. Performance measures go unmet or contracted services may not be provided or may be incomplete. Funds must be paid back. Loss of future grant revenues. Failure to comply with federal requirements to monitor (A-21, A-87, A-133, A-110, A-122, Federal Acquisition Regulations, and WIA Law). Failure to comply with federal requirements to monitor (A-21, A-87, A-133, A-110, A-122, Federal Acquisition Regulations, and WIA Law). Subrecipient(s) records to properly account for and document activities are inadequate or incomplete. Funds are spent on unallowed activities. Failure to provide enough time for subrecipients to identify and/or implement corrective actions. Subrecipient activities violate entity policy or, if funded by grant program funds, are unallowed per federal, state or grant program regulations. Subrecipient is not tracking, recording, and expending funds in compliance with appropriate federal administrative requirements, federal cost principles, and in accordance with the terms and conditions of the agencys grant agreement with the entity. Subrecipient is unaware of the applicable laws, rules, and regulations, for funds received. Subrecipient is unaware of the applicable performance measures, spending caps or spending minimums required for funds received. Funds must be paid back. Loss of future grant revenues. Failure to comply with federal requirements to monitor (A-21, A-87, A-133, A-110, A-122, Federal Acquisition Regulations, and WIA Law).
All subrecipients are timely monitored and the results adequately documented.
Provide appropriate communication and information to subrecipients that describe the passed-through requirements.
29 | Page
A. Annual Monitoring Plan and Procedures 1. Does the entity have a written annual monitoring plan that includes the following: List of subrecipients receiving payments in the entity's current fiscal year and is the plan being adhered to? Analysis of subrecipient's Single Audits? Analysis of subrecipient cost allocation plans? Verification that proper prior approval was provided for selected cost items as required by OMB Circulars (e.g., governments, non-profits, educational institutions) and Federal Acquisition Regulations (FARs) for commercial/for-profit organizations? A tracking process to summarize for management the results of monitoring and resolution of any questioned costs? Does the entity's annual monitoring plan document and follow a standardized process that generates written reports to summarize the monitoring results and corrective action tasks? Does the entity's annual monitoring plan include the issuance of a management decision on audit findings within six months after receipt of the subrecipient's audit report and a requirement to ensure that the subrecipient takes appropriate, timely corrective action? Does the entity's annual monitoring plan include onsite review of subrecipients to observe operations? Does the entitys annual monitoring plan include the review of the ETA Salary and Bonus Cap that includes the following: Reconciliation to total actual compensation, (i.e. tie to W-2 information or equivalent data from calendar year payroll files)? Ensure a reduction in the level of ETA funding if instances in excess of the limit is determined?
Yes
No
N/A
Items would be included in subrecipient's approved budget.
2. 3.
4. 5.
30 | Page
6. 7. 8. 9. Is the entity's monitoring plan reviewed and updated annually for any changes to the monitoring activities to be performed (e.g., new grant requirements, new monitoring requirements, etc,)? If subawards are given to for-profit entities, where the entity is not subject to A-133, are alternative monitoring or review procedures included in the entity's annual monitoring plan? Does the entity have procedures in place to allow it to identify the total amount provided to subrecipients from each Federal program? Are sufficient entity resources dedicated to performing monitoring activities?
Yes
No
N/A
B. Tracking and Resolution of Monitoring Issues Identified 10. Does the entity's annual monitoring plan include an analysis and follow-up on disallowed costs identified during the entity's monitoring process? 11. Does the entity's annual monitoring plan include identification of subrecipients' deficiencies in financial systems or internal controls noted during the entity's monitoring processes? 12. Are monitoring reports and related corrective action files kept current, completed per monitoring procedures and available for review? 13. Is the governing board or appropriate committee updated, no less than annually, on monitoring activities and results? 14. Is the governing board or appropriate committee updated/briefed for any significant issues identified during the monitoring process? 15. Are appropriate sanctions taken for subrecipient non-compliance? C. Communications from Pass-through Entities 16. Does the entity's monitoring activities include offering and providing technical assistance to subrecipients, where needed?
31 | Page
17. Do agreements with subrecipients include the requirement for compliance with requirements applicable to the Federal program (including the audit requirements of OMB Circular A-133) and the terms and conditions of the entity's grant agreement with the agency? 18. Do agreements demonstrate documented notice has been provided on federal awards (CFDA No. and amount) and state financial assistance (CSFA No. and amount) to subrecipients paid with funds from grant programs?
Yes
No
N/A
32 | Page
Part 4: Information Technology

Purpose: The attached questions provide a framework for performing a self assessment of the information technology processes within your entity, as they relate to financial systems such as the general ledger, subsidiary ledgers, accounting systems, purchasing systems, etc.). Information Technology: The Information Systems of an entity affect the way transactions are initiated, authorized, recorded, processed, and reported upon. Controls for any entity generally consist of a combination of manual controls and automated (computerized) controls such as controls programmed within computer systems or software packages. The information technology functions of the organization include access to information resources of the entity and, in some cases, of external parties, such as DEO. For example, some statewide program databases routinely accessed by agency subrecipients are One Stop Management Information System (OSMIS) and Employ Florida Marketplace (EFM). The questions for this Part of the Questionnaire inquire as to whether controls are in place related to the following specific functions: A. Access Controls B. Data Backup C. Disaster Recovery
33 | Page
Information Technology
Objectives Provide access to accurate information and reliable systems to employees and customers with a valid need for the information or resource. Risks Unauthorized access is gained to restricted information or systems. Information is not available when needed and services to customers cannot be provided. Information is not accurate or reliable. Information is compromised (deleted, edited, obtained by inappropriate parties, etc.). Unauthorized transactions or inability to carry out planned activities. Failure to meet goals and objectives of the organization. Information is compromised (deleted, edited, obtained by inappropriate parties, etc.). Repayment of funds due to lack of supporting documentation.
Safeguard the information technology assets of the entity.
34 | Page
A. Access Controls 1. Does the entity have a current policy specifying who has authority to access data? 2. Does the entity periodically review and update data access policies and provide refresher training to staff? 3. 4. 5. Are system security and application access logs enabled or turned on in the financial IT systems? Are documented procedures in place for removing access to all production systems when an employee with access leaves the entity? Does management periodically review the list of individuals with access to data to ensure that the access rights are consistent with current policy and that removal procedures for terminated employees are being followed? Has the entity identified sensitive or confidential data files? Is sensitive and restricted data managed by the entity (e.g., on networks, personal computers, and back-up media), classified and protected to restricted access, encryption, or other controls? Does the entity have a policy to encrypt or password protect confidential or sensitive data included or stored in mobile media (flash drives, thumb drives, laptops, or transmissions via e-mail)? Does the entity require passwords for access to all computers?
Yes
No
N/A
6. 7.
8.
9.
10. Does the entity require staff to regularly change passwords? 11. Does the entity immediately deactivate accounts for terminated employees? 12. Does the entity have policies and procedures in place to ensure data, especially sensitive client or operational data, is removed prior to disposal of assets (e.g., digital copiers, computer hard drives, flash drives, laptops, servers, etc.)? 35 | Page Internal Control Questionnaire 2012/13
13. For each material service organization (MSO) (see definition at page 3) used by the entity to provide contracted program or support services, does management obtain an understanding of the data management policies and processes related to the following: Financial management systems? Internal controls? Data confidentiality and security? Data backups? Recovery plans for client data or system applications? 14. Does management periodically test to make certain each MSO's data management policies and processes are operating as required to provide the contracted services? B. Data Backup 15. Has the entity identified important computer data files related to the financial records of the organization, which are necessary to provide program services? 16. Does the entity have a procedure in place requiring regular backups of computer files? 17. Does management periodically review and/or monitor the entity's backup policies and processes to address new issues or changes in entity operations (e.g., updates to computer programs, new programs, discontinued programs, new reporting requirements, etc.)? 18. Does management periodically review to ensure back up procedures are being performed? 19. Does the entity periodically test and restore the backup files to ensure the backup files are functionally correctly? C. Disaster Recovery
Yes
No
N/A
Daily
Weekly
36 | Page
20. Does the entity have a written continuity of operations plan (COOP) in case of a major disaster? 21. Does the entity have at least one copy of client data and application software stored offsite in a secure location? 22. Does the entity have a separate backup power supply arranged to ensure select, critical operations are not interrupted? 23. Does the entity, as part of its COOP and disaster recovery plan test the backup and restore process to ensure that key financial tools and data (software copies; general ledger master balance and transaction history files; and fiscal files necessary to support grant-funded programs) can be accessed and utilized?
Yes
No
N/A
37 | Page
Attachment A
Department of Economic Opportunity

Certification of Self-Assessment of Internal Controls
Entity: _RWB 8 First Coast Workforce Development, Inc._ To be completed by the Executive Director A self-assessment of internal controls has been conducted for our entity for the fiscal period beginning July 1, 2012 (fiscal period 2012/13). As part of this self-assessment, the Internal Control Questionnaire developed by the Department of Economic Opportunity has been completed and is available for review. Any items noted with N/A or No answers have been explained in the Comments sections included with this Internal Control Questionnaire. Signature: ____________________________ Printed Name: _Bruce Ferugson_ Title: _President and CEO_ Date: ________________________________ Please scan and email an executed copy of this certification to FMA-RWB@deo.myflorida.com on or before September 17, 2012. Or alternatively, please return this form by September 17, 2012 via fax to: Department of Economic Opportunity Attention: Financial Monitoring and Accountability Section FAX: (850) 921-3142

RWB 08 2012-13 ICQ Workforce Template

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

RWB 08 2012-13 ICQ Workforce Template

Uploaded by

Copyright:

Available Formats

RWB 08 - First Coast Workforce Development, Inc.

2012/13 Internal Control Questionnaire for Workforce Organizations/Programs

RWB 08 - First Coast Workforce Development, Inc.

Introduction and Purpose

Overview of Internal Controls

Internal Control Questionnaire 2012/13

RWB 08 - First Coast Workforce Development, Inc.

Parts of the Questionnaire

Internal Control Questionnaire 2012/13

RWB 08 - First Coast Workforce Development, Inc.

Completing the Document

RWB 08 - First Coast Workforce Development, Inc.

Certification of Self-Assessment of Internal Controls

Internal Control Questionnaire 2012/13

RWB 08 - First Coast Workforce Development, Inc.

Part 1: Control Environment

Internal Control Questionnaire 2012/13

RWB 08 - First Coast Workforce Development, Inc.

Internal Control Questionnaire 2012/13

RWB 08 - First Coast Workforce Development, Inc.

Is the control present?

Conducted through Executive Committee.

Internal Control Questionnaire 2012/13

RWB 08 - First Coast Workforce Development, Inc.

Is the control present?

Internal Control Questionnaire 2012/13

RWB 08 - First Coast Workforce Development, Inc.

Is the control present?

26. 27. 28.

RWB 08 - First Coast Workforce Development, Inc.

Is the control present?

Internal Control Questionnaire 2012/13

RWB 08 - First Coast Workforce Development, Inc.

Is the control present?

$100,000 per employee

Internal Control Questionnaire 2012/13

RWB 08 - First Coast Workforce Development, Inc.

Part 2: Administrative Operations

Internal Control Questionnaire 2012/13

RWB 08 - First Coast Workforce Development, Inc.

Internal Control Questionnaire 2012/13

RWB 08 - First Coast Workforce Development, Inc.

RWB 08 - First Coast Workforce Development, Inc.

Internal Control Questionnaire 2012/13

RWB 08 - First Coast Workforce Development, Inc.

Is the control present?

RWB 08 - First Coast Workforce Development, Inc.

Is the control present?

Comments/Explanations Cost exceeds low interest rate.

Lack of manpower, but there are seperation of duties.

Internal Control Questionnaire 2012/13

RWB 08 - First Coast Workforce Development, Inc.

Is the control present?

21. 22. 23. 24. 25.

RWB 08 - First Coast Workforce Development, Inc.

Is the control present?

Internal Control Questionnaire 2012/13

RWB 08 - First Coast Workforce Development, Inc.

Is the control present?

42. 43. 44.

Asset not issued. Asset not issued.

Reviewed; not documented. If there are any.

Internal Control Questionnaire 2012/13