Internal Control Self-Assessment s1

INTERNAL CONTROL SELF-ASSESSMENT

The objective of the internal control self-assessment is to provide the campus community with a tool for evaluating their internal control structure and general compliance, while also promoting effective and efficient business practices. The effective utilization of this checklist will strengthen controls, improve compliance, and eliminate many potential audit comments. In fact, the checklist is a tool similar to what we as internal auditors might use if they were performing a review of your department’s internal controls. The checklist should be completed by management accountable for the particular business process. While the absence of certain control activities would normally indicate a potential weakness, this could be off-set by “compensating” controls within the unit. It is difficult to make a statement regarding a particular control based on the response to just one question. Most internal control procedures are simply based on “common sense”, i.e. the person having custody of the asset, such as cash, should not be solely responsible for accounting for it; no one person should be able to complete a requisition/payment transaction or personnel/payroll transaction from beginning to end without an appropriate monitoring or oversight. Incompatible duties should be segregated for a check and balance; laws and University policies and directives are expected to be followed. Despite the fact that many internal controls are a simple matter of common sense, taking the time to periodically use this checklist to review the control processes can be a valuable tool in the process and help document your due diligence.

NOTE: The control self assessment statements below are not to be used as a substitute for the University’s and Medical Center’s policies and procedures. Reference should always be made to current policies and procedures in order to gain a full understanding of compliance requirements.

What do we do if we identify potential control deficiencies or we have questions? Risks associated with potential control deficiencies may differ from unit to unit. The unit management is the first channel to address the implications of the deficiencies. Other resources may include the Office of Internal Audit 343-6660. INTERNAL CONTROL SELF ASSESSMENT Table of Contents:

I. Petty Cash

II. Purchasing

III. Procurement Card

IV. Travel

V. Cash Collections

VI. Capital Assets

VII. Payroll

VIII. Sponsored Administration I. PETTY CASH

Do you reimburse, or make advances in relation to, “small value” miscellaneous and incidental expenditure items? (for funds totaling > $500)

Refer to the Petty Cash policy and procedures at: http://www.vanderbilt.edu/accounting/PolProcForms/policy305.htm https://finweb.mc.vanderbilt.edu/CPC/VUOnly/PettyCash.asp

Good practice in relation to petty cash means that:

1. All petty cash funds are properly authorized with the Department of Finance/Office of Financial Affairs.

2. Funds are safeguarded via safe, locked box or locked file cabinet.

3. The number of employees that have access to the secured funds is limited.

4. Reimbursements to the petty cash fund should be made via 1180; made payable to the fund custodian and deposited immediately.

5. IOU’s, travel advances, equipment or personal checks should NOT be allowed from petty cash funds.

6. Surprises counts should be performed routinely by someone that is not the custodian of the fund.

7. The funds should be reconciled monthly.

II. PURCHASING

Do you purchase goods or services from a supplier?

Refer to the Purchasing policy at: http://www.vanderbilt.edu/procurement/disbursement/policies.shtml http://www.vanderbilt.edu/procurement/about/forms/Procurement Policies & Procedures.pdf

Good practice in relation to purchasing means that:

1. Disbursements are approved prior to the purchase and prior to placing the order with the vendor.

1. Designated individuals are authorized to approve purchase orders, 1180's, demand checks and e-procurement purchases and are appropriately documented in the PRIVILEGE MANAGEMENT DATABASE. 2. Bids should be solicited for items greater than $25K, and a pricing contract should be negotiated through purchasing.

3. If blanket PO’s are used, dollar limits and expiration dates should be documented and reviewed annually.

4. Small purchase orders, purchase requisition, demand check and 1180 blank forms should not be pre-signed for approval and access should be limited to designated personnel.

5. Issued purchase requisitions/orders, check requests and 1180s should be logged or otherwise controlled for tracking purposes.

6. PO’s should be tracked through the entire cycle (order, receipt and payment) to ensure that only approved, received items are paid for. Check requests and 1180’s should be tracked as well.

8. The initiator of the purchase should not also be the person responsible for receiving, approving or stocking the delivery, or reviewing the G/L reports.

9. Deliveries received should be counted and compared to the packing slip prior to accepting and signing for them.

10. Deliveries that cannot be stocked when received should be placed in a secure location to prevent shrinkage.

11. Purchase orders and packing slips should be compared for accuracy and discrepancies communicated to the vendor.

12. The Departmental Invoice Report in Infoview should be reviewed monthly and a responsible person should be agreeing the items listed on this report to the P.O. and receiving documentation.

13. Departments should monitor time lags between the date an invoice was posted to the GL and the actual invoice date to ensure vendors are paid timely and available discounts are taken.

7. At month-end, charges per the e-dog reports should be traced and agreed to their supporting documentation noting dollar amounts, vendor, and propriety of account to verify accuracy. Where applicable, EDOG “Online Sign-off of G/L Transactions” should be documented and performed timely.

III. PROCUREMENT CARD

Do you purchase goods or services from a supplier using a procurement card?

Refer to the Procurement Card policy at: http://www.vanderbilt.edu/procurement/pcard/forms/PCard%20Policy%20and%20Procedure.pdf

Good practice in relation to the procurement card (PCard) means that:

1. There should be a limited amount of pcards within the department.

14. Authorized approvers of cardholder applications should be the Dean or Administrative Officer.

15. Cardholders and approving managers should complete training prior to receiving the Procurement Card

16. Cardholders are required to sign user agreements prior to receiving the Procurement Card.

17. PCards should not be used by anyone other than the procurement card holder whose name is embossed on the card and is authorized to use the card.

18. Dollar limits per transaction and monthly dollar limits should be established and documented for each PCard.

19. The authorized approver of PCard transactions should be at least one level above the cardholder.

20. The cardholder should review credit card transactions on the PCard Internet application at least monthly before month-end close.

21. Credit card statements should be reconciled to supporting receipts and transactions logs with notations made on the statements to indicate the charges on the statements have been verified to the supporting receipts.

22. In general, PCard supporting documentation should be maintained for the current fiscal year and two prior fiscal years. Documentation should be maintained in an audible state for eight years. If a federal grant, then documentation should be maintained for three years after the date of submission of the final status report.

IV. TRAVEL

Do you travel on University business or incur travel costs on behalf of the University?

Refer to the Travel policy and procedures at: http://www.vanderbilt.edu/procurement/travel/default.shtml https://mcapps.mc.vanderbilt.edu/E- Manual/Hpolicy.nsf/AllDocs/7350336326263F218625745B006F2054

Good practice in relation to travel means that:

1. Employees travel expense reports are: a. Prepared in accordance with University and department (if applicable) policy; b. Submitted within 60 days; c. Adequately supported by original receipts; d. Properly approved (authorized individual above the level of the traveler); a. Reviewed for reasonableness and completeness; and

b. The mathematical accuracy of the report and calculation of amount due to traveler/University is verified.

23. Department travel approvers are familiar with University, sponsored contract/grant, and/or school or division level travel guidelines. Approvers review travel expenditures for compliance with policy. Items requiring special review include:

c. Alcoholic beverage costs (if approved, requires separate account classification)

d. Entertainment (requires documentation of names of individuals, business purpose and separate account classification)

e. Foreign travel (if supported by sponsored program contracts or grants, may require advance written agency approval).

f. Spouse or other dependent travel (requires advance approval traveler’s Executive Director, Dean, Vice Chancellor/Provost)

g. Travel by private aircraft (requires advance approval by traveler’s Executive Director, Dean, Vice Chancellor/Provost)

h. Travel by rail, bus, private or rental automobile in lieu of commercial aircraft (requires support of beneficial pricing)

i. Weekend Travel to avail of discounted airfare (requires analysis confirming that discounted airfare, weekend lodging and meal costs are more economical than the next best available airfare)

24. For travelers with Procurement Cards, Procurement Card activity should be reviewed to ensure that expenses are not paid by VU via Procurement Card and submitted for reimbursement.

V. CASH COLLECTIONS

Are you responsible for handling University monies?

Refer to the Cash Collections Policy at: https://mcapps.mc.vanderbilt.edu/E- Manual/Hpolicy.nsf/AllDocs/11122C920C210C8B86256AB200704E94 https://finweb.mc.vanderbilt.edu/Support/VUOnly/Ent-Wide/FinanceBankDepositProcedures-Final.pdf

Good practice in relation to cash collections means that:

1. Prior to deposit, cash/checks should be maintained in a secure location (safe, locked-box) by a designated individual or a predetermined backup in the designee’s absence.

25. Access to the secured location (safe, locked-box) should be limited to a designated individual and his/her back-up.

26. Safe combinations or keys to cash boxes, files, drawers, etc. should be restricted to a few employees. In general, only 2 individuals, (preferably supervisory personnel) should have access.

27. Safe combinations or locks to files should be changed periodically and at each personnel change.

28. If checks/cash are received through the mail, the duties of opening the mail and preparing the deposit should be performed by separate individuals. Ideally, whoever opened the mail would prepare a dual listing of checks received for the day and keep one copy and forward the cash/checks to the deposit preparer. The deposit preparer would then fill out the deposit slip, make the deposit, and give the deposit receipt to a third person who would compare the total per the check listing prepared by the mail opener to the total from the deposit receipt for agreement.

29. Checks should be restrictively endorsed upon receipt.

30. Cash receipts should be deposited daily.

31. The deposit amounts should be verified to the general ledger by someone other than the deposit preparer or person delivering deposit to the cashier.

32. Ensure that proper segregation of duties is maintained in the absence of the primary depositor.

VI. CAPITAL ASSETS

Are you involved with the acquisition, approval, custodianship, recording, management and use of assets?

Refer to the Capital Assets policy and procedures at: http://www.vanderbilt.edu/ocga/vupolicies/assetcapt/assetcapitalization.htm#IIIB

Good practice in relation to capital assets means that: 1. The individual(s) on record as being responsible for the department's equipment should be documented.

2. If equipment inventory is very large and dispersed, the equipment should be divided and reported for responsibility purposes by department areas.

3. The dollar limit used when capitalizing equipment is equipment >$3000, and capital equipment purchases should be charged to a 74XXX account.

4. Asset Management/Equipment Inventory should be promptly notified of capital additions, disposals, or transfers via an Equipment Transmittal Form.

5. Copies of the Equipment Transmittal Form report should be retained by the department for reconciliation and referencing purposes.

6. Identifying information (VU tags) should be promptly placed on new equipment by Asset Management (for University acquisitions) or department personnel (for Medical Center acquisitions).

7. The sale, transfer, or scrapping of equipment requires written approval by an authorized individual.

8. Equipment that is disposed of [i.e., sold or scrapped] should be coordinated through Asset Management (Univ.) or Equipment Inventory Management (VUMC).

9. A physical inventory of equipment should be taken regularly (at least every 2 years).

10. Loaned equipment arrangements should be in writing and approved by management. Tax ramifications can result from permanent loans. For any permanent loans, determine if Payroll was contacted. For equipment loaned to non-exempt employees, determine if the employee(s) are being compensated for work/training performed at home.

VII. PAYROLL

Are you involved with initiating, approving, and reviewing payroll related activities?

Refer to the payroll policies and procedures at: http://hr.vanderbilt.edu/policies/index.htm

Good practice in relation to payroll means that: 1. I-9 (Employment Eligibility Verification) forms should be completed and signed within 3 days of employment/hire date.

2. Employment status or home department number should be changed prior to the next payroll period when individuals are no longer with VU and/or the department.

3. Employees should be required to sign time sheets to indicate agreement with hours recorded and worked.

4. Department Administrative Staff should encourage employees to have their payroll funds direct deposited to their personal account.

5. The employee responsible for initiating Payroll Action forms (PAFs) for new hires, terminations and special pay should not also be authorized to approve PAFs.

6. An exempt individual should be signing time cards/sheets certifying that employees were present and worked the hours indicated.

7. An employee should not have access to his/her timesheet after it has been approved.

8. Only an exempt employee should have access to approved timesheets prior to the Payroll department receiving them.

9. Copies of authorized time sheets should be maintained by the department for future reference.

10. The designated individual(s) assigned the responsibility of handing out payroll checks should receive paychecks directly from the Cashier’s Office. Employees who receive a payroll check should be required to sign a distribution log prior to receiving their check. (These logs should be maintained in the department.)

11. Unclaimed payroll checks should be stored in a secured location.

12. Once the department verifies that the unclaimed check belongs to a valid employee, the departments should mail out unclaimed checks after one week.

13. The individual(s) responsible for receiving and maintaining approved time sheets should not also be responsible for controlling unclaimed payroll checks.

14. The (WALDO) payroll distribution reports received should be reviewed for reasonableness by someone independent of possessing checks, approving timesheets, and initiating/approving PAF’s. VIII. SPONSORED ADMINISTRATION

If you are involved with sponsored funds administration you should be familiar with the following policies:

Effort Reporting http://www.vanderbilt.edu/ocga/vupolicies/vupolicies.htm https://dof.mc.vanderbilt.edu/are/Pages/ggc/pub/policy.aspx

Sub-Recipient monitoring http://www.vanderbilt.edu/ocga/vupolicies/subrecipient/SubrecipientMonitoringGuidelinesfinal.pdf http://finweb.mc.vanderbilt.edu/AcadRes/GiftsGrantsCont/SubrecipientMonitoringGuidelines.pdf

Direct Charges http://www.vanderbilt.edu/ocga/vupolicies/directcost/directcost.htm

Cost Transfers http://www.vanderbilt.edu/ocga/vupolicies/vupolicies.htm https://dof.mc.vanderbilt.edu/are/Pages/ggc/pub/policy.aspx

Service Centers/Recharge Centers http://www.vanderbilt.edu/ocga/vupolicies/servicecenter/Service%20Center%20Policy.doc https://finweb.mc.vanderbilt.edu/AcadRes/GiftsGrantsCont/VUServiceCenterPolicy.pdf