Quality of Internal Control Certification
Total Page:16
File Type:pdf, Size:1020Kb
Thomas P. DiNapoli OFFICE OF THE COMPTROLLER NEW YORK STATE COMPTROLLER DIVISION OF STATE GOVERNMENT ACCOUNTABILITY Audit Objective............................... 2 Audit Results – Summary.............. 2 DIVISION OF MILITARY Background..................................... 2 AND NAVAL AFFAIRS Audit Findings ................................ 3 Quality of Internal Control Certification .................................. 3 Audit Scope and Methodology....... 5 QUALITY OF INTERNAL Authority......................................... 6 CONTROL CERTIFICATION Reporting Requirements................ 6 Contributors to the Report ............ 6 Appendix A - Auditee Response.... 7 Report 2008-S-112 AUDIT OBJECTIVE together to provide reasonable assurance that the organization will achieve its objectives Our objective was to determine whether the and mission. While the overall purpose of Division of Military and Naval Affairs internal control is to help an organization (DMNA) submitted a quality internal control achieve its mission, internal control also helps certification to the Division of Budget by an organization to promote orderly, April 30, 2008. economical, efficient and effective operations, and produce quality products and services AUDIT RESULTS - SUMMARY consistent with the organization's mission; safeguard resources against loss due to waste, The Division of Budget (DOB) requires abuse, mismanagement, errors and fraud; agencies to certify compliance with the promote adherence to laws, regulations, State’s Internal Control Act annually by contracts and management directives; develop submitting an internal control certification, and maintain reliable financial and which includes both an internal control management data, and accurately present that summary report as well as a signed data in timely reports. certification to attest that they met required internal control provisions. The Division of Budget’s Budget Policy and Reporting Manual Bulletins B-350 and B- We determined DMNA submitted a quality 1177 require the head of each covered State internal control certification to DOB by April agency and public authority to certify 30, 2008. The DMNA certification compliance with the State’s Internal Control addressed all the requirements of Budget Act by April 30 of each year by submitting a Policy and Reporting Manual Item B-350 Certification and Internal Control Summary including a detailed responses to questions in of the internal control activities undertaken the Internal Control Summary that and during the previous year. The current Internal Control Task Force requirements in the BPRM B-350 internal recommendations. During our review, we control certification has been updated with a found adequate support to confirm the list of agencies required to establish and information in the certification was accurate. maintain an internal audit function and also requires agencies identify specific actions This report, dated September 25, 2008, is taken to implement each of the available on our website at: recommendations in the Internal Control Task http://www.osc.state.ny.us. Force report “The New York State Internal Add or update your mailing list address by Control Act Implementation Guide: contacting us at: (518) 474-3271 or Strengthening Compliance with the Act and Office of the State Comptroller Standards.” These recommendations include Division of State Government Accountability specific guidance for agencies, the Internal 110 State Street, 11th Floor Control Task Force, NYS Division of Budget Albany, NY 12236 and the NYS Comptroller’s Office. The recommendations were developed to provide BACKGROUND agencies with an improved level of assurance that an appropriate set of controls are in place Internal controls are the integration of the within the agency and are functioning activities, plans, attitudes, policies, and efforts properly. Recommendations directed toward of the people of an organization working agencies relate to internal control Report 2008-S-112 Page 2 of 7 coordination, implementation, education and AUDIT FINDINGS training as well as internal audit organization, staffing, processes, and continuing education. Quality of Internal Control Certification The mission of DMNA is to: “Provide forces to execute global missions across full The Division of Budget(DOB) requires spectrum operations as directed in support of agencies to certify compliance with the our communities, civil authority and National State’s Internal Control Act annually by Military and Homeland Security Strategies.” submitting an internal control certification, which includes both an internal control DMNA is a state agency that serves as the summary report as well as a signed headquarters for New York's militia forces certification to attest that they met required (the Army National Guard, the Air National internal control provisions. Guard, the New York Guard and the New York Naval Militia). In addition, it performs In order to determine if DMNA submitted a federal functions required to support the quality certification, we reviewed the Army and Air National Guard. Division of certification to see if they followed the Military and Naval Affairs personnel, military certification instructions outlined in the and civilian, serve under The Adjutant Budget Policy and Reporting Manual Item B- General, who must be an Army or Air 350, and followed the internal control National Guard commander and who is requirements outlined in the NYS Internal responsible to the Governor for proper Control Act Implementation Guide and the administration and for assuring the New York Internal Control Task Force militia is prepared to perform emergency state Recommendations in the Standards for roles as directed by the Governor. The Internal Control in New York State Adjutant General is also responsible to the Government which are the basis for the Department of Defense for assuring the certification. We also determined a quality military training and preparedness of the certification should show evidence an agency Army and Air National Guard units in New responded to all the questions, provided York. The National Guard is, by national explanation and detail when required, and policy, an integral part of America's military answered the questions accurately. forces. The New York Army National Guard provides combat units of almost all types, To assure accuracy of the information combat support elements, and a variety of reported, we reviewed supporting specialized services. Nonetheless, the Guard documentation, provided by DMNA, for the is a fundamentally a "state" entity. certification submitted for 2007-08. The current DMNA Internal Control Officer We determined DMNA submitted a quality (ICO) has been in her position since March internal control certification to DOB by April 2008. The previous ICO coordinated the 30, 2008. The DMNA certification implementation of an enhanced risk addressed all the requirements of Budget assessment program and designed a formal Policy and Reporting Manual Item B-350 presentation program for reporting the status including detailed responses to questions in of DMNA internal control program to The the Internal Control Summary and Internal Adjutant General. Control Task Force recommendations. During our review, we found adequate Report 2008-S-112 Page 3 of 7 support to confirm the information in the process for identifying improvement areas, certification was accurate. corresponding corrective actions and implementation status of all corrective Certification actions. DMNA responded to this recommendation that they implemented the The internal control summary report asks use of a standardized form. The new form is agencies to respond to a series of questions to provide a medium for unit managers to regarding the agency’s internal control system identify areas that require improvement and and also requests information on the specific propose corrective actions. Proposed actions taken by the agency to implement the corrective actions are tracked internally by recommendations made by the Internal Assessable Unit Managers and by the ICO via Control Task Force. Most of the questions the Management Control Plan (MCP). require the agency to provide detailed responses. Supporting Documentation The responses provided by DMNA on the We found DMNA had adequate internal control summary were detailed and documentation to support their certification. offered specific information relating to the questions. For example, when asked to For example, DMNA provided a copy of their Describe the measures instituted to sustain Internal Control Program (PAM 11-2) which the effectiveness of the internal control provides a step by step outline of the DMNA program during 2007-08., DMNA responded: internal control process. “During reporting year 2007-08 DMNA Also, during reporting year 2007-08 DMNA commenced a 100% re-evaluation of its commenced a 100% re-evaluation of its State Internal Control Program using a four step Internal Control Program. The revised process to (1) facilitate the identification of program calls for the Directors to routinely agency functions and objectives, (2) assess evaluate their programs and conduct formal agency risks and vulnerabilities, (3) review annual evaluations. To accomplish this task existing controls and (4) take appropriate and as recommended by the Internal Control steps to correct weaknesses. DMNA adopted Task Force, DMNA adopted two new internal two new internal reporting forms to assist reporting forms to assist the Directors and