1. You will need Windows Internet Explorer 7 to access the Control Assessment Tool (CAT).
2. First enter your name, unit's name and phone number. Do not use parenthesis for the area code.
3. Input the WebCAT ID and click on Sign On.
4. Click on View Questions to answer the questions for each category. The questions can be answered as Yes/ No/ NA (Not applicable)/ NS (Not sure).

Note:

5. If you do not have enough information about the question, you can check out the REFERENCES and COMMENTS buttons to find policies, regulations and auditor’s comments and suggestions.
6. You can save your answers at any time by clicking on the Save Responses button at the bottom of the screen. These answers will appear when you sign on later with your WebCAT ID.
7. When completed make sure that you click on the Submit my Responses option.
8. Each unit should make a print out of all responses provided per category and keep it as a back-up.

If you have specific questions or concerns please send an email to mjvelez@ufl.edu.

Thank you for using the Control Self Assessment Tool.

FREQUENTLY ASKED QUESTIONS AND ANSWERS

1. What is Internal Control?

Internal control in its broader sense is defined as a process affected by an organization’s board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories:

• Effectiveness and efficiency of operations
• Reliability of reporting
• Compliance with applicable rules, laws and regulations

Questions and misunderstandings about "internal controls" are quite common. Frequently, internal controls are viewed narrowly as applicable only to financial reporting or asset protection. There is also a wrong perception that implementation and monitoring of internal controls are the responsibility of others, usually the institution's financial officers, internal auditors, or the central administration. The main components of internal control are:

• Creation of a positive control environment that values integrity, ethical values, and competence
• Evaluating risks and other impediments to the accomplishment of objectives
• Establishment of control activities that would reveal exceptions on a timely basis
• Creation of information and communication systems that enable the unit to capture and exchange information to achieve objectives
• Monitoring the internal control system with the recognition that conditions and operations continuously change

Most of the time the emphasis is on common control activities which may include the following:

• Segregation of functional responsibilities to create a system of checks and balances
• A system of authorization and record procedures adequate to provide reasonable accounting control over assets, liabilities, revenues, and expenditures
• Development of policies and procedures for prescribing and documenting the business and control processes. This should consist of a well thought strategy and be reviewed and adjusted periodically to reflect changes in the business and control environment

Clearly everyone in a university has some responsibility for internal control.

2. Are there policies or principles established by the University of Florida regarding internal controls and financial management?

The University of Florida and its governing board adopted the Guiding Principles of Financial Management and Internal Control Principles. These may be accessed electronically at:

http://fa.ufl.edu/uco/internal-control-principles.asp
http://fa.ufl.edu/uco/guiding-principles-financial-management.asp

3. What is a decentralized environment?

Decentralization is the delegation of management authority to the individual units and sub-units of the organization. One of the benefits of decentralization is that decisions are made at the unit level which allows management to react quickly to local conditions.

4. Why are controls more important in a decentralized environment?

In a decentralized environment, with limited staffing, one critical element of internal control, segregation of duties, may not always be attainable. For those situations management will need to implement additional monitoring controls over operations. There is also less opportunity for specialization and greater need for support staff and unit management to be more knowledgeable and involved about operations and applicable laws and regulations.

5. What is legal/managerial compliance?

Legal and managerial compliance is simply intended to refer to compliance with the various laws, rules, policies, directives, and procedures that prescribe the guidelines and parameters that we must operate within. Some of these are self-imposed to ensure effective business and/or control practices. Legal and managerial compliance requirements which govern how we operate include, but are not limited to the following:

• Federal Constitution, Laws, and Regulations
• Florida Constitution, Statutes, and Administrative Code
• University of Florida Board of Trustee Policies, Resolutions, and By-laws
• University of Florida Finance and Accounting Directives and Procedures
• University Regulations
• Departmental Polices and Procedures

6. What exactly is a control self assessment?

A self assessment is usually defined simply as “the involvement of management and staff in the assessment of internal control within their unit." While it is not a totally new approach, it gained recent popularity and recognition as an effective approach to evaluating an organization's internal control structure. Control Self-Assessment (CSA) is effective in assessing the control environment, business and financial risk, control activities, and control effectiveness. Although CSA empowers University operating personnel and enhances business partnering between Internal Audit and departmental personnel, it does not eliminate the need for a formal audit. It serves to focus attention on areas by drawing on the knowledge and participation of the entire organization. It is highly compatible and complementary with today's emphasis on employee empowerment, teamwork, and continuous quality improvement. Control Self Assessment also provides more timely and complete feedback on an organization's internal control structure.

7. How does the University of Florida’s control assessment tool (CAT) work?

The University's self assessment program is a series of questions set up in an automated program. The program works in a Web-based environment and is user friendly. The unit head and staff will simply have to point and click to operate the program. Each question lists the appropriate reference (policy, regulation, standard, or guideline) as well as comments (auditor’s suggestions) for implementation. Upon completion of the survey your responses will be submitted to the Office of Audit and Compliance Review for compilation and analysis.

8. What will happen to my survey results?

The Office of Audit and Compliance Review (OACR) will take the information and create a summary report of controls and risks for the entire university. This summary report will not identify individual units but will instead address the university as a whole. Selective verification of the responses and appropriate support will be initiated by OACR.

9. Why should I spend time going through this process?

Control Self Assessment is for Unit heads who:

• Desire to improve their unit's operations
• Wish to increase their knowledge about the unit's operations
• New managers/unit heads wanting to evaluate and understand their organization
• Understand that an ounce of prevention is worth a pound of damage control
• The self assessment gives the unit head the knowledge to improve the unit's operations where weaknesses are identified.

Additional benefits include:

• Identifies important issues faster
• Can reduce audit time
• Provides the tools to assess the control environment within a unit between audits (self-assessment)

10. How can my staff benefit from going through this process?

The control self assessment is an excellent training tool for new staff and employees responsible for performing key functions in your unit. The program includes questions and the affiliated references and background information. All of this information can be printed out for future reference.

Additional benefits include:

• Empowers employees and increases accountability
• Provides employees with a better understanding of business risks and internal controls
• Provides employees with a broader University-wide perspective

11. Can the survey be completed by various staff using the same WebCAT ID?

Unit heads have the option of printing and distributing the survey to appropriate staff and then compile the information and enter the data into the survey. They can also share the WebCAT ID to personnel responsible for particular categories.

12. What I need to do if I am not the primary contact?

Contact Marilyn Velez (mjvelez@ufl.edu) or call 392-1391 ext. 38.

13. How long will this process take?

The entire process should take about 3 hours or less. However, the size of the unit and the level of input sought from other unit staff may impact the time and effort that is required to complete the survey.

14. Can I save my responses and work with the survey at a later time?

At the end of each category (Control Environment, Asset Management, Payroll, etc.) you will find a “Save Responses” option that will allow you to save all responses for that category.

15. If the survey results show that we need help in one or more areas what should we do?

You can review the policy information provided in the program or contact our office for assistance.

16. How can I operate more efficiently?

There is no pat answer to this question. Obviously, skilled, well-informed and motivated faculty and staff is an important ingredient to an effective operation. Staff should be provided adequate training opportunities and understand what is expected of them. Good lines of communications are important.

With the fast pace of changes in technology, coupled with changes in regulatory compliance requirements and staff turnover, it is usually useful to review the various processes from time to time asking why the various tasks are being performed and determining if the tasks add any value to the process, or if there is a better way to accomplish them.

Examining crises that have occurred in the past is often a useful way of preventing them in the future. Reviewing the structure or operations of similar organizations may also provide ideas on how to improve your organization.

Remember, we all play a part in the University’s internal control system!