The
University of Florida’s fiscal
and administrative structure is based on a decentralized
model. Within this structure, the administrator responsible
for the accomplishment of a unit's goals and objectives
is also responsible for establishment, maintenance,
and monitoring of the internal control system which
helps ensure the accomplishment of those goals and
objectives.
To assist you in evaluating your unit's internal controls
and to increase your understanding of those controls,
we have developed a controls assessment tool (CAT).
The tool links control issues to University policies
and procedures and provides further explanations.
If you would like to review the questions for information
only, click the option that does not require a WebCAT
ID number.
A
collection of Frequently Asked Questions on the use
of the tool is listed here.
Survey completion instructions can be found here.
A list of unit heads completing this assessment is
included here.
INSTRUCTIONS
Units will need a WebCAT ID to login (If you do not
receive a WebCAT ID by 4/23/07 please send a request
to mjvelez@ufl.edu).
1. You will need Windows Internet Explorer 7 to access the
Control Assessment Tool (CAT).
2. First enter your name, unit's name and phone number.
Do not use parenthesis for the area code.
3. Input the WebCAT ID and click on Sign
On.
4. Click on View Questions to answer the questions
for each category. The questions can be answered as Yes/ No/
NA (Not applicable)/ NS (Not sure).
Note:
RESPONSE TYPE
|
EXPLANATION |
YES |
Use YES if your unit has effectively implemented the control. |
NO |
While NO responses
would normally indicate a potential weakness, this could be off-set
by “compensating” controls within the unit.
If this is your case, please indicate the compensating control
under the Feedback box included at the bottom of the screen. |
N/A |
Use N/A if
the question is not relevant to your unit’s operations. |
N/S |
Use the N/S option, if you are not sure if your unit complies with
the established control or if you have specific concerns. In this case
please describe the reason for your selection under the Feedback box
included at the bottom of the screen. |
5. If you do not have enough information about the question,
you can check out the REFERENCES and COMMENTS buttons to find policies,
regulations and auditor’s comments and suggestions.
6. You can save your answers at any time by clicking on the
Save Responses button at the bottom of the screen. These answers will
appear when you sign on later with your WebCAT ID.
7. When completed make sure that you click on the Submit
my Responses option.
8. Each unit should make a print out of all responses provided
per category and keep it as a back-up.
If you have specific questions or concerns please send an email to mjvelez@ufl.edu.
Thank
you for using the Control Self Assessment Tool.
FREQUENTLY ASKED QUESTIONS AND ANSWERS
1. What is Internal Control?
Internal control in
its broader sense is defined as a process affected by an organization’s
board of directors, management and other personnel, designed to provide
reasonable assurance regarding the achievement of objectives
in the following categories:
• Effectiveness
and efficiency of operations
• Reliability of reporting
• Compliance with applicable rules, laws and regulations
Questions and misunderstandings
about "internal controls" are
quite common. Frequently, internal controls are viewed narrowly
as applicable only to financial reporting or asset protection. There is
also a wrong perception
that implementation and monitoring of internal controls are the
responsibility of others, usually the institution's financial officers,
internal auditors,
or the central administration. The main components of internal
control are:
• Creation of
a positive control environment that values integrity, ethical values,
and competence
• Evaluating risks and other impediments to the accomplishment of
objectives
• Establishment of control activities that would reveal exceptions
on a timely basis
• Creation of information and communication systems that enable the
unit to capture and exchange information to achieve objectives
• Monitoring the internal control system with the recognition that
conditions and operations continuously change
Most of the time the emphasis is on common control activities which may
include the following:
• Segregation
of functional responsibilities to create a system of checks and balances
• A system of authorization and record procedures adequate to provide
reasonable accounting control over assets, liabilities, revenues,
and expenditures
• Development of policies and procedures for prescribing and documenting
the business and control processes. This should consist of a well
thought strategy and be reviewed and adjusted periodically to reflect changes
in
the business and control environment
Clearly everyone in a university has some responsibility for internal control.
2. Are there policies or principles established by the University of Florida
regarding internal controls and financial management?
The University of Florida and its governing board adopted the Guiding Principles
of Financial Management and Internal Control Principles. These may be accessed
electronically at:
http://fa.ufl.edu/uco/internal-control-principles.asp
http://fa.ufl.edu/uco/guiding-principles-financial-management.asp
3. What is a decentralized environment?
Decentralization is the delegation of management authority to the individual
units and sub-units of the organization. One of the benefits of decentralization
is that decisions are made at the unit level which allows management to
react quickly to local conditions.
4. Why are controls more important in a decentralized environment?
In a decentralized environment, with limited staffing, one critical element
of internal control, segregation of duties, may not always be attainable.
For those situations management will need to implement additional monitoring
controls over operations. There is also less opportunity for specialization
and greater need for support staff and unit management to be more knowledgeable
and involved about operations and applicable laws and regulations.
5. What is legal/managerial compliance?
Legal and managerial compliance is simply intended to refer to compliance
with the various laws, rules, policies, directives, and procedures that
prescribe the guidelines and parameters that we must operate within. Some
of these are self-imposed to ensure effective business and/or control practices.
Legal and managerial compliance requirements which govern how we operate
include, but are not limited to the following:
• Federal Constitution, Laws, and Regulations
• Florida Constitution, Statutes, and Administrative Code
• University of Florida Board of Trustee Policies, Resolutions,
and By-laws
• University of Florida Finance and Accounting Directives and Procedures
• University Regulations
• Departmental Polices and Procedures
6. What exactly is a control self assessment?
A self assessment is
usually defined simply as “the involvement of
management and staff in the assessment of internal control within their
unit." While it is not a totally new approach, it gained recent popularity
and recognition as an effective approach to evaluating an organization's
internal control structure. Control Self-Assessment (CSA) is effective
in assessing the control environment, business and financial risk, control
activities, and control effectiveness. Although CSA empowers University
operating personnel and enhances business partnering between Internal
Audit
and departmental personnel, it does not eliminate the need for
a formal audit. It serves to focus attention on areas by drawing on the
knowledge
and participation of the entire organization. It is highly compatible
and complementary with today's emphasis on employee empowerment, teamwork,
and
continuous quality improvement. Control Self Assessment also provides
more timely and complete feedback on an organization's internal control
structure.
7.
How does the University of Florida’s control assessment tool (CAT)
work?
The University's self
assessment program is a series of questions set up in an automated program.
The program works in a Web-based environment and
is user friendly. The unit head and staff will simply have to point
and click to operate the program. Each question lists the appropriate
reference
(policy, regulation, standard, or guideline) as well as comments
(auditor’s
suggestions) for implementation. Upon completion of the survey
your responses will be submitted to the Office of Audit and Compliance
Review for compilation
and analysis.
8. What will happen to my survey results?
The Office of Audit and Compliance Review (OACR) will take the information
and create a summary report of controls and risks for the entire university.
This summary report will not identify individual units but will instead
address the university as a whole. Selective verification of the responses
and appropriate support will be initiated by OACR.
9. Why should I spend time going through this process?
Control Self Assessment is for Unit heads who:
• Desire to improve
their unit's operations
• Wish to increase their knowledge about the unit's operations
• New managers/unit heads wanting to evaluate and understand their
organization
• Understand that an ounce of prevention is worth a pound of damage
control
• The self assessment gives the unit head the knowledge to improve
the unit's operations where weaknesses are identified.
Additional benefits include:
• Identifies important
issues faster
• Can reduce audit time
• Provides the tools to assess the control environment within a unit
between audits (self-assessment)
10. How can my staff benefit from going through this process?
The control self assessment is an excellent training tool for new staff
and employees responsible for performing key functions in your unit. The
program includes questions and the affiliated references and background
information. All of this information can be printed out for future reference.
Additional benefits include:
• Empowers employees
and increases accountability
• Provides employees with a better understanding of business risks
and internal controls
• Provides employees with a broader University-wide perspective
11. Can the survey be completed by various staff using the same WebCAT
ID?
Unit heads have the option of printing and distributing the survey to appropriate
staff and then compile the information and enter the data into the survey.
They can also share the WebCAT ID to personnel responsible for particular
categories.
12. What I need to do if I am not the primary contact?
Contact Marilyn Velez (mjvelez@ufl.edu) or call 392-1391 ext. 38.
13. How long will this process take?
The entire process should take about 3 hours or less. However, the size
of the unit and the level of input sought from other unit staff may impact
the time and effort that is required to complete the survey.
14. Can I save my responses and work with the survey at a later time?
At the end of each category
(Control Environment, Asset Management, Payroll, etc.) you will find a “Save Responses” option
that will allow you to save all responses for that category.
15. If the survey results show that we need help in one or more areas what
should we do?
You can review the policy information provided in the program or contact
our office for assistance.
16. How can I operate more efficiently?
There is no pat answer to this question. Obviously, skilled, well-informed
and motivated faculty and staff is an important ingredient to an effective
operation. Staff should be provided adequate training opportunities and
understand what is expected of them. Good lines of communications are important.
With the fast pace of changes in technology, coupled with changes in regulatory
compliance requirements and staff turnover, it is usually useful to review
the various processes from time to time asking why the various tasks are
being performed and determining if the tasks add any value to the process,
or if there is a better way to accomplish them.
Examining crises that have occurred in the past is often a useful way of
preventing them in the future. Reviewing the structure or operations of
similar organizations may also provide ideas on how to improve your organization.
Remember, we all play a part
in the University’s
internal control system!
.jpg)
