When members of the Internal Audit Department visit an area on campus, they are interested in learning about what internal controls are in place to help the University ensure it accomplishes its objectives.
Internal controls are critical steps within a process that lead to its success. It is beneficial to have documentation of internal controls, and there are various forms of internal controls documentation, which are described below.
Flowcharts, also called process maps, describe the flow of activity through a process. Different symbols are used to represent parts of the process. For example, a diamond is used typically to represent a decision point in a process.
Narratives can be used to document a process, with key internal controls highlighted in some way (bold font). These are typically used by auditors but can be used by campus units, too.
Internal control questionnaires include carefully structured series of questions related to the identification and evaluation of internal controls. These questionnaires assist auditors in highlighting controls gaps. Answers to questions do not suffice as proof that controls exist. Often, auditors will ask for documentation as evidence that internal controls are in place and functioning as intended.
Risk and control matrices (RCM) assist in documenting risks and controls for evaluation of internal controls in place and residual risk. RCMs are helpful and often thought-provoking when trying to identify areas for improvement.
Internal policies and procedures at the campus unit level establish a standard to be followed. This is especially beneficial when there is turnover in an area. Internal controls are captured as part of documented processes and procedures. Internal procedure documents should be reviewed, and updated if necessary, at least annually.
“If you do not have your processes and internal controls documented, we suggest you give it a try,” said Julie Earls, a member of the Internal Audit Department. “Think about your unit’s objectives, what could go wrong, and what mechanisms (internal controls) you could put in place to prevent or detect any problems. Then document the process including internal controls. We are here if you have any questions related to documenting your internal controls. We also have guides to help you identify and understand various types of controls online.”
Information for this article came from Internal Auditor, October 2007