What are Internal Controls?

A system of internal controls consists of policies and procedures designed to provide management with reasonable assurance that the District achieves its objectives and goals. These policies and procedures are often called controls, and collectively they comprise an organization's internal control. Traditionally referred to as "hard controls," these include segregation of duties, limiting access to cash, management review and approval, and reconciliations. Other types of internal controls include "soft" controls such as management "tone at the top," performance evaluations, training programs, and maintaining established policies, procedures, and standards of conduct.

Internal control is a process, effected by an entity's board, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories:

• Effectiveness and efficiency of operations
• Reliability of financial reporting
• Compliance with applicable laws and regulations 

Several key points should be made about this definition:

1. Internal control is a process.
2. It's a means to an end, not an end in itself.
3. Internal control is effected by people at every level of a department/organization.
4. Internal control is, to some degree, everyone's responsibility. Within the District, management is primarily responsible for and will be held accountable for internal control in their departments/campuses.
5. Internal control can provide only reasonable assurance -- not absolute assurance -- regarding the achievement of a department's/campus' objectives.
6. Effective internal control helps a department/campus achieve its objectives; it does not ensure success. There are several reasons why internal control cannot provide absolute assurance that objectives will be achieved: cost/benefit realities, collusion among employees, and external events beyond a department's/campus' control.
7. Effective internal control helps an organization achieve its operations, financial reporting, and compliance objectives.
8. Effective internal control is a built-in part of the management process (i.e., plan, organize, direct, and control). Internal control keeps an organization on course toward its objectives and the achievement of its mission and minimizes surprises along the way. Internal control promotes effectiveness and efficiency of operations, reduces the risk of asset loss, and helps to ensure the reliability of financial reporting and compliance with laws and regulations.

Roles and Responsibilities of Internal Controls

Management is responsible for establishing internal controls in their departments/campuses. This means that management is responsible for identifying the risks that could prevent them from achieving their objectives, and make sure that appropriate internal controls (policies and procedures) are in place to mitigate those risks. Management is also responsible for ongoing monitoring of internal controls to make sure that controls are still working and whether risks have changed requiring new controls.