This control self-assessment is a multipurpose tool to be used by departments in assessing adequacy of internal controls within their areas. The primary purpose of this tool is for departments to evaluate their internal control environment and identify areas of risk and opportunities for improvement. A strong internal control environment can better position a department to achieve compliance, financial and operational objectives.

This assessment is divided into the following eleven categories:

All questions should be answered by “Yes,” “No,” or “N/A.” The department may use the “Describe Control/Comment” area to document the control by describing the department’s business process/procedures, or why no control exists. The “Describe Control/Comment” area could be helpful for the Unit leadership when assessing the adequacy of controls.

By thoroughly considering the questions, you will be evaluating your control environment against sound business practices. The Office of Internal Audit encourages you to engage your entire team in the exercise to brainstorm for those areas of opportunity and to share the experience.

The assessment should be completed annually. The results of the basic internal control assessment should be submitted to the Office of Internal Audit by clicking on the “Submit Form” button at the end of the assessment for review and random verification of the responses. Please feel free to send an email to [email protected] if any questions or concerns arise while completing the assessment.

• An organizational chart pictorially represents all the team players within a department. The chart shows the various working relationships between staff and supervisors. It also provides management information that may be used as a baseline for planning, budgeting, and work force modeling.
• A mission statement guides the actions of the department, spells out its overall goal, provides a sense of direction, and guides decision making for all levels of management. It also serves as an indicator of the objective of the department within the overall mission of the university.
• Departmental policies and procedures, as well as employee desk-top manuals will allow employees to understand their roles and responsibilities as well as promote consistency within the department. Policies and procedures allow management to guide operations without constant intervention. Policies and procedures are the strategic link between the university’s mission and its day-to-day operation and should be reviewed annually and updated, when necessary.
• A webpage can be a valuable tool to promote/communicate to the campus community and the general public the services the department provides and how to request such services. Webpages should be maintained and updated on a periodic basis to provide the most current information to stakeholders.

• Documentation should exist to support timely reconciliation of departmental accounts on a consistent basis. Documentation also exists to support that reconciliations are reviewed in a timely manner by the appropriate department head and/or signature authority.
• When you reconcile an account, you are proving that the transactions comprising the account balance are correct. A spreadsheet reconciliation should be maintained for each departmental budget. All account activity should be reviewed on a regular basis including payroll transactions details for accuracy, completeness, and compliance with Alcorn State University policies and procedures as well as any applicable external agency requirements.
• The purpose of the reconciliation is to track transactions as they occur and match them to transactions recorded on the monthly detail reports. This will enable the department to quickly identify any questionable transactions posted to their budget and take corrective action to ensure the accurate financial condition of the department.
• Authorization, recording and reconciling of transactions should be segregated duties. Reconciler and signature authority should sign/initial and date final reconciliation to keep on file. Proper documentation is vital, because it provides supporting evidence that departmental budget reconciliations have been reviewed for appropriateness and compliance.
• Departments should be familiar with the Budget Office Policy and understand that departmental administrators and fiscal personnel are responsible for reviewing information in Banner Finance for accuracy and ensuring that sufficient expenditure budget allocation is available to support fiscal year activities. If a Banner Organization goes into a deficit, the deficit must be resolved immediately. A request to transfer funds must be submitted to the Budget Office no later than the end of the occurring month.

• Annual training is required for all employees responsible for handling cash. · The department should be familiar with the Cash Handling & Management Policy.
• Proper documentation is vital, and documentation should exist to support that cash receipts/deposits are reconciled each month.
• Procedures should be established to ensure duties related to receipting, custody, and reconciliation of funds are adequately separated.
• Since cash is the most liquid asset and the most susceptible to loss if not properly controlled; therefore, all departments responsible for collecting cash, checks and credit card payments should ensure timely deposits, safeguards of funds prior to deposit. Proper segregation of duties in the cash handling process and regular reconciliation should be performed to ensure all funds have been deposited accurately.
• Independent counts must be performed periodically to help ensure the established amount is maintained in the petty cash fund at all times to reduce the risk of overages and shortages. Documentation should be maintained to support the counts, which should be available for review by auditors.
• The Accounting Department should be consulted to determine if revenue collected from sale of goods/services (i.e., t-shirt sales, book sales, facility rentals, etc.) are subject to sales tax or other taxes.

• The department should review and be familiar with all of the university purchasing policies that are available on the University Policy Directory for Financial Services.
• Segregation of duties reduces the risk of fraud waste or abuse of university assets. No one person should be in a position to both perpetrate and conceal errors or fraud; therefore, the duties for requisition and invoice input, approval and account reconciliation functions should be separated.
• Segregation of duties also apply to purchases made with a procurement card, and the department should utilize a control sheet when there are multiple users of a single procurement card. By utilizing a control sheet, the department is able to keep a record of who, when, and what was charged to the card.
• The department should be familiar with the State Procurement Card Guidelines.
• The department should also be familiar with the Travel Policies, which are also located on the online policy directory for Financial Services.
• If the department is required to make technology purchases, then the department personnel are aware of the guidelines pertaining to technology purchases.

• The department should monitor and conduct in-house audits of their property. The fixed asset inventory database is maintained by the Director of Property Management. The department should conduct self-inventory audits of university property for which they are responsible as required by the university. This reduces the risk of missing items. Should the department discover items are missing, they must report them to the proper authorities immediately. The department should make every effort to locate the items.
• A hand receipt should be kept on file for any property that is removed off campus. The hand receipts are only valid for one year and should be updated annually.
• Inventory over a certain threshold should be properly identified with an inventory tag and added to the department’s inventory list.
• A department record of keys and/or access cards issued, and extra keys/cards kept on hand should be maintained for control purposes. Access to facilities should be limited and restricted to only those who require access. The department should be familiar with the Key Control Policy.
• Departments that utilize university-owned vehicles understands and adheres to the Transportation Policy.

• Time-keeping documentation records actual hours worked and leave time. Employees should be familiar with utilizing the electronic time sheet that is available on Banner Online Services.
• To ensure accountability and accuracy, time keeping records should be completed and approved by the supervisor. Management should also refer to the Fair Labor Standards Act (FLSA) for guidance. To ensure that personal and sick leave is accurately reflected in the system, it is important that the information be reported in a timely manner. The Department should be familiar with all Payroll/HR Policies related to but not limited to Compensatory Time and Overtime Pay, Wage and Salary Policy, Timekeeping and Reporting Policy.
• Payroll reports should be generated, reviewed, and reconciled to the time & attendance reports to verify the accuracy of the payroll charges.

• Procedures should be in place to help ensure that termination documents are processed, and appropriate university and departmental personnel are notified in a timely manner to stop payroll, cancel computer access, retrieve keys, access cards, university equipment, and etc.
• Annual performance evaluations should be conducted for all employees and results submitted through the proper channel. It is beneficial to both the employee and their supervisor to review and discuss the job performance of the employee. Management should refer to the university policies and procedures for guidance.
• Employees should be aware of the HR Policies not limited to Background Screening Policy, Code of Conduct, Clearance Requirements, and Confidentiality Policy.
• Departments should also be aware of the Conflicts of Interest Policy as well as the obligation to disclose outside employment annually.

• Department staff has read and understands the Information Technology Services Policies regarding the acceptable use policy for computers and controls should exist to ensure the department computers/systems are not used to violate copyright laws.
• The department should be aware of the Data Disposal Policy and understands the proper transfer, disposal, and or/reuse of computers and other digital storage media.
• Passwords are an important aspect of computer security and are considered the front line of protection for user accounts. Access to computers, servers, and systems that contain confidential and/or critical data must be restricted with unique user ID’s and passwords as well as firewalls. A poorly chosen password may result in the compromise of ASU’s entire network; therefore, the department should also be aware of the Password Policy and understand that everyone is responsible for safeguarding the passwords for his/her computing accounts, which should not be shared or disclosed with anyone.
• The department should be aware of the Personally Identifiable Information (PII) Policy and understand that the responsibility for ensuring reasonable and appropriate administrative, technical, and physical safeguards are established to protect the integrity, confidentiality, and security of all PII irrespective of its source, ownership, or the medium used to store it.
• Information security training should be completed annually so that everyone is knowledgeable of the best ways to help protect the university from malicious attacks and prevent possible security breaches. Employees should also be encouraged to lock their computers prior to stepping away from their computers.
• Departments should encrypt files when transmitted or loaded on portable storage devices as well as used cross-cut or high security shredders for discarding sensitive information.
• Documentation (i.e., signed confidentiality agreements, memos, information security training certificates) should be maintained to substantiate employees have been informed and educated regarding their responsibilities of safeguarding confidential information.

• ASU is dedicated to the welfare and safety of all minors who visit our campuses to participate in university-related programs and activities or any other event involving minors on ASU campuses.
• It is important to promote a safe environment for minors by fostering a university culture that is committed to preventing, recognizing, reporting, and addressing child and child sexual abuse.
• Employees should be familiar with the Activities Involving Minors Policy , Children and the Workplace Policy and Child Abuse Policy
• Employees should also be familiar with the ASU Camp Policy as well as the Title IX Policies

• Safety policies and procedures should be established to reduce and prevent injuries and illnesses.
• The department should be familiar with the proper disposal for hazardous material and understand the Waste Removal Policy.
• The department should be familiar with the University Health & Safety Policies and the Environmental Protection Agency (EPA) Reporting Requirements.
• The department should be familiar with the Worker’s Compensation Policy.
• The department should also be familiar with the Smoke and Tobacco-Free Campus Policy and the Drug & Alcohol Policies.

• Departments should be familiar with the Sponsored Programs Policies and should be knowledgeable about Research Misconduct as well as Financial Conflicts of Interest in Research.
• Departments should be knowledgeable of the Time & Efforts Reporting Requirements as listed in 13.28 of the Grants & Contracts Policy.