Indiana League of Municipal Clerks and Treasurers Fall Meeting

Indiana Regional Sewer District AssociationOctober 26, 2015Thank you we are glad to be here this morning.

We have a few changes to go over with you and one fairly important new law that affects all political subdivisions, so lets get started1Indiana State Board of AccountsTodd CaldwellDirector of Audit Services

tcaldwell@sboa.in.govSusan Gordon, CPADirector of Audit Services

sgordon@sboa.in.gov317-232-2513Here is our contact information. I am joined today by Susan Gordon.

I personally prefer an email days get crazy sometimes with call and I can reply to an email off hours I start a 6:00 and can answer a lot of emails between 6-9 before most offices open.

Susan and I replaced Charlie Pride and Todd Austin. Youve probably dealt with one or both of them in the past. Charlie was over cities and towns for 23 years.

So we have some big shoes to fill and a lot to learn.2Internal Controls

Why Internal Controls

What Are Internal Controls

Internal ControlsToday, we are going to talk about internal controls everyones favorite subject right?

We mention internal controls when we show up to audit you and sometimes write you up for internal controls not be adequate or existent at all. But other than that, we havent provided a wealth of information on the subject.

Theres a reason for that Ill discuss later, but for right now, were going to talk about a new statutory provision regarding internal controls that will affect every political subdivision in the State.

Well discuss exactly what internal controls are, why they are important, and the 5 components that make up internal controls.

3Internal ControlsWhy Internal Controls?

So why are we discussing Internal Controls?

The primary reason is Indiana Code 5-11-1-27.HB 1264 amended IC 5-11-1-27 with some new requirements for internal controls

4Indiana Code 5-11-1-27

(e) . . . the state board of accounts shall define and the audit committee shall approve not later than November 1, 2015, the acceptable minimum level of internal control standards and internal control procedures for internal control systems of political subdivisions, including the following: (1) Control environment. (2) Risk assessment. (3) Control activities. (4) Information and communication. (5) Monitoring. The internal control standards and procedures shall be developed to promote government accountability and transparency.

We, the SBOA, now are statutorily required to define the acceptable level of internal controls.

That doesnt mean we design your controls, but rather we set a minimum level of standards political subdivisions will use to develop, adopt, and implement their own controls.

The statute requires those minimum standards to include 5 components:

Control EnvironmentRisk AssessmentControl ActivitiesInformation and CommunicationMonitoringSBOA is to define these standards no later than November 1.

5IC 5-11-1-27(f) Not later than November 1, 2015, the state board of accounts shall develop or designate approved personnel training materials as approved by the audit committee, to implement this section.

The statute goes on:

Stating that we will develop or designate approved personnel training materials as approved by the audit committee.

Here is a picture of the cover of part of our training materials. It is similar in design to the Cities and Towns Court Manual

This will definitely be on our website like manuals and bulletins it will be featured very prominently so you shouldnt miss it.

6Indiana Code 5-11-1-27(g)

After June 30, 2016, the legislative body of a political subdivision shall ensure that:

(1) the internal control standards and procedures developed under subsection (e) are adopted by the political subdivision; and (2) personnel receive training concerning the internal control standards and procedures adopted by the political subdivision.

This is where the local unit requirements come into play.

The statute goes on, stating that after June 30, 2016 --- so you have between now and June 30 to get started with this the legislative body of your city or town shall ensure internal controls standards developed by the SBOA are adopted and that personnel of your city/town have received training on those standards.

It does no good to implement internal controls if everyone involved is not aware of what they are and has not been training in how they are supposed to work. So this part of the statute is requiring personnel receive training regarding controls.

7Indiana Code 5-11-1-27(c) defines personnel:

As used in this section, "personnel" means an officer or employee of a political subdivision whose official duties include receiving, processing, depositing, disbursing, or otherwise having access to funds that belong to the federal government, state government, a political subdivision, or another governmental entity.

Personnel is defined in IC 5-11-1-27(c) as an officer or employee whose official duties include receiving, processing, depositing, disbursing, or otherwise having access to funds that belong to the political subdivision.8Indiana Code 5-11-1-27(h)

(h) After June 30, 2016, the fiscal officer of a political subdivision shall certify in writing that:

the minimum internal control standards and procedures defined under subsection (e) have been adopted by the political subdivision; and personnel, who are not otherwise on leave status, have received training as required by subsection (g)(2).This next part involves the fiscal office of your district

IC 5-11-1-27(h) states that after 6/30/16, the fiscal officer shall certify in writing

(click)The minimum internal control standards and procedures have been adopted(click)Personnel not on leave have received training9Indiana Code 5-11-1-27(h) continued:

. . . The certification shall be filed with the state board of accounts at the same time as the annual financial report required by section 4(a) of this chapter is filed. The certification shall be filed electronically in the manner prescribed under IC 5-14-3.8-7.

And that the certification made by the fiscal officer shall be filed with SBOA at the same time the annual financial report is submitted online in Gateway.

So when your fiscal officer does your districts AFR for 2016 in the winter of 2017, the will have to upload a signed copy of the certification.10Indiana Code 5-11-1-27(i)

After June 30, 2016, if the state board of accounts finds during an audit of a political subdivision that: (1) the political subdivision has not adopted the internal control standards and procedures required under subsection (g)(1); or

(2) personnel of the political subdivision have not received the training required under subsection (g)(2); the state board of accounts shall issue a comment in its examination report for the political subdivision. Continuing on, section 27(i) states that after June 30, 2016, if SBOA finds that

(click)the city/town hasnt adopted the internal controls standards required by subsection (g)

Or

(click)We find personnel have not received the required training

SBOA shall issue a comment in our audit or examination report. This is a shall statement. There is no wiggle room on our part we have to issue a comment if the minimum standards havent been adopted or if personnel dont receive the training.

This will be when we audit calendar year 2016, which would be in 2017 at the earliest.

11Indiana Code 5-11-1-27(i) continued . . .

. . . If, during a subsequent audit, the state board of accounts finds a violation described in subdivision (1) or (2) has not been corrected, the political subdivision has sixty (60) days after the date the state board of accounts notifies the political subdivision of its findings to correct the violation. If a violation is not corrected within the required period, the state board of accounts shall forward the information to the department of local government finance.

What happens after that first report comment?

When we come back for the next audit, if SBOA finds a comment from the prior audit/examination report for the standards not being adopted and/or personnel failing to receive training hasnt been corrected:

The District has 60 days after the date SBOA notifies you of the issue which will be the date of the exit conference (not the date you get your copy of the report via mail or email) to correct the violation.

If the violation isnt corrected after 60 days SBOA forwards the information to DLGF

And per IC 6-1.1-17-16.2(b) DLGF may not approve your city or town budget.

So thats what went into effect July 1, 2015 with the amendment to IC 5-11-1-27. I would urge you all to read that section in its entirety when you get back to your office as many times as you need to get a good understanding of it.

You should also make your Boards aware of it. The vast majority of the responsibility regarding internal controls falls on the legislative body. Remember when I read 5-11-1-27(g) which states the legislative body of a political subdivision shall ensure that . . . ??

It starts with your Boards they should be aware of this if they arent. We will be working with the various governamental units associations to get notifications out that this is a legislative body responsibility.

That was a lot of information to take in. Sometimes internal controls can be a bit intimidating because no one ever comes out and says here it is or this is what you should do.

Since a lot of people arent always sure what internal control looks like, they get stressed out anxieties sets in, etc.

It can be a real hair-raising time for you. In fact, Donald Trump was recently asked out on the campaign trail about internal controls and such.

his was his reaction:

12

It doesnt have to be like this!

SBOA will be able to provide much assistance throughout the process.

13Why are accountants always so calm, composed, and methodical?

They have strong internal controls.14Why are Internal Controls Important?

Why are internal controls important

Internal control is a process executed by officials and employees that is designed to provide reasonable assurance that the mission and objectives of the organization will be achieved. The internal control process includes any policy, system, or action that corresponds directly to the objectives of the organization and adjusts to change when necessary.

In government, missions and objectives change and evolve as a result of various factors such as new management, change in staff, rapid growth, technological advances, and new programs or services.

internal controls must be monitored and evaluated for applicability in the new context and adjusted accordingly. Often, new internal controls are implemented without a corresponding deletion in outmoded controls.

Maintaining processes which have no clear purpose fosters confusion and ineffective utilization of resources, resulting in a control weakness. Therefore, internal controls should be identified, monitored, and evaluated on a continual basis. 15Benefits:Accountability and transparencyInternally quickly evaluated; inefficiencies addressed and correctedEncourage efficient use of government time and resourcesConveys to citizens commitment to detect fraud, waste, abuseReduces costs timely completion of responsibilities / prevents fraud, waste, abuseBetter internal controls can result lower audit costs

Here are some benefits of internal controls that I will, in the interest of time, let you read on your own.

OR

Go thru these . . . 16What is Internal Control?

What is internal control?

By necessity, the definition of internal control is broad. Internal control is a conceptual process that is applied to a wide range of situations in a wide range of environments.

The purpose of the internal control process is to provide reasonable assurance that the mission and objectives of an organization will be achieved.

This purpose includes the reduction of risk associated with fraud as well as a safeguard of resources against loss due to waste, abuse, mismanagement, or errors.

Internal control provides a check and balance system over operations, promoting operational effectiveness and efficiency.

A system of sufficient internal control produces reliable financial and management data; ensures accuracy and timeliness in reporting; and promotes compliance with laws.

17SBOA defines internal control as follows:

Internal control is a process executed by officials and employees that is designed to provide reasonable assurance that the objectives of the political subdivision will be achieved.

It is a basic element fundamental to the organization, rather than a list of added on tasks;

For the purposes of the minimum standards, SBOA defines internal controls as

(click)Internal control is a process executed by officials and employees that is designed to provide reasonable assurance that the objectives of the political subdivision will be achieved.

(click)It is a basic element fundamental to the organization, rather than a list of added on tasks;18SBOA definition of internal control (continued):

It is an adaptable process that is a means to an end, not an end in itself;

It is focused on the achievement of objectives; and

It is dependent on officials and employees for effective implementation.

(click)It is an adaptable process that is a means to an end, not an end in itself;

(click)It is focused on the achievement of objectives; and

(click)It is dependent on officials and employees for effective implementation.

19Organizational roles are important

All members of a city or town, including elected officials, board members, and employees full fill a role in the internal control system

Leadership is key the tone is set at the top

Clear support from leadership engages a successful, effective internal control system

On this slide, want to point out all members of a district board members and employees - have a role in the internal control system

The tone is set at the top your councils will be instrumental in implementing this.20Procedures for Adopting Internal Control ProceduresLegislative body should stipulate in a policy they have adopted the internal control standards as defined by SBOA under IC 5-11-1-27(e).

Personnel training should be evidenced through a documentation process can be as simple as acknowledgement by personnel through email.

Here are the procedures for adopting internal controls

Board adopts a policy

Personnel are trained and training is documented.21Procedures for Adopting Internal Control ProceduresFiscal officer must certify in writing the minimum internal control standards have been adopted and personnel have received training.

Certification filed with SBOA when completing the Annual Financial Report for 2016 (in early 2017).

Fiscal officer makes certification

Certification filed with SBOA online in Gateway with the AFR for 2016 that will be filed in early 201722Objectives:In general, objectives originate from purposes and functions detailed in laws, regulations, ordinances, etc.Set at both the entity level and office level by the oversight body and managementMust be viewed from a holistic, interrelationship approach

In general, objectives for political subdivisions originate from purposes and functions detailed in laws, regulations, ordinances, etc.

Objectives are set at both the entity level and at office level by the oversight body and management and must be viewed from a holistic, interrelationship approach.23Categories of Objectives:Operations analyze operational and performance goals along with the effectiveness and efficiencies of operation, including the safeguarding of assetsReporting considers both financial and non-financial information, internal and external to the unit, with an expectation of reliability, accountability and transparencyCompliance - assure adherence to laws and regulations

There are 3 categories of objectives:

(click) Operations analyze operational and goal performance

(click)Reporting both non-financial and financial / both internal and external

(click)Compliance assures adherence to laws and regulations24Minimum Level of Internal ControlsCOSO Committee of Sponsoring Organizations of the Treadway Commission

Visit: www.coso.org

A system of internal control may be implemented in many different ways.

Because cities and towns vary in size and complexity, no single method of internal control is universally applicable.

However, the five internal control components should be present and functioning, operating in an integrated manner.

The Committee of Sponsoring Organizations of the Treadway Commission, or COSO, provides a framework that includes principle characteristics of these five components and three categories of generalized objectives.

25Minimum Level of Internal ControlsU.S. Government Accountability Office publication Standards for Internal Control in the Federal Government [otherwise referred to as the Greenbook]

Visit: www.gao.gov/greenbook

The Green Book is another good source of information.

From the US Government Accountability Office.

View on their website26

The five components that are recognized as basic to any internal control system are listed in IC 5-11-1-27(d) - we mentioned them before are:

Control EnvironmentRisk AssessmentControl ActivitiesInformation and CommunicationMonitoring. If any of the five components is missing, true internal control is not achieved.

27www.slideshare.net

The control environment is the basic commonality for all and comprises the integrity and ethical values of the political subdivision established by the oversight body and management.

The oversight body and management convey leadership expectations, and overall tone which are reinforced by all officials and management throughout the various offices and departments.

The control environment also contains the overall accountability structure for all employees through performance and reward measures. Ie what happens if someone doesnt follow or overrides the established controls. 28www.slideshare.net

Risk is the possibility that an event will occur and adversely affect the achievement of objectives. Risk assessment is the process used to identify and assess internal and external risks to the achievement of objectives, and then establish risk tolerances.

29www.slideshare.net

Management identifies risks to the achievement of the political subdivisions objectives across the unit as a whole and within each office or department.

30www.slideshare.net

Control activities are the actions and tools established through policies and procedures that help to detect, prevent, or reduce the identified risks that interfere with the achievement of objectives.

Detection activities are designed to identify unfavorable events in a timely manner whereas prevention activities are designed to deter the occurrence of an unfavorable event. Examples of these activities include reconciliations, authorizations, approval processes, performance reviews, and verification processes. 31

Relevant and quality information from both internal and external sources is necessary to support the functioning of the other components of internal control.

Communication is the continual process of providing, sharing, and obtaining necessary information.

Internal communication enables personnel to receive a clear message that control responsibilities are taken seriously by the organization.

External communication enables relevant outside information to be internalized and internal information to be clearly communicated to external parties.32

Monitoring can be split into Ongoing and Separate Evaluations:Ongoing evaluations, separate evaluations, or some combination of the 2 are used to ascertain whether each of the 5 components of internal control, including controls to effect the principles within each component, is present and functioning.Ongoing evaluations, built into the business processes at different levels of your District, provide timely informationSeparate evaluations, conducted periodically, will vary in scope and frequency depending on assessment of risks, effectiveness of ongoing evaluations, and other management considerations.

33www.slideshare.net

34Documentation of Internal Control SystemManagement develops & maintains documentation of its internal controls.Management documents in policies the internal control responsibilities of the organization.Management evaluates & documents results of monitoring.Management evaluates & documents issues and appropriate actions timely.Management completes & documents correction actions.U.S. GAO Greenbook, p. 7135

I repeated this slide its one of the first we started with. To summarize, it illustrates how an objective is identified

Controls designed

Controls implemented / put into action and evaluated

Then the objective first identified should be achieved.

36So dont forget:Internal control doesnt have to be a hair-raising issue.

It can be an effective tool to provide reasonable assurance the mission and objectives of your city/town will be achieved.

So dont forget, internal control doesnt have to be a hair-raising issue. It can be an effective tool to achieve your citys or towns objectives and goals.

37