Department managers need to ensure continued adherence to the requirements of Chapter 647 of the Acts of 1989. Chapter 647 establishes internal control standards that define the minimum level of quality acceptable for internal control systems in operation throughout the various state agencies and departments and constitute the criteria against which such internal control systems will be evaluated. Internal control systems must, of course, include all aspects of a departments business - programmatic operations as well as financial.
Management's specific responsibility under the law is to ensure that the standards in the act are met. These standards require, among other things that management ensure that documentation of the internal control system be readily available, transactions and events are promptly recorded, there exists qualified and continuous supervision, and that access to assets and resources is restricted. For these and the other standards set forth in the law management must send a clear message to all personnel that the control environment - its philosophy for accomplishing its goals and objectives - will encompass personal integrity, ethics, and competence.
In fulfilling the law's requirements to establish controls, management must first establish the agency's goals and objectives and identify risks associated with those goals and objectives. Objectives are to be logical, applicable, and complete. The agency head will be directly responsible for all the activities of the agency. Managers of course will be responsible for establishing internal control for their respective units. These internal controls, and the goals and objectives of the unit, must be consistent with the overall goals and objectives of the agency and mirror the tone and expectations of the agency head.
A good system of controls begins at the highest level of the organization and assists management in meeting objectives while avoiding serious problems. The agency head is responsible for all of the agency's activities and thus sets expectations for meeting the agency's goals and objectives for all financial and programmatic activities. The tone management sets through its policies, actions and expectations is important to the overall acceptance of the system by agency personnel and functioning of the operations. In accomplishing this outcome, the law requires the designation of a high-level individual to oversee the internal control system, evaluate its effectiveness, and ensure its integrity.
This individual must be able to ensure that changes necessary to ensure the continued integrity of the system are implemented and that documentation of all internal control systems is readily available for examination. The individual must also be able to see that audit results and recommendations are promptly evaluated, timely appropriate corrective action to an audit is effected, and management's actions to address audit matters will be addressed in the budget. To accomplish these requirements, the agency head must ensure that the individual is at sufficient hierarchy to fulfill them.
On a final note, management must immediately report all unaccounted for variances, losses, shortages, or thefts of funds or property to the Office of the State Auditor. The OSA, in addition to other duties under the law, will review the matter and determine amounts involved, internal control weaknesses, and report any amounts to appropriate management and law enforcement officials.