WHO IS RESPONSIBLE FOR INTERNAL CONTROLS?

Everyone has a part in the internal control system at Purchase College. The roles vary depending upon what level of responsibility and the nature of involvement by the individual. The President and the Officers (VPs) establish the presence of integrity, ethics, competence and a positive control environment. The Deans, Directors and department heads have oversight responsibilities for internal controls within their areas. Managers and supervisors are responsible for ensuring that internal controls are established and functioning to achieve the mission and objectives of their unit. Each employee within an area must be made aware of and understand proper internal control procedures associated with their specific job function.

The New York State Governmental Accountability, Audit and Internal Control Act (originated in Chapter 814 of the Laws of 1987, then made permanent in Chapter 510 of the Laws of 1999) was designed to create a process by which internal controls for public state bodies are reviewed and modified as needed and to ensure that such bodies have available the capacity to verify that these controls have been properly implemented and followed.

The Act requires State agencies to perform the following internal control responsibilities:

1)   Establish and maintain guidelines for a system of internal control.
2)   Establish and maintain a system of internal controls and a program of internal control     review.
3)   Make available to employees a statement of policies and standards with which they are expected to comply.
4)   Designate an Internal Control Officer (ICO) to implement and review the internal control program.
5)   Implement education and training to ensure employees have adequate awareness and understanding of internal control standards.
6)   Evaluate the need for an Internal Audit function.

Purchase College continues to develop its Internal Control program by adhering to the requirements as follows:

COLLEGE RESPONSIBILITIES

1. Establish and maintain guidelines for a system of internal.

Purchase College’s system of internal control integrates the activities, plans, attitudes, policies, skills and efforts of its employees working together to provide reasonable assurance that the College will achieve its objectives and mission.

The effectiveness of the College’s system of internal control in assuring the achievement of goals depends upon clearly articulating and communicating Purchase College’s mission and objectives to employees as well as providing employees with the direction and information that allow them to understand their individual responsibilities and priorities and how they relate to that mission. Essentially, they need to know what the College’s goals are, what the College expects of them in their position and the appropriate means for achieving it, and how their performance will be measured and evaluated.

Purchase College articulates its mission and objectives in several key documents, including: the College’s Mission Statement and its Strategic Plan. Purchase College communicates these goals and accomplishments to employees through a variety of mechanisms, including new employee orientation and training, continued focused training at divisional, departmental and service level and other communication like the President’s annual “tone-at-the-top letter”, the Internal Control brochure, etcetera. The development of the Internal Control website further provides for improved communication.

Upon hire, new employees attend a general orientation session intended to provide them with information concerning the College’s mission, goals, policies and practices. They also receive (or are given access to) documents that provide important information that staff should be able to refer to during the normal hours of business. These documents include, but are not limited to:

• Job description of the employee’s position
• Employee’s performance program, if applicable
• The Public Officers Law (relevant sections)
• Policies of the Board of Trustees, where applicable
• Pertinent collective bargaining agreement, where applicable
• Other policies generally applicable to all employees

In addition, employees receive a departmental orientation and ongoing training that provide them with more specific information concerning their responsibilities, priorities and the basis for measuring performance. The College has implemented a several training programs that assist managers in this area.

2. Establish and maintain a system of internal controls and a program of internal control review.

The College has been divided into reporting segments based on the VP/College Officer level divisions. The divisions are further divided into departments and units.

The College’s organizational structure and system of policies, procedures and internal controls are designed to govern the effective conduct of the College’s business.

There are a number of key documents that contain policies, procedures and practices that govern the operation and conduct of Purchase College and its employees. In addition, various functional areas on campus have specific documents that more narrowly focus on internal controls relating to key aspects of their operation. Taken together, these documents are an integral part of the internal control system (administrative controls) that governs the operation of individual departments throughout the College.

The ICO uses a “Proactive Risk Assessment’ methodology for Internal Control review, testing, development and documentation. The reviews are designed to equitably target all of the College’s Divisions and a carried out on an ongoing basis. The ICO is responsible for selecting the areas and review as well as the nature, extent and timing of these reviews. The ICO also carries out targeted review (testing and documentation) of high-risk areas on an ongoing basis as deemed necessary.

The ICO maintains an annual review schedule as well as a three year overall Internal Control program. The ICO reviews both general and specific internal controls, on an ongoing basis, with the Controller and CFO. The Internal Control Committee (comprised of representatives from the six College Divisions) is also briefed once a semester. The ICO may also refer certain issues to the College Cabinet and/or President if deemed necessary.

As part of the review process, the ICO researches SUNY, New York State, Federal and other authoritative professional guidelines and literature for new developments in order to ensure that the College’s Internal Control program is compliant and reflects current standards.

3. Make available to employees a statement of policies and standards with which they are expected to comply.

A key aspect of internal control is providing staff with clear directions and information relating to “what is expected of them”. Specifically, they need to know their individual responsibilities, priorities and how their performance will be measured and evaluated. In addition, people need a sense of understanding of the organization’s missions, specific goals, policies and practices.

Upon hire, new employees attend a general orientation session intended to provide them with information concerning the College’s mission, goals, policies and practices. They also receive (or are given access to) documents that provide important information that staff should be able to refer to during the normal hours of business. These documents include, but are not limited to:

• Job description of the employee’s position
• Employee’s performance program, if applicable
• The Public Officers Law (relevant sections)
• Policies of the Board of Trustees, where applicable
• Pertinent collective bargaining agreement, where applicable
• Other policies generally applicable to all employees

In addition, employees receive a departmental orientation and ongoing training that provide them with more specific information concerning their responsibilities, priorities and the basis for measuring performance.

The President’s “tone-at-the-top letter” plus the Internal Control brochure, both of which are distributed to employees every spring, serve to further inform employees on their Internal Control responsibilities. The development of the Internal Control website further provides for improved communication with all employees.

4. Designate an Internal Control Officer (ICO) to implement and review the internal control program.

Since internal control systems should be ingrained into the fabric of the College’s operations, those individuals responsible for day-to-day operations and management decisions must assume the continuous responsibility for assuring the adequacy of the internal controls. At the same time, each manager’s internal control responsibilities should be coordinated as part of the College’s overall internal controls effort. To facilitate this coordination, the Act requires the College to appoint an Internal Control Officer (ICO).

The ICO is not solely responsible for carrying out the College’s Internal Control Program but coordinates responsibilities among appropriate College personnel the agency, oversees those activities as part of an overall internal control effort and ensures that the Program meets the requirements of the Act.

Activities to be coordinated through the Internal Control Officer include, but need not be limited to:

• Organizing and coordinating the internal control program;
• Compiling an inventory of existing internal controls;
• Identifying internal control weaknesses and implementing necessary corrective actions, including the findings and recommendations of internal and external audits;
• Updating, revising, and preparing internal controls to reflect current programs, procedures, and policies;
• Identifying internal control training requirements and providing requisite internal control training; and,
• Conducting vulnerability (risk) assessments and internal control reviews

Purchase College has designated Joseph H. Kyambadde to serve as campus Internal Control Officer. The ICO reports directly to the College President, or the President’s designee, and is an individual with sufficient authority to act on behalf of the President in implementing and reviewing the University's Internal Control Program.

5. Implement education and training to ensure employees have adequate awareness and understanding of internal control standards.

Purchase College recognizes that an effective system of internal control requires the organization to have competent staff with the skills and knowledge necessary to accomplish their assigned duties. To this end, the College engages in continuing efforts to provide training, professional and personal development opportunities to employees.

With regard to internal control training, starting in spring 2006, the College provided basic internal control training for all employees. The sessions, conducted by the ICO, were completed in the fall of that year. Since then, new employees (hired within the previous 12 months) receive similar basic internal control training from the ICO every fall. The ICO also works in collaboration with heads of department to provide specialized (focused) training to employees in the various departments. Additional internal control training is also offered at (3) responsibility level segments as necessary. The segments are; Executive, Deans and Directors, and Faculty/Staff. Internal control review and development programs also provide for employee training at various levels (for example, the ‘Proactive Risk Analysis’ program has built-in training for management personnel).

6. Evaluate the need for an Internal Audit function.

The College’s senior administration engages in regular review of the need for an Internal Audit function.

MANAGEMENT AND EMPLOYEE RESPONSIBILITIES

A general principle applicable to all managers and employees is that they are to have personal and professional integrity. They are to maintain a level of competence that allows them to accomplish their assigned duties as well as to understand the importance of developing and implementing cost effective internal controls.

Management Responsibilities

Managers play a critical role in planning and executing the activities and programs at Purchase College. While managers' specific responsibilities may vary at different levels of the organization, the basic principle remains, that all managers are responsible for the successful execution of Purchase College’s internal control program.

Senior Management is responsible for providing the overall direction and priorities that guide the efforts of managers throughout the organization in the formulation of their plans and execution of their programs and organized activities. Senior management is also responsible for providing appropriate organizational structure that ensures internal controls protect the organization’s assets from waste, fraud and abuse without impeding the College’s ability to meet its overall goals and objectives. Finally, senior management is responsible for developing systems and tools that support managers' efforts to achieve their approved goals and objectives.

Department managers and unit heads have the day-to-day responsibility for executing the varied programs and activities at Purchase College. They must translate the College’s overall goals and objectives into goals and objectives suited to the specific missions of their units and must clearly communicate these goals and objectives to the personnel in their units. These managers are also responsible for creating an environment supportive of effective internal controls and are responsible for continuously assessing the effectiveness of the internal controls that apply to their area and suggesting and implementing changes when controls are found to be inadequate.

In summary, management is responsible for:

• Acknowledging that utilization of internal controls is an inherent part of a manager’s responsibility, not a new or additional function.
• Assuring that internal controls are supportive of and consistent with the operating mandate and philosophy of the Purchase College.
• Developing goals and objectives that are consistent with those established for Purchase College. Each manager’s action should be coordinated as part of the overall Purchase College internal control effort.
• Continuously monitoring the environment within which her/his program operates to identify required adjustments in Purchase College’s internal controls.

Employee Responsibilities

Each employee is responsible for adhering to those performance programs, policies, procedures, guidelines and internal control standards established to guide the operation of Purchase College.