Sample internal control system

A recent “KPMG Fraud Survey” found that organizations are reporting more experiences of fraud than in prior years and that three out of four organizations have uncovered fraud. The NYS Office of Mental Health's Bureau of Audit has provided the following list of internal controls to assist you in preventing and detecting fraud at your agency.

1. Use a system of checks and balances to ensure no one person has control over all parts of a financial transaction.
   • Require purchases, payroll, and disbursements to be authorized by a designated person.
   • Separate handling (receipt and deposit) functions from record keeping functions (recording transactions and reconciling accounts).
   • Separate purchasing functions from payables functions.
   • Ensure that the same person isn’t authorized to write and sign a check.
   • When opening mail, endorse or stamp checks “For Deposit Only” and list checks on a log before turning them over to the person responsible for depositing receipts. Periodically reconcile the incoming check log against deposits.
   • Require supervisors to approve employees’ time sheets before payroll is prepared.
   • Require paychecks to be distributed by a person other than the one authorizing or recording payroll transactions or preparing payroll checks.
   • If the agency is so small that you can’t separate duties, require an independent check of work being done, for example, by a board member.
   • Require accounting department employees to take vacations.
2. Reconcile agency bank accounts every month.
   • Require the reconciliation to be completed by an independent person who doesn’t have bookkeeping responsibilities or check signing responsibilities or require supervisory review of the reconciliation.
   • Examine canceled checks to make sure vendors are recognized, expenditures are related to agency business, signatures are by authorized signers, and endorsements are appropriate.
   • Examine bank statements and cancelled checks to make sure checks are not issued out of sequence.
   • Initial and date the bank statements or reconciliation report to document that a review and reconciliation was performed and file the bank statements and reconciliations.
3. Restrict use of agency credit cards and verify all charges made to credit cards or accounts to ensure they were business-related.
   • Limit the number of agency credit cards and users.
   • Establish a policy that credit cards are for business use only; prohibit use of cards for personal purposes with subsequent reimbursement.
   • Set account...