IACP Executive Summary
Internal Accounting Control Program
The Internal Accounting Control Program (IACP) established by Executive Order from the Governor requires each Ohio State cabinet agency to establish, maintain, and annually evaluate internal accounting control systems sufficient to provide reasonable assurance of accountable government.
As part of the annual evaluation, Agency Chief Executive Officers (ACEOs) must certify the effectiveness of their agency's internal accounting control systems and, if applicable, identify, plan, and schedule needed refinements.
The IACP requires an annual evaluation of the agency's internal accounting control system to assure that:
- Funds, property, and other assets and resources are safeguarded against waste, loss, unauthorized use, and misappropriation; and
- Revenues, expenditures, and transfers of assets, resources, or funds applicable to operations are properly recorded and accounted for to permit the preparation of reliable financial and statistical reports and to maintain accountability over the State's resources.
Continuing Education Essential to Effective Internal Accounting Control Systems
ACEOs identify staff who require internal accounting control training and the depth and content of that training. Such education and training efforts are directed at line managers, supervisors, and program and administrative personnel -- the staff most responsible and accountable for operating functions and thereby most involved in maintaining internal accounting control programs.
Basic internal accounting control training covers the methodology adopted to identify functions, define objectives, test the adequacy of controls, and implement plans of improvement or corrective action. It also covers the benefits derived from effective internal accounting controls and the procedures for documenting and reporting on the results of internal accounting control reviews. For agencies which have established internal audit functions, training and education should also be offered on the appropriate role of the internal auditor within the agency's internal accounting control system.
The first phase of the program required that all cabinet agencies report on the status of all accounting controls over cash by a target date of December 31, 1992. Also, Agency Chief Executive Officers (ACEOs), Internal Control Coordinators (ICCs), line managers, and internal auditors were expected to familiarize themselves with the internal control review program. The guidelines that the agencies followed were issued by the Office of Budget and Management in April 1992, and addressed both accounting controls and administrative controls. The program was known as the Internal Accounting and Administrative Control Program (IAACP).
Since the conclusion of the first year, the program name was changed to the Internal Accounting Control Program (IACP) to address only accounting controls, and the guidelines were revised and reissued in July 1993.
Beginning in 1993, all cabinet agencies entered the second phase of the program. Agencies were required to report on the status of the accounting controls of the ten transaction cycles covered under the program by a target date of December 31, of each year. Since then, there are currently nine transaction event cycles. The Field Staff Accountability (FAS) transaction event cycle has been incorporated into the Personnel and Payroll transaction event cycle. In June 1999, agencies began reporting from a calendar year basis to reporting on a fiscal year basis.
Internal Accounting Controls Defined
Internal accounting controls comprise the methods and procedures directly associated with the safeguarding of assets and the reliability of accounting data. These controls encompass the systems of authorizations and approvals, separation of duties, physical control over assets, and internal auditing.
Any internal accounting control system can be improved. Identified needs for internal accounting control system refinements should be viewed cooperatively as management opportunities, rather than negatively as indications of past problems.
Distinguishing Between an Audit and an Internal Accounting Control Review
An audit is an independent examination and evaluation of something performed to provide an objective second opinion. Effective auditing enhances confidence in management and accountability processes. Internal and external auditing have related but distinctly different confidence-enhancing roles.
Internal auditing is management-oriented. Internal auditors are management team members who report to ACEOs and who are responsible for assuring that ACEOs are in a position to make optimally informed decisions.
External auditing is oversight-oriented. External auditors report to other branches and levels of government and to the public in the interest of assuring effective legislative and public oversight of government activities.
An internal accounting control review is a process by which management performs a self-examination of a system of internal accounting control to determine whether adequate control measures exist and are implemented to prevent or detect the occurrence of potential risks in a cost-effective manner.
Who Should Perform Annual Agency Internal Accounting Control Evaluations?
Agency Chief Executive Officers (ACEOs) are fully responsible for establishing, maintaining, and annually evaluating their agency's internal accounting control systems.
Internal Control Coordinators (ICCs) are designated by the ACEOs to coordinate their agencies' internal accounting control programs and monitor program completion. ICCs should have sufficient authority to act on behalf of the agency ACEO in managing the internal accounting control program.
Line managers are responsible for establishing and maintaining programs under their control. They are also responsible for annually evaluating and testing controls in those programs.
In fulfilling their responsibilities, line managers should:
- Document agency internal accounting control systems, and ensure system changes are updated on a timely basis;
- Review prior audits and prior annual internal accounting control evaluations;
- Use designed internal accounting control checklists and questionnaires to help understand the nature of existing controls and the extent to which those controls are in place and functioning properly.
ICCs should coordinate with line managers to ensure they understand the IACP requirements and are following guidelines. ICCs should also develop educational training seminars on internal accounting control concepts for line managers. ICCs are responsible for summarizing their agency's internal accounting control activities and presenting them to the ACEOs. Ideally, ICCs are not responsible for evaluating internal accounting controls. This is a function of the agency's line managers.
Internal auditors should be independent of line managers and free of line management responsibilities so they can provide ACEOs with objective determinations of agency internal accounting control systems. Internal auditors may act as ICCs, but they should not be responsible for evaluating internal accounting controls for purposes of the IACP.
There are limits to the effectiveness with which line managers can objectively evaluate agency internal accounting control systems. Competent and independent internal auditors have the technical expertise to objectively test the evaluations of internal accounting controls designed by line managers.
Evaluations in Agencies With Sufficient Internal Auditing Resources
In agencies with established internal audit functions, the internal auditors should routinely review internal accounting control structures and report the results of their reviews to the highest levels of agency management. The reviews should be undertaken on the internal auditors' own initiative or at the ACEOs' request. Internal auditors should be considered a valuable resource to the agency and should provide technical guidance and oversight for all aspects of the evaluation process in each agency. Specifically, internal auditors should:
- Provide technical assistance to line managers on conducting internal accounting control evaluations;
- Provide guidance to managers on preparing internal accounting control reports for submission to the agency's ICCs; and
- Provide advisory service to department heads and the ICCs on preparing the annual internal accounting control certification reports.
Agencies without professional internal auditing capabilities must perform annual internal accounting control evaluations consistent with this volume of the IACP. The sample vulnerability assessment, procedures, and checklists included in Volumes II and III document and supplement portions of these guidelines and should prove helpful in these instances.
Method Used to Perform the Annual Internal Accounting Control Evaluation
There is no "right" way to evaluate internal accounting control systems. Rigid rules and extensive prescriptions of mandatory evaluation procedures are generally counterproductive to effective evaluations.
The vulnerability assessment, and specific procedures and checklists set forth in Volumes II and III, illustrate just one of many possible approaches to the annual internal accounting control evaluation.
These volumes are not intended to suggest that the manual's specific approach is mandatory or optimum. They are intended primarily to assist agencies with the implementation of the program. Agencies are encouraged to tailor procedures and checklists in a manner that best fulfills their ability to meet the IACP's control objectives and reporting requirements.
The acceptability of particular approaches to annual internal accounting control evaluations is determined by their results. Effective internal accounting control evaluations enlighten ACEOs, ICCs, and line managers and produce steadily improving internal accounting control systems.
Determination of the appropriate specific form and content of agency annual internal accounting control evaluations are necessarily a matter of professional judgment. However, they should always provide persuasive evidence to support conclusions as to the effectiveness of existing controls and needed refinements.
Agency annual evaluations should be designed to assure that internal accounting control systems meet the objectives identified in the IACP. The reviews should determine the extent to which agency internal accounting control systems assure that assets are safeguarded and reports are accurate and reliable.
Are Needed Refinements in Agency Internal Accounting Control Systems Effectively Communicated?
ACEOs should state on their annual internal accounting control system certifications whether agency internal accounting control systems provide reasonable assurance of sound management. The Governor's Executive Order requires ACEOs to identify, plan, and schedule needed refinements through the annual internal accounting control certifications.
The annual certification should be clear and to the point, and to the extent possible, stated in a positive tone and in positive terms. For each needed refinement, the certification should clearly and concisely communicate the condition observed, the criteria used to evaluate the condition, the condition's effect on internal accounting control system effectiveness, and the cause of the condition.
Importance of ACEO Attitudes Toward Internal Accounting Controls and Internal Auditing
The most critical step toward effective agency internal accounting control systems is convincing line managers that effective internal accounting controls are in their own, the agency's, and the public's best interest.
ACEOs must lead by example with respect to internal accounting control systems. Sustained effective internal accounting control systems are possible when ACEOs maintain and demonstrate a positive and insistently supportive attitude toward them and internal auditing.
Line managers take their cues from the ACEOs. When line managers are not convinced that effective internal accounting controls are a top priority with the ACEO or management personnel, effective internal accounting controls probably will not be their top priority as well.
