Bank Accounts

A.

Limit the number of bank accounts to those absolutely required to manage the
committee’s business. It may, for example, be more convenient to have separate
accounts for the primary and general elections and/or receipts and disbursements.
Obviously, the fewer the accounts, the greater the control and the smaller the
opportunity for errors or wrongdoing.

Open all accounts in the name of the committee, never an individual. The mailing
address should be a committee address and the statements should be delivered
unopened to a person not charged with processing transactions. Only the
treasurer or his designee should be permitted to open and close bank accounts.
Those permitted should be specifically named in writing.

Limit the number of persons authorized to sign checks. In addition, checks in
excess of a certain dollar amount (e.g., $1,000) should require the signature of
two responsible individuals. Facsimile signatures should be prohibited unless
controlled by a check-signing machine with a numerical sequence counter. No
signature stamps should be allowed. Debit and credit cards must be carefully
controlled since they represent easy access to committee assets.

Reconcile bank statements to the accounting records each month in a timely
manner. Many committees find that the use of one of the commercially available
small business accounting software packages is useful in this process. They often
include a simplified pre programmed process for reconciling the accounts and
locating differences. The reconciliations are essential to determining if any errors
occurred, unauthorized checks were issued or receipts were stolen. The statement
should be reconciled by someone other than the check signers and those
controlling the checking account and processing transactions. The individual
responsible for reconciling the account should receive the bank statement
unopened. This one step of segregating the processing of transactions and the
reconciliation of accounts would have prevented or quickly discovered a number
of the misappropriations that the Commission has observed in recent years and the
false reporting that resulted. The reconciliations should also be compared to the
disclosure reports that are filed.

Require all wire transfers to be pre-authorized by two responsible individuals and
immediately recorded in the accounting records. A committee sequential
identification number (similar to a check number) is often helpful in recording
and controlling wire transfers. The Commission has encountered situations where
failure to record wire transfers has resulted in substantial misstatements in
disclosure reports filed. Naturally, the reconciliation of the checking accounts to
the accounting records and the disclosure reports will help prevent the filing of
erroneous reports.


If the committee has more than a few employees, it is advisable that it use an imprest
payroll account to help prevent the payment of unrecorded payroll transactions. An
imprest payroll account is a separate checking account in which a small balance is
maintained. A check for the exact amount of each net payroll is transferred from the
general account to the payroll checking account immediately prior to the distribution of
the payroll. The advantages of an imprest account are that it limits the organization's
exposure to payroll fraud, allows the delegation of payroll check-signing duties, separates
routine payroll expenditures from other expenditures, and facilitates cash management.

Payables

The accounts payable/notes payable procedures are clearly related to the procedures for
cash disbursements and payroll. The control concern is to make certain that all liabilities
are properly recorded and ultimately paid. There should be a proper segregation of duties
over the performance of the functions of comparing receiving reports, purchase orders
and invoices and the handling of the actual disbursement functions. For disbursements
that are not normally accompanied by an invoice (e.g., payment on a note), the
authorization should come from a responsible official.

Computerized Systems

Most political committees are required to file their reports electronically and therefore
many of their records are automated. All of the same control considerations that apply to
a manual transaction system apply to an automated system. Those include the selection
of software, the selection and training of staff, the separation of duties, the limiting of
access to the system, security of the data, and reconciliation of data files to other records.
However there is an additional requirement that is important and sometimes overlooked.
The electronic data must be regularly backed up to avoid a loss of data that can interfere
with a committee’s ability to file timely and accurate disclosure reports. Regardless of
whether such a data loss stems from a hardware failure, a software failure, human error,
or a disaster such as a fire or flood, the result is the same. There are several ways to
accomplish a data back up. In some instances the software supplier will “host” the data
meaning that it resides on the supplier’s server and is backed up by the supplier. If back
up is to be done locally, it can be accomplished by copying the data to a medium such as
a tape or CD and storing the back up off site. Ideally the back up should be done daily.

Conclusion

While no system of internal controls can ever be foolproof, the elements identified above
can significantly reduce the opportunity for intentional misappropriation of funds and any
related false reporting. Furthermore, many of these internal controls can also reduce the
likelihood of inadvertent errors that can result in reporting problems. This discussion of
internal controls is not intended to be exhaustive, and it is up to each political committee
to carefully consider what internal controls are valuable and feasible.


have an understanding of importance of control procedures and the role they play in
ensuring accurate reporting of all financial activities.

Risk Assessment. The committee must be aware of, and deal with, the risks it faces both
monetary and non-monetary. Naturally some assets, such as cash, are more easily
diverted than others and the control procedures should take into account the risk that each
type of asset presents. Then the committee can establish cost effective ways of managing
the related risks.

Control Activities. Control policies and procedures must be established to ensure that
risks are minimized. Depending on the size of the organization these procedures may be
simple and limited, or complex and more extensive.

Information and Communication. Information and communication systems surround
all of these activities. They enable people to gather and share the information needed to
conduct, manage, and control operations

Monitoring. The entire process must be monitored, and modifications must be made as
necessary. In this way, the system can react dynamically, changing as conditions
warrant. In many political committees this is a critical part of the equation. Staff and
structures change often and sometimes radically. Therefore it is necessary to reconsider
the procedures in place to assure they are still effective and appropriate to the current
circumstances.

Follow-up. Once a deficiency in internal control is identified, it is incumbent upon
committee management to take steps to minimize the risk. After identifying a potential
problem, it is expected that action will be taken to reasonably assure that the committee’s
affairs will be conducted in a manner that meets the internal control goals discussed
above.

Selected Procedures for Internal Controls

As alluded to earlier, separation of duties is the key ingredient in any internal control
system. Without that separation, it is virtually impossible to be reasonably assured that
the organization’s internal control goals are met. In a small organization there may be as
few as two or three individuals involved in the processing, recording and reporting of
transactions. With careful planning and assigning of duties it is possible to establish an
elementary internal control system with very few people. If the committee staff is very
small and the Treasurer does not process transactions on a day to day basis, the Treasurer
may be the key to the system.

The controls discussed below include those over cash and non-cash assets that are readily
convertible into cash (e.g., liabilities whose liquidation will require the use of cash, such
as accounts payable and notes payable). The areas discussed below represent particular
vulnerabilities the Commission has identified based on its regulatory experience. They
do not represent an exhaustive list assets to be safeguarded.


Receipts

A. Make a list of receipts when the mail is opened. Ideally, the person opening the

mail and preparing the list should be independent of the accounting function. A
responsible official should periodically (during the monthly bank reconciliation if
not more often) compare the list with the recorded amount for the deposit and the
bank deposit. Some committee’s have found using a lockbox service (to
independently open mail, record the contributions, and make bank deposits) to
perform this part of receipt processing beneficial. Such services may be available
through the bank.

. The employee responsible for opening the mail should complete to following:

— Place restrictive endorsements, such as For Deposit Only with the
committee account number , on all checks received.

— Prepare a list of the money, checks, and other receipts.

— Forward all receipts to the person responsible for preparing and making
the daily bank deposits. Cash and check receipts should be deposited
intact daily.

. If the committee receives contributions via debit and credit card, the same type of

information described above for checks and cash should be assembled for those
contributions’. The same verification to bank deposits should also be performed.
The procedure will depend on the system that the credit card processor has in
place. These control issues should be taken into account before selecting a firm to
process the committee’s credit card contributions.

D. Prohibit delivery of unopened business mail to employees having access to the
accounting records.
E. Secure undeposited receipts in a locked cabinet at all times.
F. Cash refunds should require approval.
G. Locations where the physical handling of cash takes place should be reasonably
safeguarded.
Disbursements
A. Generally, disbursements should be made with prenumbered checks, with the

exception of petty cash. Using checks for all major cash payments ensures that
the disbursement is authorized and there is a permanent record. The check should
be prenumbered so that it is accounted for properly. This procedure helps to
prevent the issuance of a check that is not recorded in the cash disbursement
records. Additionally, presigned checks should not be allowed. The use of credit
and debit cards should be very carefully controlled and detailed records of the
transactions should be required of all users. Avoid using credit and debit cards to
withdraw cash. Wire transfers should require dual authorization and each wire
should be assigned a sequential number to help assure that all such payments have

' Be aware that credit card processing fees may be netted against the contribution amounts when deposited
into the committee’s accounts. If so, the gross amount of the contributions must be recorded with the
processing fees shown as an expense.


AGENDA DOCUMENT NO. 06-68

CEIVED
FCORRAL ELECTION
COMMISSION
SECRETARIAT
FEDERAL ELECTION COMMISSION
WASHINGTON, D.C. 20463 2b OCT Ib Pp \y 09

October 16, 2006

MEMORANDUM AGENDA ITEM
To: ‘The Commission For Meeting of: LO-/S-0G
Through: Patina M. Crk qt SUBMITTED LATE :

From: Joe Stoltz a
Assistant Staff Director

Audit Division
Subject: Proposed Internal Control Guidance for Political Committees

The Audit Division was asked to prepare a document to be distributed to the
regulated community dealing with internal controls. It has been the experience of the
Commission that the lack of such controls contributes to what appears to be a growing
number of cases where committee funds are misappropriated and, as a result, inaccurate
disclosure reports are filed. In addition to intentional acts, inaccurate reporting also
results from innocent error that potentially could be identified and corrected before
reports are filed by following some of the same internal control practices.

The attached is the result of our efforts. Much of the content is not new,
rather it represents common practice. Most of it was gathered from various published
sources available on the Internet. The document is meant to be educational, not

mandatory.

The Office of General Counsel has provided informal comments and those
have been incorporated.

Should you have any questions please contact me.


been recorded. Wire transfers should be recorded in the accounting records
immediately.

B. If a mistake is made when preparing a check, void the check before preparing a
new one. The voided check should then be altered to prevent its use, retained to
make sure all prenumbered checks are accounted for, and filed with other checks
for a permanent record. The stock of unused checks should be safeguarded and
regularly inventoried.

Cc. If possible, check signing should be the responsibility of individuals having no
access to the accounting records.

D. Draw checks according to procedures prescribing adequate supporting
documentation. It is in a committee’s best interest to ensure that disbursements
are supported by invoices that have been properly authorized. This
documentation should include (1) a proper original invoice; (2) evidence that the
goods or services were received; and (3) evidence that the purchase transaction
was properly authorized.

E. All supporting documents should be canceled or marked "paid" once a
disbursement is made to avoid double payments. In the past the Commission has
observed instances where failure to take these steps has resulted in many costly
duplicate payments. Payments should not be made on statements or balance-due
billings unless underlying invoices are included.

F. Mail all checks promptly and directly to the payee. The person mailing the check
should be independent of those requesting, writing, and signing it.

Petty Cash.

Use an imprest petty cash fund with one custodian. The imprest fund involves
replenishing petty cash only when properly approved vouchers and/or petty cash log
entries are presented justifying all expenditures. For accountability, only one person
should be in charge of the fund. No petty cash disbursement in excess of $100 is
permitted

Payroll

Many committees use a payroll service to perform much of the payroll function. In many
cases where there are more than a few employees. A service can be a very effective way
of handling payroll and maintaining a separation of duties within the payroll operation.
As an additional benefit, the service will often take care of the preparation and filing of
the necessary tax returns, and thereby help avoid errors and associated penalties.

The signing and distribution of the checks must be properly handled to prevent their theft.
The controls should include limiting the authorization for signing the checks to a
responsible employee who does not have access to timekeeping or the preparation of the
payroll, the distribution of the payroll by someone who is not involved in the other
payroll functions, and the immediate return of unclaimed checks for redeposit. If a
check-signing machine is used, the same controls are required; in addition, the check-
signing machine must be carefully monitored.


Internal Controls and Political Committees

Under the Federal Election Campaign Act (FECA) and the Commission’s regulations all
political committees are required to file accurate and complete disclosure reports. A
system of internal controls can contribute to the accuracy of a committee’s disclosure
reports. While neither FECA nor the regulations require any particular set of internal
controls, implementing effective internal controls plays an important role in meeting
those requirements, since misappropriation of funds or unintentional error generally lead
to the filing of inaccurate disclosure reports. Conversely, a lack of internal control and
oversight can create an environment that contributes to misappropriation of funds, a lack
of concern for the accuracy of committee accounting records, and misreporting to the
Commission. With respect to misappropriations, in recent years the Commission has
noticed an increasing number of instances where committee assets are misappropriated,
generally by committee staff. In most of these cases, the staff person who engaged in the
misappropriated was a trusted individual who was not properly supervised. There were
often no systems of internal controls in place that provided an independent check on the
activity of those who process the committee’s transactions. Absent some basic checks
and balances, some people will inevitably give in to temptation.

As result, effective internal controls provide the dual benefit of protecting committee
assets and facilitating the filing of accurate disclosure reports. To that end, the
Commission has prepared the following discussion to assist committees in protecting
their assets and complying with the requirements of the FECA.

We have noted that when the issue of internal controls is raised with political committees,
often their representatives respond that they are small operations staffed by volunteers
and can’t afford elaborate systems of controls. It is, however, in the interest of both the
committee and its staff to establish a system of internal controls that will prevent or
quickly detect any misappropriation. The responsibility of establishing the necessary
control procedures falls to a political committee’s treasurer. Internal controls need not be
elaborate or expensive to provide reasonable assurance that funds will not be
misappropriated. Most importantly, costs associated with recovery from
misappropriations, both monetary and non-monetary, are likely to be greater than the cost
of prevention.

This guide should not be the only resource that is consulted. In addition to accounting
professionals, there are numerous resources that can be found on the Internet. For
example the Small Business Administration offers an internal control check list that can
be used as a starting point (http://www.sba.gov/managing/financing/control.html). The
Government Accountability Office has published a guide for Government Agencies titled
Standards for Internal Control in the Federal Government that also explains the
components and principles of internal control
(http://www.gao.gow/special.pubs/ai00021p.pdf). There are also many other
organizations who have posted their control procedures on the Web ranging from State
and local government agencies, to educational institutions, to religious organizations. For
example, the Comptroller of the State of Connecticut


(http://www.osc.state.ct.us/manuals/AcctDirect/contents.htm) has an Accountability
Directive that, in Appendix B, SECTIONS APPLICABLE TO ALL AGENCY
PROGRAMS, includes not only internal control check lists, but flow charts. Much has
been written on internal controls by experts in the field, the material in this document
borrows from a number of those sources.

Naturally, no one set of controls will be right for all political committees. Small
organizations that have only a few people involved will have very different needs and
resources than a large corporate or union Separate Segregated Fund that has a significant
staff and access to the internal auditing resources of the connected organization. This
document is aimed at the smaller organizations.

What are Internal Controls?

Internal control is a process designed to ensure that an organization's goals are met with
respect to:

Effective and efficient operations

e Reliable financial reporting,

e¢ Compliance with laws and regulations, and

e Protection of the organization’s assets

The best internal control system can provide only reasonable, not absolute, assurance that
these goals are met. Any system may be defeated either by accident or intentionally
through collusion. However, a well designed system will reduce the risk that errors or
intentional acts will occur or go undetected.

The internal control process typically includes the following elements:

Control Environment

Risk Assessment

Control Activities

Information and Communication
Monitoring

Although this may sound complicated, in a small organization it is actually very simple.
The following describes each of the elements:

Control Environment. At the core of any organization are its people with their
individual attributes such as integrity and competence, and the environment in which they
operate. There are three key aspects to controlling the environment: 1) Limiting the
number of people that have access to any accounting function, assets or records system,
2) Maintaining a separation of functions so that no single individual has complete control
over financial transactions, and 3) Providing proper instruction and guidance to relevant
staff. Ideally, a committee should utilize the smallest number of individuals needed to
accomplish the work and still maintain a separation of duties. These individuals should