Separation of duties. Physical controls over assets Regular internal reviews. Staff concerned with record keeping and accounting systems should not perform duties associated with operations, asset custody, physical controls over assets, and internal review and auditing. Many people would answer this question by indicating that it is the auditor's responsibility to implement management controls. This is a common misconception.
Management is responsible for setting up and maintaining an adequate system of internal controls.
The Office of City's Auditor's purpose is to independently evaluate the adequacy of existing control systems by analyzing and testing controls and then making recommendations to management on how to improve controls. Everyone has responsibility regarding the condition of management controls in the City. Management is accountable to the City Council, which provides policies, guidance and oversight. The City Council should be asking departments questions about their controls. The City Auditor plays an important role in evaluating the effectiveness of control systems, and contributes to the ongoing effectiveness of management controls by making relevant recommendations.