Spreadsheet: 1eb7250a-b7df-46df-b38a-1b6a89214e60
Sheet: Sheet1

State University of New York Campus Internal Control Program Control Self-Assessment | Unnamed: 1 | Unnamed: 2
 | Yes | No
General
1. Does the campus have a copy of the State University of New York Internal Control Program (ICP) dated March 1996?
a. Does the campus also have the additions to the ICP issued by the University Controller's Office (i.e., new checklists, etc.) in 2003?
b. Does the campus have directives regarding the ICP issued by DOB and the University?
2. Does the campus have additional internal control training materials issued by the University Controller's Office (i.e. videos, books, etc.).
3. Has the campus Internal Control Officer (ICO) and Internal Control Coordinator (ICC), where applicable, subscribed to the internal control listserve that was established in June 2003?
Establish and maintain guidelines for a system of internal controls
1. Has the campus developed its own ICP manual and guidelines to describe policies, procedures, and methodologies?
a. Does the manual incorporate the University's ICP as a framework while also including items/areas specific to the campus internal control environment?
[NAME] Is the manual updated on a timely basis to incorporate new University directives and/or campus-specific items/areas?
c. Are appropriate staff aware of the campus internal control manual and guidelines?
Make a clear and concise statement of management policies and standards available to all employees
1. Has a supportive statement ("tone-at-the-top" letter) from the campus president to the campus community been issued emphasizing the importance of internal controls and the reinforcement of the University's policies with respect to it?
2. Has the campus developed a brochure or website that explains the New York State Internal Control Act, defines their campus-specific ICP, and explains the responsibilities of employees?
a. Does each new employee receive a copy of the brochure (or access to the website) that emphasizes the importance of effective internal controls and the responsibility of each employee for effective internal controls?
[NAME] Is the brochure or website updated on a timely basis to incorporate new University directives and/or campus-specific items/areas?
c. Is the brochure periodically redistributed to employees, or are they periodically redirected to the website, for reinforcement of the ICP?
Designation of Internal Control Officer
1. Has the campus designated an ICO?
a. Does this individual have sufficient authority to act on behalf of the campus president to ensure the implementation and review of the ICP, and effect change where necessary?
b. Does this individual possess a broad knowledge of campus operations, personnel, and policy objectives, and effect change, where necessary?
c. If not, does the designated ICO have adequate reporting channels to be able to properly implement and review the campus ICP and effect change where necessary?
Implement education and training efforts to ensure employee awareness and understanding of internal control standards and evaluation techniques
1. Has the campus ICO and ICC, if applicable, been trained in the requirements of the University's ICP?
a. Do they participate in available internal control training opportunities offered by System Administration and other organizations (symposium, presentations, etc.)?
b. Do they have all of the ICP materials to enable them to employ the ICP on campus?
c. Are newly assigned personnel properly trained?
2. Are campus-wide internal control training sessions conducted to make the campus community aware of what internal controls are, their importance, and the campus community's role in the ICP (more in-depth than the info provided in the brochure or on the website)?
a. Are training materials provided by System Administration employed in the campus training program?
b. Does the campus maintain documentation as to who attended the training sessions and when, as well as the agenda for each of the sessions?
3. Have departmental/unit personnel assigned to be involved in conducting vulnerability assessments, internal control reviews, and internal control testing been properly trained in:
a. conducting them?
[NAME] the information?
c. documenting the information and retaining the documentation?
d. reporting requirements?
Personnel
1. Are the heads of major campus organizational units involved as an integral part of the campus ICP (typically the VPs, deans, directors, etc. of each major organizational unit as identified in the segmenting process)?
a. Do they participate on a campus internal control steering committee?
b. Do they ensure that line managers are motivated and trained to accomplish their assignments?
c. Are they involved in developing/reviewing event cycle objectives?
d. Are they involved in arranging and/or conducting vulnerability assessments and internal control reviews within their units?
e. Are they involved in reviewing/analyzing the results of the vulnerability assessments and internal control reviews conducted within their units?
f. Do they ensure that significant weaknesses in controls are corrected?
g. Do they ensure that all additions and changes to policies, procedures, rules, systems, etc., include proper controls?
2. Has the campus designated an ICC or staff person to assist the ICO with the administration of the program, such as maintaining documentation, development of forms and questionnaires, facilitation of vulnerability assessments, internal control reviews, testing, and follow-up?
3. Are the line managers of the various campus organizational units involved as an integral part of the campus ICP (personnel who are uniquely familiar with the individual operation and responsible for the management process)?
a. Are the line managers encouraged to take an active role in reviewing and improving internal controls within their unit?
b. Do they ensure that an atmosphere supportive of internal controls exists?
c. Are they involved in conducting vulnerability assessments and internal control reviews within their units?
d. Are they involved in initiating internal control improvements within their units when a need is identified?
e. Do they maintain documentation of controls, vulnerability assessments, internal controls reviews, and improvements?
f.  Do they ensure that significant weaknesses in controls are corrected?
g. Do they ensure that all additions and changes to policies, procedures, rules, systems, etc. include proper controls?
Establish and maintain a system for continuous review of internal control operations
1. Has the campus been segmented to develop an inventory of assessable units?
a. Does the segmentation assure complete coverage of all administrative, finance and business, academic, and program areas?  The 11 areas of significant risk identified by the University/DOB (i.e., revenue, procurement, disaster planning and recovery, etc.) should be included in this segmentation process.
2. Has the campus developed a schedule for conducting vulnerability assessments for each area included in the inventory of assessable units?
a. Do the vulnerability assessments assure complete coverage of all administrative, finance and business, academic, and program areas?
[NAME] Has the campus developed a schedule for completing their vulnerability assessments (i.e., every 3 to 5 years, or maintained on a perpetual inventory system)?
3. Has the campus conducted the vulnerability assessments identified on the schedule?
In conducting the vulnerability assessments, was:
a. the general control environment analyzed?
b. inherent risk identified and analyzed?
c. a preliminary evaluation of existing safeguards or controls conducted?
d. an overall vulnerability ranking established (e.g., high, moderate and low risk)?
e. recommendations, where necessary (e.g., areas of high and moderate risk could result in a recommended action of having an internal control review or audit of the area, low risks may include no recommendation or a simple institution of a procedure)?
f. a plan for completing the approved recommended actions developed (line managers and supervisors are the best qualified to establish these plans)?
4. For areas identified in the vulnerability assessments as high to moderate risk, were internal control reviews or audits conducted that included:
a. identifying event cycles?
b. further analysis of the general control environment?
c. documentation of the event cycles?
d. evaluation of the internal controls within the event cycles?
e. testing of the internal controls?
5. Was corrective action taken concerning the weaknesses in the control systems identified during the internal control reviews or audits?
[NAME] reports include weaknesses identified?
b. Did reports include recommendations on how to correct the identified weaknesses?
c. Was the outcome followed-up on and documented (i.e., were new controls implemented?, were the existing controls improved?, was the risk accepted?)?
d. Is there a formal system in place to log and track weaknesses identified, suggested actions, and actions taken (similar to the audit resolution process)?
6. Has the campus conducted scheduled or subsequent testing of controls in:
a. the 11 areas of significant risk predefined by the University/DOB as areas requiring testing (3-year cycle)?
b. other areas of significant risk, self-identified by the campus, by conducting vulnerability assessments and internal control reviews (i.e., testing of implemented changes)?
7. Take additional corrective action (see #5 above)
8. Has the campus developed an internal reporting process that includes:
a. scheduling and completion of:
vulnerability assessments?
internal control reviews or audits?
internal control testing?
[NAME] information regarding the results of:
vulnerability assessments?
internal control reviews or audits?
internal control testing?
corrective actions taken?
[NAME] of corrective actions in areas where controls are either necessary but nonexistent, sufficiently weak to warrant improvement, or excessive as to hinder operations or not be cost-effective?
d. information regarding the status of training throughout the campus community?
e. dissemination of information/reports?
Retention of Documentation
1. Has the campus established a documentation retention process?
a. Is documentation maintained for activities conducted in connection with:
vulnerability assessments?
internal control reviews or audits?
internal control testing?
corrective actions taken?
training and education?
general correspondence and directives?
b. Does the documentation include information pertaining to:
personnel involved?
key factors considered?
evaluation methods used?
conclusions reached?
Periodically evaluate the need for an internal audit function
1.  Are campus operations periodically reviewed to determine if a formal internal audit function is needed?
Reporting to System Administration
1. Are the required internal control reports submitted to System Administration:
a. on a timely basis?
b. as a complete package?
c. with sufficient detail to provide the reader meaningful information (explanations of vulnerability assessments, internal control reviews, testing of controls, audit resolution, etc.)?
2. Are recommendations identified in audits followed-up on and cleared (implemented) by the campus in a timely fashion?
Certification of Compliance with the Internal Control Act
1.  Based upon affirmative answers to the majority of the questions above, is the campus able to certify as to compliance with the Internal Control Act and the University's ICP?
a. Has the campus established an action plan for the remediation of any deficiencies revealed above?
[NAME] Has the action plan for the remediation of deficiencies revealed above been submitted to System Administration?
2. If the campus cannot certify as to compliance with the provision for internal controls, has a corrective action plan been developed that outlines the steps needed to be taken, along with a timetable for implementation?
a. Has the corrective plan action outlining the steps needed to be taken, and a timetable for implementation, been submitted to System Administration?