MRSC has joined with Toni Nelson, Small Cities Specialist, State Auditor's Office, Gayla Gjertsen, Finance Director, City of Tumwater, and Mike Bailey, Administrator of Finance and Information Services, City of Renton, to bring you the "Finance Advisor" column. The "Finance Advisor" will feature a new article each month with timely local government finance information and advice you can use.*

Internal Controls

August 2006

Gayla Gjertsen, Finance Director, City of Tumwater

It's time for us to discuss something you may have heard about from time to time - “Internal Controls.” You may have seen statements like these in audit reports: "Internal controls were adequate to safeguard public assets;" or "the entity should improve internal controls over cash transactions;" or "the entity does not have adequate internal controls for us to assure the safeguarding of public assets." What types of internal controls do you have and what does that mean for your operations?

The Challenge for Small Entities

Large and medium sized entities have more options for providing internal controls, due to the simple fact that they have more staff; whereas, smaller entities don’t have that luxury. We all get busy, thereby cutting corners, because we are being asked to do more and more. We get accustomed to doing things a certain way and often find it difficult to change. Nevertheless, it's still possible for smaller entities to institute effective internal control mechanisms. Internal controls means different things to different people, but they are basically designed to promote efficiency, reduce risk of asset loss, and help ensure the reliability of financial statements and compliance with laws and regulations.

Basic Internal Controls Mechanisms

A division of duties in the handling of cash and other processes is one of the most effective ways to ensure proper internal controls. No single individual should have complete control in the handling of cash. Specifically, there should be a separation of duties for handling money, recording transactions, and reconciling bank accounts. For example, a good procedure is to have two people opening all of the mailed payments received by your entity. You’re asking "how do I do that with such a small work force?" Sometimes we have to be innovative. For example, you may have a court clerk that could help with opening not only your mailed payments, but the court’s. Do them together every morning, recording the city’s regular payments and those received by the court. Another option would be to pull someone from another department for a few minutes every day who could assist with this process. Remember, internal controls procedures/policies protect not only the entity, but you and your employees as well.

Risk Assessment

Every entity faces a variety of risks from external and internal sources that must be assessed. Risk assessment is the identification and analysis of relevant risks to the achievement of your objectives, which then form the basis for determining how those risks should be managed.

Other than the basic example we talked about, where and how do you assess risk? One way is to look at changes in personnel or processes that have occurred recently and/or those that have not changed in a very long time. Look at changes in personnel (e.g., in a sensitive position; or someone that has been in a position for a very long time); changes in technology systems; changes brought on by rapid growth (that may lead to cutting corners); or changes in the complexity of processes. If you review these basic processes, taking special note of the types of changes listed here, and just ask questions about them, your risk assessment will be done quickly.

Ongoing Monitoring

Internal controls systems need to be monitored--a process that assesses the quality of the system's performance over time. This is accomplished through ongoing monitoring activities, separate evaluations, or a combination of the two. Ongoing monitoring occurs in the course of operations. It includes regular management and supervisory activities, and other actions personnel take in performing their duties.

Legislative Body's Role

Management is accountable to the legislative body (councils) which provides governance, guidance and oversight. Effective councilmembers are objective, capable and inquisitive. They have knowledge of the entity's activities and environment, and commit the time necessary to fulfill your legislative responsibilities. Management establishes controls and provides communications to subordinates, which sets in place a culture based on honest management and commitment. A strong, active council, particularly when coupled with effective upward communications channels and capable financial and legal staff, will be able to identify, establish and maintain the most effective internal controls.

Gayla L. Gjertsen has been the Finance Director for the City of Tumwater for over 15 years and was previously the Director of Administration for the City of Milton for13 years. She has also served as president of the Washington Finance Officer’s Association. Gayla has been a presenter at the annual Budget and Fiscal Management Workshops held each summer for many years, and periodically conducts other workshops and writes about local government finance issues.

*The Articles appearing in the "Finance Advisor" column represent the opinions of the authors and do not necessarily reflect those of the Municipal Research & Services Center.