Type: University Policy
Division: Finance & Budget
Office: FINANCE & ADMINISTRATION

Contact Phone Number: 503-838-8459
Contact Email Address: yahnkee@wou.edu

TITLE
Internal Controls
POLICY NUMBER
FA-01-006
RESPONSIBLE OFFICER UNIVERSITY CONTACT
Vice President for Finance and Administration Finance and Administration
SUMMARY

POLICY STATEMENT

The Oregon University System (System) shall establish and maintain an effective system of internal controls. Internal controls are designed to assure that the System, its universities, and the Chancellor’s Office meet their mission, promote the performance leading to effective accomplishments of objectives and goals, safeguard assets, provide accurate and reliable financial and other key data, promote operational efficiency and economy, and encourage adherence to applicable laws, regulations and prescribed management policies and practices. The control model for the System is the integrated Framework of Internal Control as promulgated by the congressionally established Committee of Sponsoring Organizations (COSO). 

APPLICABLE TO
The WOU Community
DEFINITIONS
AUTHORITY
FULL STATEMENT OF AUTHORITY

GUIDING PRINCIPLES

The System’s internal control and risk assessment practices shall help ensure that:

1) Chancellor’s Office and university activities and operations function effectively and efficiently;

2) Chancellor’s Office, university activities, and operations comply with laws, regulations, and System policies and standards;

3) Chancellor’s Office and university processes result in accurate and reliable financial information and reports;

4) Chancellor’s Office and university resources are adequately protected;

5) All material ricks facing the Chancellor’s Office and each university, including, but not limited to, strategic, operational, financial, compliance, and reputational, are routinely identified and assessed, and appropriately managed; 

6) Control activities and other mechanisms are proactively designed to address and manage significant risks;

7) Information critical to identifying risks, meeting the chancellor’s Office’s and each university‘s mission, and strategic objectives is communicated through established channels throughout the System; and

8) Controls are monitored and identified problems are addressed in a timely manner.

 

POLICY RATIONALE

This policy is intended to ensure that the Chancellor’s Office and each System university has a system of accountability for an oversight of its operations and to assist the Chancellor’s Office and universities in reaching their goals and meeting their objectives

 

KNOWLEDGE OF THIS POLICY

All System personnel

 

DEFINITIONS

Internal Control: 

A process, affected by the Board, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories:

  • Effectiveness and efficiency of operations
  • Reliability of financial reporting
  • Compliance with applicable laws and regulations 

The components of internal control are:

  • Control Environment
  • Risk Assessment
  • Control Activities
  • Information and Communication
  • Monitoring  

Control Environment:

The control environment sets the tone of an organization, influencing the control consciousness of its people. It is the foundation for all other components of internal control, providing discipline and structure. Control environment factors include the integrity, ethical values, and competence of the entity’s people; management’s philosophy and operating style; the way management assigns authority and responsibility, and organizes and develops its people; and the attention and direction provided by the board of directors

Risk Assessment:

Every entity faces a variety of risks from external and internal sources that must be assessed. A precondition to risk assessment is establishment of objectives, linked at different levels and internally consistent. Risk assessment is establishment of objectives, linked at different levels and internally consistent. Risk assessment is the identification and analysis of relevant risks to achievement of the objectives, forming a basis for determining how the risks should be managed. Because economic, industry, regulatory, and operating conditions will continue to change, mechanisms are needed to identify and deal with the special risks associated with change.

Control Activities:

Control activities are the policies and procedures that help ensure management directives are carried out. They help ensure the necessary actions are taken to address risks to achievement of the entity’s objectives. Control activities are as diverse as approvals, authorizations, verifications, reconciliations, reviews of operating performance, security of assets and segregation of duties. 

Information and Communication:

Pertinent information must be identified, captured, and communicated in a form and timeframe that enable people to carry out their responsibilities. Information systems produce reports, containing operational, financial, and compliance-related information, that make it possible to run and control the business. They deal not only with internally generated data, but also information about external events, activities, and conditions necessary to informed business decision-making and external reporting. Effective communication also must occur in a broader sense, flowing down, across, and up the organization. All personnel must receive a clear message from top management that control responsibilities must be taken seriously. They must understand their own role in the internal control system, as well as how individual activities relate to the work of others. They must have a means of communication with external parties, such as customers, suppliers, regulators, and shareholders. 

Monitoring:

Internal control systems need to be monitored – A process that assesses the quality of the system’s performance over time. This accomplished through ongoing monitoring activities, separate evaluations or a combination of the two. Ongoing monitoring occurs in the course of operations. It includes regular management and supervisory activities and other actions personnel take in performing their duties. The scope and frequency of separate evaluations will depend primarily on an assessment of risks and the effectiveness of ongoing monitoring procedures. Internal control deficiencies should be reported upstream, with serious matters reported to top management and the Board.

 

RESPONSIBILITIES

A. Chancellor

The Chancellor, through directed leadership, shared values, and a culture that emphasizes accountability, is responsible for reinsuring that an effective Systemwide internal control system is established and maintained for the Systemwide operations of the Chancellor’s Office. Similarly, the Chancellor’s Office is also responsible for ensuring that such a system is established and maintained in the Chancellor’s Office. Notwithstanding any delegation made by the Chancellor to administer this policy, the Chancellor shall be responsible to the Board for the faithful execution of this policy, consistent with the other policies of the Board and applicable law. 

B. University Presidents

Each university president, through directed leadership, shared values, and a culture that emphasizes accountability, is responsible for ensuring that an effective internal control system is established and maintained for his/her university. Notwithstanding any delegation made by the president to administer this policy, the president shall be responsible to the Board for the faithful execution of this policy, consistent with the other policies of the Board and applicable law. 

 

POLICY PROVISIONS

A. Internal Control System Elements

The internal control system at all System universities and the Chancellor’s Office shall be developed using the COSO model that includes the following elements:

  • Control Environment
  • Risk Assessment
  • Control Activities
  • Information and communication
  • Monitoring

B. Chancellor’s Office Participation in Recruitments for Certain University Administrators Responsible for Internal Controls and Financial Management

In order to enable the Chancellor’s Office to establish and maintain an effective internal control system over its Systemwide operations, as well as carry out its Systemwide management and oversight responsibilities, Chancellor’s Office finance and administration personnel will participate in the recruitment process for the following key university management positions:

  • Vice President for Finance and Administration
  • Associate/Assistant Vice President for Finance and Administration
  • Director of Budgets/Chief Budget Officer
  • Director of Business Affairs/Controller

These positions have a responsibility both to their university’s President and to the Chancellor and Board with respect to the establishment and maintenance of the internal control system and to the financial management of their university. The participation by the Chancellor’s Office in these recruitments will focus primarily on whether the candidates for these offices possess the appropriate education/credentials, experience, knowledge, and skills to be successful in the position.

REFERENCED OR RELATED POLICIES
RELEVANT DOCUMENTS AND LINKS
HISTORY
APPROVAL DATE:
EFFECTIVE DATE:
LAST UPDATED:

HISTORICAL DETAIL NOTES:

This policy was previously adopted by the Board at Meeting #855 (2012).



SOURCE:   
FOR POLICY WEBSITE INPUT (public audience keyword search)
Risk Assessment, internal control, integrated Framework