Internal Control Framework
The University of California has adopted the internal control framework promulgated by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). COSO is sponsored by, among other organizations, the American Institute of Certified Public Accountants and the Institute of Internal Auditors.
COSO broadly defines internal control as a process, effected by an entity's board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories:
- Effectiveness and efficiency of operations
- Reliability of financial reporting
- Compliance with applicable laws and regulations
Five Interrelated Components
The COSO internal control framework identified five interrelated components:
Control Environment
The control environment sets the tone of an organization, influencing the control consciousness of its people. It is the foundation for all other components of internal control, providing discipline and structure.
Control environment factors include the integrity, ethical values and competence of the entity's people; management's philosophy and operating style; the way management assigns authority and responsibility, and organizes and develops its people; and the attention and direction provided by the board of directors.
Risk Assessment
Risk assessment is the identification and analysis of relevant risks to achievement of the objectives, forming a basis for determining how the risks should be managed. Because economic, industry, regulatory and operating conditions will continue to change, mechanisms are needed to identify and deal with the special risks associated with change.
Control Activities
Control activities are the policies and procedures that help ensure management directives are carried out. They help ensure that necessary actions are taken to address risks to achievement of the entity's objectives.
Control activities occur throughout the organization, at all levels and in all functions. They include a range of activities as diverse as approvals, authorizations, verifications, reconciliations, reviews of operating performance, security of assets and segregation of duties.
Information and Communication
Pertinent information must be identified, captured and communicated in a form and timeframe that enable people to carry out their responsibilities. Information systems produce reports, containing operational, financial and compliance-related information, that make it possible to run and control the business. They deal not only with internally generated data, but also information about external events, activities and conditions necessary to informed business decision-making and external reporting.
Effective communication also must occur in a broader sense, flowing down, across and up the organization. All personnel must receive a clear message from top management that control responsibilities must be taken seriously. They must understand their own role in the internal control system, as well as how individual activities relate to the work of others. They must have a means of communicating significant information upstream.
There also needs to be effective communication with external parties, such as customers, suppliers, regulators and shareholders.
Monitoring
Internal control systems need to be monitored – a process that assesses the quality of the system's performance over time. This is accomplished through ongoing monitoring activities, separate evaluations, or a combination of the two.
Ongoing monitoring occurs in the course of operations. It includes regular management and supervisory activities, and other actions personnel take in performing their duties. The scope and frequency of separate evaluations will depend primarily on an assessment of risks and the effectiveness of ongoing monitoring procedures.
Division Key Controls
Financial reporting and system access reviews are important control activities required for external and internal audits. They provide assurance that operating results are complete, accurate, and valid, and that there are no material misstatements to the financial statements. Key controls are to be performed at the division level on a quarterly basis.
A CalPlanning Reporting report (GL Summary Monthly Comparative Actuals) and a Cal Answers General Ledger Compensation by Accounting Period Report should be used in performing the financial reporting review.
System access review (Identity Management) is to be performed within BFS.
Division Finance Leaders (DFLs) are required to:
- For the financial reporting review, upload the reports with explanations and comments to a Box share site by the end of the month following the previous quarter end
- We will keep you posted on the due dates via the DFL weekly update email
- For the system access review, approve system access reports in BFS by the end of the month following the previous quarter end
- The due date will be included in the DFL weekly update message when the reports are available
We will notify you when it’s time to perform this quarter’s controls via our regular weekly DFL Update email. It is required that all DFLs complete their review by the due date. There will be an escalation process which includes three email reminders and will ultimately result in the loss of BFS access for all employees within your division. To avoid unnecessary interruptions to your business process, please make sure to complete your reviews by the due date.
Support Materials
Relationship to Other Compliance and Financial Reviews
Separate from Monthly Compliance Review
Financial reporting and system access reviews are separate functions from the monthly compliance review of individual contract and grant awards by research administrators and principal investigators in PI Portfolio and cannot substitute for the compliance review.