FAQs

If an outside agency such as the National Institute of Health (NIH), Environmental Protection Agency (EPA), Legislative Post Audit (LPA), etc. contacts you directly, first inform your supervisor, then email Internal Audit with the appropriate information.

In addition, please see this document on how to handle an external review (PDF).

See our Fraud Reporting Process or report suspected fraud to the Fraud Hotline.

Internal Control is a process within an organization designed to provide reasonable assurance regarding the achievement of the following primary objectives:

• The reliability and integrity of information
• Compliance with policies, plans, procedures, laws, and regulations
• The safeguarding of assets
• The economical and efficient use of resources
• The accomplishment of established objectives and goals for operations or programs (300.05)

Internal controls are the methods employed to help ensure the achievement of University and management objectives.  They are the tools used by managers every day.

Deans, Directors, and Chairs (Managers) at the University of Kansas are responsible for ensuring that internal controls are established and functioning to achieve the mission and objectives of their units.

Deans, Directors and Chairs (Managers) have been delegated authority for financial and human resources and are accountable to the public for the proper use of these resources, as well as compliance with all relevant Federal, State and University regulations, rules, policies and procedures.

Management at all levels of the University are responsible for knowing the exposure to fraud in the area under their responsibility and the prevention of fraud, misappropriations, similar irregular acts and other inappropriate conduct.

All managers, from the unit level to the Chancellor of the University, use internal controls to help assure that their units operate according to plan. The methods they use--policies, procedures, organizational design, and physical barriers--constitute the internal control structure of the University of Kansas.

To evaluate internal controls, first think about the following general objectives then identify your unit's specific objectives within these broad categories:

• Propriety of Transactions for all activities within accounts for which the manager is responsible
• Reliability and Integrity of Information for internal management decisions and external agency reports
• Compliance with University of Kansas Policies and Government Regulations, including but not limited to: Human Resources, Financial, Purchasing, granting agencies, and state and federal government
• Safeguarding Assets, including physical objects and University data
• Economy and Efficiency of Operations to optimize the use of limited resources in accomplishing the mission of the unit and the University of Kansas

How to Evaluate Your Controls

Appropriate Control Environment - Management Attitude - Set the appropriate “Tone at the top!”

• Monitoring – Adequate daily, weekly, monthly “Dashboard.”
• Ongoing security and control over assets, systems, and data.
• Proper control over cash, charge accounts, and expenditures.
• Good documentation including policies, procedures, and job descriptions.
• Effective staff recruitment, training and cross training.
• Periodic financial reconciliations on all departmental accounts.
• Adequate segregation of duties.

How to Evaluate Your Controls

The cost of implementing a specific control should not exceed the expected benefit of the control.

• Sometimes there is no out-of-pocket cost to establish an adequate control.  A realignment of duty assignments may be all that is necessary to accomplish the objective.
• A well-designed internal control structure can enhance operations by improving your unit's overall efficiency and effectiveness, as well as, reducing the risk of loss or theft.

In analyzing the pertinent costs and benefits, managers should also consider the possible ramifications for the University of Kansas at large and attempt to identify and weigh the intangible as well as the tangible consequences.

• It may be difficult to determine the cost of poor public relations and lost goodwill if an ex-employee steals cash because the manager did not change the safe combination or retrieve University keys upon the employee's termination.

Based on past reviews performed at the University of Kansas, the most common key areas of concern or risks are:

• Inadequate Monitoring of Key Fiscal Processes - Internal controls should be in place for fiscal processes. A "power tool" to document key control practices is provided in the "Internal Control Guide" under Areas of General Risk.
• Inadequate Safeguarding of University Assets - Key University assets include confidential information and physical assets. Several best practices can be found in the "Internal Control Guide."
• Lack of Reconciliation of Account Balances - Most unit decision making is dependent on shadow system reporting. University decision making is incumbent on shadow system reconciliation to central system data. More information on reconciliations can be found in the "Internal Control Guide" under Areas of General Risk.