Internal Control Self-Assessment Checklist: (COSO)
Internal Control Self-Assessment Checklist: (COSO)
Internal Control Self-Assessment Checklist: (COSO)
Self-Assessment Checklist
Management throughout the University is responsible to establish internal controls to keep their
operations on course toward financial goals, ensure proper use of resources, to help achieve
defined missions, to minimize surprises and risks, and to allow the organization to successfully
deal with change. Internal controls are defined as activities undertaken to increase the likelihood
of achieving management objectives in three areas:
• Efficiency and effectiveness of operations
• Reliability of financial/timekeeping records
• Compliance with laws and regulations
Some internal controls are established at the institutional level; others are established at the
department level. To achieve success, management needs to (1) be knowledgeable about, and
support, institutional controls, and (2) implement practical and effective internal controls specific
to the department utilizing a cost benefit approach. (unless required by local, state or federal
regulations).
The following checklist is provided as a tool to facilitate a self-assessment of internal controls by
management of individual departments. It is intended to address general aspects of internal
controls. Use of this checklist is voluntary and is not required.
Organization of the checklist is consistent with the five interrelated components of internal
control defined by the Committee of Sponsoring Organizations of the Treadway Commission
(COSO).
PCARD GUIDELINES
1
Assessment Factor Indication of Stronger Controls Indication of Weaker Controls Assessment
Strong - Weak
1 2 3 4 5
Department management is aware of
competency levels, and is involved in training
and increased supervision when competency is
Management is not adequately aware of
low.
2.3 Employee competence. competency levels, or does not actively address
problems.
2
Assessment Factor Indication of Stronger Controls Indication of Weaker Controls Assessment
Strong - Weak
1 2 3 4 5
Decision-making processes are deliberate and
consistent. Decisions are made after careful Decision making is nearly always informal.
3.7 Approach to decision making. consideration of relevant facts. Policies and Management makes arbitrary decisions with
procedures are in place to ensure appropriate inadequate discussion and analysis of the facts.
levels of management are involved.
4 – Organizational Structure
Complexity of the structure is commensurate Lines of responsibility are unclear or
4.1 Complexity of the organizational
with the organization. Lines of reporting are unnecessarily complicated for the size and
structure.
clear and documentation is up-to-date. activities of the entity.
Documentation does not exist or is out-of-date.
4.2 Organization charts. Documentation exists and is up to date. The documented structure does not correspond
with actual responsibilities.
Size is commensurate with the complexity of Size is not appropriate (e.g., too many levels,
4.3 Size of the management group.
the department and its growth. too dispersed, or too "thin").
4.4 Stability of the management group. Low turnover. High turnover.
5 – Assignment of Authority and Responsibility
5.1 Delegation of authority and assignment Delegation of authority and assignment of Decisions are dominated by one or a few
of responsibility for operating and responsibility is clearly defined. Individuals are individuals. Roles and responsibilities of
financial functions. held accountable for results. middle management are unclear.
Authority limits are clearly defined in writing Policies and procedures covering authority
5.2 Authority limits.
and communicated as appropriate. limits are informal or poorly communicated.
Appropriate limits have been placed on each Signature authority is delegated without
delegation of signature authority. Management adequate consideration. Delegated authority is
5.3 Delegated signature authority.
reviews and updates signature records as not in line with employee knowledge, training,
turnover occurs. or competence.
Key personnel are knowledgeable and Key personnel are inexperienced. Management
5.4 Knowledge and experience. experienced. Management does not delegate delegates authority without regard to
authority to inexperienced individuals. knowledge and experience.
3
Assessment Factor Indication of Stronger Controls Indication of Weaker Controls Assessment
Strong - Weak
1 2 3 4 5
Management provides the resources needed for Management does not provide necessary
5.5 Resources.
employees to carry out their duties. resources.
6 – Human Resource Policies and Practices
A careful hiring process is in place. The
The hiring process is informal, and sometimes
Human Resources Department is involved in
6.1 Selection of personnel. proceeds without adequate involvement by
identifying potential employees based on job
higher-level supervisors.
requirements.
On-the-job and other training programs have
Training programs are inconsistent, ineffective,
6.2 Training. defined objectives. They are effective and
or are given low priority.
important.
Regular supervision does not exist or is
Personnel are adequately supervised. They
6.3 Supervision policies. ineffective. Employees are frustrated and feel
have a regular resource for resolving problems.
they ‘have nowhere to go’ with issues.
Inappropriate behavior is consistently
Reprimands are not timely, direct, or are not
6.4 Inappropriate behavior. reprimanded in a timely and direct manner,
consistently applied (climate of favoritism).
regardless of the individual's position or status.
The evaluation process is ad hoc and
6.5 Evaluation of personnel. An organized evaluation process exists. inconsistent. Performance issues are not
formally addressed.
Compensation decisions are based on a formal
process with meaningful involvement of more Compensation decisions are ad hoc,
6.6 Methods to compensate personnel. than one level of management. The effect of inconsistent, or inadequately reviewed by
performance evaluations on compensation management.
decisions is defined and communicated.
There is inadequate staffing and frequent
Critical functions are adequately staffed, with
6.7 Staffing of critical functions. periods of overwork and "organizational
reasonable workloads.
stress."
6.8 Turnover. Particularly turnover in Low turnover. Management understands root High turnover. Management does not
financially responsible positions. causes of turnover. understand root causes.
4
Assessment Factor Indication of Stronger Controls Indication of Weaker Controls Assessment
Strong - Weak
1 2 3 4 5
6
Assessment Factor Indication of Stronger Controls Indication of Weaker Controls Assessment
Strong - Weak
1 2 3 4 5
Management is willing to commit resources to Management offers no resources to facilitate
9.2 Support of change.
achieve positive change. change.
Mechanisms exist to identify, prioritize, and
react to routine events (i.e., turnover) that
9.3 Routine change. Procedures are not present or are ineffective.
affect achievement of unit-wide objectives or
action steps.
Mechanisms exist to identify and react to
9.4 Economic change. Procedures are not present or are ineffective.
economic changes.
Mechanisms exist to identify and react to
regulatory changes (maintain membership in
9.5 Regulatory change. Procedures are not present or are ineffective.
associations that monitor laws and regulations,
participate in University forums, etc.).
Mechanisms exist to identify and react to
9.6 Technological change. technological changes and changes in the Procedures are not present or are ineffective.
functional requirements of the unit.
11 – Control Procedures
11.1 Senior management (University or Senior management monitors the department's Senior management does not monitor
College) reviews. performance against objectives and budget. department performance.
7
Assessment Factor Indication of Stronger Controls Indication of Weaker Controls Assessment
Strong - Weak
1 2 3 4 5
Reviews are made of actual performance
11.2 Objective performance reviews by
compared to objectives and previous periods Analyses are not performed or management
department management of major
for all major initiatives. Management analyzes does not follow up on significant deviations.
initiatives.
and follows up as needed.
Reviews are made of actual performance
versus budgets, forecasts, and performance in
11.3 Financial performance reviews by Analyses are not performed or management
prior periods for all major initiatives.
department management. does not follow up on significant deviations.
Management analyzes and follows up as
needed.
11.4 Direct functional or activity Performance reviews are made of specific
management by department functions or activities, focusing on compliance, No performance reviews occur.
management. financial or operational issues.
Unexpected operating results or unusual trends
11.5 Performance indicators. Operating results and trends are not monitored.
are investigated.
Financial transactions, timekeeping and
reconciliations are completed timely. The activities are not performed timely or
11.6 Financial transactions, timekeeping
Management performs a diligent review and regularly. Management does not carefully
records and reconciliations.
approval by signature and date or review or formally approve.
electronically.
Sponsored project accounts are reviewed and
reconciled. PIs certify the expenditures timely. Sponsored project accounts are not monitored;
11.7 Sponsored project account management. Department management monitors the reconciliations and certifications are not
portfolio of sponsored accounts for compliance timely.
and fiscal responsibility.
Restrictions on use are well documented, and
Restrictions are not clearly documented.
are understood by employees who administer
11.8 Use of restricted funds (gifts). Restricted fund accounts are not monitored;
the funds. Usage is monitored by management,
usage may not match restrictions.
accounts are reconciled.
8
Assessment Factor Indication of Stronger Controls Indication of Weaker Controls Assessment
Strong - Weak
1 2 3 4 5
Controls exist to monitor the accuracy and
No information processing controls are in
11.9 Information processing. completeness of information as well as
place.
authorization of transactions.
Equipment, supplies, inventory, cash and other
Equipment, supplies, inventory, cash and other
assets are physically secured and periodically
11.10 Physical controls. assets are not protected. Control records do not
counted and compared to the amounts shown
exist or are not up to date.
on control records. (if applicable)
11.11 Training and guidance for asset Adequate guidance and training are provided to
No training or guidance is provided.
custodians. personnel responsible for cash or similar assets.
Financial duties are divided among different
people (responsibilities for authorizing No significant separation of financial duties
11.12 Separation of duties.
transactions, recording them and handling the among different employees.
asset are separated).
Unit employees understand which records they
Unit employees do not understand which
are responsible to maintain and the required
11.13 Record retention. records they are responsible for maintaining.
retention period. Records are appropriately
The filing system is inadequate.
filed.
A disaster response and recovery plan has been
developed and is understood by key personnel.
11.14 Disaster response plan. No disaster response or recovery plan exists.
9
Assessment Factor Indication of Stronger Controls Indication of Weaker Controls Assessment
Strong - Weak
1 2 3 4 5
The department controls its computer
applications by diligent and timely response to
edit lists, rejected transactions and other
12.2 Application controls. control and balancing reports. Controls ensure Application controls are not used.
a high level of data integrity including
completeness, accuracy, and validity of all
information in the system.
Key data and programs on LANs or desktop
No formal back up procedures exist.
computers are appropriately backed up and
12.3 Back Up. Management has not informed staff of back up
maintained. Off-site storage is adequate
requirements.
considering possible risks of loss.
10
Assessment Factor Indication of Stronger Controls Indication of Weaker Controls Assessment
Strong - Weak
1 2 3 4 5
11
Assessment Factor Indication of Stronger Controls Indication of Weaker Controls Assessment
Strong - Weak
1 2 3 4 5
Formal methods are used to communicate unit
policies and procedures (e.g., manuals, training To the extent that they exist, policies are buried
14.4 Formal communications.
programs, written codes of conduct, and in unused manuals and documents.
acceptable business practices).
Standards and expectations are communicated
to key outside groups or individuals (e.g., No external communication of standards and
14.5 External communications.
vendors, consultants, donors, sponsors, expectations.
subcontractors, sub-recipients).
Employees are kept informed of important
matters (downward communication) and are
able to communicate problems to persons with Most information is received by the
14.6 Informal communications.
authority (upward communication). There is "grapevine."
effective functional coordination within the
department (lateral communication).
Information is openly shared with outside Information is kept secret from outside
14.7 Communication with evaluators.
evaluators. evaluators.
Section 5 – Monitoring
15 – Management Supervision
Management routinely spot-checks
15.1 Effectiveness of key control activities. transactions, records and reconciliations to Management never performs spot-checks.
ensure expectations are met.
Knowledge of University financial and
15.2 Management supervision of financial
timekeeping policies are known by those with Policies are ad hoc or poorly communicated.
and timekeeping activities.
those responsibilities in the department.
Policies are defined for developing new
systems or changes to existing systems
15.3 Management supervision of new Policies and procedures are ad hoc, poorly
(cost/benefit analysis, team composition, user
systems development. communicated, or ineffective.
specifications, documentation, acceptance
testing, and user approval).
12
Assessment Factor Indication of Stronger Controls Indication of Weaker Controls Assessment
Strong - Weak
1 2 3 4 5
Budgets are compared to actual results and
deviations are followed up on a timely basis.
An analysis of actual versus budgeted results is
Adequate consideration is given to
15.4 Budget analysis. not performed, or management does not follow
commitments.
up on deviations.
16 – Outside Sources
Data is used to compare the unit’s performance
16.1 Industry and professional associations. Comparative data is not regularly monitored.
with peers or industry standards.
Reports from regulatory bodies are considered Response is limited to what is necessary to "get
16.2 Regulatory authorities.
for their internal control implications. by" the regulators.
Root causes of inquiries or complaints are
16.3 Sponsors, students, suppliers, creditors, Inquiries or complaints are dealt with case-by-
investigated and considered for internal control
and other third parties. case, with little or no follow-up.
implications.
Information provided by external auditors
Findings are referred to lower levels or are
16.4 External auditors. about control-related matters are considered
explained away.
and acted on.
17 – Response Mechanisms
17.1 Management follow-up of violations of
Timely corrective action is taken. Follow-up is sporadic.
policies.
Consideration of issues from audit reports are
Audit report issues are considered and
17.2 External or internal audit reports. delegated to lower levels or is given low
immediately acted upon at appropriate levels.
priority.
17.3 Changes in conditions (e.g., economic, Changes are anticipated and routinely
regulatory, technological, or integrated into ongoing long- and short-range Responses are reactive rather than proactive.
competitive). planning.
18 – Self-Assessment Mechanisms
13
Assessment Factor Indication of Stronger Controls Indication of Weaker Controls Assessment
Strong - Weak
1 2 3 4 5
Management periodically assesses employee
attitudes, reviews the effectiveness of the
18.1 Monitoring of control environment. Assessment processes do not exist.
organization structure, and evaluates the
appropriateness of policies and procedures.
Management periodically evaluates the
18.2 Evaluation of risk assessment process. Assessment processes do not exist.
effectiveness of its risk assessment process.
18.3 Assessment of design and effectiveness Internal controls are subject to a formal and
Assessment processes do not exist.
of internal controls. continuous internal assessment process.
Management periodically evaluates the
accuracy, timeliness and relevance of its
18.4 Evaluation of information and information and communication systems.
Assessment process does not exist.
communication systems. Management questions information on
management reports that appears unusual or
inconsistent.
Completed By:
____________________________________________________________________________
Name(s)
____________________________________________________________________________
Title(s)
14