TOPIC: Internal Control Plans
OFFICE: Administrative Services
QUESTION / ISSUE:
STATE: NE
DATE: 08/10/2009
Is there any information available as to how many states have implemented requirements for agencies to
document an internal control plan? If not, would it be possible to send an email to the members of the
Consortium on Internal Controls to see how many states actually have guidelines in effect and if those states
have statute or regulations to back up the requirement for an internal control plan?
Colorado
Idaho
Colorado has a statutory requirement for state agencies to certify their internal controls
(Colorado Revise Statutes 24-17-101), but that certification addresses only certain parts of an
internal control plan rather than a complete or comprehensive plan.
Idaho is taking a gradual approach to documenting our internal controls. The Idaho State
Controller's Office, Division of Reporting and Review, started working with our auditors last
year to review the internal controls in place for preparation of the CAFR.
For many years, Idaho has asked agencies to complete an attestation letter that says they
have completed an internal control checklist that is published on our website. That attestation
letter is submitted to our office and used to provide the controller enough comfort to sign the
management representation letter. Legislative service auditors review the agencies'
attestation letters as part of their agency visits to verify the information. As part of the
agencies' attestation letter, they say they have reviewed an evaluation toolkit, and checklist.
You can see those on our website at www.sco.idaho.gov then click on Accounting then Internal
Controls. I believe our intention is to eventually replace that checklist with results from the
Multi-State Consortium on Internal Controls.
At first our auditor and I went over instruction binders for preparing the statements and notes.
Those were already fairly well documented. Then she and I verbally went over many of the
checklist items that I originally shared in the Reporting and Financial Statements section for
the Multi-State Consortium document and I documented those answers. Most were already
documented by instructions we give to the agencies through the closing packages (questions
we ask agencies to provide for accruals). The closing packages are also on our website under
Accounting, Applications, GAAP Closing Packages, Read-Only version. That series of
interviews helped us see what was not documented or needed to be improved.
The Controller's Office also provides a centralized accounting system for most of the state and
a statewide payroll accounting system. The auditors visited with those areas to review their
processes and documentation.
This year, the auditors will review our reconciliation process between our cash-based system
used throughout the year and the accrual-based system used to prepare the financial
statements. We have good documentation of that process, but are expanding it to make sure
we can answer those questions.
Maine
Since GASB 34, we have documented our decisions about various reporting issues and try to
keep those updated as guidance or situations change. This year we worked on unclaimed
property (investments and liability), pollution remediation, restricted assets, land held as
investments by endowments, derivatives, and intangibles to name a few topics. The papers
often include information about how we will capture information or avoid double counting. Our
auditors review and sign off on those papers.
The State of Maine has a Statute (Title 5, Chapter 143, Subsection 1541 -10-A) in place
requiring agencies to document internal control systems. This law is followed up with a
requirement from the State Controller’s Office to provide an internal control plan to the
controller’s office and certify that the plan has been updated annually.
Massachusetts
Massachusetts has both a statute and guidelines. Both of these are posted at:
http://www.nasact.org/nasc/committees/multistate/index.cfm, along with some other states’
info. Probably a good idea to update the list.
We also have a questionnaire that we use for each state agency to certify their IC compliance.
Attached are the FY2009 questions (with ARRA compliance added). We review and change
questions each year for clarity and applicability.
Sample ICQ_all
sections.pdf
Mississippi
The Mississippi Department of Finance and Administration (DFA) require state agencies to
complete internal control assessments and submit a certification letter each year to DFA. As
part of this requirement, state agencies are asked to assess their internal controls and
develop/update their internal control plan.
The MS Agency Accounting Policies and Procedures Manual (MAAPP) contains a section on
Internal Control (Section 30). The index of the MAAPP Manual can be located at the following
address: http://www.dfa.state.ms.us/Offices/OFM/MAAPP.htm
We have state statute that backs up the MAAPP Manual Internal Control section. Section 7-73(6) (d), Miss. Code can be located at
http://michie.com/mississippi/lpExt.dll?f=templates&eMail=Y&fn=mainh.htm&cp=mscode/a7d/d3b/d3d/d48.
North Carolina
In 2007, the North Carolina General Assembly passed the “Statewide Governmental
Accountability and Internal Control Act”. As directed by the legislation, the Office of the State
Controller developed what we refer to as the EAGLE (Enhancing Accountability in Government
through Leadership and Education) Program. We are in the process of wrapping up year 2 of
our statewide rollout for Phase I – which is Internal Control over Financial Reporting – and will
begin the final implementation efforts for Phase I this fall. Other phases, Internal Control over
Compliance and Internal Control over Efficiency and Economy of Operations, will follow in
subsequent years.
For more information regarding North Carolina’s EAGLE Program, as well as the legislation
passed in 2007, please review our website: http://www.osc.nc.gov/eagle/index.html.
Virginia
Virginia implemented Agency Risk Management and Internal Control Standards in November
2006.