Internal Controls Toolkit

CHRISTINE H. DOXEY, CAPP, CCSA, CICA, CPC, is president of Doxey, Inc. Prior to forming her company, she served in executive positions with Verizon Business (formerly MCI), Hewlett Packard, Compaq, and Digital Equipment. Doxy is on the Advisory Boards of The Exchange Summit and The Institute of Internal Controls. She has authored several books and speaks at conferences globally on financial process best practices.

• Introduction to The Internal Controls Toolkit 9Introduction 9Internal Controls And Fraud Prevention 9Internal Controls And Fraud Prevention: Additional Statistics 10Who Will Benefit From This Toolkit 11About The Standards of Internal Control 12How Were The Standards Developed? 12How Are The Standards Used? 12What Is The Basic Premise of The Standards? 12When Should The Standard Be Updated? 12What Is A Best Practice For Implementing And Using The Standards? 12General Standards of Internal Control 13How This Toolkit Is Organized 141.0 Background On Internal Controls 15The Goals And Challenges of Internal Controls 15Risk Based Internal Controls 15Application of Internal Controls 16The Three Critical Corporate Controls 17The Background And History of Internal Controls 19Securities Act of 1933 19Securities Exchange Act of 1934 19Trust Indenture Act of 1939 19Investment Company Act of 1940 19Investment Advisors Act of 1940 19Foreign Corrupt Practices Act (Fcpa) of 1977 19Comprehensive Crime Control Act – 1984 20Federal Sentencing Guidelines For Organizations – 1991 20Internal Control – Integrated Framework – 1992 And 2013 20Coso’s Monitoring Guidance 21Cobit – 1996 23Systrust – 1999 23Corporate Frauds – 2001-2002 23U.S. Sarbanes Oxley Act of 2002 24Enterprise Risk Management (Erm) Integrated Framework – 2004 And 2013 25Example: Enterprise Risk Management (Erm) And The Application to The Procure to Pay (P2p) Cycle 26An Erm Checklist 27Internal Control Over Financial Reporting — Guidance For Smaller Public Companies - 2006 28Guidance On Monitoring Internal Control Systems – 2009 28Definition of Internal Controls 29Types of Internal Controls And Control Mechanisms 29Major Types of Internal Control 29Compensating Controls 30Other Controls 30Organization Controls 30Policy Controls 31Procedure Controls 31Supervisory Controls 31Review Controls 31Leveraging The Standards of Internal Control to Implement A Controls Self-Assessment (Csa) Program 32Ethics And “Tone At The Top” 34What Is ‘Tone At The Top’? 34What Are The Components of An Effective Ethics Policy? 34What Are The Components of A Well-Defined Code of Conduct? 34What Are Examples of Poor “Tone At The Top”? 35Code of Conduct Considerations 35Entity Level Controls 36Benefits For Entity Level Controls 36“Tone At The Top” 36Roles And Responsibilities For Internal Control 382.0 The Order to Cash (O2c) Process 422.1 Order Entry/Edit 452.1 Order Entry/Edit (Continued) 462.1 Order Entry/Edit (Continued) 472.2 Export Controls 482.2 Export Controls (Continued) 502.2 Export Controls (Continued) 512.3 Sales Contracts 532.3 Sales Contracts (Continued) 542.4 Credit 552.4 Credit (Continued) 562.5 Shipping 582.5 Shipping (Continued) 592.5 Shipping (Continued) 602.6 Revenue Recognition/Billing 612.6 Revenue Recognition/Billing (Continued) 622.6 Revenue Recognition/Billing (Continued) 632.6 Revenue Recognition/Billing (Continued) 642.7 Accounts Receivable (Ar) 662.7 Accounts Receivable (Ar) (Continued) 672.8 Collection 692.9 Cash Receipts And Application 702.9 Cash Receipts And Application (Continued) 712.10 Price Establishment 722.10 Price Establishment (Continued) 732.11 Promotional Activities 742.11 Promotional Activities (Continued) 752.11 Promotional Activities (Continued) 763.0 Treasury Process 773.1 General Treasury Controls 803.1 General Treasury Controls (Continued) 813.1 General Treasury Controls (Continued) 823.2 Financing Operations 833.2 Financing Operations (Continued) 843.3 Investment of Available Funds 853.3 Investment of Available Funds (Continued) 863.4 Foreign Exchange 873.4 Foreign Exchange (Continued) 884.0 Procure to Pay (P2p) Process 894.2 Purchasing/Ordering 994.2 Purchasing/Ordering (Continued) 1004.2 Purchasing/Ordering (Continued) 1014.2 Purchasing/Ordering (Continued) 1024.3 Import Controls 1034.3 Import Controls (Continued) 1044.4 Receiving 1054.4 Receiving (Continued) 1064.4 Receiving (Continued) 1074.5 Accounts Payable 1084.5 Accounts Payable (Continued) 1094.5 Accounts Payable Continued) 1104.6 The Payment Process - General 1114.6 The Payment Process – General (Continued) 1124.6 The Payment Process – General (Continued) 1134.7 The Payment Process - Travel And Entertainment 1144.7 The Payment Process - Travel And Entertainment 1154.8 Research And Product Development 1164.8 Research And Product Development (Continued) 1174.8 Research And Product Development (Continued) 1184.9 Procurment Cards (P-Cards) 1194.9 Procurment Cards (P-Cards) (Continued) 1204.9 Procurment Cards (P-Cards) (Continued) 1215.0 Hire to Retire (H2r) Process 1225.1 Payroll Preparation And Security 1255.1 Payroll Preparation And Security (Continued) 1265.2 Payroll Payment Controls 1285.2 Payroll Payment Controls 1295.3 Distribution of Payroll 1305.4 Compensation And Benefits 1315.4 Compensation And Benefits (Continued) 1325.5 Hiring And Termination 1335.5 Hiring And Termination (Continued) 1345.6 Education, Training, And Development 1355.7 Contingent Workforce 1365.7 Contingent Workforce (Continued) 1386.0 The Supply Chain Process 1396.1 Planning & Control 1426.1 Planning & Control (Continued) 1436.2 Inventory Control 1446.2 Inventory Control (Continued) 1456.2 Inventory Control (Continued) 1466.3 Inventory Verification 1476.3 Inventory Verification (Continued) 1486.4 Inventory Valuation 1496.5 Product Cost Management 1506.5 Product Cost Management (Continued) 1516.5 Product Cost Management (Continued) 1526.6 Original Equipment Manufacturers (Oems) / Alliance Partners 1536.6 Original Equipment Manufacturers (Oems) / Alliance Partners (Continued) 1546.6 Original Equipment Manufacturers (Oems) / Alliance Partners (Continued) 1556.8 Tranportation And Logistics 1586.8 Tranportation And Logistics (Continued) 1597.0 Record to Report (R2r) 1617.1 International Transfer Pricing 1667.2 Intercompany Transactions 1677.2 Intercompany Transactions (Continued) 1687.3 Accumulation of Financial Information 1697.3 Accumulation of Financial Information (Continued) 1707.4 Processing And Reporting of Financial Information (The Final Mile) 1717.5 Fixed Assets 1747.5 Fixed Assets (Continued) 1757.5 Fixed Assets (Continued) 1768.0 Government Contracts 1778.1 United States Government Contracts - General 1788.1 United States Government Contracts – General (Continued) 1798.1 United States Government Contracts – General (Continued) 1808.1 United States Government Contracts – General (Continued) 1818.1 United States Government Contracts – General (Continued) 1828.2 United States Government Contracts - Non-Commercial Products 1838.2 United States Government Contracts - Non-Commercial Products (Continued) 1848.3 United States Government Contracts - Commercial Products 1858.3 United States Government Contracts - Commercial Products (Continued) 1868.3 United States Government Contracts - Commercial Products (Continued) 1878.4 Contracts With State And Local Governments And Educational Institutions Within The United States 1888.5 Contracts With Governments Outside The United States 1908.5 Contracts With Governments Outside The United States (Continued) 1919.0 Records And Information Management 1929.2 Standards of Internal Record Keeping Requirements 1979.2 Standards of Internal Record Keeping Requirements (Continued) 1989.2 Standards of Internal Record Keeping Requirements (Continued) 19810.0 Computer, Telecommunication And Systems Controls 20110.1 Owners, Users, And Service Providers 20610.1 Owners, Users, And Service Providers 20710.1 Owners, Users, And Service Providers (Continued) 20810.1 Owners, Users, And Service Providers (Continued) 20910.3 Computer Access Control 21410.4 Network Operations And Security Controls 22410.4 Network Operations And Security Controls (Continued) 22510.5 Systems Development Methodology 22810.5 Systems Development Methodology (Continued) 22910.5 Systems Development Methodology (Continued) 23010.6 Change Management 23110.6 Change Management (Continued) 23210.7 Computer And Telecommunications Backup For Production Restart/Recovery 23510.8 Disaster Recovery And Business Contingency Planning 23710.8 Disaster Recovery And Business Contingency Planning (Continued) 24110.8 Disaster Recovery And Business Contingency Planning (Continued) 24210.9 Input Controls 24310.10 Output Controls 24510.11 Paperless Transactions, Electronic Commerce, And Edi 24710.12 Non-Company Networks And Bulletin Boards 25011.0 Protection of Assets: Human, Physical And Intellectual 25611.1 Security Framework 25811.1 Security Framework (Continued) 25911.1 Security Framework (Continued) 26011.2 Perimeter Security 26111.2 Perimeter Security (Continued) 26211.3 Interior Security 26411.3 Interior Security 26511.4 Protecting Intellectual Property 26612.0 The Insurance Process 26812.1 Protection Against Physical Damage And Other Accidents 26912.2 Insurance (Property & Casualty Risks) 27012.3 Business Continuity 27213.0 Environmental, Health, And Safety (Eh&S) 27313.1 General Controls 27513.1 General Controls (Continued) 27614.0 Customer Services 27714.1 Policy 27914.1 Policy (Continued) 28014.1 Policy (Continued) 28114.2 Call Center Management 28214.2 Call Center Management (Continued) 28314.3 Warranty 28414.3 Warranty (Continued) 28514.3 Warranty (Continued) 28614.4 Support Sales 28715.0 Professional Services (Ps) 28815.1 General Controls 29015.1 General Controls (Continued) 29115.2 Opportunity-Bid Process 29215.2 Opportunity-Bid Process (Continued) 29315.2 Opportunity-Bid Process (Continued) 29415.3 Program Management 29515.3 Program Management (Continued) 29615.3 Program Management (Continued) 29715.3 Program Management (Continued) 29815.3 Program Management (Continued) 29915.4 Customer Order Management 30015.4 Customer Order Management (Continued) 30115.4 Customer Order Management (Continued) 30216.0 Entity Level Controls 30316.1 Compliance And Compliance Screening 30516.1 Compliance And Compliance Screening (Continued) 30616.2 Internal Controls Roles And Responsibilities 30816.2 Internal Controls Roles And Responsibilities (Continued) 30916.4 Audit Committee Controls 31316.4 Audit Committee Controls (Continued) 31416.4 Audit Committee Controls (Continued) 31517.0 Glossary 31818.0 Addendum – Additional Tools 32718.1 Example Internal Controls Policy 32718.2 Delegation of Authority (Doa) Policy 33018.3 Segregation of Duties (Sod) Policy 33818.4 System Access (Sa) Policy 35218.5 Pricing Policy Example 35518.6 Testing Internal Controls And Selecting Sample Sizes 357References 361