If an outside agency such as the National Institute of Health (NIH), Environmental Protection Agency (EPA), Legislative Post Audit (LPA), etc. contacts you directly, first inform your supervisor, then email Internal Audit with the appropriate information.

In addition, please see this document on how to handle an external review (PDF).

• The reliability and integrity of information
• Compliance with policies, plans, procedures, laws, and regulations
• The safeguarding of assets
• The economical and efficient use of resources
• The accomplishment of established objectives and goals for operations or programs (300.05)

Internal controls are the methods employed to help ensure the achievement of University and management objectives.  They are the tools used by managers every day.

Back to top^

Deans, Directors and Chairs (Managers) have been delegated authority for financial and human resources and are accountable to the public for the proper use of these resources, as well as compliance with all relevant Federal, State and University regulations, rules, policies and procedures.

Management at all levels of the University are responsible for knowing the exposure to fraud in the area under their responsibility and the prevention of fraud, misappropriations, similar irregular acts and other inappropriate conduct.

All managers, from the unit level to the Chancellor of the University, use internal controls to help assure that their units operate according to plan. The methods they use--policies, procedures, organizational design, and physical barriers--constitute the internal control structure of the University of Kansas.

Back to top^

• Propriety of Transactions for all activities within accounts for which the manager is responsible
• Reliability and Integrity of Information for internal management decisions and external agency reports
• Compliance with University of Kansas Policies and Government Regulations, including but not limited to: Human Resources, Financial, Purchasing, granting agencies, and state and federal government
• Safeguarding Assets, including physical objects and University data
• Economy and Efficiency of Operations to optimize the use of limited resources in accomplishing the mission of the unit and the University of Kansas

How to Evaluate Your Controls

Back to top^

• Monitoring – Adequate daily, weekly, monthly “Dashboard.”
• Ongoing security and control over assets, systems, and data.
• Proper control over cash, charge accounts, and expenditures.
• Good documentation including policies, procedures, and job descriptions.
• Effective staff recruitment, training and cross training.
• Periodic financial reconciliations on all departmental accounts.
• Adequate segregation of duties.

How to Evaluate Your Controls

Back to top^

• Sometimes there is no out-of-pocket cost to establish an adequate control.  A realignment of duty assignments may be all that is necessary to accomplish the objective.
• A well-designed internal control structure can enhance operations by improving your unit's overall efficiency and effectiveness, as well as, reducing the risk of loss or theft.

In analyzing the pertinent costs and benefits, managers should also consider the possible ramifications for the University of Kansas at large and attempt to identify and weigh the intangible as well as the tangible consequences.

• It may be difficult to determine the cost of poor public relations and lost goodwill if an ex-employee steals cash because the manager did not change the safe combination or retrieve University keys upon the employee's termination.

Back to top^

• Inadequate knowledge of University and/or Department Policies -The University is not a static environment--new policies and policy revisions are a part of our continual evolution. Many University policies are available electronically and printed copies can be supplied upon request by contacting the relevant University department. Managers must stay abreast of these changes and understand their responsibilities.
• Inappropriate Access to Assets and Data- Internal controls should provide safeguards for physical objects, restricted information, critical forms, and update applications.
• Incomplete/Insufficient documentation of Control Overrides - Exceptions to established policies are sometimes necessary to accomplish a specific task, but can pose a significant risk if not effectively documented, monitored and limited.
• Inherent Limitations - There is no such thing as a perfect control system. Staff size limitations may obstruct efforts to properly segregate duties, which requires the implementation of compensating controls to ensure that objectives are achieved. A limitation inherent in any system is the element of human error (misunderstandings, fatigue, and stress). Cost/Benefit analysis is required.
• Inadequate Segregation of Duties - Separating responsibility for physical custody of an asset from the related record keeping is a critical control.

Back to top^