Internal accounts and student activity accounts offer schools a faster, more convenient way to handle the income and expenses that result from student fees, school clubs and organizations, field trips, fundraising, and similar activities. But this convenience also incurs the added risk of fraud.
Fortunately, there are proven ways to strengthen internal controls and reduce that risk. Moreover, contrary to many educators’ impressions, such internal controls do not have to be cumbersome or time-consuming. In fact, when properly structured and executed, strong internal controls can simplify the job of handling such accounts, freeing up teachers’ and administrators’ time to concentrate on education.
Nature of the Risk
The practice of maintaining accounts outside the central business office—although often the most practical way to handle funds related to extracurricular events—presents some inherent risks:
- Decentralized control makes monitoring and tracking funds more difficult.
- Many individuals—including teachers, volunteers, and parents—typically handle the funds.
- The transactions are often small and difficult to track.
- Those responsible for supervising the accounts might lack bookkeeping experience or training.
Even well-designed internal controls can fail in execution. For example, requiring duplicate prenumbered tickets for raffles or event admission is a common control. But without a master log of ticket numbers to account for all the tickets issued, fraud is possible.
The breakdowns in internal controls are not always so obvious, of course. And although the amounts involved in such frauds are often small in relation to the total budget, the damage caused by internal control failure can be significant in lost reputation, damaged credibility, and diminished community support when fraud is discovered.
Internal Control Basics
What specifically do we mean by internal controls? The standard definition comes from the Committee of Sponsoring Organizations of the Treadway Commission (COSO), a voluntary private-sector organization made up of leading accounting and auditing professional associations.
COSO defines internal control as “a process, effected by an entity’s board of directors, management, and other personnel, which is designed to provide reasonable assurance regarding the achievement of objectives in effectiveness and efficiency of operations, reliability of financial reporting, and compliance with applicable laws and regulations.”
It’s important to note that COSO defines internal control as a process. It is a means to an end, not an end in itself. Note also that internal controls are not just stand-alone practices, policy manuals, or forms. Rather, they are woven into the day-to-day responsibilities of the people involved.
Internal controls must make sense within each school’s operating environment. They should be cost-effective, and they should actually benefit—rather than encumber—management.
Reducing Fraud Risk
With local headlines highlighting fraudulent activity at local school districts and news stories covering the latest account of someone committing white-collar crime, the questions always left unanswered are why the fraud occurred, what the intricate details of the circumstances were, and how the events could have been prevented. While these details aren’t as exciting and tend to not make headlines, the fact remains that many fraud events occur because internal controls in an organization aren’t sufficient to deter and detect fraud.
Internal controls are the foundation to support the business of schools and school districts, and they provide the important framework to help prevent fraud. The basis for internal controls are processes and procedures that are followed by school and district personnel to document the checks and balances employed to safeguard assets, validate records and reports, and improve the effectiveness and efficiency of operations. The processes are the activities that are performed on a daily basis to get things done. Procedures are the best way to communicate the tasks that employees must execute while performing their daily duties, to train new employees on their job functions, and to demonstrate that internal controls are in place. The most effective way to enforce procedures is to write them down.
In order to implement procedures in a school, it is important to look at all existing processes and develop a comprehensive procedures manual that provides the school with a resource to which employees can refer. The manual can be as complex or as simple as the staff needs it to be; it should accumulate procedures so they can be reviewed for consistency and completeness. When the procedures manual is complete, utilize it in training and communicating the internal controls to school district employees.
Once a procedures manual has been developed, the principal should communicate and reinforce the rules regularly. In addition to reviewing the rules at the start of each school year, meet periodically throughout the year to cover specific procedures. The next step is to reinforce that all employees are expected to commit to enforcing and upholding the internal controls, and they will be held responsible for doing so. Staff must ensure compliance. Finally, when explaining the rules, emphasize that internal controls and procedures have been established to protect everyone.
Implementing Stronger Internal Controls
How can you get started on the important task of implementing stronger controls over internal accounts in your school? In general terms, the process can be broken into five steps:
- Know the exposures.
- Know the symptoms of occurrence.
- Be alert for symptoms.
- Build control procedures and audit program steps to look for symptoms.
- Follow through on all symptoms observed.
Implement recognized fraud-prevention practices, such as the following:
- Segregate duties. Ensure that no one person has custody of assets and is also responsible for recordkeeping and documentation. Someone who is independent of the process should perform reconciliation of the accounts.
- Rotate duties. Regularly rotate responsibilities among qualified personnel, if adequate resources exist, to stay alert to any unusual patterns.
- Document procedures. Documentation helps ensure that processes are handled consistently and controls are not circumvented. The documentation process itself can reveal weaknesses.
- Ensure independent review. Establish a monitoring or an internal audit program.
- Provide training. Bear in mind that some individuals involved in the process might lack an understanding of proper internal control processes.
Putting Theory into Practice
In addition to sound general fraud-prevention practices, a number of specific internal control techniques are especially useful in managing internal accounts, student activity, and extracurricular funds:
- Centralize accounts whenever practical to improve management control and efficiency.
- Write down the procedures that should be followed to document how employees should handle their duties.
- Review written procedures with district finance office personnel or auditors for feedback on how to improve internal controls.
- Make each student activity or convenience account self-sustaining. Account balances should not be allowed to go negative unless a loan between accounts has been approved to fund the deficit.
- Keep activity funds in approved depositories or invested in conformity with the district’s investment policy.
- Use prenumbered receipts that are reconciled to deposit information.
- Reconcile cash and investment balances with activity fund ledgers on a monthly basis.
- Identify any large invoices that are paid without a purchase order.
- Make sure activity fund checks generally are made out to companies rather than to individuals.
- Cross-check vendors to identify recurring addresses or phone numbers. Also cross-check addresses against employee addresses.
- Run certain payments made to district employees through payroll and include them on employees’ W-2s.
- Compare bids awarded with payments made, and look for price variances.
- Carefully review descriptions of services rendered.
- Use prenumbered tickets for events, with a corresponding prenumbered ticket log.
- Have two individuals sign checks.
- Make sure two individuals work together to count and verify cash collections.
- Implement a documented credit or purchasing card policy. Maintain an inventory of all cards, and identify dormant accounts or any use by terminated employees.
- Apply rationalization testing and monitoring of purchasing card expenditures. Ask if the purchase makes business sense given the cardholder’s duties. Review statements between months to see if credits were issued but not received.
So, where do you start? To some extent, the answer depends on the resources you have available. If resources are scarce, consider using members of the district’s finance office, auditors, or other comparable groups to provide expertise and support. Typically, you want to start with the highest risk processes first, but if necessary, start small. The point is to get started.
Bert G. Nuehring, CPA, is a partner with Crowe Horwath LLP in Chicago. Daryl J. Okrzesik, CPA, is a former controller for Chicago Public Schools.
Editor’s note: This article is based on “Reduce Fraud Risk in Your District with Stronger Internal Controls,” by Daryl J. Okrzesik, CPA, and Bert G. Nuehring, CPA, which appeared in the May 2011 issue of School Business Affairs, published by the Association of School Business Officials (ASBO) International. The text herein does not necessarily represent the views or policies of ASBO International nor imply any endorsement or recognition by ASBO International and its officers or affiliates.