InternalAudit_SoftChapter 263 of the Laws of New York, 2005 requires all school districts to create an internal audit function. The creation of this function requires an engagement with either a qualified audit firm or individual to make an initial risk assessment of the design of internal controls; annually update this assessment; and, periodically test these controls for operational effectiveness and efficiency.

The initial risk assessment requires that we obtain an understanding of both the inherent and control risks associated with the various functions within your organization, while the risk assessment update requires us to identify the changes in procedures, policies, personnel, and systems that may have an impact on these risks and possibly alter the initial risk assessment’s level of control risk.

Internal Audit

Internal controls are the checks and balances over the various processes or functions that comprise the operations. We can help you understand and improve upon the key elements and concepts of any internal control system.

Some key elements and concepts are:

  • Segregation of duties
  • Monitoring of cash
  • Safeguarding of assets
  • Reasonable assurance
  • Recognizing inherent limitations

Risk Assessment Update

During each engagement we interview management, accounting staff and other department personnel to determine the flow of accounting information and controls that are in place. We review our understanding of the critical business processes and operations and determine if further action is necessary. These critical business processes include but are not limited to:

  • Governance and planning
  • Accounting and reporting
  • Revenue and cash management
  • Payroll and related benefits
  • Purchasing and related expenditures
  • Facilities and equipment
  • Student services
  • Student related data
  • Information technology

We identify the key risks based on our understanding of these business processes and we will identify whether or not the stated controls that are currently in place to address those risks are satisfactory.