Are your Internal Controls like Swiss Cheese?

Are your Internal Controls like Swiss Cheese?
Part Three - The Internal Control Policy

by Gene Bucciarelli, CPA
Internal Control Systems

"Good planning that does not plan for controls is not."

In the last few years many if not all of my clients have been asked by examiners to create an Internal Control Policy. This policy provides for the various types of controls that the Bank managers and supervisors must consider in their departmental controls. The list of controls is by necessity a generic list. All managers should review this policy and ensure that applicable controls are installed in their information flows. The following outline should be a useful guide to creating an effective control policy.

I. Objectives

II. Responsibility for Internal Control
Board of Directors
Audit Committee
Senior management
Mangers and supervisors

III. Definition and Purpose of Internal Control

IV. Administrative controls
Budgets
Personnel Policies
Hiring Policy
Vacations
Compliance and Operating Policies
Procedures manuals
Desktop procedures

V. Accounting Controls
Segregation of duties
Rotation of Personnel
Cross training
General Ledger account control totals and supporting ledgers
Bancontrol account reconciliation's
Audit trails
Audit logs
Approvals
Authorized signers
Signing Limits

VI. Operating Controls
Cash controls and cash limits Certifications
Joint custody
Dual Custody
Call Back
Daily exception and change reports
Passwords
Backups
Alarms
Cameras
Key controls
Offsite storage
Inventory
Third party or vendor totals

VII. External Audit

VIII. Internal Audit

Many departments including the branch, accounting, the note department and the wire room will use a large number of these controls to ensure the integrity of the work being accomplished. Others may use just a few. Note that preventive and detective controls discussed in Part II are mostly listed under accounting and operating controls.

Has your Bank implemented an Internal Control Policy? Most if not all examiners will agree that a thoughtful and thorough policy is an indicator that examination results will show a good internal control framework. And who wouldn't be pleased about that?

Access the previous articles in the Swiss Cheese series

Gene Bucciarelli, CPA is the principal of Internal Control Systems, a community bank internal audit and internal control consulting firm. He is an expert witness for employee frauds. He can be reached at 925.828.7360 or via email at genebu@home.com.

First published on BankersOnline.com 7/16/01