Auditors should be asking more questions about internal controls, checks and balances, the control environment, and policies and procedures. Recently issued auditing standards, SAS 109 Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement and SAS 115 Communicating Internal Control Related Matters in an Audit have a direct impact on local governments.

SAS 109 requires that auditors gain a more thorough understanding of the government’s environment, including internal control. This standard defines internal control as:

“A process affected by those charged with governance, management, and other personnel designed to provide reasonable assurance about the achievement of the entity’s objectives with regard to reliability of financial reporting, effectiveness and efficiency of operations, and compliance with applicable laws and regulations."

SAS 115 requires the auditors to redefine internal control deficiencies documented during the audit process. Municipalities may have more audit findings in their reports than in prior years. This may not mean you are handling transactions differently than in the past but auditors may not have asked the detailed level of questions that are now required in order to document compliance with these standards. Audit findings in the past that were referred to as “reportable conditions” are now called “significant deficiencies.” The term “material weakness” remains the same. Local governments that have not adopted control procedures to ensure financial transactions are processed accurately and completely will see “significant deficiencies” or “materials weaknesses” in their audit reports.

The standard also requires certain communications related to significant deficiencies and material weaknesses to be made in writing to management and those charged with governance. The person(s) who holds responsibility for strategic oversight for the direction of the entity and obligations for the accountability of the entity are considered “those charged with governance.” In local governments, that is usually the board of mayor and aldermen, council or commission. Management and elected officials should expect to see and hear more communications before, during and after the audit.

A few examples of control deficiencies found in government auditing guidance that might be the basis for an audit finding include:

• Lack of awareness of the importance of controls by top management (elected officials, mayor, city manager or administrator)
  • Failure to ensure that policies and procedures are adopted
• Ineffective oversight by those charged with governance
  • Failure to hire competent personnel in key management positions
• Control systems (check and balances) are not adopted or are not working properly
• Identification of fraud
• Failure by management to correct previously communicated deficiencies

Municipal officials have the responsibility to ensure that municipal resources are being utilized in the most effective ways possible. No one likes to deal with red tape or jump through hoops to get things done but in order to maximize efficiency, controls must be implemented. Think about it, is the city or town receiving all the fines and fees it is entitled to from county court cases? How does anyone know if no comparison is done to see what should be collected? Are those rising fuel costs only because the price of fuel has skyrocketed? How do you know gas is not disappearing if a system is not in place to monitor usage by various departments? These are just a tiny sampling of questions that should be asked by those responsible for how a city operates. Internal Control is all-encompassing and not simply limited to writing receipts and getting money into the checking account at the end of the day. It involves considering how every task is performed.

Control over the manner in which a government processes its transactions is the responsibility of management. This always includes the governing board, who generally has delegated this day-to-day oversight to the recorder, city manager, finance officer or city administrator.

Two valuable resources for municipalities to use in structuring their financial and compliance practices are the Internal Control and Compliance Manual for Governmental Entities (City Manual), published by the Comptroller's Office, and a book titled Government Accounting, Auditing and Financial Reporting (GAAFR) more commonly called the Blue Book, published by the Government Finance Officers Association (GFOA). The latest version of the Blue Book is the 2012 revision. Finance staff of each city should use this publication as a reference book in recording and reporting financial transactions of the city.

The City Manual states in part:

“A good internal control framework is essential to providing reasonable assurance that organizations are achieving their objectives.  Such objectives include, but are not limited to, utilizing public resources in compliance with laws, regulations and budgetary limitations.  An adequate control framework will provide information that helps detect errors and fraud, and provides reasonable assurance that financial reports are accurate. It will limit the opportunity for theft or unauthorized use of assets, including cash, inventory, and capital assets."

The City Manual has recently been edited and places more responsibility on the governing bodies and management of municipalities for the design and implementation of the entity's internal control structure. The City Manual now follows more closely the GAO Green Book and is based on the 17 principals outlined in that reference material. The principals are presented in the City Manual and are recommended, but their use is not required. What is required by state and federal law if the establishing and maintaining of a system of internal control and implementation of the 5 compoments: Control Environment; Risk Assessment; Control Activities; Information and Communication; and Monitoring, should be considered mandatory. 

If basic procedures for financial and compliance practices have not been implemented by your government then you will most likely have audit findings. To improve controls, municipal officials should begin implementing the procedures from the City Manual and not wait on the audit. The City Manual should be used as the minimum standard overseeing operations. Municipal management should add other procedures to further strengthen the reliability of financial data as necessary. GFOA also has several “best practice” publications available that will be beneficial in determining controls to implement.

Municipalities can begin to assess their controls by asking questions such as:

• What are employees doing?
• What can go wrong?
• Is the city collecting all the revenue it is due?

This process should be started before the auditors arrive. A good way to begin the assessment is to document the specific job duties of each employee involved in any part of the financial process. Once that is completed, those duties should be reviewed to ensure they are separated as much as possible.

The process should include determining what type of monitoring is performed to ensure transactions are being processed accurately and completely. Management should review at a very minimum the following items:

• monthly financial reports
• bank reconciliations
• utility adjustment reports
• accounts receivable reconciliations
• police ticket and court docket reconciliations
• property tax reconciliations

Refer to the Internal Control and Compliance Manual for Governmental Entities and Other Audited Entities in Tennessee [1] for ideas on how to start a self-assessment or contact your MTAS Finance Consultant.