INTERNAL

CONTROL
Essays & Ponderings
on Accountability

J. Timothy O’Toole

www.internal-control.us

www.1ceman.com
 Internal Control – More Than a Good Idea – It’s Also the Law!

HOW TO BE A BETTER MANAGER • Do you have a hundred or a thousand

employees doing your bidding, or just a
How can I improve productivity, accuracy,
favored few?
integrity and effectiveness of my operations?
Can internal control techniques make a • Are you involved in purchases/
difference? Am I just making more work for expenditures/contracts in the millions, or are
myself? Besides, is anyone really enforcing the your expenses limited to an occasional
Internal Control Act? Amtrak run to New York City?
Okay, all reasonable questions. In order to • Has your program had a track record of
respond, let’s start at the beginning, and discuss success, or a history of negative press, grand
the Control Environment. Sounds fancy, but it jury investigations and scathing audit
just means - what is the reality of your reports?
program/function operation?
I think you get the picture. Control environment
• Do you handle dangerous drugs or refers to the set of circumstances you and your
chemicals – or just sales tax forms? program are in at all times. The answers to each
of these questions form a baseline of “inherent
• Is it a 9-to-5 office or a 24/7 residential
risk” against which you must consider the
facility?
wisdom of enforcing some internal controls
• Is your operation centralized or far-flung? (a/k/a management controls). Before you jump
to conclusions, you need to conduct a…
• Do you deal directly with the public (in
office or residential settings), or local RISK ASSESSMENT
government/elected officials?
If you’ve answered the preceding questions
• Are you responsible for expensive inventory fully, and have taken into consideration unique
(computer parts, medical supplies, sides of factors relevant to your specific operation, you
beef, power tools or firearms), or more are ready to assess your risk (or “vulnerability”).
routine office supplies (paper clips, pens, Fraud, waste and mismanagement are the issues
pads, binders, rubber bands)? of greatest concern in most of our operations,
but public safety, environmental health,
• Are you the gate-keeper for confidential
susceptibility to litigation, scandal or satire in a
records (computer or paper)?
future Dilbert cartoon may also be at the back of
• Are your staff seasoned, trained and your mind (along with that April 15 filing date).
reliable? Or
• Have you had a lot of turnover (due to
illness, retirement, indictment) - and there is
a hiring freeze?
• Are your policies and procedures up-to-
date? Or
• Are you hamstrung by out-of-date
regulations, hidebound legacy computer
systems, or management indecision? (“Is
that what’s troubling you, bunky?”)
• Are you being held accountable for
something over which you have no
authority?
1
 Internal Control – More Than a Good Idea – It’s Also the Law!
We tend to procrastinate regarding unpleasant
realities. You may also have leadership that
does not encourage or even welcome questions,
yet you are the one who will be held
accountable. Clearly you can’t afford any
further delay in assessing your risk.
The best place to begin is with a baseline review
of each element of your operation, sample some
data, interview some staff (and clients), and ask
some questions. Common sense and logic come
in handy here – even if they deviate from the
“conventional wisdom” that was followed
historically.
Is any one person (staff or public) in a position
to take advantage of weak management
controls? For example, does the person in
charge of petty cash also reconcile the account
every month? Do your staff accept information
submitted by the public without question, in
effect rubber-stamping their applications, be it
for a license, public assistance, employment, or
student loan?
Are you under pressure to purchase only from
selected vendors? Are you constantly splitting
orders to keep under the competitive bidding
threshold? If you are fortunate enough to be
able to hire replacement staff, are heroic
measures being taken to circumvent the “rule of
three”?
Imagine your worst case scenario:
• A major embezzlement.
• A bridge collapse.
• A patient abuse scandal.
• Bid rigging.
• A bribery investigation.
• A three-car pileup.
• Tainted vaccine.
• A diploma mill.
• Asbestos.
• Polluted drinking water.
All of these have occurred somewhere in the
past, and will continue to do so in the future.
What would bring Mike Wallace to your door
with a video camera? What is the potential
damage in dollars or lives lost, illness or
litigation? What would be the impact on your
agency’s reputation and continued funding?
Now imagine the likelihood of occurrence of
any of these calamities. It may sound cold-
hearted, but we cannot protect against all
potential risks. We must establish priorities,
weigh the economic feasibility of each control,
the availability of staff to enforce such controls,
and consider what role such risk would play in
interfering with your mission. We are looking
for a “reasonable assurance” that bad things
won’t happen.
“Reasonable”, but not “absolute”.
For example, a warehouse or mailroom may
keep its laptop computers in locked storage, but
leave mailing envelopes and copier paper out in
the open. You have to use a password to send e-
mail via computer, but the fax machine does
your bidding without further ado. Keys for the
company car are kept secure, but staff are
trusted to use the copier without a keycard.
UNIVERSAL PRECAUTIONS
In health care settings, medical professionals are
required to follow universal precautions for their
own protection, and that of their patients. It’s
not just about AIDS. We are becoming one
world, and TB from Zimbabwe, bird flu from
Saigon, or encephalitis from Belgium can show
up in Schenectady without warning.
Dental hygienists
wear gloves (maybe
even masks). Red
Cross workers are
very careful when
collecting your pints
of AB+ or O-. Even
barbers now sterilize their scissors between
customers.
In business and government, there are certain
“universal precautions” taken by financial
officers, account clerks, stock-room staff, data
entry clerks – to protect assets and to protect
their individual reputations.
 Internal Control – More Than a Good Idea – It’s Also the Law!
If you work in an office where individuals are
given considerable latitude, they may also be
susceptible to allegations of abuse of such
power. There are also countless regulations
affecting various facets of daily life, which
require periodic compliance procedures.
We are all familiar with the following health,
safety and compliance procedures: that annual
vehicle inspection; the April 15 tax filing
deadline; winter flu shots (if you are eligible).
We also need to make sure we pay our fire
insurance premiums on time. Phone companies
and utilities may be patient waiting for
payment, but they are not going to wait
indefinitely.
We also expect our restaurants to be
clean; produce in the supermarket to
be fresh; poultry inspected; milk to
be tuberculin-free; kosher foods
receive proper rabbinical
supervision; toddlers’ toys to
be safe from choking hazards.
The list goes on and on.
These are all reasonable expectations for
consumers. Likewise, we in government have
reasonable expectations from one another
(within and between agencies), and the public
have reasonable expectations from government
(state/local/federal).
When a child dies in a day care center, the
public look first at the provider. Then they look
at the licensing agency.
When a city bus hits a bystander, the police
check the driver’s blood-alcohol content. Then
they check the brakes. Then they review the
maintenance records at the garage.
When $14 is missing from petty cash, it doesn’t
get much press. But when BOCES is missing a
million or two, and their treasurer just retired,
buying a new car, boat and summer house, all
kinds of people take notice.
When a prisoner escapes from custody, issues
under review include facility (or transport)
procedures, staff qualifications and training;
physical security measures and legal
requirements. Investigators may also check into
staff finances and phone records.
INTERNAL CONTROL
PROCEDURES
All of the foregoing examples are comparable to
locking the barn door after the horses escape. It
may also be difficult to get the toothpaste back
into the tube (and still meet OSHA regulations).
To avoid these nightmares (and bad press) some
common sense procedures are in order.
It’s harder to fix traffic tickets these days
because citations are numbered, and the
Comptroller insists they all be
accounted for. This was probably
instituted as a revenue measure, but
has also had a positive impact on local
government integrity.
When accepting cash payments, cash
registers keep track of (and issue) receipts.
Whether it’s a charity’s collection plate or
payroll at least two people should count the
cash. The person who signs the checks should
not be the person who reconciles the account.
You may have “read only” access to computer
files, to protect them from tampering or
accidental deletion. Employment in some
sensitive positions may require a criminal record
check. Review the driving records of staff who
transport clients, BEFORE tragedy strikes.
Progressive discipline is required for employees
with chronic attendance problems. This is
especially critical in 24/7 environments where
other staff must work involuntary overtime to
fill a post.
Technically speaking, when a warehouse or
stockroom receives supplies and materials, staff
should check the quantity received. If it’s an
order of staples from Staples, this may not be
critical. But a pallet full of PCs from DELL?
Count them twice.
There is an old adage that “history teaches us
that no one learns from history”. Not true. If
 Internal Control – More Than a Good Idea – It’s Also the Law!
your methadone clinic has been going through a
case of syringes every week, and suddenly that
volume has doubled, either there is a growth
trend in services provided, or someone is
sidelining supplies.
If you are used to $35 phone bills each month
and suddenly get a $495 bill, read it carefully
before you rush to your checkbook.
(Note: “The way things have always been” is
part of your control environment.)
When considering what kind of control
procedures are necessary, consider the
likelihood of risk, the significance of failure,
and those three words from all those Law &
Order episodes: “means, motive, and
opportunity”. Along with motive, you can add
“rationalization”. Was a long-term employee
passed over for promotion time and again? Is
he/she in a position to get even? Has a
disgruntled worker
just given his/her two-
weeks notice?
Wouldn’t it be wise to
change the computer
system password
BEFORE they are out
the door?
If you have ever
shopped on the
Internet, you know
those bargains may be
risky. Windows XP for $29.95? Not likely.
Gutenberg Bible for sale on E-Bay? Sure. You
may have had reliable experience with L.L.
Bean and Land’s End, but this cannot be applied
to www.fly-by-nite.com. When you spend your
own money, you like to know who you are
dealing with. When you are spending the
State’s money, it is also wise to know your
suppliers.
You may have a sophisticated/computerized
purchasing system to ride herd on purchase
orders and vouchers, but such a system could be
compromised by unscrupulous staff. Can
anybody add a vendor to your database? Or do
you funnel all such entries through authorized
staff? Do you find a dozen DBAs all sharing
the same Federal Employer Identification
Number? Do you check those numbers against
employee Social Security Numbers? How about
P.O. Box addresses or Suite addresses (they can
be a precursor of a bogus business).
How do you guard against paying the same bill
twice? If it’s the Phone Company or electric
utility, they will likely credit you for the
overpayment against next month’s bill. But
there are those happy to make use of your
money until you notice the overpayment. With
delays in internal processing of vouchers,
double-billing is not just the province of
unscrupulous healthcare providers.
For that matter, how do you ensure vouchers are
processed in a timely fashion? Prompt payment
legislation may not affect smaller transactions,
but it is best to eliminate billing
confusion at any price.
MONITORING
If the South had won the war,
this would be called
“Merrimacking”. You know
the old adage “If you can’t
measure it, you can’t manage it.”
Monitoring is an ongoing
process that involves measuring
outcome against expectation.
On an assembly line, we expect
the drill presses to bore so many holes per hour,
fill so many ounces per bottle, and pack so
many bottles per case. In some cases
monitoring can be automated, but even then,
manual inspection is called for on a sampling
basis. If your paper mill turned out less than
1,000 sheets per roll, the Federal Trade
Commission would find out eventually
(someone out there would have enough time on
their hands to check the count).
If your laboratory is responsible for testing rabid
bats, you can be sure there are procedures in
place to make sure that staff follow safety rules,
file reports promptly, and destroy the carcasses
 Internal Control – More Than a Good Idea – It’s Also the Law!
hygienically – not to comfort the bat’s next of
kin, but to protect the public health.
Based on experience, you may find it necessary
to monitor certain processes more than others –
or to review the work of some staff more than
others. But you still need that “reasonable
assurance” that things are going as planned.
The Division of the Budget – and the Internal
Control Act – recognize the value of
monitoring. They insist on some sort of formal
testing process, whereby management can
identify problems or emerging trends, determine
an acceptable level of error, and a target level of
production for each major function.
Granted, there are some long-range goals not
immediately verifiable (like reducing illiteracy
or acid rain, increasing employment, or curbing
recidivism). That is where the cousin to
monitoring, “evaluation”, comes in.
Evaluation, by definition, is conducted by an
impartial group not directly involved in program
implementation. This is done to ensure
independent judgment. Evaluation may also
involve research techniques beyond the
capability of on-site managers, like following a
cohort of clients over a five year period,
interfacing with other agencies and their data
systems (e.g. Department of Labor, OTDA, DCJS),
or field interview of former clients. This all
takes time, and you may be retired before the
report is finalized, so concentrate on monitoring.
How do you know that
things are going as
planned?
How do you know that
vouchers are checked
against purchase
orders, and processed
through OSC in a
timely fashion.
How do you know
those eye test forms
turned in at DMV are
legitimate?
When a resident is placed on suicide watch, how
do you verify that staff looked in on a frequent
basis (as prescribed in the suicide watch
protocol)?
In some cases, there is DOCUMENTATION to
show a transaction occurred, and when it
occurred. Computer logs, date stamps, EZ-Pass
records, toll booth receipts, phone records.
Along with standardization of records, many
computer applications now add a time/date
element. Filter a digital report file through an
Excel spreadsheet, and you can “sample” all the
data – rather than a 5% sample – then filter and
massage it a hundred ways. If this approach can
help you monitor your function, make sure you
receive the proper training to take advantage of
this technology.
Documentation can be helpful, but there are
other times when you have to INTERVIEW
staff, clients, vendors, the public to gain
perspective on an operation. Find out if your
staff really know what they are supposed to do.
Find out if clients have unreasonable
expectations from a program. Find out if
vendors understand the RFP. The public
(including the press, advocacy groups, and
elected officials) may have a totally different
impression of what you are about. In some
cases this means re-engineering your program.
In other cases this means educating the public as
to your capabilities.
Finally, OBSERVATION is a tried and true
technique. Shop foremen take a walk around
the factory floor. They know by experience
what sights, sounds and smells to expect on a
normal business day. If a factory (or a phone
bank) is unusually quiet, it is time to find out
why. Unless you work in a welding shop, if you
smell something burning, don’t pass it off as an
olfactory hallucination. Check it out – your
health (or your life) may be at stake. If you look
around the office on a Monday morning, and
you are the only one who is there, don’t jump to
 Internal Control – More Than a Good Idea – It’s Also the Law!

conclusions about malingerers. Check your

calendar – maybe it’s a holiday.
And if everybody is gathering around the water
cooler, locked in animated conversation, it
might involve vital information. By design,
managers are usually the last to know. That’s
why they are kept in private offices, secretaries
screen their calls, and in some cases they eat in
separate dining rooms.
This is where we segue whimsically to our next
element of better management:
INFORMATION &
COMMUNICATION
“Everybody’s talkin’ at me…but I can’t hear a
word they’re saying….” The opening lyrics
from the theme from Midnight Cowboy may be
your work reality, but probably not. Like most
of us, you probably have fallen prey to the status
quo of hierarchical decision-making and
pecking order communication. “Right to know”
and “need to know” are phrases that apply to
more than the CIA and Homeland Security. If
you are responsible for an operation, you need
all the available information to bolster
productivity – which includes both efficiency
AND effectiveness.
The military talk about the 3 C’s – command,
control, and communication. We civilians
talk about horizontal and vertical two-way
communication. Your subordinates need to
bring things to your attention. You need to
confer with them, fielding questions and
concerns, passing on vital information from
above. You need to keep your bosses in the
loop concerning issues that affect the agency or
program. And you need to compare notes with
your peers in other parts of the agency – to
make sure you are not working at cross-
purposes, duplicating each other’s work, and
pick up information that missed your desk.
Knowledge is power, only if it is shared. And
the more people who share the knowledge, the
more productive your agency can be.
 Internal Control – More Than a Good Idea – It’s Also the Law!
IF IT AIN’T BROKE, DON’T FIX IT
A frequent temptation for a new manager is the
urge to change a long-standing policy or
procedure, regardless of the need for change.
Primates do like to mark their territory.
But one of the cardinal rules of bureaucracy is
“If it ain’t broke, don’t fix it.” Some people are
eager to embrace new technology, so that they
will have bragging rights at cocktail parties.
These are often the same people who buy riding
mowers for their postage stamp lawns.
But there are times when change is
justified, if it is the right change.
And sometimes, any change will
yield improvements in
productivity, primarily because
people appreciate being noticed
(even if it is negative attention).
Consider the Hawthorne Effect.
Named for the Western Electric
Hawthorne Works in Cicero,
Illinois, Between 1927 and 1932
professor Elton Mayo reviewed productivity and
work conditions, starting with lighting and
humidity, then addressing psychological aspects
of the work group (changing break times or
working hours, applying different managerial
style, or creating a sense of competition between
work groups). Every change yielded
improvement in productivity because people act
differently when they know they are being
observed.
Keeping in mind the X, Y and Z types of people
working for you, some will improve out of fear
of retribution (curtailing personal phone calls,
double-checking their figures, improving
attendance and punctuality). Others will
improve because they want to be noticed in a
positive sense (even if you have no ambition to
higher office, positive feedback is an uplifting
experience).
Of course we do not advocate change for the
sake of change. Bureaucratic inertia (or tight
budgets) usually ensures this. Then there is the
bureaucratic equivalent of the Hippocratic Oath:
“When in doubt, do nothing.” Some things have
a habit of sorting themselves out. When an
unwelcome trend is identified, the rules are
changed. Some situations are transitory (snow
plows are a seasonal affair, disaster movies
notwithstanding). And sometimes, the people
most affected by a trend look for solutions
outside traditional channels.
THE INTERNAL CONTROL ACT
There are cynics who feel that the Internal
Control Act is just another meaningless
fad – and it will be a meaningless fad
unless it is embraced by executive staff,
managers, supervisors, and rank & file
employees. The Internal Control Act
requires agencies to engage in periodic
review of their internal control systems –
which means identifying those
procedures, measuring productivity
(qualitatively and quantitatively), and
assessing the risks inherent in such operations.
When properly implemented, those “annual
nuisances” can become an important
communication tool for you to get the attention
you need to resolve a long-standing problem.
Reallocating staff due to retirements and
reductions in force requires a reprioritization of
an agency’s mission and functions. It also
requires training for those assigned to new roles
and responsibilities. It may also require new
procedures, or integration of data between units.
Ideally, an internal control review would depend
on ongoing monitoring of key functions, not a
perennial paper chase. There are three standard
ways to monitor a situation, be it a
licensing/registration operation, fiscal audit or
UN peacekeeping mission:
Observe – Interview – Document.
 Internal Control – More Than a Good Idea – It’s Also the Law!

By Observe we are talking about using your
eyes and ears to monitor the operation. A good
shop foreman knows by sound alone whether a
printing press is functioning properly,
or if the staff are keeping
busy. Are you getting
the expected results
at the end of the
day? Are people
ebullient or
exhausted at quitting
time? And yes, even a sense of
smell can come in handy. Factory workers
know the value of good ventilation, and the
harmful effect paint and solvent fumes can have
on their bodies. There is also the “sense of
smell” an account clerk can develop processing
vouchers, or the “sense of smell” an auditor taps
into instinctively when reviewing questionable
transactions.
progress. Checking dates (prompt payment
legislation is only one issue – delays in
transaction can cost more than money).
When you are observing-interviewing-
documenting, avoid the tendency to second
guess your staff. Avoid the tendency to think
you know more than they do. Approach the task
with humility, not arrogance, and this will
communicate to your staff that “you are all in
this together”.
To these three trusted techniques, I would add a
fourth: Confer.

By Interview we are talking

about talking to your people,
both new employees and
seasoned staff. Ask them
questions about their work. It has been said that the Army is run by its
Are they following the Sergeants. Generals may plan campaigns,
proper protocol? Are they colonels may issue edicts, and lieutenants (fresh
keeping up with the out of Officer Candidate School) may think they
workload, or are they cutting are giving the orders, but it is the wise, seasoned
corners to avoid backlogs? sergeants who make things work.
Do they have any ideas on
how to improve the Think of yourself as a sergeant, not a general.
operation? Do they fully Confer with other sergeants. Develop a network of
understand WHY they do what they do? people you can compare notes with, vent your
frustrations, ask questions, or pool resources.
By Document we are talking about Perhaps your predecessor is still available for
manual and computer record- consultation. There is no need to supervise in a
vacuum. No matter what size your agency, there are
keeping. Sampling trans-actions
people you can turn to for specialized assistance (be
for anomalies (often with it training, information technology, labor relations,
computer technology, methods and procedures, or EAP). Don’t be afraid
you can filter ALL to ask for help.
transactions for glitches).
Double-checking figures, If you must sweep something under the
verifying signatures, carpet, remember - that carpet was provided
setting up tracking by the low bidder.
systems to document
 Internal Control – More Than a Good Idea – It’s Also the Law!
MASTERS OF THE UNIVERSE
In Tom Wolfe’s best-selling novel, Bonfire of
the Vanities, one of his characters, a Wall
Street bond trader, proclaims his invulnerability,
saying that he is one of the “masters of the
universe.” Such invulnerability claims are
usually signs of adolescence. A teenager is sure
that he/she will never get hooked on drugs,
never catch VD, be able to beat that train to the
grade crossing (usually on prom night, after a
lot of heavy drinking).
Tom Wolfe’s novel (based in New York
City) serves as a fascinating microcosm
of that urban environment, with
different characters – in different
walks of life – living parallel
existences. What they all had in
common was “living on the edge”
or “living beyond their means”,
prompting them to engage in
various unethical or self-
destructive behaviors. The
movie was terrible, but the book
is an excellent read.
No, I don’t get a commission
from Barnes & Noble. I mention this book as a
lead in to the eternal Internal Control issues of
fraud, waste and mismanagement. These
same issues are the raison d’être (reason for
being) of the Inspector General’s Office.
The Governor’s Executive Order No. 39
(issued June 17, 1996) requires all State
employees to report instances of fraud, waste or
mismanagement to the Inspector General. “Any
state employee who reports wrongdoing will
receive "whistle-blower" protection against
dismissal, discipline or other adverse personnel
action.” This is not to promise that you will
win a popularity contest, get promoted, or be
named as Employee of the Year.
The key provision of the Executive Order
affecting all State employees is:
“Every State officer or employee in a
covered agency shall report promptly to the
State Inspector General any information
concerning corruption, fraud, criminal
activity, conflicts of interest or abuse by
another state officer or employee relating to
his or her office or employment, or by a
person having business dealings with a
covered agency relating to those dealings.
The knowing failure of any officer or
employee so to report shall he cause for
removal from office or employment or other
appropriate penalty. Any officer or
employee who acts pursuant to this
paragraph by reporting to the State
Inspector General improper
governmental action as defined
in Civil Service Law Section 75-
b shall not be subject to
dismissal, discipline or other
adverse personnel action.”
Take a close look at the above
paragraph, then ask yourself
“Do I know any “Masters of
the Universe’?” Worse yet, are
YOU one of these myopic
creatures? You probably know
what constitutes corruption or fraud (rigged
bids, buying overpriced goods and services from
relatives or cronies, bribery or kickback
schemes), but what constitutes “abuse?”
How about time and attendance ambiguity? Is
someone really working in the field, or working
at home, when they say they are? Did they
really put in those extra hours of overtime, or
did they slip out once the boss went home? Do
they tend to take an extra-long lunch hour every
payday (without charge to accruals)? What
about all those executives who go to a daylong
conference, yet never seem to attend the closing
session (which is probably about the important
of internal control)?
 Internal Control – More Than a Good Idea – It’s Also the Law!
Then there are those who use their assigned
State vehicles to commute to the office, take
extensive side trips on the State’s dime, talking
to sweethearts on their State cell phone as they
drive (and probably not hands-free). Yes, just
like sports celebrities who start buying hard
drugs with their signing bonuses, there are
“Masters of the Universe” near you who let it all
go to their heads. The fancy titles, private
offices, free long distance, State cars and private
secretaries. They consider the accoutrements of
office as personal prestige items, not tools to get
the job done.
When you work for the State, it is pretty easy to
figure out how much everyone is making. Just
download the salary schedules from the Internet.
Most of you reading this are probably struggling
to keep pace with gargantuan monthly mortgage
payments; a car loan with seductively low
interest – but equally low down payment;
orthodonture for the kids (maybe even private
school tuition, not to mention $100 sneakers that
only last a semester).
So it is only reasonable for you to wonder about
bosses or co-workers who appear to be living
beyond their means. Maybe the do have a rich
aunt, or a winning lottery ticket, or made a
killing in the stock market. This is not to
suggest that you start spying upon them in
Orwellian 1984 style. But it does suggest that
as part of your routine day-to-day work, you
remain alert to “anomalies” – i.e., things that
don’t make sense. Like irregularities in
purchasing, absenteeism, possible no-show or
ghost employees (who just love direct deposit),
wasteful practices (like travel junkets to
expensive conferences in Las Vegas, while the
rank and file can’t get their employer to cough
up $99 for a one-day, local seminar).
So “What’s in it for me? Why should I risk
my career to report wrongdoing?” Chances
are, even if the long arm of the law reaches out
and nabs an employee on the take, no one will
blame you. After all, it’s not as if you approved
their activities. Or is it? Were you pressured to
authorize payment to a vendor, when your
instinct told you otherwise? How about
approving an applicant for government funding
because they were the commissioner’s nephew?
Was the commissioner even aware that a
relative had approached your agency for
funding?
Worst-case scenario: the local papers uncover
something smelly via the Freedom of
Information Law (probably tipped off by a co-
worker who decided not to trust the Inspector
General with that information). Your name gets
dragged through the mud, even though you did
not personally benefit by the suspect activity.
The commissioner embarrasses the governor, is
forced to resign, and deep in his heart of hearts,
blames you for never warning him that
“something is rotten in the state of Denmark.”
And the local press won’t follow Roberts Rules
of Order, or rules of evidence in speaking and
speculating. Not even the UCMJ (Universal
Code of Military Justice). No blindfold, no
cigarette. You will never make it to SG-27
now. Unless you are an SG-31.
Executive Order No. 39 does say “The knowing
failure of any officer or employee so to report shall
be cause for removal from office or employment or
other appropriate penalty.”
Maybe you will never pay a penalty for looking the
other way, but then how does that make you feel
when someone around you is pilfering or
profiteering, lording it over legitimate workers.
Acting like the Aesop’s grasshopper, treating you
like an ant.
Is there a scandal waiting to erupt in your shop?
And is your signature on any of the paperwork?
A partial list of Governor Pataki’s Executive Orders
(134 of them at last count) is available online at the
Governor’s Office of Regulatory Reform:
http://www.gorr.state.ny.us/gorr/executive%20orders.htm
 Internal Control – More Than a Good Idea – It’s Also the Law!
PLAUSIBLE DENIABILITY
You’ve all seen the movies. Our Commander-
in-Chief is stunned to learn that there are aliens
in formaldehyde at Area 54. Or the CIA has
replaced a world leader with a look-alike actor.
Or the Pentagon has a spare space shuttle known
but to a few. When the President asks “Why
wasn’t I told?”, the answer is “plausible
deniability.”
Well-meaning Presidential aides think they are
protecting their leader by shielding POTUS
from the truth.
Such melodramatic moments don’t cut it in the
real world. If something happens on your
watch, it won’t matter whether it ever made it to
your in-basket. Print and media journalists will
vivisect your administration gleefully.
Advocacy groups and partisan politicians will
vilify you. Small dogs will nip at your ankles.
Maitre-d’s will lose your reservations.
Maybe this doesn’t matter to you. You’ve got
37 ½ years of State service under your belt, and
Florida has no extradition treaty regarding
incompetent bureaucrats. If so, read no further.
But if you care about your reputation, your
career, or better yet, the people of New York,
then you will want more than plausible
deniability to support your administration. That
is where two magic words come in:
Reasonable assurance is not a “get out of jail
free” card, nor is it a money-back guarantee that
things can’t go wrong. It is the recognition that
you have taken appropriate steps to minimize
the likelihood of significant fraud, waste or
mismanagement. You have internal controls
(management controls) in place that are
proportionate to the risks identified. You have
considered both the likelihood and magnitude of
such risks – be it life-threatening, financially
compromising, or disruptive to your program.
Reasonable assurance depends on a number of
things – like recognition of legitimate risk (no
Hollywood meteor disasters or white sharks,
please), and open, honest communications
involving management and line staff (no buried
Morton Thiokol memos about Space Shuttle O-
rings). But most of all it depends on people –
your people.
Article 54, S 950 of the Internal Control Act
defines “internal control” as
“a process that integrates the activities,
plans, attitudes, policies, systems, resources
and efforts of the people of an organization
working together, and that is designed to
provide reasonable assurance that the
organization will achieve its objectives and
mission. The objectives of an internal
control system include, but are not limited
to: the safeguarding of assets; checking the
accuracy and reliability of accounting data
and financial reporting; promoting the
effectiveness and efficiency of operations;
ensuring compliance with applicable laws
and regulations; and encouraging adherence
to prescribed managerial policies. Internal
control review processes are used
periodically to evaluate the ongoing internal
control system and to assess and monitor the
implementation of necessary corrective
actions.”
Yes, that is a mouthful. But all these goals can
be met with smart administration.
Work smarter, not harder
This vicious phrase, as beloved as “knowledge
is power” and “the check is in the mail” is
usually uttered by an unimaginative executive or
a long-suffering budget analyst, when resources
are not adequate to the task at hand. Retirement
incentives, reductions in force, or reassignment
 Internal Control – More Than a Good Idea – It’s Also the Law!
of staff to other responsibilities all conspire to
tell you the traditional way of doing things is no
longer the answer.
In some instances, you need to take calculated
risks – inspecting pushcarts once a year, rather
than once a month. Licensing drivers for five
years, not three. Sampling 5% of income tax
returns over $80,000, rather than a 10% sample
of those over $60,000.
In other instances, you need to explore new
methodologies to collect and analyze data (e.g.
scan applications into a computer system, then
deep-six tons of paper).
Yes, there are training gurus who will insist the
solution is to cross-train all your staff, so that
they can be assigned more flexibly to fill arising
need. But the weeks of training required to do
this will take them away from their current
responsibilities.
Sharing Power
One, often overlooked solution is to share power
with your staff. Remember the little Dutch boy?
Sure, you can plug a few holes single-handedly,
but when you run out of fingers, you need to
solicit additional help. I am not recommending
a press release or guest spot on Charlie Rose. I
am recommending honest two-way
communication with your staff. Let them know
you have a problem, whether it’s “Louise is out
on Worker’s Comp” or “we have another
unfunded mandate.”
Get a little brainstorming session going. Gain
perspective and insight into the problem. Open
the floor to suggestions. Be gentle with the
impractical. Look for examples of duplication
of effort or waste motion.
If turnaround time is an issue, think like a
factory foreman. How does the assembly line
flow? Are there bottlenecks in the overall
process? Are some units waiting for work,
while others are drowning in it?
You will have to take some of the feedback with
a grain of salt (photo courtesy of Smithsonian
Institution).
After all, you’ve probably kept some of your
staff walled off into tiny confines and limited
functions. People work best when they can see
the big picture, put that is probably not the
bureau you inherited with your last promotion.
Now is your chance to change that.
We’ve always done it that way” no longer
matters.
Sharing power is a strange thing. In the 20th
century, we thought there was only so much
power to go around, that sharing what we had
with others would sacrifice the power we did
have. Little did we suspect that sharing power
actually creates more power – like a breeder
reactor creates more fissionable material to
power additional reactors.
Maybe the toxic byproducts of nuclear power
make you nervous, but the byproducts of
sharing human power are far from toxic. Surf
the Internet and you will find “power sharing”
under discussion by feminists and theologians,
military specialists and accountants,
international aid workers and West Wing
strategists. Sharing power takes away the us vs.
them phenomenon - where two opposing sides
neutralize one another, and nothing positive is
accomplished.
 Internal Control – More Than a Good Idea – It’s Also the Law!
Right now a major power sharing experiment is
underway in Iraq, hoping that Shiia, Sunni and
Kurd can work together to establish a rule of
law, squelch insurrection, and create a
progressive society.
A more esoteric version of power sharing
involves the Search for Extra-Terrestrial
Intelligence (SETI). Individual PC’s scattered
across the Internet are invited to participate in a
data processing effort (presumably data received
by radio-telescopes), that takes advantage of
down-time (e.g. when screen savers would kick
in) from all participating computers to create a
gigantic, virtual machine.
Of course we are still searching for terrestrial
intelligence. And that’s where you come in. If
you are not tapping into all the mental resources
at your disposal, you are wasting time, money,
and staff talents.
Be Ruthless
Every thing you and your staff do must
contribute to meeting your goal. Or else it is
just contributing to your administrative
overhead. Sure, there are lawyers and
accountants looking over your shoulder, to
make sure everything is legitimate and
accountable. But you are your staff are the
arbiters of the procedures you employ. Is there
data on a form, or a required field on your input
screen which add nothing to the process? The
U.S. Census likes to ask lots of questions every
ten years, though only a handful relate to its
original purpose (determining representation in
Congress).
If you are ordering shoes from L.L. Bean, they
don’t ask you for your hat size. Take a close
look at the data you process, and weed out the
inconsequential.
Remember too, there is a big difference between
efficiency and effectiveness. You may be
producing buggy whips with incredible
efficiency – holding down labor costs,
minimizing scrap, recycling tanning chemicals,
but sales outside of Lancaster, Pennsylvania are
less than brisk.
You are a leader, not a follower. When you
identify useless appendages, vestigial
regulations, counter-productive procedures and
fossilized forms, you have a responsibility to
confront such situations, and communicate up
the line to change things.
The Internal Control Act insists that you
encourage “adherence to prescribed managerial
policies.” It is easier to do that when the
policies make sense.
 Internal Control – More Than a Good Idea – It’s Also the Law!
IDENTITY THEFT
reported by someone claiming to be Tim O’Toole
No, it’s not about someone pretending to be heir
to the throne of Lower Slobovia. Nor is it likely
that someone will undergo plastic surgery so
they can attend your high school reunion, as
you! Identity theft is just the latest edition of an
age-old tradition. It is no longer cost-effective
to break into your home to steal your property,
risk apprehension, then fence second-hand
goods at a considerable mark-down.
It’s much more efficient to purchase brand new
goods, with warranty, and let someone else pay
for them. Free shipping and no sales tax are a
bonus for the digi-thief.
You’ve probably seen the movie
Catch Me If You Can, about
Frank Abagnale – a child prodigy
who started with a PanAm decal
from a Revell model plane, then
parlayed that into millions of
dollars in bad checks. After a
miserable stint in a French prison,
Frank reversed course, and now
heads a major anti-fraud company
helping defend corporations from
forgery.
But there is a new generation of
con artists out there (as featured
in a current credit card commercial), who
recognize the weak underbelly of modern e-
commerce.
Using psychology and technology, rather than
lock picks and windows shims, they are
beginning to cost us real money, even by
Pentagon standards.
On Thursday, February 26, 2004 the New York
State Internal Control Association featured a
presentation on Identity Theft by John J.
Sennett, a recent retiree of the FBI. Sennett is
now employed by the Department of Public
Service as their Director of Utility Security.
While acknowledging that the Secret Service1
are the experts in this field, Sennett’s
presentation offered intriguing insights into the
criminal mind, and the “socially engineered”
mind of the victim.
His presentation also awakened some family
memories for me, which will inevitably intrude
without warning in this article. But here goes:
Once upon a time we all lived in small towns,
and like the bar in Cheers, everyone knew your
name. You shopped in person at local stores,
and paid cash, or ran up a tab at the company
store. Your face and your signature were the
only identification you needed.
Then Social Security arrived, to defend us from
total penury and starvation (there
was a lot of that going on after
1929). A generation ago, a sign
of maturity was getting your own
checking account after you
finished school and were
gainfully employed. Your
employer paid you by check, and
you paid your recurring bills by
check (e.g., phone, electric, rent,
car insurance). You probably
bought groceries by check once
you started feeding more than one
of you.
Credit cards started happening with gusto in the
60’s. I know this because my father retired
from the FBI in 1965, to take a job as Vice
President of Diners Club, the leading
entertainment credit card of that era. Would
you believe way back then, there were people
forging credit cards? Charges over a set dollar
amount had to be approved by phone call from a
restaurant or hotel to Diners Club.
Waiters talked to human beings at 1 Columbus
Circle, and everyone was happy. The diner was
happy because he or she had just impressed a
1
This will make my brother happy. He specializes in
collaring Nigerians who engage in imaginative banking
practices in North Carolina.
 Internal Control – More Than a Good Idea – It’s Also the Law!

business contact, was close to closing a big deal, with lots of time on hold being told your call
and had his or her employer pay for the lobster was important).
and champagne.
Now when we talk of “identity theft” we are
Then some unscrupulous employees started talking about two technically different items:
keeping track of credit card names and numbers,
selling the data to counterfeiters in Queens, NY • Account Theft – a stable indignity,
who could print and emboss some very whereby someone gets a hold on an active
authentic looking credit cards. The phony cards credit card number, and via Internet or 800
might have a useful shelf life of only 30 or 45 number, orders merchandise to be shipped
days, but each card had a high or open-ended to a different address;
credit limit, so it was worth the effort. In those • Identity Theft – a growing phenomenon,
days it was said that you could steal more with a whereby someone uses your personal
briefcase than you could with a gun. descriptors to open up new credit accounts,
then runs up mega-debts in your name.
Today, you don’t even need the briefcase.
In the first example, you may realize something
Enough preamble, here’s the meat of John is wrong when you get your next credit card
Sennett’s presentation. statement. In the second example, you may
It’s now the 21st Century, and banking, never see a bill until a collection agency knocks
commerce and the Internet have changed the on your door demanding repayment of $30,000
rules of the game. It all started toward the end for that fuschia Lexus.
of the 20th Century with the proliferation of Complaints to the Federal Trade Commission
credit cards. Consumer-oriented have been doubling annually for the
Visa, MasterCharge, and Discover all
eclipsed the more effete titans (Carte …it was said that past few years regarding that second
example (250,000 complaints in
Blanche and Diners Club), while you could steal 2003). Losses to businesses are
American Express picked up the more with a now $32.9 Billion (an average of
corporate side. Following Sears, briefcase than you $10,200 to each business), while
Roebuck’s lead, more and more could with a gun. losses to consumers total $3.8
companies turned to color catalogs to Billion (an average loss of $1,180 to
ply their trade, as 800 numbers Today, you don’t every victim).2 What’s worse, the
replaced expensive bricks & sticks even need the average victim of identify theft will
stores. Add the Internet and dot.com briefcase. spend an average of 60 hours re-
websites, and “distance shopping” negotiating a good credit rating, and
became the new reality. resisting the bill collectors.
Teens who used to steal hubcaps now learned To understand how we are being victimized by
how to hack into mainframe computer systems this new technology, we need to look at human
with lowly Commodore 64 computers and 300 psychology. After all, most of us are social,
baud modems. If your purse or wallet were gregarious creatures, who want to get along,
stolen, you worried more about the data in them, play well with others, learn to share, and not run
than the dollars lost. Laws were passed to limit with scissors.
the honest consumer’s liability to $50 for each
lost or stolen credit card. If you didn’t keep a
copy of that lost data elsewhere (names, 2
On the plus side, we are less frequently bothered by
numbers and 800 phone lines for each credit boiler room con artists and telemarketers at dinner time.
card; drivers license, bank number, etc.) you On the minus side, it’s a bit like termites eating away at
the foundation of your house. You don’t know there’s a
would spend hours retrieving that information problem until it’s too late.
 Internal Control – More Than a Good Idea – It’s Also the Law!
John Sennett referred to something called the
Six Peripheral Roots to Persuasion3:
1. Authority - we tend to believe something is
true, if it is stated by, or attributed to an
authority figure;
2. Scarcity – this item is in short supply, or on
sale for a limited time only, but you must act
quickly;
3. Liking/Similarity – we want people to like
us, and we like to relate to folks with similar
interests or history (the old college tie,
service buddies, ethnic or religious
affiliation);
4. Reciprocity - I’d like to do something nice
for you, you’ve been such a nice audience. I
can offer you a free 56K modem, all you
need to pay is the shipping and handling
(which will cost twice what the item is
worth);
5. Commitment and Consistency – we want
to “be nice”, and keep or promises;
6. Social Custom – we tend to value and trust
the written word, even if it’s just dots on a
computer screen, or an amazing offer in an
e-mail.
Hearing John’s words, I was reminded that this
is an election year, and a lot of the powers of
persuasion relate to more than e-commerce
scams.
Having dissected our own brains, Mr. Sennett
went on to describe the mind-set of the
perpetrators, who have nothing but contempt for
their gullible marks. They refer to a victim as a
“mooch”, saying the victim wanted something
for nothing, and instead them gave them
“nothing for something.”
I’ve always heard that “if it’s too good to be
true, it’s too good to be true”, and “it’s hard to
cheat an honest man”. We are always looking
for a bargain. John Sennett is into power tools4,
and has been known to “distance shop” for
routers in the wee hours of the morning.
3 5
Dave Barry might think this would make a great name
for a rock band.
4
Binford Tools meets Benford’s Law.
Before getting into a discussion of tips for
protecting yourself from scams, John offered
more anecdotes on identify theft, including one
Arab terrorist who was a sleeper agent in
Canada. Acquiring the baptismal certificate of a
dead Québecois, he was able to upgrade that to a
dozen identification items. (Even then, an alert
Immigration official prevented him from
completing his mission when he attempted entry
to the United States via the state of
Washington).
The scams are not limited to credit card
purchases of durable goods. Verizon now has
400 investigators on staff delving into phone
bills charged to someone else’s credit card
(hopefully not yours). The electric utilities have
a similar problem. Yes, there are conveniences
to digital shopping, but headaches as well to the
naïve and gullible.
When questioned about what steps we could
take to avert financial catastrophe, Mr. Sennett
admitted he didn’t own a shredder, but he did
reconcile his bank statements promptly,
reviewed his credit card bills (more power tools)
immediately, and tempered his “socially
engineered” gullibility with a healthy dose of
“buyer beware”.
He recommended we each photocopy the
contents of our wallets, and store that data in a
safe place. Be sure to have current anti-virus
software on your computer (to protect yourself,
and be a good citizen, avoiding infecting
others).5
We are more likely to be victimized by bogus e-
commerce come-ons. Given the large scale of
the Internet, a new “digital boiler room” scam
need only succeed in 1/10th of 1 %. Encryption
techniques, e-mail filters, additional
authentication measures and even bio-metric
devices can help reduce the chance of chaos.
Editor’s Note: A Firewall is critical if you have Internet
service via a cable modem (like Road Runner). A firewall
is desirable even if you are using a phone modem.
 Internal Control – More Than a Good Idea – It’s Also the Law!
Sennett recommended you go to the big three
credit reporting agencies annually to review
your ratings. They are Equifax, Experian and
TransUnion. If you lose your Social Security
card (or someone starts claiming your number),
call the Social Security Administration at 1-800-
269-0271.
The Federal Trade
Commission has a website
devoted to ID theft:
www.consumer.gov/idtheft
Their website offers valuable
instructions, plus an
AFFIDAVIT form (PDF file)
for those of you who may
have been the victim of
identify theft.
Also, a new law is taking effect in New York
State this year, requiring all new ATMs to print
only the last five digits of your account code on
receipts (and existing machines must be
retrofitted or replaced by 2007).
Sennett also warned us of “frame spoofing”, or
those insidious pop-up screens that appear when
using the Internet. They look genuine, but can
draw you into a scheme, and lure you to reveal
your credit card number. And those on-line
auctions play up the “scarcity” of collectibles,
drawing absurd bids, even if the merchandise is
delivered.
The follow-up discussion by the group yielded a
few more valuable observations and ideas. For
example, have one credit card with a low credit
limit that you use of on-line shopping (save
your Platinum card for impressing friends at
restaurants). Watch out for spam that looks like
authentic, incredible offers from major
corporations or absurd discounts on name-brand
items. For that matter, watch out for e-mail
links that take you to what looks like a
respectable website (complete with color logs).6
6
As good citizens we need to discourage spam, by NOT
responding to such unsolicited offers. When you are
ready to buy something, go to www.walmart.com or
www.victoriassecret.com . In such instance you have the
They are just “phishing” for personal
information about you (credit card numbers,
date of birth, bank account, mother’s maiden
name). Delete any letters you receive from
former oil ministers of Nigeria, who need your
help moving an account off-shore. Think of
unsolicited e-mail as the equivalent of a stranger
knocking on your door. Do not
provide personal identifying
information to anyone over the
phone, or via e-mail or Internet.
If your bank needs to be
reminded of your mother’s
maiden name, tell them you
will call them back, then phone
your local branch manager.
I’d like to close on an upbeat,
personal note about identity theft. The year was
1967, and the FBI were trying their damnedest
to get something on Joe Bananas, the crime
family capo from New York City. His business
associates (euphemism) had extorted the open-
ended use of a Diners Club card from a losing
gambler. Said card was then used by Joe’s son
Salvatore, then sanitized as Bill Bonnano, living
in Arizona, riding horses, wearing southwest
style clothing, and acting respectable. When the
gambler tired of the outrageous “vigorish”, he
went crying to Diners Club, and they succeeded
where the FBI had failed – getting an indictment
and conviction of Salvatore for using someone
else’s credit card. My father’s former co-
workers were chagrined (to put it mildly), but
they learned from the experience.
We should all learn from our experiences.
Did I mention that the US Secret Service has a
fascinating CD-Rom about electronic evidence,
credit card forgery (“Forward Edge”)? Not
available in stores. They also have a detailed
guide to seizure of electronic evidence at
http://www.secretservice.gov/electronic_evidenc
e.shtml .
assurance that you are going to the real on-line store, not a
spoof. Of course, OFT’s WebSense will block the second
site, but you get the idea.
 Internal Control – More Than a Good Idea – It’s Also the Law!

WHAT KIND OF LEADER

ARE YOU? Impoverished You don’t care much for the
job, or the people in your
While it must be recognized that there are organization, so your focus is
leaders in every field, leaders in every walk in on the minimum effort to get
life, and leaders at every level of an the job done, with limited
organization, this article is directed at YOU, interface with your staff.
because you are an executive, a decision-maker,
a policy setter. One who has considerable Country Club Your organization is pretty
influence on the operation and effectiveness of much a sheltered workshop,
your agency. pampering staff, creating a
A 1969 book by Paul Hersey and Kenneth friendly, family organization
Blanchard, Management of Organizational where nothing gets done, but
Behavior1 took a close look at several models nobody cares, because the staff
of leadership, notably the Ohio State model, the meetings serve great
University of Michigan study, and the refreshments.
Managerial Grid (popularized by Robert Blake
and Jane Mouton). While some of the language Task- You are obsessed with getting
in these studies requires a healthy vocabulary Oriented the job done, without
and post-graduate education, the Managerial kowtowing to human needs.
Grid should be familiar to most of you: You rant and rave when staff
have the audacity to call in
sick, or take maternity leave,
scream when the Legislature
delays approval of your budget
request, and don’t return phone
calls from the Employee
Assistance Program (EAP)
liaison.

Middle of Some may view this style as

the Road mediocrity, others as sanity.
You’ve got to balance
competing demands –
recognizing staff and resource
limitations, while still trying to
get the job done without
obsession. And parts of the job
are impossible anyway.
In 25 words or less, the Managerial Grid looks
inside your head, to determine your degree of Team- Utopia, here we come. You
concern for getting the job done (production) vs. Oriented have somehow managed to
your concern for the social order and motivation recruit and retain highly
of your staff (people). motivated staff, who are on
board with you, delighting in
1
Management of Organizational Behavior: Utilizing getting the job done in the
Human Resources, Paul Hersey and Kenneth Blanchard, most efficient and effective
Prentice-Hall, Inc, Englewood Cliffs, NJ, 1969.
 Internal Control – More Than a Good Idea – It’s Also the Law!
manner.
You get bonus points if you recognize Team-
Oriented as the ideal leadership style. This is
the style you should espouse during Civil
Service oral examinations.
More realistically, most of you are probably
somewhere around the Middle of the Road in
style. You started out with high ideals,
imagining an efficient and effective work
environment, presuming all your staff would be
educated and motivated. But then four weeks
latter when your first paycheck cleared the
Comptroller’s payroll system, you noticed that
even those staff with good attendance patterns
had their limitations.
Like the secretary who is still tangling with MS
Word’s mail-merge feature. The motor vehicle
operator with a drinking problem. The lounge lizard
hitting on all the female staff. The whiner who is
always complaining about the job, the people, the
computer system, the forms designs. The veteran
employee who has been passed over for promotion
too many times, and is now just counting the days
till retirement. You may also be saddled with a
computer systems analyst who insists the solution to
everything is a complicated, artificial intelligence
system that only she can maintain.
You’ve probably also identified at least one
employee who makes work avoidance an art
form, and another who thinks they should have
been given your job.
So how do you
motivate these
disparate elements to
share your vision of a
Team-Oriented work-
place, where people
are collegial and
collaborative, the
focus is on getting the
job done effectively and efficiently, without
concern for individual egos and rewards?
Here’s a few practical hints:
• Don’t lord it over them. Perhaps you are
believed by the Front Office, or have
friends in high places. That will not
impress your staff.
• Set a good example. Don’t expect your
staff to work longer hours than you put in.
This may be problematic with flex-time.
Still, the rest of the crew get paid lesser
salaries for being on hand 37 ½ hours a
week. It wouldn’t kill you to give 40 hours
to the State.
• Listen to your staff. There may be people
who have been there longer than you, who
have a few ideas on the subject (and may
have been rebuffed by past administrators).
There may be people new to the operation
who have relevant experience elsewhere, or
fresh perspective on an operating problem.
• Be scrupulously honest when it comes to
management perks. That private office is
provided to you to get things done, not
have lots of personal phone calls with your
fraternity brother (or sorority sister) in
Cleveland.
• Avoid travel junkets. Don’t spend all of
your training budget on a convention in
Las Vegas. Consider group memberships
for your staff, so that all your workers can
get in on training opportunities, with
member discounts.
• Don’t stretch the truth. If you leave the
house at 7:30 on a business trip, don’t
pretend that you left at 6:30 so that you can
qualify for a free breakfast (like the new
Awesome Omelet at Embolisms’ R’ Us).
Besides, an auditor will be checking your
EZ-Pass records.
• State cars are for State business. Too
many would-be leaders have sacrificed
more than their reputations, treating the
company car as a status symbol. State
agency license plates are distinctively
numbered – don’t park in front of an
establishment that would offend your
mother.
 Internal Control – More Than a Good Idea – It’s Also the Law!
• Cell phones are not toys. Sure it may be
capable of text messaging and low-
resolution photos. Let the middle school
kids enjoy those features (and let their
parents pay dearly for them). Besides, you
will be so busy motivating your staff one-
on-one, that you won’t have time to jabber.
And turn the rude thing off when you are at
a conference, in a restaurant, riding up the
elevator, or at an Inaugural Ball (West
Wing staff excepted).
• Don’t sweep things under the carpet.
Deal promptly and effectively with
situations that adversely affect your staff
and/or your program.
• Don’t pressure your staff to contribute
to your pet causes. Whether it is political,
religious, charitable or social, their time
and money is theirs alone. You do not
want the Ethics Commission to know your
name.
• Don’t play favorites. Sure, some of your
staff are easier to deal with than others, and
some of your staff are more productive.
You are responsible for ALL your people,
so make sure each and every one benefits
from your leadership, and is provided with
opportunities to excel.
• Fight for your people. You are in a chain
of command, which effectively makes you
“monkey in the middle” when problems
occur. This may irritate your own bosses,
but they need to be kept in the loop. Just
be sure you have a list of solutions to offer
them.
Maybe this sounds a bit like “Eight Simple
Rules for Dating My Teenage Daughter”. The
important thing to remember is that you are
NOT a breed apart. Your group may have had
fewer cavities than theirs, but it wouldn’t hurt to
floss after lunch.
You’ve all seen examples of those “clear and
concise” brochures aimed at the rank and file –
insisting that they toe the line on countless rules
and regulations, all in the interest of
accountability. Well take a look at the
alternative brochure “What to Expect from
Management.” The brochure is written from
the perspective of the rank and file – and their
expectations of what managers should do, and
how they should treat their staff. Take a good
look at the brochure, then ask yourself: “Can I
live up to these expectations?”
The brochure (you probably ignored my advice
to read it just now) also details a lot of
expectations for a positive work place - a drug-
free, bias-free sanctuary (unlike the outside
world where parents worry about drive-by
shootings; immigrants, minorities and other
“different” people are demeaned by bullies;
hospitals double-bill; and hung-over mechanics
both a simple oil change).
Come quitting time, each of your staff must go
out and deal with that outside world (including
gasoline costs, heating bills, supermarket lines,
traffic jams, etc.). Wouldn’t it be nice if they
could focus on the job at hand during office
hours? Read the brochure.
 Internal Control – More Than a Good Idea – It’s Also the Law!
Internal
Control ~
Grasping At
Straws?
For years, managers and executives in the private
and public sectors have sought foolproof ways to
improve their bottom line, be it enhanced profits
or improved services. Those of us in government
service may recall past and current attempts by
New York State to improve its operations. We
have seen a wave of centralizing and
decentralizing services, be it computer support,
fleet management, telecommunications – each
change an attempt to enhance performance
beyond mediocrity.
Back in the 1960’s, the State of New York
employed a variety of management
improvement tools and techniques; PPBS
(Program-Planning - Budgeting –
Systems), followed a few years
later by PAR (Program Analysis
& Review). The next wave of
experimentation included MBO
(Management by Objective),
TQM (Total Quality Management)
and HPO (High Performance
Organization) as mechanisms for
improving productivity,
accountability and ultimately the bottom line.
A recent Dilbert cartoon featured our hero of the
cubicle interviewing a prospective employee. We
have a slogan: “All our employees are
empowered”, to which the would-be recruit
parries with “If all your employees are
empowered, why do the need a slogan?”
All these past and current management trends
have many things in common, so let us focus on
the logic of what it takes to run a smooth
operation – especially one with changing
mandates, shrinking workforce and tight budget.
For starters, everything you do in government
should relate back to legislation, be it your
agency’s enabling statute, or a patchwork quilt of
laws and regulations added through the years. If
you cannot point back to such a mandate, then it’s
time to ask some questions.
In each of your operations/pro-grams/functions,
you are trying to achieve one thing, while
avoiding another. Public assistance programs aim
to provide an economic safety net to those in
need, while ferreting out fraudulent activity that
scams the system. Health agencies are concerned
about affordable and professional medical
services, but need to be alert to unethical practices
amongst pharmacies, doctors and business offices
alike. Nuclear regulatory agencies are caught in a
Catch-22, with citizens nervous about radioactive
waste and reactor accidents, while at the same
time our dependence on foreign oil has far-
reaching consequences.
This may seem an awfully Big Picture to those of
you with more mundane concerns, like licensing
day care centers, giving eye tests to drivers, or
dissecting crows and bats to monitor
environmental health. But civilization
as we know it depends on all its
complex parts working efficiently,
effectively, and honestly.
Efficiency vs. Effectiveness
Jargon and buzz-phrases do not
improve communication for the
uninitiated. And pet phrases from various
management theories can age out rapidly. But
there is more than a semantic distinction between
certain pairs of similarly sounding words.
Efficiency – you may be able to process the
paperwork from applicants in record time, at a
rock-bottom price, with every entry scrutinized
for completeness, but
Effectiveness – depends on the front-end of the
process being tied into other activities, to ensure
program goals are met. For example, does anyone
double-check the veracity of the information
contained in the application? Is the information
collected relevant to the program function, be it
licensing, small business loans, employability, or
eligibility for public assistance?
 Internal Control – More Than a Good Idea – It’s Also the Law!
What is Internal Control?
Internal control is NOT a collection of
disconnected processes and procedures. Internal
control IS an integrated approach to sound
management. It may involve specialized
equipment (combination locks, computer
passwords, refrigerator thermometers, smoke
detectors, fire extinguishers, etc.) but most of all it
depends on PEOPLE. People who understand the
why’s and how’s of the program, the significance
of information generated, the purpose behind all
that specialized equipment – and when to ignore
it.
Internal control certainly involves
PROCEDURES – be it OSC payroll requirements,
OGS purchasing, OFT computer security, EZ-
Pass scanners or State Police radar – but each of
these procedures depends on people, people
talking to other people, people entering
accurate/timely data into computer systems,
people following up on problems and exceptions
to the rule.
Know Your People
There are people who are clearly uncomfortable
when we bring up this topic. They think that there
is an ironclad rule of privacy that prohibits them
from learning anything personal about co-
workers.
True, when hiring new workers, there are certain
questions that are rightfully prohibited during the
interview process. Your race, ethnicity, religion,
marital status, political affiliation and sexual
orientation have no part in the
recruitment/selection process, be it for initial
employment or promotion. But this does not
prohibit you from learning a little bit about your
staff once they are on board.
For example, does someone belong to an
organization that is antithetical to the vision and
mission of your agency? Are they working a
second job somewhere that constitutes a conflict
of interest, or interferes with their productivity
and attendance at their government job? You
know what grade level they are – are they living
beyond their means?
Of course, getting to know your people also can
be a positive experience. Your file clerk by day
may be a web designer at night. Your senior
accountant may be a wiz at restoring old Jaguars.
The shop teacher in your facility may be bilingual.
Your youth counselor may be a talented musician.
Just as government is the sum of its parts, we as
individuals are the sum of our parts – our unique
background, education, talents, passions, biases,
ambitions, and even our clinical depressions.
Part of getting to know your people involves
getting to know what they are good at.
Micromanagers plague those who are quite
capable of working without supervision. Laissez-
faire managers are the bane of those who require
constant attention to stay focused on tasks. And
most of your people will be somewhere in
between – excelling at the things they enjoy, and
avoiding the onerous.
Some Definitions
We cannot totally escape some “boilerplate”
definitions of internal control, though we can
discuss them logically.
In New York State government, Internal control is
a process, designed to implement a legislative
mandate, executed by executive, management,
supervisory and line staff, to provide reasonable
assurance that objectives will be achieved
effectively and efficiently, in compliance with
applicable laws and regulations, supported by
reliable financial and program reporting.
Reasonable assurance – takes into consideration
the significance of the program or activity (e.g. its
cost, impact on people, effect on agency
reputation), likelihood of error (some risks go
with the territory), and relevance and affordability
of controls to those risks.
 Internal Control – More Than a Good Idea – It’s Also the Law!
Five Components of Internal Control
Currently there are five major components of a
good internal control system (equally applicable
to large or small organizations):
1. Control Environment
Do you deal directly with the public? In an office or
residential setting? Do you handle large volumes of
transactions, with or without a monetary component?
Does your executive set an example for ethical values
and integrity? Does your agency seek, train and retain
competent employees? What is your management’s
philosophy and operating style? Are you highly
centralized, or are offices/facilities/decisions
decentralized? Is there an independent oversight body
that reviews and evaluates your successes, and your
failures?
Is your workforce stable? Does your agency have a
long-standing, positive reputation in its field? Are the
resources provided commensurate with your
responsibilities? Are your computer networks secure,
your data stable, your offices safe and environmentally
healthy?
If you can answer YES to each of these questions, we
would then ask you if there are any job openings
within your organization. But, seriously, you get the
picture – all these things affect your work, your
agency’s mission, and how you feel about your job.
2. Risk Assessment
Every operation faces internal and external risks – be it
employee pilferage, contractor kickbacks, applicant
fraud, bogus credentials, communicable diseases or
computer network failure. Something as simple as a
faulty smoke detector can interfere with success.
Handling hard currency requires special procedures.
Agencies that serve residential populations in a 24/7
setting must focus on the special risks not inherent in a
9 to 5 office operation. Blacktopping your driveway is
not as risky as bridge and tunnel construction, though
you won’t want to track anything indoors.
Risk assessment is an ongoing process that identifies
the likelihood of a risk, the potential magnitude of a
risk, and the degree to which such risk could interfere
with your agency’s mission and program success. Has
it happened before? Then it will happen again, unless
you establish procedures to control such risk.
3. Control Activities
Policies and procedures can help ensure success, by
controlling significant risks. They include activities
such as approvals, authorizations, verifications,
account reconciliations, operating reviews, protection
of assets and segregation (or separation) of duties.
The challenge for government workers here is to avoid
over-control of insignificant risks, while avoiding
under-control of significant risks. For example,
drivers must have their vehicles inspected annually by
a professional, licensed third party. Getting that
sticker from your brother-in-law who never looks
under the hood may keep you from getting a traffic
ticket, but won’t protect you from that icy hill in
February. By the same token, checking your tire
pressure and oil level periodically is wise, but if you
start doing this twice a day, someone might think you
have an Obsessive Compulsive Disorder.
Your main concern is getting the job done in a timely
and accurate way. Accuracy also means honesty. Get
those three bids in writing from reputable firms. Lock
up valuables overnight. Have someone balance the
checkbook who doesn’t write the checks. Call up past
employers and schools/universities to verify an
applicant’s work history and educational credentials.
Have your fire extinguishers inspected annually, and
recharged as necessary. Change those computer
passwords when an employee leaves your agency, or
your bureau.
We are all familiar with the logical procedures
involved in purchasing – including physical count of
the goods received examination of their quality, date-
checking of dairy goods, etc. But did you know that
the temperature at which crude oil is delivered can
affect how many gallons are actually provided? Was
that shipment of flu vaccine you just received part of a
manufacturer’s recall?
4. Information and Communication
Certainly, those in the military know the value of good
information and communication. Knowing where the
enemy is, where your own troops are, and the location
of innocent civilians are all important elements of war
and peace. The Pentagon may term this military
intelligence, or command & control, but it is what it is.
Phrases like “friendly fire” and “collateral damage”
pop up when communication fails.
 Internal Control – More Than a Good Idea – It’s Also the Law!
All too often in a hierarchical system, information is
“managed”, i.e. it is restricted to a limited few (under
the theory that “knowledge is power”.) Some
supervisors also embrace the Nike slogan “just do it”
when an employee seeks a greater understanding of
his/her role and responsibility.
With apologies to the State Police and Department of
Correctional Services, most of you will never be
instructed to storm a building or tackle a fugitive, so
you should have time for the luxury of knowing why
you do what you do. Knowing “why” may also
improve your chances for finding a more efficient and
more effective way to do your job.
Effective organizations are not afraid of information
and communication. They look upon their employees
as colleagues, are not afraid to answer questions, or
even consider new ways of doing things.
Transforming an ineffective organization involves
more than taking a few HPO or TQM classes, giving
speeches or cutting ribbons. It involves development
of a corporate culture that encourages communication
up and down the ladder, and sideways between
divisions and bureaus. Yes, you should still read the
manual, but comparing notes with your peers can be
invaluable.
Much of what we do in government is repetitive by its
very nature. Every year Taxation & Finance deals
with the same eternal issues. Every year, thousands of
citizens smile into the face of the DMV’s flattering
camera. Every year, the courts deliver thousands of all
ages to our facilities, for education, correction,
rehabilitation, medical treatment and the like. With
long-established processes in place to continue these
activities, there should be time to talk about the job,
compare notes, and envision alternatives.
A side issue for some, but it effects all – open
communication between interested parties, be they
regulators, “stakeholders”, families, advocacy groups,
legislative bodies or advisory groups.
5. Monitoring
On an ongoing basis, managers need to monitor
operations – to assess the quality of the system’s
performance over time. This includes regular
management and supervisory activities, and other
actions personnel take in performing their duties. The
focus should be on critical aspects of an operation to
ensure that key elements are conducted properly.
Where performance falls short of expectation,
managers need to notify those responsible for taking
corrective action, and engages in follow-up activity to
ensure their warning was heeded.
A supervisor “monitors” staff attendance via visual
observation, phone calls, computer log-in and/or spot-
checks on-site. A program manager “monitors” grant
activity through conversations (phone or in-person)
with service providers or clients, or on-site visits to
local service providers. A grant administrator
“monitors” expenditure activity on a periodic basis by
reviewing expenditure reports or claims on a monthly
or quarterly basis, comparing them to projections.
Within the broad category of “monitoring” we can also
place “evaluation” and “auditing”. The distinction
between these activities and managerial monitoring is
primarily organizational.
To ensure independent, unbiased thinking, evaluators
and auditors cannot be part of the operation being
reviewed. Evaluators are frequently specialists in
program areas, employing research methods to
determine the effectiveness of program services.
Auditors (in the past) focused on financial issues,
employing accounting skills to review inventories,
fiscal resources, integrity in payrolls, purchasing and
grants. But more and more, auditors are becoming
management generalists, with a growing
understanding of agency goals, program specialties,
and bottom-line criteria of success. And of course,
auditors will tell you they are there to help you.
Tying It All Together
A good internal control system depends on “synergy”,
i.e., the whole should be greater than the sum of its
parts. The five components discussed above should
form an integrated system that reacts dynamically to
changing conditions. Internal controls are most
effective when they are built-in to an operation, not
added on by some external force. In other words,
don’t do it because the law says you have to do it. Do
it because it makes sense.
Be on the lookout for changing conditions. Staff
turnover, new legislation, demographic changes in
population served, unusual weather conditions,
economic downturn, or even terrorist attack all require
quick response to changing conditions. Youth
facilities and adult correctional facilities must pay
attention to judicial system flow-through, when
constructing and staffing residential facilities. The
Department of Transportation has its hands full
monitoring traffic chokepoints throughout the state
 Internal Control – More Than a Good Idea – It’s Also the Law!

(you may think the Northway is intolerable at rush Case Studies

hour, but we are a distant second place to other
roadways to the south and west). The following Case
Studies depict a proto-
The reasonable assurance doctrine requires that all
typical work process that
five components of your internal control system (a/k/a/
would be influenced by
management control) work together. When they do,
the establishment and
your job is easier. When they don’t your job is
application (or absence)
virtually impossible.
of internal controls.
What Internal Control Cannot Do Trainee(s) would be asked to:

Internal control cannot change a poor manager into a
good one. But it can change a good manager into a
better one, and set the stage for the next generation of
managers. This is an important consideration, given
our rapidly aging work force.
Shifts in government policy or programs, competitors'
actions or economic conditions can be beyond your
control, but at least you will be the first one on your
block to recognize this.
Internal controls cannot guarantee an ironclad defense
against fraud, waste and mismanagement. Human
nature is what it is, and there are those who are
indolent, deceitful and imaginative just waiting to
scam your system.
1. Evaluate the control environment to determine
the level of inherent risk,
2. Determine what controls would need to be
imposed to provide 'absolute assurance',
3. Of those controls, which ones would provide a
satisfactory level of 'reasonable assurance?'
4. How would reasonable assurance controls be
implemented?
5. How might they be monitored?
6. How might communication flow support or
stifle the success of the controls in minimizing
risk/maximizing success?

An internal control system, no matter how well

conceived and operated, can provide only reasonable--
not absolute--assurance that you will achieve your
objectives. Judgments in decision-making can be
faulty. Breakdowns can occur because of simple error
or mistake. Controls can be circumvented by the
collusion of two or more people, and management may
choose to override the system. There are also resource
constraints, and the benefits of controls must be
considered relative to their costs.
Internal control is an essential tool in achieving your
objectives, but it is not a silver bullet. When
combined with well-trained, motivated staff working
within an environment where the goals are clear,
internal controls will enable a manager to successfully
attain their organizational objectives both efficiently
and effectively.
 Internal Control – More Than a Good Idea – It’s Also the Law!

“WE NEVER SAW IT COMING”

FAMOUS DISASTER WARNINGS IGNORED

The O-Ring Failure on the Space Shuttle

One Morton Thiokol engineer expressed concerns about the
effect of cold weather on the o-ring seals of the Space Shuttle
Challenger’s booster rockets. He was told to mind his own
business.

Flight School Training for Arab Terrorists

A female FBI agent (Coleen Rowley) in the Midwest expressed concern over the number of foreign
nationals taking flight training. They didn’t want to know how to land the jets, just fly them. She was
ignored by her bosses – after all, she was a woman. What do they know about terrorists?

BACKGROUND CHECKS

The Walker Spy Family

A low-ranking Pentagon code clerk shows up for work in a brand new, shiny red Ferrari. A rich aunt?
A lottery ticket? Nobody checked. He threw lavish parties, too. Were you invited?

BOGUS CREDENTIALS

Albany VA Hospital
The VA never checked the credentials of a medical researcher,
who doctored his undergraduate transcript (from St. Rose
College), was dismissed from medical school, then played
doctor at the VA, leading to the deaths of cancer patients. The
case has been dragging on for several years. At first the
hospital administration tried to dismiss allegations of
wrongdoing. Now it is going to cost them dearly.

COOKING THE BOOKS

Barings Bank
Singapore trader (Nick Leeson), working without supervision, fluffs up
accounts, engages in highly risky investments, losses totaling 830
million pounds - leading to bankruptcy of firm. He made the losses look
like profits!

Other luminaries in creative accounting:

Arthur Andersen and ENRON (whistleblower - Sherron Watkins);
Parmalat (founder - Calisto Tanzi); WorldCom (whistleblower - Cynthia Cooper)’ Lincoln Savings and
Loan, Tyco (Former Tyco International director Frank Walsh has been arrested and charged with
securities fraud after allegedly receiving a secret $20m (£12.5m) payment.); Lawrence Insurance Group
(Albert W. Lawrence - Llenroc a B & B)
 Internal Control – More Than a Good Idea – It’s Also the Law!

Urban League of Albany

It’s board of directors was a Who’s Who of local politics, including
Albany’s Catholic bishop. But Aaron Dare kept juggling real estate deals,
including a promised jobs/lease arrangement with a suspect telemarketer.
In the end, the entire house of cards collapsed. None of the board members
were held personally liable for the $500,000 owed to the IRS (the ten
members could have each been tapped for $50,000). Due diligence? It
happened on their watch.

Capital Region BOCES

If he had just waited a few more months to retire, the treasurer could have
covered all his tracks. Instead, an inquiry from Schoharie County about a
small accounting error led to discovery of a multi-million dollar
embezzlement. When he retired, he bought a new car, a boat, and a
vacation home. No one would ever suspect!

BOCES RETIREE GOING TO PRISON

Wednesday, November 22, 2000 Page: B1
The former treasurer for Capital Region BOCES who stole $3.7
million from his employer and used the money to buy expensive
cars, homes and a boat, was sentenced Tuesday to five to 15
years in state prison.

Not to be outdone, two Long Island school district superintendents were charged with similar creative
accounting practices in 2004. OSC had a few harsh words to say about the auditor who reviewed
Roslyn (LI) books. That auditor had the account for 12 years. Did I mention the audit firm also sold the
accounting software used by 250 NYS school districts, including Roslyn?
A Grand Island BOCES staffer pled guilty to a mere $40,000 theft. Chump change!

William Cabin and the Lieutenant Governor’s Office

Phantom employees on the payroll let then Lt. Gov. Mario Cuomo’s Chief of Staff buy up lots of Centre
Square real estate. Fortunately, he turned a profit, which kept him out of jail, and gave the State an
excellent return on his investment.

Billie Sol Estes and the Magic Silos

Back in 1961, LBJ confidant Billie Sol Estes applied for some
agriculture loans, using the same handful of tractors and silos as
collateral. He graciously flew the auditors from one side of Texas to the
other, in his private plane, so they could conduct inventory. Meanwhile,
his staff were changing the numbers on the silos, and gluing new serial
numbers over the old on his tractors. Once the paint and glue dried,
he’d fly the auditors back to the other side of the state, so they could
inventory the “additional” property.
Did I mention the murder of USDA staffer Henry Marshall It was
originally ruled a “suicide” – he managed to shoot himself five times
with a bolt-action 22.
 Internal Control – More Than a Good Idea – It’s Also the Law!

ALBANY TIMES-UNION ARCHIVES

ACCOUNTANT EMBEZZLED ALL THE CASH HE WANTED
Friday, June 4, 1993 Page: A1
John James Lugas needed far more than his $26,800 salary as an Air Force accountant to feed an
insatiable appetite for expensive cars, Rolex watches, diamond jewelry and beautiful young women. So
he exploited weaknesses in the Air Force bookkeeping system for three years to make sure U.S.
taxpayers paid for his avarice. He siphoned more than $2 million without arousing suspicions of officials
here at Reese Air Force Base on the wind-swept plains of west Texas, or higher up in the chain of
command.
THEFT CASTS CLOUD OVER SUNYA WEATHER CENTER
THURSDAY, March 29, 1990 Page: B1
Instead of reading the maps in the weather center at State University at Albany, five graduate students
pored over newspaper stories about one of their professors in trouble. Lightning expert Richard Orville
pleaded guilty in Albany County court Tuesday to stealing computer data from SUNYA that he sold for
$604,000, part of which he used to buy a car and a town house.
FORMER BANK AIDES ADMIT EMBEZZLEMENT
Thursday, September 15, 1994 Page: B4
ALBANY Two former employees of Albany Savings Bank pleaded guilty Wednesday in federal court
to stealing more than $47,000 from an elderly customer, using their jobs to create ATM cards to get into
the man's account. Joseph C. Debrango, 46, of Grove Street, Rensselaer, and Robert H. Arket, 36, of
Sanders Avenue, Scotia, will be sentenced Nov. 30 on charges of conspiracy to embezzle bank funds
and of forfeiture.
INSIDE THE EMBEZZLER'S MIND - CRIMINOLOGISTS DETAIL PATTERNS OF MONEY
PRESSURES, ACCESS TO CASH AND RATIONALIZATIONS
Sunday, June 25, 2000 Page: C1
When fallen insurance magnate Albert W. Lawrence diverted $38 million from policyholders,
employees and others for his own purposes, he was following a classic pattern among white-collar
criminals, experts say. First came the financial pressure, then the opportunity to take cash and, finally,
the rationalizations.
State Legislature – interns (sex scandals) – How the might have fallen.
Assemblyman Roger Green – travel abuses lead to resignation
Thruway Authority – Canal Land Deal (overturned by OSC)
4 MTA employees charged 1-12-05 with illegally taking gifts including deluxe meals and gifts from
vendors (chump change -
New York Racing Association (money laundering by pari-mutuel clerks; lavish perks for execs)
New York Bridge Authority – executive resigns in disgrace over travel expense improprieties.
 Internal Control – More Than a Good Idea – It’s Also the Law!

MORE SCANDALS IN THE NEWS (Various Internet Sources)

NYC scandals of 2002 featured an array of miscreants, including:

• Angel Rodriguez: The City Council member from Brooklyn resigned after pleading guilty to
taking bribes to win his support for construction of a supermarket in Red Hook
• Anthony Serra, a Rikers Island prison official forced to resign for allegedly coercing Corrections
Department employees to work in Republican political campaigns.
• More than half of the city's plumbing inspectors were charged in June with taking bribes in
exchange for allegedly approving plumbing work without doing required inspections. Mayors
have tried and failed to clean up the Buildings Department, where the plumbing inspectors work,
and so, in the wake of the scandal, Bloomberg vowed that he too would tackle the longstanding
mess.
• Eighteen current and former New York City tax assessors were indicted in February on charges
that they accepted millions of dollars in bribes over 35 years in order to cut the property taxes on
500 buildings in the city. The alleged corruption cost the city some $160 million in tax revenues
in the last four years alone.
• These instances of malfeasance, however tawdry, were sadly predictable and local. But
newspapers throughout the nation took notice in November when it became known that financial
analyst Jack Grubman helped engineer a $1 million contribution from Citicorp to the 92nd Street
Y in order to improve his twins' chances of being admitted to the Y's selective nursery school.
The incident stepped over the line from surreal to scandal with allegations of what the Wall
Street Journal called a kid pro quo: Had Grubman altered his analysis of AT&T in order to win
the contribution? After all, the analyst and father said, "there are no bounds for what you do for
your children."

REAL ESTATE MOGUL SUES NEW YORK CITY FOR $500M . Real estate mogul Donald Trump
has sued the city of New York for $500 million, claiming a tax assessor bribery scandal forced him to
sell apartments at a luxury building at below-market prices, a published report said. Trump said corrupt
tax assessors hiked up taxes at Trump World Tower, a 72-story building near the United Nations, in
order to cover up their scheme to lower taxes for certain landlords, The New York Times. Authorities
said that Assessors took bribes totalling $10 million in exchange for lowering assessments on
commercial properties, mostly in Manhattan. At least one former tax assessor who pleaded guilty said
assessors would raise taxes on some properties in order to hide the lower taxes on others. (World News
(AP), November 8, 2002, summary by Sherldine Tomlinson).

School administrator admits to three felonies. Sheila Johnson-Moore entered a guilty plea in
County Court Thursday, 2/25 to embezzling $26,208 from the Buffalo School District. She had been on
paid suspension from her $60K+/year job for several weeks. The 39-year old black woman has a
criminal record which local school authorities had been warned about repeatedly when she began work
for the school district, and several times thereafter. She was strongly supported by former
Superintendents of Schools Thomson and Harris. Johnson-Moore was caught in the most recent felony
as a result of an investigation by the Internal Revenue Service. She had been allowed to be sole
financial administrator for a $800,000 federal grant. The matter has brought wide-spread public
outrage. An investigation into how Johnson-Moore got away with the embezzlement, and how her
previous criminal record could have been ignored, is reported underway. (2/25)
 Internal Control – More Than a Good Idea – It’s Also the Law!

Schools had been warned three times of administrator's criminal record. The Buffalo
News reported that warnings about the criminal past of Sheila Johnson-Moore had come three times to
the Buffalo School district over a period several years from federal authorities. Still, the school district,
under the direction of Superintendents Thomson and Harris, continued to employ and promote Johnson-
Moore. A member of the Board of Education said this past week that an inspection of Johnson-Moore's
personnel file indicated that the warning communications from the federal government had
"disappeared." Meanwhile Johnson-Moore continues to draw her $60K+ salary while on suspension.
The investigation into improper handling of grant money in the Buffalo Schools reportedly is still
expanding. (1/23)
Administrator had been convicted of previous embezzlement. One of the targets in a probe
of "mis-handling" of a $800,000 federal grant to the Buffalo schools reportedly has an extensive police
record. The Buffalo News is reporting that Sheila Johnson-Moore had been convicted of embezzling
$23,991 from a federal minority program at an Tuskegee University in Alabama. That scam took place,
The News reports, before the 39-year old woman was hired in Buffalo first as a teacher, and then quickly
promoted to an administrator under the regime of former School Superintendent Albert Thompson. The
newspaper is also reporting in Sunday, 1/9, editions, that Johnson-Moore illegally collected welfare
benefits and food stamps from Erie County Social Services starting about mid-1990 and continuing
through 1991---a time when she was employed at a good-paying job with the Buffalo School District.
That scam, The News reports, was made possible by her use of the name Stella D. Moore. Johnson-
Moore is said to be making about $60,000 a year in her present position with the Buffalo Schools, a
position she has been on fully paid suspension form, since late last year. (1/9/00)

Roosevelt NY, head of private school, Shelly Williams, 1979 founder of Upward Prep School (private)
with emphasis on high test scores, etc. is charged with embezzling $329,000 of day care funds provided
by Nassau county. About $92,000 was diverted to improve her home in Old Westbury. $237,000 was
diverted to her personal account. (NYT, Apr 6, 2K, p. B8).

Other Scandals
PAXIL (GlaxoSmithKline anti-depressant) – linked with suicides in adolescents
Rensselaer – Police Chief vs. Mayor re using city gasoline for personal use. Bad press, but judge
drops charges.
Pick Six Betting Scandal (Autotote Employee rigging Breeders’ Cup “winning” ticket) They almost
got away with it.

Albany Police Department – improper use of drug forfeiture moneys for non-criminal justice purposes
(like retirement parties and artwork). $40,000+ involved
UN Oil for Food Program - Kofi Annan’s son implicated (appearance of impropriety). Other UN
officials bribed.
New York City – Park Avenue Armory, a favorite for antique shows. Staff extorted free Persian
carpets from exhibitors. Meanwhile, Javits Convention Center staff involved in other strongarm tactics.
 Internal Control – More Than a Good Idea – It’s Also the Law!
WHY DOES INTERNAL
CONTROL MATTER?
Say the words “internal control” and they are
automatically confused with “internal audit”.
Internal audit refers to a small group of trained
professionals who review accounts and business
practices, scrutinize databases and sample paper
records. All this in an attempt to identify
weaknesses in an operation that could lead to
fraud, waste or mismanagement.
Enter the Internal Control Act, and now the
emphasis is on “accountability”. There is more
involved than just money. Agency reputations,
government credibility, and taxpayer support are
all at risk. It’s more than a question of
pilferage from agency coffers. The
very funding of government
programs is at stake.
Internal control involves more
than internal auditors – it
involves every government
employee. Front line,
supervisor, executive. And if
you are lucky, it also involves
citizen advisors and the general
public. Each of us knows a little
bit of what goes on in a government agency.
Each of us has a sense of smell, and an ounce or
two of curiosity when things don’t add up.
Yes, we have accounting systems in place,
segregation of duties when it comes to major
expenditures, elaborate and onerous procedures
for contracting and purchasing. But all these
systems depend on trust, open communication
and personal integrity. When any of these three
elements are missing, disaster is imminent.
Not all these disasters will make it to the
Evening News. More likely you are aware of a
series of minor disasters, individually
insignificant, but added together they can spell
the downfall of an empire:
• A dedicated and talented MSW stretches things
on a timesheet or travel voucher. When nobody
notices, she gets greedy. After all, “we aren’t
paying her what she’s worth.”
• An information technology wizard is assigned a
cell phone, sign of on-call importance. Before
you know it he’s running up a monthly bill of
$300 for personal calls.
• An executive is assigned a State car for business
travel. Soon his own car is up on blocks in his
garage, as every trip takes on governmental
significance. The oil changes and car washes are
on us, too.
• A building inspector regularly receives free
tickets to Yankee Stadium from the builders he
inspects. “Hey, we’re not talking World Series
here. It’s no big deal.”
• A correction officer or teacher
takes a personal interest in an
inmate or student, abandoning
all pretense of professional
detachment.
• The Merit System is “tweaked”
by Human Resources, so that a
lesser-qualified candidate rises
in an organization. Diversity is
also sacrificed.
• A school bus driver forgets to
take his BP medication, then
drinks his lunch. The roads are
hilly and icy.
• A grant decision or contract determination is
based not on its merits, but on influence of
political pressure or economic incentive (bribery
is such a dirty word).
• A doctor is involved in clinical trials, but her
investment portfolio includes a lot of
pharmaceutical stock.
• A contractor substitutes an inferior grade of steel
or concrete on a bridge project. Nobody will
notice for 20 years.
• A school teacher marks on a curve so that Johnny
who can’t read can move up to senior year. He
can always hope for an athletic scholarship when
his College Boards bottom out.
• An executive spends an inordinate amount of time
on charitable work, drawing subordinates into the
process. It’s not like she is profiting monetarily
from their efforts. Heck, we even give that
charity a Member Item every year.
 Internal Control – More Than a Good Idea – It’s Also the Law!
• A purchasing agent can get a great deal from her
cousin, but he is not on state contract.
• A computer programmer pads her resume to get
the dream job she can’t handle. She holds things
together with a patchwork quilt of subroutines,
but the day is drawing nigh when the entire
system will collapse under its own weight.
No, the sky isn’t falling (though the bridge
might). But each of these instances,
unaddressed by management and colleagues,
spells trouble for accountability and agency
success.
To the executives and managers I say – your
only hope is to listen to your people. Call them
the front line, underlings, subordinates, office
temps, whatever. Listen to them, for
collectively they are the ones who know what is
going on. You may be the only one who can put
all the pieces together, and do something about
it. But that’s your job.
In the ‘60’s, the Administrative Analyst’s
Handbook had a quote: “An administrative
analyst should have a passion for anonymity.” I
didn’t agree with that quote back then. But
today, with Gossip TV, yellow journalism,
muckraking and mudslinging back in vogue,
your 15 minutes of fame may not be what Andy
Warhol envisioned.
Do you really want to be quoted in the New
York Times, the Albany Times-Union or the
Syracuse Post-Standard? Do you want 60
Minutes to do a feature on you, when you were
asleep at the switch? How about Fox News?
Rather fail with honor than succeed
by fraud. - Sophocles
 Internal Control – More Than a Good Idea – It’s Also the Law!

ANATOMY OF FRAUD
Uniform Occupational Fraud Classification System
MAJOR CATEGORIES
I. CORRUPTION
• Conflicts of Interest
Purchase Schemes (split vouchers to avoid
competitive bidding)
Sales Schemes
Other
• Favoritism and nepotism in hiring,
purchasing or client services
• Governance in-breeding
• Bribery
Invoice Kickbacks (vendor collusion)
Bid Rigging (phony bids or no bids)
Other (bogus inspections, licenses granted)
Political (votes promised, nominations & endorsements)
• Illegal Gratuities
Christmas Presents
Theatre Tickets (Broadway)
Free Travel & Lodging (conventions)
Expensive Dinners or Country Club Greens Fees
Free Product Samples (laptops or cocaine)
Gift to Favorite Charity
• Economic Extortion (Political Extortion too?)
“By me, or I’ll sue”
“I’ll tell them about the freebies”
“I have the negatives”

II. ASSET MISAPPROPRIATION

• Cash
Larceny (outright theft or embezzlement)
Skimming (cash receipts, charitable donations – cash or goods)
Fraudulent Disbursements
• Billing Schemes (shell company, personal purchases, collusion, fictitious goods)
• Payroll Schemes (no-shows, phony overtime, attendance abuse, workers comp)
• Expense Reimbursement Schemes (multiple and/or padded travel vouchers)
• Check Tampering (altered payee, diverted checks, forgeries)
• Cash Register Disbursements (false refunds, false voids)
• Company Credit Card (personal use)
 Internal Control – More Than a Good Idea – It’s Also the Law!

• Inventory and Other Assets

Misuse
• Cell Phones, Gasoline, Vehicles, Computers, Copiers, Long Distance
Larceny
• Asset Requisition & Transfer
• False Sales & Shipping
• Purchasing & Receiving
• Unconcealed Larceny

III. FRAUDULENT STATEMENTS

• Financial
Asset/Revenue Overstatements
• Timing Differences (fiscal year roll-overs, delayed payments)
• Fictitious Revenues (inflated sales figures, bogus bonuses)
• Concealed Liabilities (stockholders will never know)
• Improper Disclosures (insider trading, trade secrets)
• Improper Asset Valuations (conceal company’s true value)
Asset/Revenue Understatements
• Tax Avoidance
• Deflate Sales Staff Commissions (favoritism/revenge)
• Non-Financial
Employment Credentials (often unverified, liars win)
• Diploma Mill PhD’s
• Forged Licenses or Degrees
• Fake Identification (criminals / illegal aliens)
• Concealed criminal history
• Padded Resumes, bogus references
Internal Documents (examples?)

External Documents (examples?)

Source: Association of Certified Fraud Examiners

2004 Report To The Nation On Occupational Fraud And Abuse.
 Internal Control – More Than a Good Idea – It’s Also the Law!

; CHECK YOUR STANDARDS

A. AUTHORIZATION CONSIDERATIONS:

1. Execution & a) Is there a set of written policies & procedures - including an updated
organization chart?
Authorization: b) Are employees made aware of policies & procedures?
c) Is employee or supervisor acting within scope of authority?
d) Are staff following management's intent?
2. Separation of
a) Are duties clearly defines so that no one individual is responsible for a
Duties: transaction from start to finish?
b) Are procedures designed to provide appropriate checks & balances?
c) Are key duties/responsibilities for authorizing, processing, recording and
reviewing transactions divided among individuals
(e.g. different individuals authorize purchase / receive goods)?
d) Are sensitive functions rotated periodically?
B. DOCUMENTATION
a) Are transactions promptly & properly recorded by persons other than
those authorizing transactions or having custody of assets?
1. Recording of b) Does documentation include pertinent facts (names, dates, dollar
Transactions: amounts, description of occurrence, purpose of transaction)?
c) Are documents inventoried to determine who uses them and how they
are stored?

a) Are documents (paper files or computer records) readiliy available for

2. Retrieval of examination?
Information: b) Do you have a contingency plan for disaster/loss recovery of
information?

a) Is access to information limited to authorized individuals?

3. Access to b) Is use of information limited to appropriate individuals?
Information: c) Do you have a procedure for secure disposal/shredding of confidential
information?
C. ASSET a) Is access to assets (cash accounts, food stocks, equipment inventory,
PROTECTION vehicles) limited to authorized individuals? Remember - information is
an asset. Are paper and computer files properly secured?
1. Access to b) Are assets secured in safe, locked filing cabinet, locked room. etc.?
Assets: c) Are keys/combinations controlled and limited to authorized personnel
only?

2. Accountability a) Are individuals assigned/accountable for specific assets (e.g. stores,

for Assets: gasoline supplies, commisary) ?
b) Are physical assets maintained in safe working order (e.g. vehicles,
computers, copiers, appliances?
c) Is periodic inspection of facilities made for health & safety safeguards
(e.g. fire extinguisher recharging) ?

3. Reconciliation a) Are assets (e.g. computer equipment) duly tagged or labelled (with a
of Assets: decal)?
b) Is an inventory of equipment and/or supplies kept and updated
appropriately?
c) Is periodic comparison made of the physical resources vs.
documentation (equipment/supplies inventories, bank reconciliations,
heating oil tank readings) ?
 Internal Control – More Than a Good Idea – It’s Also the Law!

COSO’S New Definition

There are eight components in COSO’s new definition of the Enterprise Risk Management process.
Five of them should be familiar to Internal Control practitioners.

Internal Reflects an entity’s philosophy on risk management, considering performance and

Environment value (i.e., cost of control vs. cost of risk) to arrive at an acceptable level of risk.

Objective Based on an entity’s mission, management sets strategic objectives, which if

Setting achieved will create and preserve value for the organization.

Event Management identifies potential events affecting its ability to achieve objectives
Identification Events with potentially negative consequences represent RISK.
Events with potentially positive consequences represent OPPORTUNITY.

Risk Management assesses likelihood and impact of negative events

Assessment (qualitatively and quantitatively).

Risk Management identifies response options, taking into consideration cost versus
Response benefit and acceptable level of risk. Responses may include avoidance, reduction,
sharing of risk (e.g., pooling of risk or co-insurance), and acceptance of risk.
The chosen response(s) may have significant impact on the entity’s business plan,
services provided, product line or corporate policy.

Control Policies and procedures help ensure appropriate risk response, including activities
Activities such as approval, authorization, verification, reconciliation, review of operating
performance, security of assets, and segregation of duties.

Information & Pertinent information from internal and external sources must be identified, captured
Communication and communicated in a timely and relevant fashion.
This includes exchange of relevant information among external parties, customers,
vendors, regulators, stakeholders.

Monitoring Monitoring assesses both the present and functioning of risk management
components, as well as quality of performance over time.

COSO’s draft ERM Framework is available at www.coso.org.

 Internal Control – More Than a Good Idea – It’s Also the Law!
PROTECTING YOUR
REPUTATION:
You’ve read the headlines. The CEO (Chief
Executive Officer) claims it was all the CFO’s
doing (Chief Financial Officer). This is
somewhat akin to Claude Rains’ famous line
from Casablanca: “I'm shocked, shocked to find
that gambling is going on in here!” 1
You may not be the head of a Fortune 500
corporation, but you do have certain authority
that is hopefully commensurate with your
responsibilities. Sure, you trust the people you
work with2 – you hired most of them. But could
a newcomer (one whose “ethical values are not
fully formed”3) take advantage of the situation –
diverting resources, selling information, or
doctoring records?
Maybe you aren’t the protector of portable
assets, but you could be the keeper of
marketable assets – like information. I don’t
want to put ideas into your head, but there are
people who will pay good money for adverse
information – be it financial information (late
child support payments or tax data), medical
problems, employee discipline (demotion,
termination), arrest records (even dismissals),
confidential family court proceedings (PINS,
JD), driving histories (speeding, DWI). And
there are other people who will pay good money
to change that information.
Are you one of those indispensable managers
who does it all? Never takes a vacation – never
takes a sick day? Authorizes the payments,
writes the checks, reconciles the accounts?
There are a zillion case studies about such
managers, and their off-shore bank accounts.
1
Rick: How can you close me up? On what grounds?
Captain Renault: I'm shocked, shocked to find that gambling is going on in here!
[a croupier hands Renault a pile of money]
Croupier: Your winnings, sir.
Captain Renault: [sotto voce] Oh, thank you very much.
2
My father used to say “Trust all men, but cut the cards.”
3
Thanks to OSC’s Dave Hancox for that euphemism.
Even if you are beyond reproach, could
someone else blame you for their own
malfeasance?
Do you keep your
computer password on a
Post-It tm note? Do you
share log-in identity
with a co-worker or
subordinate? How about
the key or combination
to the safe? Even petty
cash can tempt someone
with a drug habit or
gambling problem.
Would it be possible for someone in your office
(or a total stranger, for that matter) to send an e-
mail from your computer workstation, then let
you take the blame when the Secret Service
show up? Could someone log onto an
inappropriate website, fill your hard drive with
prurient material, then start a whispering
campaign about your Internet browsing habit?
Never mind that – could they use your computer
to doctor or delete critical records while you
were on break? And if those files were doctored
or deleted, would anyone ever notice?
There are a lot of things that can keep you lying
awake at night (like nuclear or biological
terrorists, fuel bills, the economy, that upcoming
Civil Service exam or your kids’ report cards).
Did you lock the back door, let the cat out, turn
off the stove, unplug the iron, log off at work?
Honesty may be the best policy, but it is not
the only way to protect you from false
accusation. At the very least, you should treat
your passwords like money – keep them in your
wallet, not on your CRT screen.
 Internal Control – More Than a Good Idea – It’s Also the Law!
IF YOU SUPERVISE
MORE THAN ONE PERSON:
Chances are you have noted differences between
your staff:
• One might be an early riser, the other is
“not a morning person”
• One might accept new assignments
cheerfully, the other grumpily
• One may be very talkative, the other tight-
lipped
• One may be a very private person, the
other tells you more than you want to know
• One may have computer skills, the other
distrusts new technology
• One may have been doing the job for years,
the other is a recent transfer
Still, despite their different personalities,
experiences and skill sets, they may have
comparable workload. Do you have a
monitoring (supervising) mechanism in place to
detect anomalies?
What’s an ‘anomaly”
No, it’s not a variation on a frijole. An anomaly
is a “deviation from the normal or common
order or form or rule”. Some people jump to
conclusions and decide there must be an error.
An auditor-in-training may suspect there is an
accounting irregularity (a/k/a fraud or
embezzlement) when there actually is a rational
explanation for the variation from the expected.
Does one person handle ongoing transactions in
a timely fashion, while the other person gets
sidetracked with troubleshooting or ad hoc
assignments? Does one person scrutinize every
field in an application, while the other rubber
stamps perfunctory acceptance?
Perhaps each staff person is responsible for
processing license fees or child support
payments. One worker may log in $20,000
every week, the other only $10,000. Before you
go pointing fingers or calling in the Inspector
General, you may want to examine other
elements of the workload.
Perhaps each worker is
processing an equivalent
number of transactions,
but one deals with
small business, the other
with major corpo-
rations (license fees),
or perhaps one staffer
specializes in “deadbeats” or
unemployed parents (child
support payments), while the
other processes routine payments.
Discrepancies could also be due to faulty
procedures or misconstrued instructions. Is
there a division of labor, where one staffer
passes on certain categories of transaction to the
other? Is each person putting in a full workday,
or did one go to a three-day training class that
month?
If you are dealing with productivity in an office
setting, there are ways to review the workload –
sampling incoming and outgoing paperwork, or
reviewing computerized exception reports. If
you are dealing with field staff (e.g. on-site
inspectors), supervision is more difficult.
How do you know a staffer actually inspected
that factory or day care center? Do you follow
up with licensees, agencies or vendors (by mail
or phone) on a periodic basis (or sample)? Do
field staff file a weekly itinerary with you so
that you can get in touch with them in case there
is a change of plans, or a new priority crops up?
Yes, in this day of cell phones, it is easier to
“reach out and touch someone”, but are they
driving to another inspection site, or driving a
golf ball down the fairway?
Some savvy supervisors call a site long AFTER
the worker should have concluded his/her work.
When told that their inspector left there an hour
ago, they just say “thanks, I’ll catch him/her at
the next site”.
 Internal Control – More Than a Good Idea – It’s Also the Law!

While they may have certain staff in mind when

making these calls, they are also wise enough to
follow this procedure for all staff, so that no one
feels singled out. Old Russian proverb: Trust,
but verify.

Are your internal control

procedures adequate?
Situation: You are responsible for transporting
defendants (in criminal court proceedings) from
the county jail to the court house for trial.
Those jailed pre-trial are generally individuals
with few financial assets and limited roots in the
community. They could not make bail (or
This is not to make light of the recent tragedy in
qualify for ROR – Release on Own
Atlanta. It is to show you that common sense
Recognizance), so many of them have been
and policy may clash on occasion. Fulton
waiting for three to six months for trial.
County (Atlanta) had a long established practice
since the Civil War that shackles were
The accused is innocent until proven guilty, so
considered demeaning and onerous. Still, the
you may not do anything to compromise the
sheriff’s office could have delivered the prisoner
defendant before a jury. Hence, defendants
in a more secure fashion (e.g. two deputies as
must enter the courtroom un-cuffed, and in
escort) without compromising the trial or
street clothes (not orange coveralls). Plea
influencing the jury.
bargains for violent felonies are rare in your
jurisdiction.
I might add that the Governor of Georgia had
recently removed the sheriff of that county due
On a given day, you must transport a six foot,
to a $3 million accounting “anomaly”. That
200 lb. former college football player to court
county had also experienced recruiting
for a new trial on a rape charge that could carry
difficulties resulting in hiring of inexperienced
with it a 20 year sentence. On the previous day,
staff who also lack the proper training to
the defendant had attempted to smuggle two
compensate for their limited physical
“shanks” (hand-made knives) into the court
capabilities.
house (in his shoes). Do you:
I mention the fact that the deputy was female
(a) Assign two equally large, armed deputies
because this could have been a source of
to escort the handcuffed and leg-shackled
antagonism to the defendant (due to the nature
prisoner to court,
of the charges before him). One might wonder
(b) Search the prisoner thoroughly before he
if sending her alone up the elevator with the
leaves the holding pen,
defendant might have been a form of hazing for
(c) Keep the prisoner in handcuffs until he is
a new staffer, or retribution to a whistle blower.
at the door of the specific courtroom, or
(d) Send the un-cuffed prisoner up the
Film at eleven.
elevator with one armed 5 ft 3 inch, 130
lb. female deputy, and hope for the best.
 Internal Control – More Than a Good Idea – It’s Also the Law!
Case Study #1
Agency X is located in a multi-storied building,
occupied by various state agencies that are open to
the public (including the main lobby, and elevator
areas on each floor). However, access to Agency
X itself is controlled by employee's key card access
and video surveillance monitors located on the
receptionist's desk. Entry can only be gained
through two locked doors, one of which requires
entering the reception area, the other opens directly
into the hallway out of view of the receptionist
where a number of offices are located. These doors
can be propped open. Rest rooms are in the elevator
areas and have coded entry locks, but the code for
rest rooms is the same for all floors of the building.
Rest room doors automatically close and
lock after being opened, but can be
propped open.
Within the Agency X location, all
employee offices are open and
accessible during working hours
except the main computer room.
Support staff has open architecture offices,
but only the receptionist can view people entering
the reception area. Employees' personal offices have
doors that maybe locked when the agency is not
open for business.
Many employees work on sensitive information,
much of which can be accessed through designated
employees' PCs. Additionally, as do most
employees, this agency's employees keep personal
belongings, including wallets, purses, radios, etc. in
their work areas.
Employees, on occasion, leave their
identification/key cards on their desks or remove
them in the rest rooms and leave them on the
shelves. Also, on occasion, one employee may lend
his or her card to another employee who has
forgotten to bring his or her card to work or that
employee may prop open the entry door when
making short trips to other floors of the building or
the rest room.
Case Study #2
You are in charge of a
six-county region of the
state, dealing with
licensed day care
centers.
In a significant
percentage of cases the
families involved may
be eligible for Federal
subsidies (based on
family size and
income).
Each county has established a different per diem
rate structure (including different rates for different
ages), and each county determines eligibility of its
residents.
You are under pressure to recruit additional
day care resources, to meet local needs and
encourage unemployed parents to pursue gainful
employment.
At the same time, you are under pressure to ensure
that those day care centers licensed by the State
meet health and safety standards (staffing ratios,
background checks, educational qualifications of
lead staff, hygiene and sanitation, food and fire
safety) as well as accounting requirements (no
subsidies for no-shows). Of course, there are plenty
of unlicensed operations out there (beyond your
control), which give the licensed centers a bad
name.
Of all your competing demands, which one is your
number one priority? How do you make that
happen?
Fortunately, you have a staff of six (one per county)
who visit current and fledgling day care centers, to
inspect their physical plant (for fire safety,
cleanliness, heating and ventilation, and adequate
square footage per child), their staff to child ratio,
and observation of child interaction.
 Internal Control – More Than a Good Idea – It’s Also the Law!
Following the principles of triage, you have
informally divided day care centers into three
categories:
• Terrific - I’d send my own kids there
• Passable – You can send your kids there
• Terrible – Don’t go there
Of your six staff, three have been on board for more
than ten years (the “old China hands”), two have
been with you for three years, and one just started
six month ago (“new kid on the block”). Does this
mean your office qualifies as a “stable operation?”
Monthly inspection reports from five of your
counties are about the same – 10 percent of the
reports are negative, requiring a remediation plan
and follow-up visits (which usually yield the proper
results). License revocation usually involves a
small-scale operation, where the owner is unwilling
to make the investment in physical plant and
staffing (and may even decide to drop out of the
business, rather than fight the revocation).
Your newest staff person has just completed two
months of on-site inspection of the day care centers
in her county, and reported to you that fully one-
third of these centers should be closed for serious
compliance issues. Can these allegations be true?
She also claims that in half a dozen cases, there was
nobody at home (staff or client).
How can her experience in this one county differ so
markedly from the other five counties? Does she
realize that shutting down so many centers would
hurt the families affected (e.g. employability)? Is
she misconstruing the regulations, or playing
hardball with the centers? What other possibilities
can you imagine?
What do you do about it?
Case Study #3
You are responsible for
transporting defendants (in
criminal court proc-eedings)
from the county jail to the
court house for trial.
Those jailed pre-trial are generally individuals with
few financial assets and limited roots in the
community.
They could not make bail (or qualify for ROR –
Release on Own Recognizance), so many of them
have been waiting for three to six months for trial.
The accused is innocent until proven guilty, so you may
not do anything to compromise the defendant before a
jury. Hence, defendants must enter the courtroom un-
cuffed, and in street clothes (not orange coveralls). Plea
bargains for violent felonies are rare in your jurisdiction.
On a given day, you must transport a six foot, 200
lb. former college football player to court for a new
trial on a rape charge that could carry with it a 20
year sentence. On the previous day, the defendant
had attempted to smuggle two “shanks” (hand-made
knives) into the court house (in his shoes). Do you:
• Assign two equally large, armed deputies to escort
the handcuffed and leg-shackled prisoner to court,
• Search the prisoner thoroughly before he leaves
the holding pen,
• Keep the prisoner in handcuffs until he is at the
door of the specific courtroom, or
• Send the un-cuffed prisoner up the elevator with
one armed 5 ft 3 inch, 130 lb. female deputy, and
hope for the best.
This is not to make light of the recent tragedy in
Atlanta. It is to show you that common sense and
policy may clash on occasion. Fulton County
(Atlanta) had a long established practice since the
Civil War that shackles were considered demeaning
and onerous. Still, the sheriff’s office could have
delivered the prisoner in a more secure fashion (e.g.
two deputies as escort) without compromising the
trial or influencing the jury.
 Internal Control – More Than a Good Idea – It’s Also the Law!

DOCUMENTING INTERNAL CONTROL PROCEDURES

A. INTRODUCTION
As a manager, you need to know, in detail, what procedures your unit employs to meet each
of its major functional responsibilities effectively, efficiently, and legally.

For the purposes of the Internal Control Act, we need to document procedures that touch on
staff responsibility and accountability, accuracy of records, chain of command in the decision
process, protection of assets and management oversight of each major function.

It does take time to review, document, and update these procedures, but the ultimate
beneficiary of this effort is your own organization. Well-documented procedures have
considerable value in training new staff, cross-training current staff, establishing work plans,
devising annual budgets to keep pace with workload responsibilities, and identifying new ways
to meet those responsibilities in a changing world.

A well-documented set of internal control procedures should also prove invaluable in

communicating problems outside your organization, where other bureaus or agencies need to
become involved in rectifying a problem or improving an operation.

The procedures you document for each major function should address the following questions:

• Who or what gave you the authority to conduct this function?

(e.g. State law, executive order, agency policy, administrative directive)

• What activities or transactions need to occur to meet the function's objectives?

• Is there a mandated timetable for completing key elements of this activity?

(e.g. quarterly billing, monthly reconciliation, annual report, prompt payment legislation)

• What system of checks and balances is employed to prevent fraud or abuse?

(e.g. separations of duties, prior approval for travel/purchasing, outside review)

• What documentation is maintained for each transaction, and who maintains these
records?
(e.g. shift logs, ledgers, computer entries, monthly reports, statements)

• Do you test your system periodically? If so, how??

(e.g. sampling, inspection, testing, outside audit)

The procedures should reflect key steps from beginning to end, noting any interim reports, files
created, supervisory authorization, and individuals or units involved at each step. This
information should help you manage your operation by determining where accountability lies
for each component of the overall function.
 Internal Control – More Than a Good Idea – It’s Also the Law!

NOTE: From an audit standpoint, it is evident that documentation of activities mandated in

Law, policy, or rules and regulations is vital. It is standard practice for OSC auditors to
criticize an agency's function by making the assumption that "if it is not documented, it did not
happen".

B. SAMPLE INTERNAL CONTROL PROCEDURES

In our earlier example of Perform Fiscal Audits of Agency-Operated Programs/Services,
we noted two major objectives - ensuring that programs/services operate in accordance with
policy & procedures; and assisting management in compliance through analysis, appraisal and
recommendation concerning activities audited. Internal Audit meets these objectives through a
number of procedures:

CONTROL PROCEDURES

a) The Audit Director and Assistant Director develop an annual Audit Plan.

b) Executive request audits are scheduled as received by the Audit Director.

c) Audit request procedures and protocols are outlined in the Internal Audit Procedures
Manual, including the following phases:

Pre-On Site - This phase is characterized by the identification of specific audit

projects, assignment of audit staff, development of audit purpose and scope,
preparation of audit instruments, review of background information and
coordination of audit logistics (travel/scheduling of field work).

On-Site - This phase includes entrance meeting, on-site data collection, daily
debriefings and phone contact with Central Office supervision, and exit meeting
with facility director.

Post On-Site - This phase includes debriefings with Central Office units, pre-
release meeting with Central Office units, and preparation/transmittal of the
audit report to the facility director and appropriate Deputies.

Follow-Up - This phase involves on-site verification of implementation of the

facility's action plans, including on-site interviews, daily debriefing meetings, exit
meeting, and preparation/distribution of follow-up audit report to the facility
director and appropriate Deputies.

Procedures developed in greater detail can be used for such management purposes as new
employee orientation and training, as well as performance standards for employee evaluations.
 Internal Control – More Than a Good Idea – It’s Also the Law!
Internal Control Act and
Information Technology
Since the inception of New York State’s
Internal Control Act (formal name Government
Accountability, Audit and Internal Control Act),
each state agency has been required to review its
major programs and administrative functions on
a periodic basis, to arrive at a “reasonable
assurance” that such programs or functions
were operating efficiently and effectively, with
sufficient controls in place to protect assets,
ensure compliance with applicable laws, rules or
regulations, and to produce financial/
management reports in an accurate/timely and
relevant manner.
The Office of the State Comptroller and the
Division of the Budget are the two control
agencies most involved in oversight of the
Internal Control Act – OSC by audits of state
operations, DOB by an annual reporting and
certification process.
For many years, the Information Systems Audit
and Control Association (ISACA) has been
promoting COBIT – Control Objectives for
Information Technology as a more structured
and detailed audit tool. COBIT takes into
consideration those issues most relevant to the
information technology environment, including:
• Computer Systems Security
• Data Integrity and Reliability
• Cost-Effectiveness of Data Processing
Operations
• Timeliness/Relevance/Availability of
Information to serve management and
program needs
• Increasing Dependence on IT for program
and management
• Increasing Vulnerability to organized and
individual attacks on computing systems.
Like COSO’s Control Self-Assessment and
OCFS’s Internal Control Review process,
COBIT’s – Control Objectives are goal-oriented.
“The policies, procedures, practices and
organizational structures are designed to provide
‘reasonable assurance’ that business objectives
will be achieved and that undesired events will
be precented or detected and corrected.”
As might be expected, COBIT depends on:
• Systemization
• Documentation
• Standards & Defined Expectations
• Measurement
• Appropriate Risk Assessment
A full-fledged COBIT review of OCFS IT
operations would be beneficial, but would also
be very costly and time-consuming. Following
the principle of “walk before you run”, it is
suggested that your agency develop a modified
COBIT approach, incorporating some of the
basic elements of COSO Control Self-
Assessment and Division of the Budget
guidance on the Internal Control Act. The
survey instrument for OCFS IT operations will
need be more detailed than that instrument used
for other agency operations, but far less
complex than the COBIT instrument.
As Division of the Budget has instructed, it all
starts with the plan of organization of the
agency or operation. Accountability depends on
human beings in place, planning, implementing
and monitoring program performance. First step
in the IT Internal Control Review will be a
description of the staffing, consultants/ contractors
and system (hardware/software) resources. This will
also entail a description of the division of labor and
responsibilities of the major bureaus within your
agency, and cost estimates of the annual
expenditures in each category, plus an estimate of
the cumulative assets (e.g. file servers,
network/transmission lines, desktop computers,
etc.). The old adage “If you can’t measure it, you
can’t manage it.” holds true.
COBIT audits look (at varying levels of detail) at
34 items, detailed below. All such issues need
to be examined on a global IT basis, but some of
these issues may only affect one or two bureaus
within IT. They include the following Control
Objectives:
 Internal Control – More Than a Good Idea – It’s Also the Law!

PLANNING AND ORGANIZATION

PO-1 Define a strategic IT Plan Long and short-range plans relevant to agency
mission and information needs
PO-2 Define the information architecture e.g. data dictionary & classification framework;
security levels
PO-3 Determine technological direction Monitor future trends; plan future acquisitions
PO-4 Define organization and relationships Ownership of system; segregation of duties
PO-5 Manage the investment Annual operating budget; cost-benefit analysis
PO-6 Communicate management aims & direction Including security awareness, commitment to quality,
management responsibilities
PO-7 Manage human resources Employees and SUNY contractors; recruitment,
retention, cross-training, succession planning
PO-8 Ensure compliance with external requirements e.g. Social Service Law & Family Court
confidentiality requirements; site safety, ergonomics
PO-9 Assess risk Define acceptable level of risk
PO-10 Manage projects Request/approval process; phased-in implementation;
testing and training; link to strategic plan
PO-11 Manage quality Quality assurance, coordination and communication;
adherence to IT standards & procedures

ACQUISITION AND IMPLEMENTATION

AI-1 Identify automated solutions Define information requirements; third-party services;
procurement control; acquisition and acceptance
AI-2 Acquire & maintain application software e.g. CITRIX Solutions, Cognos; design approval and
documentation; liabilities of proprietary software;
availability and integrity ofdata
AI-3 Acquire & maintain technology architecture e.g. Windows 2000 Server; assess new
hardware/software; system security software;
software maintenance; preventative maintenance
AI-4 Develop & maintain procedures Operations manual, user guides, training materials
AI-5 Install & accredit system Training, system and data conversion, testing and
final acceptance and production
AI-6 Manage changes Change request process; software release policy;
distribution of software; system compatibility

DELIVERY AND SUPPORT

DS-1 Define service levels Define service level agreements; monitoring and
reporting
DS-2 Manage third party services Telecommunications providers; contractor
reliability/qualifications; security relationship
DS-3 Manage performance & capacity Availability and performance requirements; workload
forecasting; performance measurement; resources
DS-4 Ensure continuous service Continuity plan, critical resources, training; back-up
and off-site
DS-5 Ensure system security Hardware & software protection; management review
of user accounts, security surveillance; authentication;
encryption, firewall,
DS-6 Identify & allocate costs e.g. state vs. county, shared services; chargeable
items; billing/chargeback procedures
DS-7 Educate & train users Training organization; security awareness, training
needs
DS-8 Assist & advise customers e.g. ENTERPRISE help desk, customer query
escalation (job ticket), clearances of queries
 Internal Control – More Than a Good Idea – It’s Also the Law!

DS-9 Manage the configuration Configuration baseline, unauthorized software,

software accountability
DS-10 Manage problems & incidents Disaster & security response teams; problem
management and escalation; tracking and audit trail
DS-11 Manage data Backup, backup, backup; data entry error handling;
source document retention; authorization procedures;
output distribution and retention; protection of
sensitive information; authentication, media library
DS-12 Manage facilities Physical security, visitor escort, uninterruptible power
supply; environmental protections; employee health
and safety; low profile of IT site
DS-13 Manage operations 24/7 operation; procedures and operations manuals;
job scheduling, operations logs; remote operations;

MONITORING
M-1 Monitor the process Collect and assess information; user satisfaction;
assess performance
M-2 Assess internal control adequacy Timely operation of internal controls; operational
security and quality assurance
M-3 Obtain independent assurance Accreditation of IT services; proactive audit
involvement; independent evaluation of effectiveness;
compliance with applicable laws/rules/regulations
M-4 Provide for independent audit Professional ethics and standards; audit charter,
independence

Yes, this is a very demanding, comprehensive It is interesting to note that the fourth “domain”
list. It also requires: of COBIT objectives – Monitoring is very
similar to COSO Control Self-Assessment and
• Identification of the primary party OCFS Internal Control Review. ISACA has
responsible for each of these IT Control provided a 155 page document detailing these
Objectives 34 COBIT objectives, but a review of the table
• IT resources applicable above is informative enough for our purposes.
o People
A full-fledge COBIT review would entail
o Applications
o Technology considerable training of both auditor and
o Facilities auditee. A more workable alternative is for the
o Data internal control officer to initiate a series of
management consultations with IT executives
• Information criteria applicable and managers, following the general framework
o Effectiveness & Efficiency of a COBIT audit, though taking into account the
o Confidentiality incremental nature of such a review, since we
o Integrity are starting from the ground up.
o Availability
o Compliance It is also important for IT staff to take
o Reliability ownership of the need for such a review. As
agencies become increasingly reliant on
information technology there is a greater need
for self-reliance in the development,
maintenance and improvement of all its
information systems. Where necessary, there
will also need to be mutual agreement between
the internal control officer and IT regarding
 Internal Control – More Than a Good Idea – It’s Also the Law!
terminology used, and degree of detail required
to fulfill annual reporting/certification
requirements of the Internal Control Act.
Past experience with internal control review
processes in most agencies indicates that the
internal control review process is of greater
value to those in charge or a program or
function, when they fully embrace such process,
and document systems to a level of detail in
excess of minimum Internal Control Act
requirements.
However, the current fiscal/staffing climate may
interfere with such eventuality (at least on a
short-term basis).
The following chart from the COBIT manual
bears an uncanny resemblance to Canada’s own
internal control approach (CICA, vs. COSO),
indicating it is a constant renewal process, as we
learn by doing.
 Internal Control – More Than a Good Idea – It’s Also the Law!

PO1 define a strategic IT plan

PO2 define the information architecture
PO3 determine the technological direction
PO4 define the IT organization & relationships
M1 monitor the processes PO5 manage the IT investment
M2 assess internal control adequacy PO6 communicate management aims & direction
M3 obtain independent assurance PO7 manage human resources
M4 provide for independent audit PO8 ensure compliance with external requirements
INFORMATION PO9 assess risks
PO10 manage projects
PO11 manage quality
• effectiveness
• efficiency
• confidentiality
• integrity
• availability
• compliance
• reliability
MONITORING PLANNING &
ORGANIZATION
IT RESOURCES

• people
• application
systems
• technology
• facilities
• data
DELIVERY &
SUPPORT
ACQUISITION &
IMPLEMENTATION
DS1 define & manage service levels
DS2 manage third-party services
DS3 manage performance & capacity AI1 identify automated solutions
DS4 ensure continuous service AI2 acquire & maintain application software
DS5 ensure systems security AI3 acquire & maintain technology
DS6 identify & allocate costs infrastructure
DS7 educate & train users AI4 develop & maintain procedures
DS8 assist & advise customers AI5 install & accredit systems
DS9 manage the configuration AI6 manage changes
DS10 manage problems & incidents
DS11 manage data
DS12 manage facilities
DS13 manage operations
 Internal Control – More Than a Good Idea – It’s Also the Law!
INTERNAL CONTROL
PERFORMANCE STANDARDS
Source: Ernst & Young
REVENUES
Grants, shared revenues and entitlements are
accepted and received in compliance with
program and legal provisions.
Interfund transactions are authorized and
recorded correctly as to fund, account, amount,
and period.
Services rendered are billed promptly, in the
correct amount.
Revenues are recorded correctly as to account,
amount, and period.
Uncollectible/delinquent accounts are promptly
identified for follow-up action.
EXPENDITURES
Budgets are prepared and approved in
accordance with legal requirements.
Budgetary compliance is monitored, and
noncompliance is prevented or detected and
properly corrected.
Expenses are incurred only with proper
authorization.
Expenses and related liabilities are recorded
correctly as to account, amount and period.
Salaries, wages, and benefits are incurred only
for work authorized and performed.
Salaries, wages, and benefits are calculated at
the proper rate.
Salaries, wages, benefits and related liabilities
are recorded correctly as to fund, account,
amount, and period.
Goods or services are purchased with proper
authorization and in compliance with legal
requirements.
Goods or services received (and related
liabilities) are recorded correctly as to fund,
account, amount, and period.
Grants and subsidies to ultimate recipients and
sub-recipients are made with proper
authorization and in compliance with legal
requirements.
Grants and subsidies to ultimate recipients and
sub-recipients are recorded correctly as to fund,
account, amount, and period.
Physical loss of property and equipment is
prevented; disposals/retirements/trade-ins are
identified, authorized and are recorded correctly
as to fund, account, amount, and period.
Indirect cost allocation plans are appropriately
developed and used to properly allocate
overhead.
Commitments and contingencies are identified,
monitored, and if appropriate, recorded or
disclosed.
FINANCE
Cash receipts are recorded correctly as to fund,
account, amount, and period.
Cash disbursements are for goods and services
or properly-supported claims authorized and
received.
Cash disbursements are recorded correctly as
to fund, account, amount, and period.
Debt, leases and other similar obligations and
related expenditures/expenses are authorized
and
Fund segregations and transactions are
properly authorized and are recorded correctly
as to fund, account, amount, and period.
INVESTMENTS
Investment transactions are authorized and are
recorded correctly as to fund, account, amount,
and period.
Income earned on investments is recorded
correctly as to account, amount, and period.
Investment assets are protected from loss or
misappropriation.
 Internal Control – More Than a Good Idea – It’s Also the Law!
INVENTORY
Costs are assigned to inventory in accordance
with the stated valuation method.
Usage and movement of inventory is recorded
correctly as to account, amount (quantities and
dollars) and period.
Physical loss of inventory is prevented or
promptly detected.
Obsolete, slow-moving, and overstock inventory
is prevented or promptly detected and provided
for.
CONTRIBUTIONS
Contributions by employers and participants are
at authorized or required amounts.
Contributions are recorded correctly as to fund,
account, amount, and period.
BENEFIT PLAN OBLIGATIONS
Benefit payments are to valid participants, are
determined in accordance with plan provisions,
and are processed only with proper
authorization.
Benefit payments are recorded correctly as to
fund, account, amount, and period.
Participant data accumulated for actuarial
valuation is complete and accurate.
INTERNAL ADMINISTRATION
Audits are properly planned and supervised;
audit findings are supported by evidential
matter.
Audit reports are issued only with proper
management review and authorization.
Research studies are properly planned and
supervised; reports are supported by evidential
matter.
Request for legal assistance are authorized and
controlled by management; legal assistance is
supported by evidential matter.
Financial forecasts, cash flow projections and
status reports are developed from appropriate
information sources.
Hiring, retention and promotional practices
comply with Affirmative Action requirements.
Policies and procedures are issued only with
proper management review and authorization.
COMPUTER SYSTEMS
Computer programs are authorized, tested and
approved prior to being placed into production.
Computer operations are separated from
applications development/programming.
Data processing personnel are independent of
user department, and have no access to cash,
investments or other similar assets.
Changes to existing program applications
require authorization and approval.
Systems documentation provides programmers
with information required to correctly maintain
applications.
Physical access to data files is controlled;
access to data files is restricted to authorized
users and programs; passwords are changed
periodically.
Physical security precautions are taken for fire,
flood and other applicable hazards.
Appropriate backup procedures exist for data
files/programs.
Uncharacteristic (unusually heavy) use of
computer resources is investigated promptly.
Obsolete or unnecessary programs/files are
evaluated periodically and purged from system
or production schedules as appropriate.
User participation, approval and acceptance is
sought in the applications development
process.
Formal documents of production schedules and
actual processing are maintained and reviewed;
deviations from planned or usual processing
are identified/evaluated promptly.
 Internal Control – More Than a Good Idea – It’s Also the Law!
Internal Control -
Integrated Framework
Executive Summary
Senior executives have long sought ways to better
control the enterprises they run. Internal controls are
put in place to keep the company on course toward
profitability goals and achievement of its mission,
and to minimize surprises along the way. They
enable management to deal with rapidly changing
economic and competitive environments, shifting
customer demands and priorities, and restructuring
for future growth. Internal controls promote
efficiency, reduce risk of asset loss, and help ensure
the reliability of financial statements and compliance
with laws and regulations.
Because internal control serves many important
purposes, there are increasing calls for better
internal control systems and report cards on them.
Internal control is looked upon more and more as a
solution to a variety of potential problems.
What Internal Control Is
Internal control means different things to different
people. This causes confusion among
businesspeople, legislators, regulators and others.
Resulting miscommunication and different
expectations cause problems within an enterprise.
Problems are compounded when the term, if not
clearly defined, is written into law, regulation or rule.
This report deals with the needs and expectations of
management and others. It defines and describes
internal control to:
• Establish a common definition serving the needs
of different parties.
• Provide a standard against which business and
other entities--large or small, in the public or
private sector, for profit or not--can assess their
control systems and determine how to improve
them.
Internal control is broadly defined as a process,
effected by an entity's board of directors,
management and other personnel, designed to
provide reasonable assurance regarding the
achievement of objectives in the following
categories:
• Effectiveness and efficiency of operations.
• Reliability of financial reporting.
• Compliance with applicable laws and
regulations.
The first category addresses an entity's basic
business objectives, including performance and
profitability goals and safeguarding of resources.
The second relates to the preparation of reliable
published financial statements, including interim and
condensed financial statements and selected
financial data derived from such statements, such as
earnings releases, reported publicly. The third deals
with complying with those laws and regulations to
which the entity is subject. These distinct but
overlapping categories address different needs and
allow a directed focus to meet the separate needs.
Internal control systems operate at different levels of
effectiveness. Internal control can be judged
effective in each of the three categories,
respectively, if the board of directors and
management have reasonable assurance that:
• They understand the extent to which the entity's
operations objectives are being achieved.
• Published financial statements are being
prepared reliably.
• Applicable laws and regulations are being
complied with.
While internal control is a process, its effectiveness
is a state or condition of the process at one or more
points in time.
Internal control consists of five interrelated
components. These are derived from the way
management runs a business, and are integrated
with the management process. Although the
components apply to all entities, small and mid-size
companies may implement them differently than
large ones. Its controls may be less formal and less
structured, yet a small company can still have
effective internal control. The five components are:
1. Control Environment
--The control environment sets the tone of an
organization, influencing the control consciousness
of its people. It is the foundation for all other
components of internal control, providing discipline
and structure. Control environment factors include
the integrity, ethical values and competence of the
entity's people; management's philosophy and
operating style; the way management assigns
authority and responsibility, and organizes and
develops its people; and the attention and direction
provided by the board of directors.
 Internal Control – More Than a Good Idea – It’s Also the Law!
2. Risk Assessment
--Every entity faces a variety of risks from external
and internal sources that must be assessed. A
precondition to risk assessment is establishment of
objectives, linked at different levels and internally
consistent. Risk assessment is the identification and
analysis of relevant risks to achievement of the
objectives, forming a basis for determining how the
risks should be managed. Because economic,
industry, regulatory and operating conditions will
continue to change, mechanisms are needed to
identify and deal with the special risks associated
with change.
3. Control Activities
--Control activities are the policies and procedures
that help ensure management directives are carried
out. They help ensure that necessary actions are
taken to address risks to achievement of the entity's
objectives. Control activities occur throughout the
organization, at all levels and in all functions. They
include a range of activities as diverse as approvals,
authorizations, verifications, reconciliations, reviews
of operating performance, security of assets and
segregation of duties.
4. Information and Communication
--Pertinent information must be identified, captured
and communicated in a form and timeframe that
enable people to carry out their responsibilities.
Information systems produce reports, containing
operational, financial and compliance-related
information, that make it possible to run and control
the business. They deal not only with internally
generated data, but also information about external
events, activities and conditions necessary to
informed business decision-making and external
reporting. Effective communication also must occur
in a broader sense, flowing down, across and up the
organization. All personnel must receive a clear
message from top management that control
responsibilities must be taken seriously. They must
understand their own role in the internal control
system, as well as how individual activities relate to
the work of others. They must have a means of
communicating significant information upstream.
There also needs to be effective communication with
external parties, such as customers, suppliers,
regulators and shareholders.
5. Monitoring
--Internal control systems need to be monitored--a
process that assesses the quality of the system's
performance over time. This is accomplished
through ongoing monitoring activities, separate
evaluations or a combination of the two. Ongoing
monitoring occurs in the course of operations. It
includes regular management and supervisory
activities, and other actions personnel take in
performing their duties. The scope and frequency of
separate evaluations will depend primarily on an
assessment of risks and the effectiveness of
ongoing monitoring procedures. Internal control
deficiencies should be reported upstream, with
serious matters reported to top management and the
board.
There is synergy and linkage among these
components, forming an integrated system that
reacts dynamically to changing conditions. The
internal control system is intertwined with the entity's
operating activities and exists for fundamental
business reasons. Internal control is most effective
when controls are built into the entity's infrastructure
and are a part of the essence of the enterprise. "Built
in" controls support quality and empowerment
initiatives, avoid unnecessary costs and enable
quick response to changing conditions.
There is a direct relationship between the three
categories of objectives, which are what an entity
strives to achieve, and components, which represent
what is needed to achieve the objectives. All
components are relevant to each objectives
category. When looking at any one category--the
effectiveness and efficiency of operations, for
instance--all five components must be present and
functioning effectively to conclude that internal
control over operations is effective.
The internal control definition--with its underlying
fundamental concepts of a process, effected by
people, providing reasonable assurance--together
with the categorization of objectives and the
components and criteria for effectiveness, and the
associated discussions, constitute this internal
control framework.
 Internal Control – More Than a Good Idea – It’s Also the Law!
What Internal Control Can Do
Internal control can help an entity achieve its
performance and profitability targets, and prevent
loss of resources. It can help ensure reliable
financial reporting. And it can help ensure that the
enterprise complies with laws and regulations,
avoiding damage to its reputation and other
consequences. In sum, it can help an entity get to
where it wants to go, and avoid pitfalls and surprises
along the way.
What Internal Control Cannot Do
Unfortunately, some people have greater, and
unrealistic, expectations. They look for absolutes,
believing that:
• Internal control can ensure an entity's success--
that is, it will ensure achievement of basic
business objectives or will, at the least, ensure
survival.
Even effective internal control can only help an entity
achieve these objectives. It can provide
management information about the entity's progress,
or lack of it, toward their achievement. But internal
control cannot change an inherently poor manager
into a good one. And, shifts in government policy or
programs, competitors' actions or economic
conditions can be beyond management's control.
Internal control cannot ensure success, or even
survival.
• Internal control can ensure the reliability of
financial reporting and compliance with laws and
regulations.
This belief is also unwarranted. An internal control
system, no matter how well conceived and operated,
can provide only reasonable--not absolute--
assurance to management and the board regarding
achievement of an entity's objectives. The likelihood
of achievement is affected by limitations inherent in
all internal control systems. These include the
realities that judgments in decision-making can be
faulty, and that breakdowns can occur because of
simple error or mistake. Additionally, controls can be
circumvented by the collusion of two or more people,
and management has the ability to override the
system. Another limiting factor is that the design of
an internal control system must reflect the fact that
there are resource constraints, and the benefits of
controls must be considered relative to their costs.
Thus, while internal control can help an entity
achieve its objectives, it is not a panacea.
Roles and Responsibilities
Everyone in an organization has responsibility for
internal control.
Management
The chief executive officer is ultimately responsible
and should assume "ownership" of the system. More
than any other individual, the chief executive sets
the "tone at the top" that affects integrity and ethics
and other factors of a positive control environment.
In a large company, the chief executive fulfills this
duty by providing leadership and direction to senior
managers and reviewing the way they're controlling
the business. Senior managers, in turn, assign
responsibility for establishment of more specific
internal control policies and procedures to personnel
responsible for the unit's functions. In a smaller
entity, the influence of the chief executive, often an
owner-manager, is usually more direct. In any event,
in a cascading responsibility, a manager is
effectively a chief executive of his or her sphere of
responsibility. Of particular significance are financial
officers and their staffs, whose control activities cut
across, as well as up and down, the operating and
other units of an enterprise.
Board of Directors
Management is accountable to the board of
directors, which provides governance, guidance and
oversight. Effective board members are objective,
capable and inquisitive. They also have a knowledge
of the entity's activities and environment, and
commit the time necessary to fulfill their board
responsibilities. Management may be in a position to
override controls and ignore or stifle communications
from subordinates, enabling a dishonest
management which intentionally misrepresents
results to cover its tracks. A strong, active board,
particularly when coupled with effective upward
communications channels and capable financial,
legal and internal audit functions, is often best able
to identify and correct such a problem.
Internal Auditors
Internal auditors play an important role in evaluating
the effectiveness of control systems, and contribute
to ongoing effectiveness. Because of organizational
position and authority in an entity, an internal audit
function often plays a significant monitoring role.
Other Personnel
Internal control is, to some degree, the responsibility
of everyone in an organization and therefore should
be an explicit or implicit part of everyone's job
description. Virtually all employees produce
information used in the internal control system or
 Internal Control – More Than a Good Idea – It’s Also the Law!
take other actions needed to effect control. Also, all
personnel should be responsible for communicating
upward problems in operations, noncompliance with
the code of conduct, or other policy violations or
illegal actions.
A number of external parties often contribute to
achievement of an entity's objectives. External
auditors, bringing an independent and objective
view, contribute directly through the financial
statement audit and indirectly by providing
information useful to management and the board in
carrying out their responsibilities. Others providing
information to the entity useful in effecting internal
control are legislators and regulators, customers and
others transacting business with the enterprise,
financial analysts, bond raters and the news media.
External parties, however, are not responsible for,
nor are they a part of, the entity's internal control
system.
Organization of this Report
This report is in four volumes. The first is this
Executive Summary, a high-level overview of the
internal control framework directed to the chief
executive and other senior executives, board
members, legislators and regulators.
The second volume, the Framework, defines internal
control, describes its components and provides
criteria against which managements, boards or
others can assess their control systems. The
Executive Summary is included.
The third volume, Reporting to External Parties, is a
supplemental document providing guidance to those
entities that report publicly on internal control over
preparation of their published financial statements,
or are contemplating doing so.
The fourth volume, Evaluation Tools, provides
materials that may be useful in conducting an
evaluation of an internal control system.
What to Do
Actions that might be taken as a result of this report
depend on the position and role of the parties
involved:
Senior Management
Most senior executives who contributed to this study
believe they are basically "in control" of their
organizations. Many said, however, that there are
areas of their company--a division, a department or
a control component that cuts across activities--
where controls are in early stages of development or
otherwise need to be strengthened. They do not like
surprises. This study suggests that the chief
executive initiate a self-assessment of the control
system. Using this framework, a CEO, together with
key operating and financial executives, can focus
attention where needed. Under one approach, the
chief executive could proceed by bringing together
business unit heads and key functional staff to
discuss an initial assessment of control. Directives
would be provided for those individuals to discuss
this report's concepts with their lead personnel,
provide oversight of the initial assessment process
in their areas of responsibility and report back
findings. Another approach might involve an initial
review of corporate and business unit policies and
internal audit programs. Whatever its form, an initial
self-assessment should determine whether there is
a need for, and how to proceed with, a broader,
more in-depth evaluation. It should also ensure that
ongoing monitoring processes are in place. Time
spent in evaluating internal control represents an
investment, but one with a high return.
Board Members
Members of the board of directors should discuss
with senior management the state of the entity's
internal control system and provide oversight as
needed. They should seek input from the internal
and external auditors.
Other Personnel
Managers and other personnel should consider how
their control responsibilities are being conducted in
light of this framework, and discuss with more senior
personnel ideas for strengthening control. Internal
auditors should consider the breadth of their focus
on the internal control system, and may wish to
compare their evaluation materials to the evaluation
tools.
Legislators and Regulators
Government officials who write or enforce laws
recognize that there can be misconceptions and
different expectations about virtually any issue.
Expectations for internal control vary widely in two
respects. First, they differ regarding what control
systems can accomplish. As noted, some observers
believe internal control systems will, or should,
prevent economic loss, or at least prevent
companies from going out of business. Second,
even when there is agreement about what internal
control systems can and can't do, and about the
validity of the "reasonable assurance" concept, there
can be disparate views of what that concept means
and how it will be applied. Corporate executives
have expressed concern regarding how regulators
might construe public reports asserting "reasonable
assurance" in hindsight after an alleged control
 Internal Control – More Than a Good Idea – It’s Also the Law!

failure has occurred. Before legislation or regulation Purchasing Information

dealing with management reporting on internal
control is acted upon, there should be agreement on
a common internal control framework, including
limitations of internal control. This framework should
be helpful in reaching such agreement.
COSO publications are available through the
American Institute of Certified Public Accountants
(www.aicpa.org). For further information about
COSO products or to order, contact AICPA at 888-
777-7077 or visit the CPA2BIZ Web site.

Professional Organizations Internal Control — Integrated Framework, 2 Vols.

Rule-making and other professional organizations Product number 99009
providing guidance on financial management, Internal Control Issues in Derivatives Usage—An
auditing and related topics should consider their Information Tool, Product number 990010
standards and guidance in light of this framework.
To the extent diversity in concept and terminology is
eliminated, all parties will benefit.

Educators
This framework should be the subject of academic
research and analysis, to see where future
enhancements can be made. With the presumption
that this report becomes accepted as a common
ground for understanding, its concepts and terms
should find their way into university curricula.

We believe this report offers a number of benefits.

With this foundation for mutual understanding, all
parties will be able to speak a common language
and communicate more effectively. Business
executives will be positioned to assess control
systems against a standard, and strengthen the
systems and move their enterprises toward
established goals. Future research can be leveraged
off an established base. Legislators and regulators
will be able to gain an increased understanding of
internal control, its benefits and limitations. With all
parties utilizing a common internal control
framework, these benefits will be realized.
 Internal Control – More Than a Good Idea – It’s Also the Law!
INTERNAL CONTROL TESTING
A Jargon-Free1 Guide
“Internal Control”, also known as management
control, refers to the combination of systems,
processes and procedures in place that provide
“reasonable assurance” that risks will be
minimized, and results maximized – whether
this refers to a far-reaching social program, or a
routine administrative task.
“Reasonable assurance” means just that. Any
program or administrative task has inherent
risks – the cost of doing business, and managers
must take such risks into consideration in a cost-
effective fashion. The cost of a management
control must be proportionate to the risk. For
example a pharmacy would keep serious
narcotics (controlled substances) under lock and
key, but stock the public shelves with
antihistamines and aspirin.
Annual-salaried employees are trusted to keep
track of their time and attendance, but additional
management oversight is required for overtime
payments. Program applicants submit
qualifying information to caseworkers, but such
information is subject to independent
verification where appropriate.
Testing is a key ingredient in each state
agency’s “Internal Control Review”, i.e., a
review of management controls systems in place
governing key program and administrative
functions of the agency. Such testing is
generally of two types:
• Ongoing testing/monitoring – built into
standard procedures, supervisory oversight,
employee evaluation and case review;
• Periodic evaluation – e.g., on a quarterly
or annual basis, often conducted by a
consultant or independent body, with
emphasis on program results, cost-benefit
analysis, and timeliness of services.
Internal Control Testing and Internal Auditing
have much in common, which is why most state
1
Almost
1
agencies have placed the internal control
oversight function within their internal audit
shops. The three main techniques of testing
AND auditing include:
Observation – this is part of good supervision,
applicable to factory assembly lines, residential
programs, the classroom, workshop, kitchen, or office
environments. It is especially useful when training a new
employee to ensure results match expectations, and
instructions are clear.
Interview – asking questions – of staff, customers,
clients, vendors, or peer professionals is often the only
way to get to the bottom of a situation in a non-
adversarial way.
Documentation – this includes a review of items such
as elevator inspection certificates, fire extinguisher
recharging tags, time sheets, vouchers, program
applications, day care center inspection reports, or even
computer access logs.
What differentiates internal audit from internal
control testing (or program monitoring, for that
matter), is auditor independence. If you’ve
followed the scandals of Enron, WorldCom,
Parmalat and the like, you understand the
temptation to tell the boss what he/she wants to
hear, overlook shortcomings, or downplay fiscal
irregularities. Even with auditor independence,
collusion can occur (with adequate financial
incentive).
Testing is a management responsibility of
each division and bureau, but an Internal
Control Officer needs to review the methods
employed to determine if they constitute
“reasonable assurance” that results are being
achieved as responsibly as possible, while
minimizing the downside of fraud, waste and
mismanagement.
Yes, we must recognize that anytime large sums
of money are involved, there is the potential for
fraud – by an applicant, vendor/provider or
employee. And the damages resulting from
such fraud may be more than monetary. A
daycare center bribes an inspector to overlook a
building code or fire safety violation. A
mechanic uses substandard parts to replace the
brakes on a facility van. A computer vendor
 Internal Control – More Than a Good Idea – It’s Also the Law!
contracts out hard disk manufacturing to a
shoddy cousin (where does lost data go?). A
defective smoke alarm causes a house fire.
Internal Control Testing must keep in mind the
two sides of the coin:
• What are we trying to achieve?
• What are we trying to avoid?
If a risk does not interfere with results, one
needs to ask “why spend money and time trying
to control such a risk.” Similarly, if the risk (or
“vulnerability”) is highly improbable (like a
Martian invasion2), we would only invest in
controls where the impact of such a long-shot
would be devastating.
Plain Talk About Testing
On a periodic basis, the Internal Control Officer
(ICO) will ask you how your specific program
or administrative function is going. The Survey
form is quite simple, but as anyone knows,
trying to sum up anything into twenty-five
words or less is no small task. As Mark Twain
once said “Please forgive this long letter, I
didn’t have time to write a short one.”
You are the expert when it comes to your
program or function, so the ICO will not dictate
what you have to do to verify things are going
as they should. But the ICO will review your
submission to determine if the frequency and
extent of testing you describe is proportionate to
the scale and significance of the operation.
The ICO should also meet with bureaus on a
selective basis to review testing efforts, and
provide suggestions for improved testing, based
on experience with comparable functions, and
based on state and nationally recognized
standards for internal control and internal audit.
“Control self-assessment” is one such standard,
expounded by the COSO3 or Treadwell
2
Them coming here, not NASA’s rover.
3
Committee of Sponsoring Organizations – including
the American Institute of Certified Public Accountants,
the American Accounting Association, Financial
2
Commission. Applying the control self-
assessment approach for auditing, testing and
evaluating program performance is an ideal
process for reviewing office operations and
residential programs.
Observation
Have you ever sat at a traffic light, and
wondered if it would ever change. Most lights
change on a 30 to 45 second cycle, but the light
at the corner of Fuller Road and Washington
Avenue can take an eternity to cycle through all
its choices.
If you’ve observed something happen more than
once, you develop expectations. The shop
foreman on the automobile assembly line
expects you to install one bumper every 4
minutes and 19 seconds. The chief account
clerk expects you to process 15 vouchers per
hour, regardless of their illegibility. A
crackerjack typist should be able to clock 90
words per minute, provided the network doesn’t
crash.
As a manager, you have had to justify staffing
based on a work plan that estimates the volume
and complexity of activities, including
individual unit times to complete an activity,
with total turnaround goals established to
provide timely and accurate service.
Observation is one way to determine if reality
is in sync with that work plan.
Interview
Interviewing starts when you select someone to
join your operation. Of course you will also
check their credentials and references, but the
interview is the final determinant in hiring.
Interviewing doesn’t stop once a new employee
signs on. During his/her probation period you
will use the interviewing technique to reinforce
training, to verify the employee’s understanding
of the processes/procedures employed, provide
an opportunity for the employee to ask
questions about his/her role and your
perceptions if his/her performance.
Executives International, the Institute of Internal
Auditors, and the Institute of Management Accountants
 Internal Control – More Than a Good Idea – It’s Also the Law!
Once an employee is well-established in an
organization, interviewing continues to be used
as a management technique. Changes occur –
be it new trends, new technology, new
mandates, staff shortages, increased workload,
or new procedures. As a manager it is your job
to make sure things are going as well as can be
expected. Are you keeping pace with quality
control and turnaround time? Are you
delegating functions and authorizations
appropriately. Are your customers happy?
Who are your customers? People will volunteer
information verbally that they will never put in
writing – for a variety of legitimate or
illegitimate reasons.
As a manager, you will need to filter the
information received, compare it to observations
of what is really happening on the job, then
checking the Documentation to determine if
allegations or suspicions are well-founded.
Documentation
Ever since the time of Moses, documentation
has been viewed as a necessary evil. Ethicists
rely on the Ten Commandments (yes, even in
Alabama). Accountants and bookkeepers have
followed the Code of Hammurabi longer than
agency employees have followed their Policy
and Procedures Manual. The Bill of Rights and
US Constitution continue to be relied on,
interpreted, argued and re-argued. The best
ideas get written down – on clay or stone
tablets, papyrus, vellum, paper, and now the
new electronic media.
Your office files, be they on paper or a
computer hard drive, follow a long trend in
human history. Properly maintained, they can
help you maintain a semblance of order in your
operation, faithfully and accurately record what
happened, and when. Or you can “cook your
books” in support of alternative theories of
reality (deficit, what deficit?).
Your first responsibility as a manager is to make
sure such documentation is useful and
necessary. Some types of documentation are
required by law or procedure.
3
Other types help control the processing of a
transaction from start to finish. Paper files may
include signatures, date stamps, original
documents such as purchase orders or vouchers,
inspection certificates, and facsimiles of official
records such as birth certificates, college
diplomas, pay stubs and tax filings.
The modern office is in transition from paper to
a paperless environment. Rather than store
Xerox copies of documents, many offices now
scan digital images, for on-line storage that
automatically links the images with other related
files (e.g. MS Word documents, Adobe PDF
reports or Excel spreadsheets). More and more
companies now make lengthy bills available
digitally, be it an EZ-Pass account or cell phone
minutes. Such digital information has many
added benefits. You can “filter” a lengthy
report, looking for certain occurrences (e.g.,
dollar amounts over $50, weekend use of cell
phones or EZ-Passes), or sort data in various
ways to structure specialized reports without re-
keying of data.
Sampling is a common technique for reviewing
documentation. Perhaps you want to check 10%
of a new employee’s output on a weekly basis to
ensure they are doing the job right. Then you
may do a 5% sample of a senior staffer on a
monthly basis. Research analysts and auditors
may also select a random sample of specific
types of records during an evaluation or audit.
When records are maintained in electronic
format, you can even look for exceptions in
100% of the records, letting your personal
computer do all the grunt work.
Most managers prepare monthly reports,
identifying trends/problems, quantifying any
backlog in processing (is it increasing or
decreasing?), seeking clearance for procedural
changes to cope with changing times or growing
workload, even quantifying the error rate in
input and output materials. Are you coping with
demands of prompt payment legislation?
 Internal Control – More Than a Good Idea – It’s Also the Law!

WHAT ARE CONTROL OBJECTIVES?

A Control Objective is a written statement related to the function which focuses on minimizing
risks, sets function-specific performance standards and directs protection of resources.

National bodies such as the American Institute of Certified Public Accountants, US General
Accounting Office and major consultant firms have compiled a growing list of internal control
performance standards. One such list (from Ernst & Young) is included in this Guide (as
Appendix A), but it could all be summarized simply:

We must do our job responsibly - effectively, efficiently and legally. This includes
protecting the State's assets, providing services to clients according to recognized
standards, minimizing the State's exposure to lawsuit for improper or inadequate
activities, operating the agency without bias or favoritism, investing resources wisely in
activities which fulfill our mission.

Internal control objectives strengthen the management process by developing performance

criteria by which each function is carried out in a responsible manner.

The following examples of internal control objectives pertinent to major functions are not
intended to be exhaustive, but rather offer several useful examples of control objectives
relevant to a wide range of agency functions:

FUNCTION INTERNAL CONTROL OBJECTIVE

Personnel To recruit only qualified staff, in keeping with Civil Service Law rules
Recruitment and regulations, Affirmative Action policies and agency policies
regarding verification of credentials.

Payroll To ensure that salary, wages and benefits are incurred only for work
duly authorized and actually performed.

Inventory To safeguard physical assets which support agency mission;

to record inventory movement correctly; to prevent loss of materials/
equipment or promptly detected such loss.

Purchasing To ensure that goods or services are purchased with proper authoriza-
tion and in compliance with legal requirements.

Capital To verify that new construction and building repairs meet all applicable
Construction building/fire codes

Vehicle To ensure that all vehicles are maintained in safe working order,
Management inspected annually, and operated only by authorized, licensed staff.
 Internal Control – More Than a Good Idea – It’s Also the Law!

Surplus To ensure that overstock inventory (supplies and equipment) is

Inventory identified periodically, and transferred to other /more suitable
offices/facilities.

Computer To ensure appropriate precautions are taken for fire, flood and other
Security hazards. To ensure that access to data files is limited to authorized
users

Physical To verify that direct care staff are trained in restraint techniques and
Restraint procedures before physical encounter with clients.

Universal To ensure direct care staff are trained in and use universal
Precautions precautions when dealing with client during accidents, illness or
routine health care.

Equipment To ensure that power tools are maintained in keeping with

Safety manufacturer's specifications and OSHA standards, and supervised to
minimize accidents to clients or staff.

Contraband To ensure that facility practices are followed to prevent client access
Control to legal drugs, alcohol, tobacco products, weapons and inappropriate
amounts of cash.
 Internal Control – More Than a Good Idea – It’s Also the Law!
Whenever someone talk to you about rules and
regulations, policies and procedures, or internal
controls, your body has an inevitable response.
Eyes glaze over, ulcers start percolating,
respiration and circulation decelerate. Your
brain goes to its happy place until the
conversation slides to a more scintillating topic,
like gout or tax reform.
Yes, there are rule and regulations that frustrate.
Policies and procedures that obstruct. And
overzealous controls that interfere with
performance. How then do we translate vision
into action? How then do we achieve our
goals while avoiding unacceptable risks?
As a leader in government service, your primary
concerns are not rules and regulations. You are
looking for results. Results that are achievable,
affordable and accountable. Whether you are
fighting disease, poverty, ignorance or crime,
there are people counting on you to make a
difference. And if you can do so without
encouraging a visit from Mike Wallace or
Geraldo Rivera, so much the better.
You may find this hard to believe, but:
We are NOT talking about the painful, but
necessary controls placed upon us by Civil
Service, OGS, OSC, or Division of the Budget.
Hiring and firing, purchasing, payroll, budgeting
– all have administrative requirements to
maintain integrity and accountability.
We ARE talking about the kind of management
controls your own agency puts in place to
control risk and monitor performance.
Controls that are tailored to meet the needs of
your programs, your staff and the population
they serve. We can arbitrarily divide internal
control into four major categories:
• Hardware controls – like locks on doors,
combinations on safes, smoke detectors
• Software controls – like passwords on
computer systems or edit routines to
reduce data entry errors
• Procedural controls – including
accounting procedures, instructions to
staff, form designs and documentation
requirements
• “Soft” controls – knowledgeable, trained,
ethical staff who are dedicated to your
programs, honestly seeking to meet
agency goals without resort to slipshod
practices or dangerous shortcuts.
With good, honest, and dedicated staff (soft
controls), you can rely less on the other three
categories. For example, most of us have the
intellectual acumen to assemble peanut butter
and jelly sandwiches1 without referring to
detailed, step-by-step, illustrated instructions.
1
Believe it or not, it is possible to purchase frozen, pre-
assembled, crust-free PB&J sandwiches.
 Internal Control – More Than a Good Idea – It’s Also the Law!
We know the value of separate knives for the
two main ingredients. When we join the two
slices of bread together, we ensure the filling is
on the inside. Chances are, we didn’t have to
use a keypad to open the refrigerator, and the
jars opened without password protection.
Of course, the cost factor
involved in such an operation
is negligible. Beluga caviar,
on the other hand, requires
special handling. (Hey kids,
don’t try this at home)
You’ve probably seen the PBS commercial
where a young child scoops out some sturgeon
roe, and dumps it into her aquarium, reasoning it
is just fish eggs, after all. Maybe you have no
caviar at home2, but if you did you probably
rethought where to store it away from such
innocent intellects.
Internal controls are developed over time, in
response to risk and experience. Risk
assessment is an ongoing process (part formal,
part informal). Experience tells us (if we are
paying attention) the likelihood of occurrence,
and the negative impact of such occurrence (be
it frequent or infrequent).
And years of negotiating (battling) with the
control agencies tells us whether controls are
affordable (DOB) and adequate (OSC). You
may not be responsible for a warehouse full of
caviar, but you may have been assigned a
$2,000 laptop computer. Ever wonder where
you left it?
While we have divided internal controls into
four major categories, some folks just divide
them into two categories – over-control and
under-control.
When fax machines were a novelty, some
agencies/offices inflicted users with sign-in
sheets or onerous logs when sending a fax. Of
course no one filled out a form when receiving a
fax.
2 3
Of course you do – you are a leader, aren’t you?
Now the average fax may only cost 3 cents per
page, you can buy a home machine for $50, and
faxes themselves are being supplanted by e-mail
and MS Word attachments. No more logs. No
more over-control in one instance.
What about under-control? We all know the
value of locking the barn door after the horses
escape. There are times we are unwilling (or
un-prepared) to impose new controls in a new
setting, because we have had no negative
experience controlling that risk. When
computers were all kept in air-conditioned
rooms, with raised floors and locked doors,
entrusted to a few wizards, the rest of us did not
need Palm Pilots to hold all our passwords.
Then PCs started showing up on all our desks,
and passwords evolved from our pet’s birth date
to complex algorithms with letters and numbers
and control characters.
For the record, your agency’s internal control
officer is NOT a control character (though it
takes a special breed to devote every waking
hour to this benighted profession).
At this point, we could “sit on the ground and
tell sad stories of the death of kings.”3 Better
we should talk about the circumstances on our
own agency, examine the over-controls that
have outlived their usefulness, and consider the
possible risks we are exposed to due to under-
control.
All in all, we are just looking for a reasonable
assurance that no one will die on our watch,
none of our staff will wind up involuntary
clients of another State agency, and Mike
Wallace and Geraldo Rivera will focus their
attentions elsewhere, at least for the next two
weeks.
William Shakespeare, Richard II, Act III. Scene ii.
 Internal Control – More Than a Good Idea – It’s Also the Law!

KNOW YOUR VENDORS • It would help if Finance kept an unduplicated

database of vendors (including their EINs and
Are you are in a position to order supplies, mailing addresses).
contract for services, retain a consultant, or • Keep in mind that it is the policy of the state to
even recommend a vendor to someone else? encourage (where possible) business with
WMBs (women-owned or minority-owned
If so, then you need to consider a lot of factors – to businesses). Your Equal Opportunity office
do your job right, and protect your reputation. may be of assistance in identifying candidates
Sometimes it is the little things that can bite you for such business.
when (and where) you least expect it. • When receiving goods or services, check on
the quality and quantity received, and make
You don’t have to be a high-ranking executive, or an sure invoices are processed promptly. This is
elected official to suffer the “slings and arrows” of especially important where small businesses
outrageous journalism. To help you avoid the are concerned.
appearance of impropriety, consider the following: • Ask your finance office about the impact on
• Even if the goods are services are small enough Prompt Payment legislation – even if you are
that they can be purchased off state contract, buying on state contract, delays in payment
you need to be careful in choosing the vendor; could carry an interest penalty.
• A series of purchases over time might trigger • Don’t be afraid to shop around for more than
interest from an internal auditor (or external one price quote (even if it is not absolutely
auditor) if it crosses the threshold for contract necessary). You don’t want to develop a
purchasing (dollar limits on competitive reputation for being lazy or wasteful.
bidding change periodically – check with your • Ask yourself “Would I buy this item at this
finance office); price, if it were my own money?” You have a
• If you are under pressure from someone in lot of experience being a savvy consumer – put
your organization to choose a particular vendor it to work for the State.
(e.g., family, friend or political contributor), • Share your purchasing expertise with other
beware; bureaus (verbally). Be careful what you put in
• If you are encouraged to tailor your RFP or writing – even in an e-mail (it could be FOIL-
purchase request to benefit a particular source able). But it is appropriate to compare notes
or brand, beware; with other bureaus/supervisors when making a
• Has your agency done business with the vendor spending decision.
in the past (perhaps another bureau)? What • Oh yes, be wary of scam artists (they used to
experience has your agency had with the call them boiler room operations, but now they
vendor? use the Internet). Don’t authorize payment for
• Is it a real company, or one of those ephemeral something you never ordered, never received,
DBA’s (Doing Business As) with a mailing and never signed for (like brand x copier
address that is either a P.O. Box or Suite, or toner).
worse yet, the home address of one of your • And if you do sign for something, verify the
agency’s employees? quality and quantity (count those laptops).
• Be wary of an address that is c/o (in care of) Don’t wait until inventory time to find out you
another entity – or worse yet, in care of one of are missing the goods!
your own agency’s employees!
All this information is brought
• The Employer Identification Number (EIN) is
to your attention, not to
9 digits, just like a Social Security Number.
frighten you away from
Maybe it is a Social Security Number! Ask
purchasing activities, but to
Audit or Finance to double check to make sure
help you meet your agency or
you are not inadvertently doing business with a
program needs at a fair price,
co-worker.
without charges of favoritism
or influence peddling.
 Internal Control – More Than a Good Idea – It’s Also the Law!
On The Take:
When is a gratuity1 not a gratuity? There
are times when organizations or vendors
offer gifts or free products, either to reward
you for past actions, or influence you in a
current or future action. The State Ethics
Commission’s Advisory Opinion No. 94-162
set a limit of $74.99 on the dollar value of
any such gift – be it a “free lunch”,
handsome plaque, software, hospitality at a
convention, or pen and pencil set.
The Public Officers Law §73(5). It reads as
follows:
No statewide elected official, state
officer or employee, member of the
legislature or legislative employee shall,
directly or indirectly, solicit, accept or
receive any gift having a value of
seventy-five dollars or more whether
in the form of money, service, loan,
travel, entertainment, hospitality, thing
or promise, or in any other form, under
circumstances in which it could
reasonably be inferred that the gift was
intended to influence him, or could
reasonably be expected to influence
him, in the performance of his official
duties or was intended as a reward for
any official action on his part. No person
shall, directly or indirectly, offer or make
any such gift to a statewide elected
official, or any state officer or employee,
member of the legislature or legislative
employee under such circumstances.
This is not to say that a $50 dinner, or a
$29.95 pocket calculator is an acceptable
gift. You might pick up a stress-ball or
other advertising gimmick at a computer
convention – items which seek to prolong
1 activities.
Gratuity (noun) A relatively small amount of
money given for services rendered (as by a
waiter); An award (as for meritorious service)
given without claim or obligation.
2
http://www.dos.state.ny.us/ethc/opinions/AO94-16.htm
your visit to a vendor’s booth – and these
would have no influence on your decision to
steer business their way. But a lavish meal
(and you can still dine quite fine on $74.99
– it even rhymes) is what some theologians
call a “proximate occasion of sin”. Whether
or not you believe in the concept of sin, you
do believe in the concept of Mike Wallace
and 60 Minutes. Andy Warhol may have
promised each of us 15 minutes of fame,
but this would be better earned competing
with Ken Jennings on Jeopardy.
It “could reasonably be inferred” that a
sales representative intends to influence
you with theatre tickets, single malt scotch
or cable modem. Free sample software is
more of a gray zone. As a “perk” you might
receive a free working copy of an expensive
computer program – with the hope that you
will use it at work, judge its value, then
decide to order a hundred copies for all
your staff. Of course competing vendors
may provide the same inducement. Such
items should remain the property of your
agency, even though the vendor attaches
no strings to the product.
The risk you take when accepting such trial
software is a competitor’s complaint when
you make your final choice. There are
those with inferior products who sell
through intimidation. There are also those
insidious boiler-room operations (now
outsourced overseas) that will plague you
with unsolicited copier toner, newsletter
subscriptions, etc. Stand your ground
against such tactics by holding yourself
above suspicion. “Where there’s smoke,
there’s fire.” Or so it is said. Don’t add fuel
to a fire. Don’t encourage negative
speculation by engaging in questionable
And remember –
there is no such
thing as a free
lunch.
 Internal Control – More Than a Good Idea – It’s Also the Law!
A PLACE FOR ETHICS
Back in the time of the Cold War, when school
children practiced “duck & cover”, Senator
McCarthy saw pink, and Sputnik beeped
overhead, the United States relied on a Distant
Early Warning System, consisting of a series of
radar installations in Northern Canada. Also
known as the DEW Line, these installations
were intended to give the U.S. advance warning
of a missile attack from the Soviet Union.
Check your geography, the North Pole was a
shortcut from Siberia to any U.S. city.
Fortunately, we never had to “duck & cover”, and
the Soviet Union will soon be a footnote in global
history. However, the U.S. is now installing a
missile defense system in Alaska, focused on North
Korea. The enemy changes, but the risks continue.
WHY AM I MENTIONING THIS?
New York State has an Ethics Commission,
charged with the impossible task of identifying
potential conflicts of interest among State
policy-makers and high elected or appointed
officials. Some of you may have to go through
the tedious and boring task of telling the Ethics
Commission that you have no investments of
value, no financial interests in businesses that
seek State custom, no relatives on the payroll of
agencies or businesses regulated by your own
agency. If you are lucky enough to have a
significant stock portfolio, you must fill out the
lengthy details to satisfy the Commission that
you are above suspicion, there is not even the
slightest hint of impropriety, and that you
subscribe to the noble (Civil War) sentiment of
“Death before dishonor”.
As we try to avoid any hint of scandal, conflict of
interest, impropriety, fraud, waste or
mismanagement, we should look upon ethics not as
a hindrance, but as a valuable ally. A first line of
defense against civil litigation or criminal
indictment.
This is not to badger you to be overly scrupulous.
On April 14th, everyone in the public or private
sector finds it necessary to make copies (we used to
call them Xeroxes) of their tax returns.
And on occasion you probably brought in your
own floppy disks when the office supply ran
short – so taking home a low-bidder ballpoint is
not likely to earn you a place in Dante
Alighieri’s Inferno.
No, common sense
is still an option.
The old quote about
“dipping your pen
in company ink” is
about more than
social improprieties
with staff. It is
about abusing a
position of trust.
Taking advantage of your employer – and the
taxpayer, for personal gain, monetary
enrichment, or securing special advantages for
yourself or a favored group.
There is no guarantee that you will not be
falsely accused of impropriety – character
assassination is always in season. But you are
more likely to lead an uneventful life if you set
an ethical example – for yourself, your family,
your staff, your agency, and your community.
If you are really lucky, you will only need a
lawyer to write your will. Choose a good one.
Ethics does not depend on a vengeful deity, or an
altruistic spirit. It’s a simple equation. The more
you stray from ethical behavior, the more likely you
will face the consequences. Check out the 2005
award-winning film Sideways. It’s kind of an “odd
couple” story – reminiscent also of Aesop’s Fable of
the grasshopper and the ant. Then think back to
your teenage years, when you were invulnerable.
How many of your friends never made it to the NY
State retirement age (55 in Tier One)? How many
thought they could handle drugs or alcohol? How
many thought their GTO would beat Amtrak to the
grade crossing?
If you are going to steal, steal big, but practice
ethical behavior until you find that million
dollar opportunity. Keep your nose clean, and
they will never suspect you, until you fly off to
Brazil (first class, no less)!
 Internal Control – More Than a Good Idea – It’s Also the Law!
MANAGEMENT INFORMATION
SYSTEMS
Once upon a time, ADP and EDP were the
acronyms for computer data processing.
(Automated Data Processing and Electronic
Data Processing). Then a guru somewhere
decided to call it MIS (Management Information
Systems), implying that the data was collected,
processed, sifted and regurgitated to inform
managers so they could manage their operations
efficiently and effectively.
At the turn of the last century, someone decided
to call the whole thing IT (Information
Technology), taking management out of the
picture entirely. This may have been done out
of spite, as computer programmers expressed
frustration when managers ignored the data
staring them in the face, making decisions based
on tea leaves or I Ching readings.
But make no mistake, data can only become
“information” only when it is assembled in a
coherent form, and provided to the appropriate
people, in a timely and relevant fashion.
If you have the soul of a manager, then you
clamor for data. Depending on your responsibilities,
you have an insatiable need to know where things
stand in a hundred areas. Teachers and school
principals need to know if their students are
learning. Parole officers need to know if their
parolees are keeping out of trouble (gainfully
employed, or earning passing marks in school or job
training). Medical professionals monitor vital signs
of their patients (sometimes on a minute-by-minute
basis with the help of computer technology).
Finance officers need to know if there is enough
money left in their budget to pay that voucher.
Maybe you don’t care about staff turnover,
retirement eligibility, client recidivism in the justice
system (adult criminal or juvenile). Maybe you
don’t care whether a voucher is processed in a
timely fashion (it’s not your money that pays the
interest penalty). Maybe you don’t care if a major
traffic intersection has a disproportionate number of
accidents. And you don’t care if the train is late
from New York City.
If you have total
disinterest in
information, then you
are not a manager,
and you may even be
dead. Because
“inquiring minds
want to know”.
Maybe you manage a
fantasy baseball team,
and constantly update the statistics on your batters
and pitchers (rbi’s, era’s, bob’s, etc.). Maybe you
keep track of all the numbers picked each night by
Yolanda Vega. Daily statistics like the Dow Jones,
barometric pressure readings or wind chill may
influence your investments, gardening or skiing.
A new TV show, NUM3ERS tells us that
numbers are all around. Insurance actuaries
know a few things about numbers. Economists
claim to know even more things about numbers,
and most of us know that you cannot balance
your checkbook with little lead weights.
Still, you may ask “When does data become
information?”
A number of years ago IBM ran a color print
advertisement that looked something like this:
01010101010101010101010101010101
10101010101010101010101010101010
01010FIND10101010101010101010101
10101010101010101010101010101010
01010101010101010101010101010101
101010101THE10101010101010101010
01010101010101010101010101010101
01010101010101010101010101010101
10101010101010HIDDEN101010101010
01010101010101010101010101010101
10101010101010101010101010101010
01010101010101010MESSAGE01010101
10101010101010101010101010101010
01010101010101010101010101010101
At the time, they were trying to sell color
monitors (a luxury then, a run-of-the-mill
commodity now). The point was without
special treatment, we can all drown in the sea of
data that is out there.
 Internal Control – More Than a Good Idea – It’s Also the Law!
I would make an additional point – unless you
make it clear to your IT (information
technology) people what you need to know – the
kind of decisions you need to make, the
resources to be invested in such decisions, the
impact of such decisions on world peace, the
economy or good dental hygiene, then your IT
people will just be alienated technologists – who
will look upon you “surface
people” as Eloi, while they
work in the dark, underground
as Morlochs. See H.G. Wells
Time Machine for details.
Of course, the IT folks will not
make your data needs a priority
unless they see evidence that you
1) care about the data; 2) make
valid decisions based on the data;
and 3) your decisions make a
positive impact on the people of
New York State. Yes, they can also help the people
of Ohio or Vermont, but they have their own way of
doing things.
If you have the soul of a manager, you will have
an insatiable need for more data, faster data, more
relevant data, data you can synthesize into
INFORMATION. Maybe you are monitoring
ground water contamination levels around a landfill,
PCBs in the Hudson River, or acid rain in the
Adirondacks (most of which comes from Ohio, I
think). Or then there is the alarming incidence of
asthma in our next generation. Or the paucity of
engineers graduating from our universities. Or the
number of potholes on I-90.
There is an old axiom (there are rarely new
axioms) “If you can’t measure it, you can’t
manage it.” Some folks just throw in the towel,
and assert the second half of the axiom. These
are called “experienced managers”. It is too late
for them – they’ve burned out from years of
inadequate data support. But there is hope for
you IF you start clamoring now for timely and
relevant information.
Maybe you will need to start collecting it the
old-fashioned way. Ask people questions.
Keep a paper log of transactions. Start
numbering incoming correspondence. Maintain
key statistics on 3 X 5 cards.
Start a checklist. Include key statistics in your
monthly report. It might impress your boss, but
it will help whoever follows you in your
position.
Establish realistic goals, set
deadlines, then monitor results. If
the NYS Education Department can
renew an RN’s certification in 24
hours, maybe you can inspect and
recertify that day care center in 30
days.
Do you need to expand your RFP
mailing list? Try “Googling”
potential vendors via the Internet.
Network with peers in other/
comparable agencies (we are all in
this together – maybe they know something
useful). Boldly go where none have gone
before (just be sure to get competitive bids, and
save your receipts).
Here is where you have to do a little
something on your own: Make a list of your
key functions.
What are the
goals? What
risks must you
avoid in order to
meet those goals?
Then make a list
of the kinds of
data that would help achieve positive results.
Are there mandated deadlines? Will delay in
processing hurt a citizen, client, patient, student,
taxpayer, applicant or vendor? Who can you
assign to handle those key functions? Do you
have useful procedures written down, or have
you got trained staff to rely on? When is Louise
retiring? Can you get out before she does?
If you don’t have the soul of a manager, pass
this two-page treatise on to someone who does.
Wouldn’t you like to have one of these? A way to monitor your agency’s
performance. Current status on budget balance, purchasing and contract
expenditures, computer system stability, personnel turnover, succession
planning, program performance?
While you wait and hope for IT (information technology) to craft a real-time
feedback system, the grains of sand keep dripping through the hourglass.
Have you considered gathering information the old-fashioned way – by talking
to people? The annual Internal Control Review process can help you do just
that! It’s not a chore, it’s a proven method to facilitate two-way
communication, identify goals and objectives, and recognize the inherent risks
and administrative weaknesses that interfere with achievement.

An integrated database would be ideal, though absorbing huge amounts of data out of context can be a
daunting proposition. Instead, consider the merits of 5 X 7 index cards, or simple one-page forms
covering all your critical functions. Who is in charge? How do you measure success or failure? What
“Checkpoint Charlies” have you installed to track performance. Who are the gatekeepers for quality
control? Who are the protectors of resources? What procedures have you built in to control the flow of
money, data, supplies and materials? Where are the gaps in your armor where fraud or theft could
occur?
The Association of Certified Fraud Examiners developed the following chart to capture all the possible
ways staff, vendors, applicants, clients or grantees could take advantage of your resources, and
compromise your integrity. While some of these apply only to commercial ventures (e.g., stock market
manipulations), the majority can affect government and not-for-profit entities:
ANATOMY OF FRAUD - Uniform Occupational Fraud Classification System1
MAJOR CATEGORIES
I. CORRUPTION
• Conflicts of Interest
Purchase Schemes (split vouchers to avoid competitive bidding)
Sales Schemes
Other
• Favoritism and nepotism in hiring, purchasing or client services
• Governance in-breeding
• Bribery
Invoice Kickbacks (vendor collusion)
Bid Rigging (phony bids or no bids)
Other (bogus inspections, licenses granted)
Political (votes promised, nominations & endorsements)
• Illegal Gratuities
Christmas Presents
Theatre Tickets (Broadway)
Free Travel & Lodging (conventions)
Expensive Dinners or Country Club Greens Fees
Free Product Samples (laptops or cocaine)
Gift to Favorite Charity
• Economic Extortion (Political Extortion too?)
“By me, or I’ll sue”
“I’ll tell them about the freebies”
“I have the negatives”

II. ASSET MISAPPROPRIATION

• Cash
Larceny (outright theft or embezzlement)
Skimming (cash receipts, charitable donations – cash or goods)
Fraudulent Disbursements
• Billing Schemes (shell company, personal purchases, collusion, fictitious goods)
• Payroll Schemes (no-shows, phony overtime, attendance abuse, workers comp)
• Expense Reimbursement Schemes (multiple and/or padded travel vouchers)
• Check Tampering (altered payee, diverted checks, forgeries)
• Cash Register Disbursements (false refunds, false voids)
• Company Credit Card (personal use)
• Inventory and Other Assets
Misuse
• Cell Phones, Gasoline, Vehicles, Computers, Copiers, Long Distance
Larceny
• Asset Requisition & Transfer

1
Source: Association of Certified Fraud Examiners
2004 Report To The Nation On Occupational Fraud And Abuse.
 • False Sales & Shipping
• Purchasing & Receiving
• Unconcealed Larceny

III. FRAUDULENT STATEMENTS

• Financial
Asset/Revenue Overstatements
• Timing Differences (fiscal year roll-overs, delayed payments)
• Fictitious Revenues (inflated sales figures, bogus bonuses)
• Concealed Liabilities (stockholders will never know)
• Improper Disclosures (insider trading, trade secrets)
• Improper Asset Valuations (conceal company’s true value)
Asset/Revenue Understatements
• Tax Avoidance
• Deflate Sales Staff Commissions (favoritism/revenge)
• Non-Financial
Employment Credentials (often unverified, liars win)
• Diploma Mill PhD’s
• Forged Licenses or Degrees
• Fake Identification (criminals / illegal aliens)
• Concealed criminal history
• Padded Resumes, bogus references
Internal Documents (employee evaluations, vendor ratings, applicant vetting)

External Documents (IPO filings, puffed-up press releases, misrepresentations)

DETECTING FRAUD

The ACFE has recognized that “internal controls” come in fourth place when it comes to detecting
fraud. Experience from 2002 to 2004 shows this has improved somewhat, but government and industry
still have a ways to go, implementing appropriate and affordable controls to minimize risk. Within
government agencies, internal controls detected less that 12% of all frauds during the survey period.
SHRINKAGE
No, it’s not about making your kids smaller. Nor
is it about a mid-life crisis requiring professional
help. It’s not about fast food or hot water making
your clothing feel tight.
It’s about inventory disappearing – either through
shoplifters, employee theft, poor security or even
bad accounting.
And things are not always as they seem.
I offer into evidence two case studies – one retail,
one manufacturing. The thoughts provoked herein
should be applicable to any setting, public or
private.
The Case of the Incredible
Shrinking Chicken Wire

A number of years ago, a manufacturer in

Kentucky or Tennessee (considering we are
talking about chicken wire, Kentucky is a more
likely choice, though Arkansas should not be ruled
out of contention), was concerned that the quantity
of wire being used to produce poultry fencing
appeared to be increasing, while production was
decreasing.

The managers, convinced that employee theft was the culprit, called on a famous consultant to review
their plant security. His initial observations focused on shrinkage, and the facility with which
employees could smuggle out the precious commodity. He noted that all employees drove through a
gate, and parked inside the perimeter, within walking distance of the factory. It would have been
relatively easy to transport fencing in a car trunk, since security staff did not screen outgoing vehicles.
The consultant recommended the fence be moved, so that employees would need to file past the guard
on foot, thereby limiting the potential for pilfering. Lunch boxes are not known for their ability to
conceal large quantities of chicken wire.

However, the real issue was not shrinkage. The consultant being rightly famous and astute discovered
the real culprit was bad accounting. All scraps of wire too short to be fed into the fence-making
machinery were sold to a scrap dealer, who promptly and dutifully paid a fair price for these remnants.
All the money went into a special headquarters account that was overlooked by the local plant managers.

The company did move the fence, just in case a lucrative chicken wire black market ever developed.
And the employees all breathed a sigh of relief when the consultant returned to the big city to ferret out
other evil doers and malingerers.
 THE OLD DISAPPEARING MUSTARD TRICK
A gourmet deli in upstate New York prided itself on its real-time
inventory system. Every purchase at the register was fed into their
computer system upstairs, so that managers would know what was
selling, and when to reorder favored items.

The system did have its drawbacks. During peak shopping periods
(e.g., Christmas, New Year’s, Kentucky Derby, Saratoga summer),
the undersized computer could not keep pace with all the data, and
the cash registers crawled, infuriating customer and clerk alike.

Come the annual physical inventory, and staff were dismayed to

discover untold amounts of missing (and expensive) stock.

Considering that a gourmet bottle of mustard or a wedge of cheese made in the Himalayas by elves
could cost $10 or $20 (crackers extra), the missing stock was eating heavily into the store’s profit
margin.

The prime suspects were ravenous employees or larcenous customers. Little did anyone realize that the
real culprit was the “state of the art” computerized inventory system, and a little thing called “returns”.

It seems the bookkeeper was authorized to entire a certain kind of transaction into the system – at her
office desk, far from prying eyes, and far from the disappearing mustard. When a customer returned
merchandise, it would have to be entered into the inventory system – with a refund to the customer. It
turns out the bookkeeper was creating phantom returns to generate personal revenue to support her
lavish lifestyle. Thousands of dollars later, the flaw in the system was discovered – bad software,
inadequate separation of duties, and a dishonest manager. It didn’t help that the owner of the business
spent most of his time in Florida, trying to sell his real-time inventory control software to other stores.

The company in question sold out to a pair of restaurateurs who drove what was left of the business into
the ground, encouraging local supermarkets to go upscale with specialty items.

One could suggest the gourmet enterprise could have survived had it tended to its core mission (fantastic
vittles) and leave the high tech malarkey to geeks. One could also suggest that the time to get to know
your employees is AFTER they are hired. When employees start dressing better than the bosses, driving
nicer automobiles, and vacationing overseas, it’s time for the bosses to get nervous.

Tim O’Toole of Albany, NY is approaching his 20th year in harness overseeing internal control
activities in his home state. You can find more of his writings at www.1ceman.com and
www.internal_control.us
TEAM-BUILDING, NATION-BUILDING AND COMMUNITY
In his long career as healer and author, M. Scott Peck penned a series of books under the “Road Less
Traveled” banner. One of these popular works, “A World Waiting to Be Born: Civility
Rediscovered” dealt with human organizational dynamics. His observations can be related to any
human organization, be it the fledgling republic in Iraq, the boardrooms of corporate America, or the
austere cubicles of state and local government.

When we talk of “soft controls” we are PARTICIPATORY

talking about those tangible and Why are we
intangible elements of a human talking
organization. Not computer pass- about this?
words, or combination locks. Not
elaborate procedures or inspection Because
stickers.
it’s
Dr. Peck described four styles of important!
leadership that can apply in various
venues, and in different proportions.
AUTHORITARIAN
A traditional and common style – the one we
grew up with, and the one we first experienced
in government service. Managers make
decisions, then inform subordinates to
implement them flawlessly without complaint.
In COSO terms, the direction of information
and communication is one way – down.
CONSULTATIVE
The manager is still calling the shots, but
consults with affected staff before making the
decision. Communication flows up and down,
though most likely on a one-to-one basis
between manager and subordinate(s). Of course
there are those authoritative managers who go
through the motions of consulting with
subordinates, then make the decision they
planned all along.
A less common style of leadership in
which the secure manager encourages
subordinates to collaborate in the
decision-making process. Two-way
communication flows in every
direction, perhaps even crossing
outside organizational boundaries.
CONSENSUAL
This is a style of decision-making that
transcends democracy. All the members of an
organization participate collectively in the
process, with communication flowing in all
directions regardless of pay grade or hierarchy.
Actions are then taken based on group
consensus. This style of leadership is based
heavily on trust and talent.
“No one of these four management styles is ‘the
best’.... The truly competent manager, therefore, will
have all four of these styles at her command.”
Peck, pp. 261-264
Because it’s important. If you’ve been awake
for the past 30 or 40 years, you should have
noticed that the reality of “community” has
eroded. Suburban bedroom communities pop
up like mushrooms. Strangers commute in
droves over long distances. PTAs and volunteer
fire departments have difficulty recruiting
volunteers.

IS YOUR OFFICE A COMMUNITY?

You spend 40 hours a week, 2,000 hours per year surrounded by strangers sharing common goals and
tasks. Are they a second family to you, or the less-than-hidden source of your distemper? Let’s
examine the concept of “pseudo-community”.
In “A World Waiting to Be Born:
Rediscovering Civility”, M. Scott Peck defined
the four stages of Community Development:
1. Pseudo-community - a group pretends to be
a community, denying conflict or individual
differences. Manners and etiquette are used to
derail conversations that may be painful or
antagonistic - yielding superficial, inauthentic,
sterile and unproductive communication.
2. Chaos - a group accepts individual
differences, but may self-destruct in an attempt
to convert/heal/fix each other. This may lead to
win/lose negotiations that get nowhere, and only
irritate one another thoughtlessly and rapidly.
3. Emptiness - A transition period that is
seldom dramatic, but often prolonged. Some
members may risk authentic conversation, only
to be rejected by the rest of the group. Only
when the entire group has emptied itself of petty
concerns, jealousy, hatred or fear can there be
hope of evolution into the final stage of true
community.
4. Community - shift to this final stage can be
sudden and dramatic - a spirit of peace may
pervade the room. There is more silence, less
nay-saying, one can almost taste the fresh air, or
the team spirit inspiring the gathering - which
can then go to work, making decisions, planning
and negotiating effectively.
Source: Peck, pp. 274-276 & passim.
True community is rare in our society and the
world, not easily constructed, and can easily
disintegrate without continued energy of its
participants.
A true community must be one of participants,
not spectators. Unfortunately most pseudo-
communities (and this is where most of us spend
our 9-to-5 existences) can be divided into three
groups that I call:
Wheeler-Dealers - at it daily jockeying for
power, forming cartels and cliques, second-
guessing one another, albeit often well-
intentioned. Back-stabbing upstarts, pooh-
poohing subordinates, making unilateral
changes in procedure or organization, with
minimal input from staff.
Alumni - those who have either aged out, or
burned out of the Wheeler-Dealer ranks, whose
involvement may be reflected in token
attendance at meetings, nostalgia for the good-
old days (before computers). “We’ve always
done it this way” is their motto.
Frustrated Upstarts - newcomers to the
organization who may try to worm their way
into the Wheeler-Dealer ranks. If they don’t
succeed, they may go elsewhere, or become
alumni prematurely, content to be mere
spectators - expecting the Wheeler-Dealers to
tend to the details, since “they know best”.
There is probably not much chance of inspiring
the wheeler-dealers to loosen their strangle-
hold on power - even though it has been proven
that shared power increases the total power of
an organization.
But it may be possible to rekindle the interest of
alumni in reconnecting with the place they
spent so many years – by facilitating meaningful
involvement of those frustrated upstarts, who
are underemployed and underutilized.
TONE AT THE TOP
Building a true community involves risk-taking.
A commissioner, deputy or director must see the
value of embracing a more collaborative
approach to running an agency, division or
bureau. Then a vision must be communicated to
all staff that encourages participation, by
showing the direction the enterprise wishes to
take.
When America sent people to the Moon, it
kindled a team spirit and pride in
accomplishment. It may have only been a
pseudo-community (as we ignored the grim
realities in Vietnam, and the continued failure of
the war on poverty), but it was a start.
In the coming year, New York State government
will undergo transformation in countable and
uncountable ways. Time for the next rank of
commissioners to set the tone at the top.
SOFT CONTROL thing” is in a biker gang, or that tattooed Goth
The conventional wisdom that pervades the sings in a choir – not a rock band.
internal control literature (bedtime reading for
What relevance does this have for internal
accountants when PBS is fund-raising), speaks
control? Well, if the position involves access to
of staff competence, integrity, shared purpose,
valuable resources (be it revenue, inventory or
dedication and experience. Each of these values
confidential data), the wise supervisor will key
can make a difference, fostering effectiveness
in on dramatic changes in lifestyle.
and efficiency in the absence of formal
monitoring systems. When an entry-level person takes a European
vacation, then shows up for work in a bright red
Such glowing realities need not pervade an
Ferrari (parking next to the supervisors Dodge
organization, though clusters of clarity and
Dart), a few questions are in order.
honesty may occur in the nooks and crannies of
any bureaucracy. When an employee seems to have hay fever
year round, is it a sign that the office air quality
When a supervisor has the luxury of recruiting
is hazardous, or is petty cash being siphoned to
new staff, he/she has the opportunity to define
pay for nose candy?
what office life will be like for years to come.
Affirmative action officers may Is the new employee fully integrated
agonize over limitations of the merit into the team, or are some of the
system, or subconscious tendency of Your co-workers staff resistant for inappropriate
people to select staff based on are more than reasons?
external characteristics (“will he/she interchangeable Then there is the question of your
fit in?”). Is the supervisor a “good parts. own style of leadership. Do you
judge of horse flesh”, or is he/she
encourage open communications?
under pressure to make a quick
decision and fill a critical vacancy
Do you share important information with staff,
while the list is still valid - or budget approval in
and solicit their feedback?
force?
Do you communicate instructions clearly, then
Sometimes, time pressures lead to shortcuts in
take the time to review assignments? Do staff
“vetting”1 the new hire. Doctored transcripts,
consider they are making contributions to a
diploma mills, and unchecked references. Snap
larger purpose, or do they see their work as a
decisions based on a twenty-minute interview.
mere chore that pays the bills? Can you relate
Then that new employee will need training. Are your own work to a higher purpose?
procedures well-documented and up-to-date? Is
Do your co-workers collaborate on a project, or
the right kind of training available and
act individually/sequentially? Have you
affordable? How will other staff accept the
segregated duties adequately, to reduce the
newcomer? Was an insider passed over for
chance or fraud, forgery or embezzlement?
promotion? Are the newcomer’s tasks and
What about cross-training so that work is not
standards legitimate and current?
interrupted by illnesses and vacations?
In the hiring process, questions about religion,
Do you value all your co-workers, or did you
sex and politics are taboo. Likewise questions
inherit some goldbricks from the previous
about family and hobbies. Once hired, the
supervisor?
challenge is to determine if that “sweet young
Take the time to get to know your people, and you
are on your way to learn what motivates them.
1
I delight in telling you that “vetting” has its roots in
horse racing. Wikipedia claims it relates to a veterinarian You can find author Tim O’Toole at
carefully inspecting a horse before a race. Winners are www.1ceman.com and www.internal_control.us
then subjected to drug tests. Losers can keep their secret.