brent clark, pugh cpas: effective internal controls
TRANSCRIPT
The Importance of EFFECTIVE INTERNAL CONTROLS
BRENT CLARK, CPAAudit Vice President
Pugh CPAs
In
Internal Controls –
Why Bother?Internal Controls
Protect the Plan:
• By minimizing opportunities for unintentional errors or intentional fraud (Preventative Controls)
• By discovering small errors before they become big problems (Detective Controls)
In
Where are the
Risks? Two Types of Fraud
Fraudulent Financial Reporting
Poor investment results (I)
Financial stability of the plan sponsor is
threatened (I)
Plan has invested in employer securities (I)
Non-readily marketable
investments (O)
Ineffective monitoring of
management (O)
Deficient internal control
components (O)
In
Where are the
Risks? Two Types of Fraud
Misappropriation of Assets
Personal financial pressures (I)
Known or anticipated future
layoffs (I)
Recent or expected changes
in benefits (I)
Lack of qualified outside service providers (O)
Inadequate internal controls over assets (O)
In
DOL Crim
inal
Enforcement Cases
Head of defense contractor steals
$186,000
Plan trustee convicted on 17 counts of wire fraud totaling approximately $5.3 million
Plan administrator steals $4.3 million from four plans for which he provided
administrative services
In
Internal control should bebased on a risk-oriented
approach to ensure adequate controls exist for high riskareas and that controls are
not excessive for areaswith low risk. - EBPAQC
Some high risk areas include:
Participant data input and change
administration
Processing payroll &
contributionsParticipant
distributions
Establish
ing a
Cost-Effectiv
e
Control Environment
In
Monitoring
Internal Controls
• Are the controls in place and operating
• Is the system working as designed
• Are the controls periodically reviewed
• Are identified exceptions and problems resolved
• Are you monitoring service organizations
Effective monitoring helps ensure your system of internal control continues to provide the
protections you envisioned.
In
Read Them!
Evaluate the ComplementaryUser Entity Controls
SOC Reports
In
Internal Controls
And Your Regulators
If a plan is selected for audit by the IRS,the EP agent conducting the retirement-plan
examination will begin by evaluating the effectiveness of the plan's internal controls
to determine whether to perform a focused audit—that is, just look at three to five issues or expand
the scope of the examination.In other words, based on the strength of the plan's internal controls, the agent will decide to examine more or less of the return than originally planned.
Monika Templeman, IRS Director of
Employee Plans Examinations
“
”
In
Internal Controls and
Your Auditor
Our audit of the financial statements will include obtaining an understanding of internal control sufficient to plan the audit and to determine the nature, timing and extent of audit procedures to be performed. An audit is not designed to provide assurance on internal control or to identify significant deficiencies or material weaknesses. Our review and understanding of the Plan's internal control is not undertaken for the purpose of expressing an opinion on the effectiveness of internal control.
In
Significant deficiency - A deficiency, or a combination of deficiencies, that is less severe than a material weakness yet important enough to merit attention.
Understanding the
Severity of Control
DeficienciesMaterial weakness - A deficiency, or a combination of deficiencies, such that there is a reasonable possibility that a material misstatement of the financial statements will not be prevented, or detected and corrected, on a timely basis.
How Your Auditor
Can Help
In
Example Control
Activitie
s
Participant Data1. Procedures exist to promptly identify and notify
eligible participants for enrollment2. Retain enrollment applications including signed
refusals3. Management should regularly review changes
made to the payroll master file Payroll Processing and Contributions4. Ensure adequate segregation of duties exist5. Current payrolls are compared with previous payrolls
and variances are investigated6. Access to the payroll system is appropriately
restrictedParticipant Distributions7. Signed distribution forms are used8. Withdrawal forms, including requests
for hardship withdrawals from401(k) arrangements, arereviewed by a responsibleofficial
InTreatment without prevention is simply
unsustainable.
- Bill Gates
“”
In
Resources/
Links
AICPA Employee Benefit Plan Audit Quality Center – The Importance of Internal Control in Financial Reporting and Safeguarding Plan Assets
AICPA EBPAQC Plan Advisory, Effective Monitoring of OutsourcedPlan Recordkeeping and Reporting Functions
IRS – Retirement Plan Operation and Maintenance