American Reinvestment and Recovery Act (ARRA) Planning
For City Departments receiving monies as a result of the ARRA (American Reinvestment and Recovery Act), increased emphasis and reliance will be placed on the City internal control structure. This structure will provide a framework for demonstrating accountability for monies requested, received, expended, and reported. This structure will also be relied upon to support city accomplishments consistent with Act intent to include the number and type of jobs created and/or maintained.
It is likely that audits completed by the Office of the City Auditor, the city's external auditors, and oversight reviews that may be conducted by the U.S. General Accounting Office will focus on how the strengths and weaknesses of the established internal control structure demonstrates compliance with specific provisions of the ARRA.
To assist, the Office of the City Auditor has developed a series of self-assessment checklists built around the city internal control structure and consistent with specific expectations and compliance requirements of the ARRA. The checklist is made up of two parts:
- Checklist 1 is to be completed at the departmental level. This self-assessment tool will assist in identifying strengths and weaknesses in the Departmental level internal control structure. For those weaknesses noted, opportunity will be provided for management to assess the importance of the weakness and, as applicable, to develop an action plan. In some instances, there may be a need for additional assistance in the form of training on ARRA requirements.
- Checklist 2 is to be completed at the program level where monies will be administered. This self-assessment checklist is also designed to identify strengths and weaknesses in the internal control structure at the program level. Action plans will be developed as needed based on management's assessment of the significance of the weakness identified.
For the most part, both checklists are built around the COSO (Committee of Sponsoring Organizations) structure for internal control. This structure is composed of: (1) the control environment; (2) risk assessments; (3) control activities; (4) information and communication; and (5) monitoring.
Control Activities
Control activities are the policies, procedures, techniques, and mechanisms that enforce management's directives. They are an integral part of planning, implementing, reviewing, and accountability. They include a wide range of diverse activities such as approvals, authorizations, verifications, reconciliations, performance reviews, and creation and maintenance of records that provide evidence of execution of activities as well as appropriate documentation.
Information and Communication
Information should be communicated to management and others who need it and in a form and within a time frame that enables them to carry out their responsibilities. Information needs to be relevant, reliable, and timely communicated.
Monitoring
Monitoring should occur in the course of normal operations. A variety of controls should be in place to check accuracy, completeness, and authorization of transactions.
Risk Assessment
Risk assessments are mechanisms to determine the relative potential for irregularities or non-compliance in programs and functions from both external and internal sources. Management is responsible for assessing risk and encouraging continuous assessment at all levels in the organization. Once an assessment of risk has been performed, management is in a much better position to determine controls that need to be put in place to mitigate significant risk identified.
Control Environment
Management is responsible for establishing and maintaining the control environment, for setting the tone for the organization, and for influencing the control consciousness of its people. The control environment provides an atmosphere in which people conduct their activities and carry out their responsibilities, and reflects the overall attitude, awareness and actions of management concerning the importance of control and its emphasis on the entity. It is the foundation for the other four components.