Frequently Asked Questions (FAQ) and Answers

A collection of Frequently Asked Questions on the use of the Controls Self-Assessment survey are listed below, with links to specific topics:

What Is Internal Control?
Are there policies or principles established by the University of Florida regarding internal controls and financial management?
What is a Decentralized Environment?
Why are controls more important in a decentralized environment?
What is legal/managerial compliance?
What exactly is a controls self-assessment?
How does the University of Florida’s controls self-assessment survey work?
What will happen to my survey results?
Why should I spend time going through this process?
How can my staff benefit from going through this process?
Can the survey be completed by various staff?
What do I need to do if I received the survey but I am not the primary contact?
How long will this process take?
Can I save my responses and work with the survey at a later time?
What if I do not have the time or knowledge to respond?
If the survey results show that we need help in one or more areas what should we do?

What is Internal Control?

Internal control in its broader sense is defined as a process affected by an organization’s board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories:

Effectiveness and efficiency of operations
Reliability of reporting
Compliance with applicable rules, laws and regulations

Questions and misunderstandings about “internal controls” are quite common. Frequently, internal controls are viewed narrowly as applicable only to financial reporting or asset protection. There may also be an incorrect perception that implementation and monitoring of internal controls are the responsibility of others, usually the institution’s financial officers, internal auditors, or the central administration. The main components of internal control are:

Creation of a positive control environment that values integrity, ethical values, and competence
Evaluating risks and other impediments to the accomplishment of objectives
Establishment of control activities that would prevent or detect exceptions on a timely basis
Creation of information and communication systems that enable the unit to capture and exchange information to achieve objectives
Monitoring the internal control system with the recognition that conditions and operations continuously change

Most of the time the emphasis is on common control activities which may include the following:

Segregation of functional responsibilities to create a system of checks and balances
A system of authorization and recording procedures adequate to provide reasonable control over assets, liabilities, revenues, and expenditures
Development of policies and procedures for prescribing and documenting the business and control processes. This should consist of a well thought strategy and be reviewed and adjusted periodically to reflect changes in the business and control environment

Everyone in the university has some responsibility for internal control.

Are there policies or principles established by the University of Florida regarding internal controls and financial management?

The University of Florida and its governing board adopted the Guiding Principles of Financial Management and Internal Control Principles. These may be accessed electronically at:

Internal Control Principles

Financial Management Principles

What is a decentralized environment?

Decentralization is the delegation of management authority to the individual units and sub-units of the organization. One of the benefits of decentralization is that decisions are made at the unit level which allows management to be more flexible and react quickly to local conditions.

Why are controls more important in a decentralized environment?

In a decentralized environment, with limited staffing, one critical element of internal control, segregation of duties, may not always be attainable. For those situations management will need to implement additional monitoring controls over operations. There is also less opportunity for specialization and greater need for support staff and unit management to be more knowledgeable and involved about operations and applicable laws and regulations. Training and communication of information are critical to all employees.

What is legal/managerial compliance?

Legal and managerial compliance is simply intended to refer to compliance with the various laws, rules, policies, directives, and procedures that prescribe the guidelines and parameters that we must operate within. Some of these are self-imposed to ensure effective business and/or control practices. Legal and managerial compliance requirements which govern how we operate include, but are not limited to the following:

Federal Constitution, Laws, and Regulations
Florida Constitution, Statutes, and Administrative Code
University of Florida Board of Trustee Policies, Resolutions, and By-laws
University of Florida Finance and Accounting Directives and Procedures
University Regulations
Departmental Polices and Procedures

What exactly is a controls self-assessment?

A self-assessment is usually defined simply as “the involvement of management and staff in the assessment of internal control within their unit.” Controls Self-Assessment (CSA) may be effective in assessing the control environment, business and financial risk, control activities, and control effectiveness. Although CSA empowers university operating personnel and enhances business partnering between Internal Audit and departmental personnel, it does not eliminate the need for a formal audit. It serves to help focus attention on areas by drawing on the knowledge and participation of the entire organization. It is highly compatible and complementary with today’s emphasis on employee empowerment, teamwork, and continuous quality improvement. Controls Self-Assessment may also provide timely and complete feedback on an organization’s internal control structure.

How does the University of Florida’s controls self-assessment survey work?

The controls assessment survey is facilitated through Qualtrics, the University’s licensed online survey software. The unit head and staff will answer the questions within the survey. The email containing the survey link may be forwarded to multiple individuals within your unit to complete the relevant sections but only one person should have the survey open at a time otherwise responses will not be recorded. The Qualtrics survey tool will automatically save your responses when you close the browser window. Each question lists the appropriate reference (policy, regulation, standard, or guideline) as well as comments (auditor’s suggestions) for implementation. Upon completion of the survey your responses will be submitted to the Office of Internal Audit (OIA) for compilation and analysis.

What will happen to my survey results?

The Office of Internal Audit will take the information and create a summary report of controls and risks for the entire university. This summary report will not identify individual units but will instead address the university as a whole. The survey results will allow for the identification of potential areas for improvement university-wide. Selective verification of the responses and appropriate support will be initiated by the OIA.

Why should I spend time going through this process?

Controls Self-Assessment is for unit heads who:

Desire to improve their unit’s operations
Wish to increase their knowledge about the unit’s operations
Are new managers wanting to evaluate and understand their organization
Understand that an ounce of prevention is worth a pound of damage control
May benefit from the knowledge gained to improve the unit’s operations where weaknesses are identified

Additional benefits include:

Identification of important issues before they become critical
Possible reduction in audit time
Can help to reinforce understanding of policies and expectations at the university
The ability to assess the control environment within a unit between audits (self-assessment)

How can my staff benefit from going through this process?

The controls self-assessment is an excellent training tool for new staff and employees responsible for performing key functions in your unit. The survey includes questions, related references, and background information. All of this information can be printed out for future reference.

Additional benefits include:

Empowers employees and increases accountability
Provides employees with a better understanding of business risks and internal controls
Provides employees with a broader university-wide perspective

Can the survey be completed by various staff?

Unit heads have the option of printing relevant sections of the survey and distributing the questions to appropriate staff and then compiling the information to enter the data into the survey. (The entire survey can be found at http://www.oia.ufl.edu/wp-content/uploads/2018/06/AllQuestions.pdf). Unit heads also have the option of forwarding the email with the survey link to other staff members to complete the relevant sections. Please ensure that only one person have the survey open at a time otherwise responses will not be recorded. The survey tool will automatically save your responses when you close the browser window.

What do I need to do if I received the survey but I am not the primary contact?

Contact Lily Ly (LilyLy@ufl.edu) or call 352-273-1889.

How long will this process take?

The entire process should take about 3 hours or less. However, the size of the unit and the level of input sought from other unit staff may impact the time and effort that is required to complete the survey.

Can I save my responses and work with the survey at a later time?

No, you may access the survey as many times as you need to complete it. The current survey responses are saved when you close out of the browser window. Just close the webpage when you want to stop working on the survey. You may return to the survey later using the same links provided in the initial email. If you would like to review the survey in its entirety before taking it online, it can be found at http://www.oia.ufl.edu/wp-content/uploads/2018/06/AllQuestions.pdf

What if I don’t have the time or knowledge to respond?

The questionnaire is not intended as an assessment of one individual but of your unit’s practices/procedures as a whole. More people from your area may need to be involved to complete the survey. If your unit is unable to complete the questionnaire, please contact our office and we may schedule a visit to validate the internal controls in place.

If the survey results show that we need help in one or more areas what should we do?

You can review the references to university directives/policies within the survey or contact our office for assistance.

Remember, we all play a part in the university’s internal control system!

Frequently Asked Questions (FAQ) and Answers