The New York State Governmental Accountability, Audit and Internal Control Act, Chapter 814 of the Laws of 1987 (The Internal Control Act), was enacted to promote and strengthen internal controls and accountability. The Internal Control Act requires all State agencies, including SUNY, to develop a system of internal controls. In addition, the Act mandates that each State agency comply with the following:

• Establish and maintain guidelines for a system of internal controls
• Establish and maintain a system for continuous review of internal controls to identify risks, weaknesses, and corrective actions and monitor implementation of corrective actions
• Ensure that all employees understand the concept of internal control and their respective roles and responsibilities
• Formally state the organization’s policies and standards for all employees
• Determine the role of the internal audit function
• Designate an internal control officer to coordinate the internal control program.

In addition, the University at Buffalo must annually certify that its Internal Control Program is in compliance with the Internal Control Act.

In an effort to assist campuses with maintaining compliance with the Internal Control Act, SUNY System Administration provides tools to define and evaluate compliance, and offers guidance regarding implementation of best practices and program enhancements. Internal control is a dynamic concept and the requirements for compliance have evolved and expanded over the years. The University at Buffalo has certified compliance since the Internal Control Act’s implementation. With the 2005 annual certification, the University has renewed its commitment to internal control under the leadership of President John Simpson.

Although the mandates as specified in the Internal Control Act are brief, there are significant compliance requirements for each mandate. These are summarized as follows:

Establish and maintain guidelines for a system of internal controls.

Internal control guidelines communicate management and programmatic objectives to employees and provide the methods and procedures to assess the effectiveness of internal controls in supporting these objectives.

President John B. Simpson has stated his commitment to make UB a great public research university. To accomplish this goal, he initiated an institutional assessment and strategic planning process known as UB 2020. In a message to the university community on September 24, 2004, President Simpson states that “meeting future challenges and capitalizing on opportunities requires that we act from a truly comprehensive institutional perspective, one supported by an administrative culture at the university that is fundamentally proactive, forward-looking, and above all, driven by academic excellence.”

The University at Buffalo system of internal controls integrates President Simpson’s vision and goals with the activities, plans, attitudes, policies, skills, and efforts of its employees working together to provide reasonable assurance that the University will achieve this mission.

The effectiveness of the internal control system in assuring achievement depends on clearly articulating and communicating the mission to employees as well as providing employees with the direction and information that allows them to understand their individual responsibilities and priorities and how they relate to that mission. President Simpson communicates his vision to the university community through the UB 2020 web site. The web site is dedicated to the assessment and planning efforts currently underway and provides all resource materials, findings, and recommendations to date. It is a university community resource and public forum for the strategic planning efforts. President Simpson is also firm in his belief that collaboration and inclusion are key to the institutional planning process. The web site has been designed not only to share information, but to elicit feedback, discussion, and community discourse.

While the UB 2020 web site is the primary means for communicating the President’s vision and the efforts surrounding the strategic planning process, the information and concepts included on this web site focus on internal control and are a compilation of the guidelines for the University at Buffalo Internal Control Program. This information is current and updated on a timely basis to reflect new directives and specific campus initiatives.

Establish and maintain a system for continuous review of internal controls to identify risks, weaknesses, and corrective actions and monitor implementation of corrective actions.

• Develop a campus-wide inventory of assessable units. Determining factors include organizational structure, budget level, funding source, geographic location, number of staff, nature and size of programs and administrative functions, and degree of independence of programs or functions.
• Determine the risk of each assessable unit. This will be done by a self-assessment survey or one-on-one discussion between the unit manager and Internal Control Coordinator. Considerations include inherent risk, management attitude, personnel, delegation of authority, policies and procedures, budget and report practices physical location, organizational checks and balances, and technology safeguards.
• Conduct an internal control review or detailed examination of activities to determine whether adequate control measures exist, are implemented, and are effective. The extent of this review will depend on the level of risk identified for the assessable unit.
• Recommend improvements or corrective actions based on the analysis of the risk assessment and internal control review.
• Follow-up to verify that recommended actions have been properly implemented and the unit functions as intended.

Ensure that all employees understand the concept of internal control and their respective roles and responsibilities.

The University at Buffalo recognizes that an effective system of internal control requires the organization to have competent staff with the skills and knowledge necessary to accomplish their assigned duties. Education and training are important to ensure that employees are aware of and understand internal control.

Formally state the organization’s policies and standards for all employees.

A key aspect of internal control is providing staff with clear direction and information regarding expectations. Specifically, employees need to know their individual responsibilities, priorities, and how their performance will be evaluated.

On an annual basis, an administrative update regarding the required notice of generally applicable management policies and standards is published in the Reporter, the campus community newspaper published by the Division of External Affairs.

In addition, University senior management has committed to directing resources toward the development of a policy and procedure manual and web site.

Determine the role of the internal audit function.

The University at Buffalo has long recognized the importance of the internal audit function as a means of safeguarding UB’s assets and reducing the risk that assets are lost due to wasteful practices, fraud, and abuse.

The University has an established internal audit function. The Internal Audit Department conducts an ongoing program of audits of University activities. The Director of Internal Audit reports directly to the President and administratively to the Executive Vice President for Finance and Operations.

Visit the Internal Audit web site at http://wings.buffalo.edu/services/internalaudit/index.html

Designate an internal control officer to coordinate the internal control program.

The Internal Control Officer is not solely responsible for administering the University’s Internal Control Program, but coordinates responsibilities among appropriate personnel within the University and oversees those activities as part of the overall internal control effort.

Ms. Pamela Lojacono, CPA is the University at Buffalo Internal Control Coordinator. Ms. Lojacono assists the Internal Control Officer with the administration of the Internal Control Program. Ms. Lojacono is responsible for implementing all aspects of the Internal Control Program including but not limited to maintaining documentation, developing and facilitating risk assessments and internal control reviews, developing the internal control web site, internal control training, and reporting to SUNY System Administration.