Finding Text
Condition – The size of the Organization’s staff in charge of accounting and reporting precludes a proper segregation of duties to ensure adequate internal controls. The basic premise is that no one employee should have access to both physical assets and the related accounting records or to all phases of a transaction. The following segregation of duties issues were noted during the audit, and primarily center around certain functions or access within the information systems:
• Individuals involved in the payroll process also have access to personnel changes.
• Individuals with the ability to establish new patients also have access to charge posting, cash receipts posting, and ability to post adjustments within the system.
• The individual responsible for reconciling the general checking account and payroll account also prepares checks issued by the Organization.
• The individual authorized to make deposits and withdrawals from the investment accounts also reconciles the investment accounts.
• Individuals authorized to post adjusting journal entries into the accounting system also prepare reconciliations of the same accounts with limited review by additional personnel.
The Board of Directors should be aware of these conditions and realize that a concentration of duties and responsibilities in a limited number of individuals is not desirable for an effective system of internal control. Under these conditions, the most effective control is the Board of Directors’ knowledge of matters relating to the Organization’s operations. This is a material weakness in the Organization’s internal controls. This is a repeat finding from 2023, Finding 2023.002.
Criteria – The lack of proper segregation of duties is considered an internal control weakness.
Effect – Without adequate segregation of duties, the likelihood that unauthorized or false transactions will be prevented or detected in a timely fashion is significantly diminished, which may result in misstated financial statements.
Recommendation – We recommend management and those charged with governance continue to evaluate whether to accept the degree of risk associated with this condition because of cost or other considerations.
Management’s Response – The Organization does not have the resources available to increase staff size and address this internal control deficiency. The Board of Directors and management are aware of the incompatible duties and will continue to provide oversight and monitor the Organization’s operations.