Finding Text
Finding No. 2025-002: Segregation of Duties Type of Finding Material Weakness in Internal Control over Financial Reporting Criteria An effective system of internal control should provide for an appropriate segregation of duties so that no one individual has control over all phases of a transaction. Where segregation of duties is limited due to staffing constraints, compensating monitoring controls should be implemented. Condition During our review of internal controls, we noted that the Controller performs multiple significant functions within the accounting and financial reporting processes, including responsibilities related to cash disbursements, banking activities, transaction processing, account reconciliations, and financial oversight. In addition, the Controller has the ability to initiate payments and receives the bank authorization code required to release certain disbursements. As a result, key accounting and treasury functions are concentrated with one individual. Context There is a lack of segregation of duties over internal controls for all significant transaction classes. Effect The concentration of incompatible duties increases the risk that errors, unauthorized transactions, or irregularities could occur and not be detected in a timely manner. The lack of segregation also increases the risk that an individual could initiate, process, approve, and conceal transactions without independent review. Cause Due to staffing constraints and organizational structure, certain incompatible accounting and treasury responsibilities have not been adequately segregated among multiple individuals. Repeat Finding No. Recommendation We recommend that management evaluate opportunities to strengthen segregation of duties by assigning certain authorization, review, banking, reconciliation, and reporting functions to other qualified personnel. Where staffing limitations make complete segregation impractical, compensating controls should be implemented, including independent review and approval of disbursements, dual authorization requirements for bank transactions, periodic review of bank activity by executive management or the Board, independent review of reconciliations and journal entries, and increased oversight of cash disbursement and financial reporting activities. Management’s Response/Views of Responsible Officials See Auditee’s Corrective Action Plan.