Getting to “Yes” in the Internal Controls Certification (ICC)
Is it enough just to “adopt” CTR published guidance to be able to select a “Yes” response in each section of the ICC?
No. While including CTR published guidance is a critical step, the certification requires that these policies and guidance are integrated into daily operations, and that monitoring and training are actively in place. Integration, monitoring and training do not have to be complicated and can be simple documented steps provided to staff.
Therefore, it is important in an audit or desk review to be able to provide documentation that shows “how” the department is integrating the CTR guidance, along with your department’s other internal policies and procedures, and how guidance is communicated to staff. Documented routine check-ins with staff support active monitoring and training.
Note that the responses to the ICC, similar to the prior Internal Control Questionnaire, are statutorily required to be made available to the State Auditor and independent auditors when conducting statewide financial audits, and for statewide single audits for federal funds.
Even if the department has selected “yes” in a prior fiscal year ICC, Departments should select “in process” whenever it is determined that there may be some additional work to meet the ICC certification for a section(s).
Action Steps:
-
Ensure that your written internal controls identify “how” the department is integrating the CTR guidance and how guidance is communicated to staff.
-
Engage your managers to document your routine check-ins and other communications with staff to demonstrate active monitoring and training.
The “Internal Controls” folder in PowerDMS includes the ICC Compliance Checklist, Frequently Asked Questions for the Internal Control Certification and Internal Control Certification Job Aid to assist you with completion of the ICC.
See our new CTR Compliance Corner for additional guidance on completion of the ICC, such as ensuring your current Internal Control Officer is listed in the Statewide Key Contacts. Bookmark this page as your one-stop shop for alerts and success factors that you can integrate into your daily operations to keep you safe on your mission.
See our Internal Controls page for more information on internal controls and contact [email protected] if you need support from our Statewide Risk Management Team.