Records Management for Internal Controls and the ICC
One of the key internal control requirements is maintaining your department’s written system of internal controls in a central repository in accordance with records management protocols. Internal control records include copies of your department completed Internal Control Compliance (ICC) that your Department Head receives by email once the ICC is electronically signed in DocuSign.
Your annual completed ICC and other internal control documents should not be stored in personal folders or email mailboxes since these documents can be inadvertently deleted or lost. Auditors are now routinely reviewing internal control documents, including copies of your completed ICC, as part of operational audits. Internal Control Officers (ICOs) should ensure that the following controls are in place:
Action Steps
- ICOs should confirm that your written system of internal controls are stored securely in a central repository and accessible to staff who need access to these documents, and not in personal folders or mailboxes
- ICOs should ensure that internal control protocols are in place to retain the completed annual ICC electronically signed by your department head and any other documentation of the annual ICC review process
See our new CTR Compliance Corner for additional guidance on completion of the ICC, such as ensuring your current Internal Control Officer is listed in the Statewide Key Contacts and key staff have access to PowerDMS. Bookmark this page as your one-stop shop for alerts and success factors that you can integrate into your daily operations to keep you safe on your mission.
See our Internal Controls page for more information on internal controls and contact [email protected] if you need support from our Statewide Risk Management Team.