Internal Controls

Transaction Cycles and Related Control Objectives

UC Berkeley’s internal control framework views certain business processes in terms of “cycles” into which related transactions can be grouped within the specific accounting procedures and control activities that have been established. Each cycle typically comprises several transaction classes that vary with the particular aspect of the University’s operations. The transaction cycles are outlined below;

• Revenue cycle: Transactions related to generating and collecting revenue, and related controls applied to such activities as invoicing and cash receipts associated with tuition and fee revenues from students, sponsored research-related activity, and other operating revenues. It also includes cash receipts from the State of California through state appropriations and other governmental funds allocated to UC Berkeley.
• Purchasing cycle: Transactions related to purchasing and payments, and related controls applied to such activities as ordering and receiving purchases, cash disbursements, and goods returned to suppliers.
• Payroll cycle: Transactions related to payroll payments to employees include major activities such as time recording, payroll calculations, payroll payment, allocation of payroll benefits from UCOP to UC Berkeley, and adjustments such as salary cost transfers.
• Plant, Property, and Equipment cycle: Interrelated to purchasing, transactions related to capital acquisition of goods and services for long-lived assets include major activities associated with acquisitions and capital projects, asset depreciation, disposals and retirements, asset valuation, adjustments, and ledger maintenance.

Control Objectives

These are the control objectives relevant to financial reporting for a specific class of transactions.

1. Processing Transactions: There are three control objectives related to this area.

   • Authorization: all recorded transactions that actually occurred and relate to the entity, and were approved by designated personnel. Typical control activities might include authorization by an appropriate individual and exception reporting (e.g. reporting employees working more hours than a given number of hours in a week, with subsequent review and follow-up by a responsible official like a supervisor).

   • Completeness of input: all transactions occurred are initially entered into the accounting records and accepted for processing. Relevant control activities, for example, might include computer matching of transactions to other data within the system, one-for-one checking of source documents to data entered into the system, etc.)

   • Accuracy of input: transactions are initially recorded at the correct amount, in the appropriate account, and on a timely basis. Control activities might include one-for-one checking, matching vouchers from purchase orders to goods receipt information in the purchasing system, etc.

2. Maintaining files on which those transactions and the related data are stored
3. Protecting assets against loss from errors and fraud: Assets are protected against loss from errors and fraud (particularly misappropriation) in the processing and handling of assets. This might include physical controls that restrict access to physical inventories and related documents and segregation of duties between personnel authorized to purchase assets and those authorized to disburse cash.

Best Practices in Control Activities

The following is a list of best practices to safeguard the University from fraud, waste, abuse, and mismanagement and ensure effective operations, reliable reporting, and compliance with federal regulations and UC policies.

• Segregation of duties: Establishes a breakdown of duties so that no one person can single-handedly conduct the entire procedure in a transaction. This separation ensures a check and balance system. Assigned responsibilities should be properly documented and reviewed periodically. For example, employees and proxies to employees enter travel reimbursement requests into the reimbursement system. The supervisor is responsible for reviewing the request to ensure compliance against policy before authorizing reimbursement, and individuals within the Controller’s Office monitor transaction processing to ensure reimbursement is completed using automated systems. Review this chart as an illustrative example of segregation of duties by financial cycle.

• Policies and procedures: Written policies and procedures should be made available to personnel and must describe processes for planning, organizing, directing, controlling, and reporting on organizational operations.
• Documentation: Ensures detailed, accurate, and sufficient information is recorded and retained to support and corroborate University transactions.
• Authorization: Establishes transactions that should be reviewed and authorized prior to execution. For example, purchase transactions require financial approval if the amount exceeds certain dollar thresholds within BearBuy.
• Asset safeguarding: Physical assets susceptible to misappropriation or misuse, such as cash, fixed assets, or theft of sensitive equipment such as tablets, cell phones, and laptops, are properly secured and accessible only to authorized personnel. Access controls, however, do not prevent individuals who have authorized access to assets from misappropriating them. Individuals who have authorized access to both assets and related accounting records may be in a position to conceal shortages of assets in the records; however, if duties are properly segregated, such as between the BETS system of asset records and individuals with access to equipment, the concealment of shortages can be mitigated.
• General Computer Controls (GCCs): Computer systems frequently have common areas of control and related control procedures. Managers of the information systems function usually monitor the performance of GCCs. Monitoring activities include observation, exception reporting, reviews of work performed, reviews of program changes, and monitoring of user complaints.
• Reconciliations: Accounting reconciliations corroborate that recorded transactions are accurate and provide the most current information for reporting. Physical reconciliations ensure assets purchased with University funds are being properly utilized. For example, custodial managers are required to perform equipment inventory audits on a biennial basis. The Controller’s Office, as another example, reconciles bank statement amounts to current cash balances for any unexplained discrepancies.

All of these best practices have been built into UC Berkeley’s internal control framework.

In summation, it’s important for the DFL to know that maintaining the internal control environment and related control procedures is an integral part of management’s responsibilities. In the context of governmental accounting and reporting, the control environment has a direct impact on UC Berkeley’s ability to collect and present accurate financial information, and as a result, the internal control environment and related procedures are key areas of concern to the University of California’s external auditor.