Internal Control Plan

This document presents the Internal Control Plan for the Missouri Department of Higher Education (DHE). The purpose of the plan is to list the steps that are taken by DHE employees to ensure all assets and information is properly safeguarded against improper use. This plan will be reviewed annually to ensure that internal controls and system controls are kept up to date and in accordance to state and federal rules and regulations.

This plan incorporates the guidelines and rules set forth in the following documents, which are available for review upon request:

DHE's Integrated Strategic Plan
DHE Personnel and Policy Manual
DHE Accounting Procedures Manual (draft)
DHE Human Resource Procedures Manual (draft)
DHE Information Technology Acceptable Use Policy

Over the past two years DHE has implemented policies and procedures that minimize risk and make better use of staff time. Staff continues to use best practices to centralize transactions and to make operations run more efficiently and effectively.

To aid in the development of this plan, all business processes were identified. Business processes are defined as any transaction or activity performed that has a fiscal impact on a program, fund, appropriation or bank account. These processes were then examined for weaknesses in internal control and current procedures were examined to ensure all assets are safeguarded against any and all risks. In addition, information systems (both internal and external) that help establish a sound internal control plan were reviewed and staff duties are clearly communicated with all staff. Finally, DHE's plan to formally monitor and evaluate the adequacy of this plan was disseminated and approved by senior staff.

The plan consists of the following five components:

Control Environment
Risk Assessment
Control Activities
Information and Communication
Monitoring

INTRODUCTION

This document presents the internal control plan for the Missouri Department of Higher Education (DHE). The internal control plan addresses the establishment and delivery of proper controls for the fiscal operations of the DHE and how mechanisms have been established to safeguard the organization's assets and ensure proper use of resources. The format employed for this document follows the guidelines recommended by the Office of Administration, Division of Accounting as outlined in the report titledInstructions for the Preparation of an Agency Internal Control Plan, April 1999.

DHE's approach to establishing and maintaining proper internal controls parallels the recommendations from OA and other state and federal regulations. DHE has assessed known risks for business processes, developed procedures to minimize those risks and has developed a plan that will formally monitor the internal control plan. This plan will be modified based upon any findings in subsequent fiscal reviews.

Fiscal Objectives

Most all fiscal transactions are centralized and are the responsibility of the Administration Section, including the following activities:

Establishment of fiscal polices and procedures to comply with federal and state rules and regulations
Provide control of DHE's accounting activities
Make monetary disbursements and deposits with the State Treasurer and Central Trust Bank
Maintenance of fixed asset and expendable inventories
Collect receivables

Other activities that are decentralized include the following:

Proper coding and control of the Automatic Transfer of Money (ATOM) which handles the disbursements of student loans to financial and higher education institutions. This account is held outside the state treasury.
Proper coding and control of the state grants and scholarship program.

Internal control provides DHE management with reasonable assurance that its policies and procedures are implemented and consistently followed to ensure efficient and effective organizational operation. The internal control plan consists of all the methods used to safeguard assets, to promote accuracy and reliability of the organization's accounting data and records, to encourage compliance with all state and federal rules and regulations and department polices and procedures, and to promote the operational efficiency of the agency.

Internal Control Objectives

To assist in making sure the Department of Higher Education's (DHE) fiscal objectives are met, internal controls are established to provide a structure for accomplishing these fiscal objectives. The objectives for DHE are:

Transactions are properly authorized.
Duties are sufficiently segregated with proper back-up personnel to have continuity of business.
Access to assets is properly safeguarded.
Annual reviews of the internal control plan to ensure policies and procedures are being followed.

DHE's internal fiscal objectives are addressed in this document by providing the following components:

Control Environment ? Provides the overall description of the agency and the Department of Higher Education and the Coordinating Board for Higher Education, including DHE's mission statement, the Coordinated Plan, a history of the department, and DHE policies.
Risk Assessment ? Describes the processes taken to determine weaknesses in the overall financial management processes, and the organizational structure and its funding to determine if the structure is accurate to reach desired goals and outcomes.
Control Activities ? Includes the elements necessary to provide management with reasonable assurance that its policies and procedures are being carried out. The control activities that are relevant are categorized as internal controls that pertain to: performance reviews, information processing, physical control, and segregation of duties.
Information and Communication ? Consists of the methods and records established to identify, assemble, analyze, classify, record and report transactions, and to maintain accountability for the related assets and liabilities. The systems are periodically tested and information regarding those tests is disseminated among senior staff.
Monitoring ? The plan established to perform periodic reviews of systems, transactions, processes and programs to ensure proper internal controls are in place and to continue to keep risk of misuse non-existent. This plan provides a means for the agency to be proactive in determining weaknesses rather than reactive.

CONTROL ENVIRONMENT

Department of Higher Education History
The Department of Higher Education (DHE) was authorized by an amendment to the Missouri Constitution in 1972 and established by statute in the Omnibus State Reorganization Act of 1974.

The nine board members that form the Coordinating Board for Higher Education, one from each congressional district, are appointed by the governor and confirmed by the Senate. The term of appointment is six years. No more than five of the nine members may be affiliated with the same political party. Members serve without compensation.

The commissioner of higher education is appointed by the Coordinating Board to carry out the goals and administrative responsibilities for the state system of higher education ? with 13 public four-year college and university campuses, 19 public two-year campuses, 1 public two-year technical college, 25 independent colleges and universities, and 120 proprietary schools serving more than 360,000 students.

The DHE's primary responsibilities include:

The identification of statewide needs for post-secondary education.
Statewide planning for post-secondary education.
The evaluation of student and institutional performance.
The review of institutional missions.
The establishment of admission guidelines consistent with institutional missions.
The administration of a performance funding program encouraging the achievement of statewide priorities.
The submission of a united annual budget request for public higher education to the governor and the Missouri General Assembly.
The administration of a statewide post-secondary technical education program.
The approval of new degree programs offered by public colleges and universities.
The establishment of guidelines to promote student transfer among post-secondary institutions.
Policy setting for and the administration of state and federal student financial assistance programs.
The administration of the Proprietary School Certification program.

MOSTARS, the student assistance division of the department, provides approximately $440 million to 136, 000 students annually. In addition, MOSTARS conducts outreach activities to improve consumer information about opportunities for post-secondary education and student financial assistance in Missouri and to help students avoid defaulting on their educational loans and accumulating credit card debt.

The Department of Higher Education's internal control environment is dictated by official State policies and procedures and federal rules and regulations. DHE adheres to statewide procedures for budgeting, human resources, procurement, receipting, expenditures and general accounting. The DHE uses the online transaction capabilities of the Statewide Advantage for Missouri II (SAM II) automated accounting system. DHE has established a number of workflow rules and approval controls.

The control environment is the foundation of all other components of the internal control plan, providing discipline and structure. The DHE's control environment components include:

Management Philosophy. Management's commitment to provide adequate control through the design, the installation, and the maintenance of a system of internal controls.
Organizational Structure. The organization structure provides the framework for the division of authority, responsibility and duties while also allowing for proper section backup for continuity of business.
Human Resource Activities. Ensures adequate policies and procedures are in place to ensure that staff is competent, is continually trained in field, adheres to standard code of conduct, and understands the importance of their duties and how they relate to the overall goal of the agency.
Internal Control Reviews. Periodically, Administration performs reviews on internal controls, program expenditures and other financial record reviews. Any findings will result in a modification of this plan as needed.

The DHE's management staff is committed to providing its customers, employees, government officials and the general public with excellent customer service. The maintenance of sound fiscal controls to ensure the delivery of services to our customers is a continual review and improvement process.

VISION:
The Department of Higher Education's vision is to help Missourians ?learn smart? by taking advantage of postsecondary education and to encourage investments in high-quality education. The Department envisions a coordinated, value-drive system of education of public, independent, and private career school, colleges and universities that provides access to high quality educational environments in order to enrich the intellectual, professional and personal capabilities of Missourians, thereby advancing their civic, economic and social contributions to Missouri communities.

MISSION:
The Department of Higher Education's mission is to improve educational achievement, enhance educational quality, and promote the economic and social value of education throughout Missouri .

VALUES:
The Department of Higher Education values a customer focus in the design and delivery of programs and services; prioritizing departmental activities and services based on customer needs; and quality improvements in higher educations administration, institutions and programs.

RISK ASSESSMENT

Risk assessment is the process of identifying any risk that could negatively impact fiscal performance of DHE. This section addresses the risk assessment process. This assessment is an on-going exercise for senior staff to determine on a continual basis if business processes are being completed in the most efficient and effective manner while also abiding by state and federal rules and regulations. During the initial assessment, some of DHE senior staff performed the following tasks:

Identified DHE's primary responsibilities and functions as they relate to internal control.
Identified transactions, cycles and systems used to manage financial information that is vital to the accomplishment of the agency objectives.
Identification and management of obstacles and risks to agency financial processing and information systems.

During the assessment, DHE combined activities relating to fiscal management into business processes. The business processes are defined and have been assessed a risk factor. The DHE accessed the level of risk due to fraud, abuse and mismanagement for each of its business processes.

Business Processes:

Policy and Planning
Reporting
Budgeting
Human Resources
Payroll
Procurement
Disbursement
Receipt
Fixed Asset Management
General Accounting

The key factors determining the level of risk included: volume of transactions, current procedures, authorization process, and prior occurrence of problems.

Business Process	Description	Possible Risk	Process to Minimize Risk

Policy and Planning	DHE's policy and planning process includes defining the organization's vision, mission and values, preparing and maintaining the Coordinated Plan for Higher Education, establishing sound fiscal policies and procedures.	The lack of or the misunderstanding of the organization's vision, mission and values, without sound fiscal policies and procedures, could result in insufficient controls to safeguard DHE assets.	Ensure that all fiscal policies and procedures are kept up to date and in conformance with state and federal rules and regulations and that these policies are disseminated among staff and understood in their entirety.

Financial Reporting	Includes the periodic reporting regarding management and operational reports, statements of revenues and expenditures and the agency's financial statements.	The inability to create, distribute and validate accurate and timely financial and management reports could result in misleading financial data and never knowing the financial position of the agency at any given time.	Written procedures established and disseminated to senior staff outlining the schedule of periodic reports regarding revenues and expenditures and the timely review of transactions to ensure accuracy and completeness of reports.

Budgeting	Budgeting is the process that determines the level of funding necessary to carry out the objectives in the agency's Coordinated Plan.	The lack of planning could result in the agency no longer operating as an on-going concern. Budget review is necessary to compare the amount budgeted to actual expenditures, review any variances, and make adjustments as needed.	Senior staff continues to adequately plan for the future as an on-going business concern. Proper planning results in more efficiencies and a better government.

Human Resources	The administration of the human resources includes ensuring that qualified and well trained staff are hired and a proper continual training program is in place to keep staff adequately trained in field	The risk of not running background checks could result in unqualified staff, staff with a delinquent student loan or staff with a criminal background	Develop procedures that would require a background check on all persons considered for employment through the Missouri State Highway Patrol, check the NSLDS system for all persons considered for employment for delinquent student loans and perform annual checks on all employees to ensure no changes in the past year have occurred.

Payroll	SAM ll procedures are followed when setting up payroll, entering in leave and other personnel related activities.	The potential for mistakes is great during this process, without personnel policies and procedures in place; an agency runs the risk of fraud, mistakes and proper oversight of entries.	DHE has drafted procedures that explain the reconciliation process to ensure the payroll information is accurate and the reconciliation is done in a timely manner. Reconciliations do occur, but nothing is formal at this time.

Procurement	The process by which goods and services are purchased to assist the agency in reaching its goals.	The possibility of unauthorized transactions can occur either intentionally or unintentionally. To minimize those risks department procedures regarding prior authorization were adopted in September of 2001.	State and federal rules and regulations are followed to accurately procure goods and services according to the intent in which money was appropriated and/or awarded. The procurement process includes prior authorization of any expenditure, without prior approval the employee will be held personally liable.

Disbursement	The DHE disbursed over $15 million in operating expenditures, $43 million in grants and scholarships and $246 million in student loans during FY2002.	Due to the number of transactions processed, the greater the risk is for fraudulent payments and other unauthorized transactions. Also the greater for legitimate errors that could have a negative financial impact if not corrected.	State and federal rules and regulations are followed to accurately procure goods and services according to the intent in which money was appropriated and/or awarded. The procurement process includes prior authorization of any expenditure, without prior approval the employee will be held personally liable. There is also a monthly review of expenditures by appropriation and a review of revenue sources to determine if transactions have been recorded properly.

Receipt	The DHE has centralized the receipt function of its financial operations. Procedures have been put into place that reduce risks by centralizing where checks are kept and depositing the majority of checks within 24 hours of receipt. Reconciliations are completed on a monthly basis by each corresponding section by reports generated from administration.	Prior to procedures changing, the department realized a great risk by having actual checks distributed to personnel throughout the department and also not requiring a timely deposit of those receipts. By allowing this practice to continue would result in the probability of theft and the state losing interest revenue.	All payment procedures will be performed in accordance with all applicable laws, rules, regulations, OA/SAM ll polices, and DHE policies and procedures. DHE will ensure receipt procedures include the proper segregation of duties in receiving, depositing and reconciling, and with the appropriate levels of approvals.

Fixed Asset Management	Procedures have been put into place segregating the ordering, receiving, paying, entering information on fixed asset system, and performing of the annual physical inventory.	Without the proper segregation of duties and proper management controls over fixed asset, the risk of theft of equipment and improper listing of equipment and its location is high.	Procedures have been established in accordance with all applicable state and federal rules and regulations in addition to being compliant with OA/SAM ll procedures. These procedures include proper segregation of duties for asset management.

General Accounting	Procedures have been established in accordance with all applicable state and federal rules and regulations in addition to being compliant with OA/SAM ll procedures.	The primary risk involves the inappropriate processing of journal vouchers that could result in moneys be deposited into funds in which one or more employees have access for inappropriate disbursements.	DHE follows the procedures outlined by SAM ll for the processing of journal vouchers. DHE maintains a log of all journal vouchers including a copy of the transaction being reversed attached to the JV document. All JV documents require approval thus minimizing the risk of inappropriate transactions.

Control Activities

The section summarizes the process taken for all financial and payroll transactions completed at DHE. This summary provides the reader with a complete understanding of steps taken to ensure all transactions are completed, reviewed, corrected if needed, in a timely manner. All transactions are prepared and authorized in accordance with SAM II Financial Policies and Procedures, SAM II Human Resources/Payroll Policies and Procedures and DHE Policies and Procedures.

Over the past two years procedures have been adopted and processes changed to provide for tighter controls in safeguarding DHE assets. Those include centralizing all receivables, developing a vendor file system, performing internal reviews, developing written procedures for sections performing financial and payroll functions, and keeping separate ledgers on all programs operating from the federal fund. DHE processes and procedures will continually be reviewed and updated as needed to adhere to state and federal rules and regulations.

FINANCIAL PROCESSING PROCEDURES

The primary objectives of the accounting office are to scrutinize all invoices, ensure that all purchases have received prior approval and invoices have proper backup documentation, to deposit checks within 24 hours of receipt, and to perform operational reviews as needed.

The Accountant reviews all invoices for accuracy. Prior to processing invoices for payment the accountant will receive approval on invoice for payment from appropriate section Director or Associate Commissioner. This approval along with a copy of the purchase requisition is forwarded to the accountant for prompt payment.

There are several documents that invoices are paid from. DHE primarily uses the following:

PVE - Payment Expense Vouchers, used for expense accounts
PVS - Special Payment Voucher - claims paid, federal distributions and state aid to community colleges
PVQ - Quick Payment Voucher - process payments on invoices where PO's are not required
RE - Receivable documents
P1 - Vendor Payment Voucher - purchase orders are associated with these documents
CR - Cash Receipt - used for depositing monies in the State Treasury

The process used in submitting the above listed documents include prior approval from section directors for purchases less than $250 and anything over $250 requires the Director of Administration's signature. Upon receipt of invoice, the section director is required to approve as authority to pay. Invoice is then given to the Accountant to review and process for payment. The Accountant assigns a document number and enters information into SAM II for processing. All documentation is forwarded to Director of Administration for review and final approval in SAM II. Copies are kept at the DHE office, the check number and/or EFT date is written on the invoice copy and filed accordingly. All checks are mailed along with a copy of the invoice by Office Support Services.

PAYROLL PROCESSING PROCEDURES

Entering of Deduction Information

All payroll additions, deletions or changes are given to Human Resources. New hires, salary changes, probation letters and leave with no pay circumstances must have the Commissioner's approval. All necessary forms for payroll changes are available in the Human Resources section. When these forms are received, they are checked for completion, accuracy and signature. Any forms requiring agency information are completed, signed and dated. The multi-page forms are separated, originals to their destinations, agency copy and employee copy. Each pay cycle, Human Resource staff enters all payroll transactions on the SAM II ? HR system. Most transactions that affect an employee's salary require on-line approval from the Director of Administration. After the transaction is completed, the form is forwarded to the appropriate office: MCHCP, MOSERS, Cafeteria Plan, PEBSCO, etc. Copies of all payroll transactions are kept in Human Resources. If any problems occur with the running of payroll, the Division of Accounting or the Division of Personnel will contact Human Resources. We work together until the problems are resolved. After the pay cycle has ran, all transactions are double-checked. Copies of all payroll transactions are kept in an employee's personnel file. Personnel files are locked each evening. There is limited access to these files.

Document Direct (MOBIUS) Reports

After each pay cycle has run, Human Resources print all necessary payroll reports from MOBIUS. The entire list of SAM II - Human Resource reports available to agencies is located on the web at: http://www.missouri.gov/mo/samii/hr/mobius/ The Department of Higher Education prints the following report numbers:

HAA8000 - Leave Balance
HAR5200 - Payroll Register
HAR6100 - Paycheck Register
HAR6200 - Direct Deposit Register
HAR6300 - Paycheck Control Sheet
ODWF640 - Employees Not On Direct Deposit
OHB0805 - Year-To-Date Payroll Register
OHB0816 - Current Earnings Register
OHB0823 - Allocated Vacant Position
OHB0877 - SUSE ESMT Audit Trail Report
OHB819R - Employees Not Paid
OHUB807 - Annual Wage & Tax Report By Agency/Organization
OHUB809 - Court Ordered Deduction /Sequestration
OHUB811 - Allocated Position Listing
OHUB821 - T&A Activity by Agency/Organization Accountant I prints this report.
OHUB831 - Time and Leave Accepted Transaction

Human Resources review these reports as necessary. They are also used by the state auditors each year.

Receipt & Disbursement of Monthly Payroll Checks

Normally, a couple working days before the scheduled pay date, the paychecks are signed for and picked up by the department's Office Support staff from the Office of Administration, Division of Accounting. The checks/check stubs are given to the Accountant I. They are stored in a locked safe each night. The day before payday the Accountant I sorts the paychecks/deposit slips and mails all checks/check stubs to employee(s) located out of the office. The Accountant I also distributes the check stubs to the Administrative Assistants. The Administrative Assistants hand delivers check stubs to employees in their section. Checks are signed off by employee(s) receiving actual paper checks; otherwise all check stubs are distributed. Any employee who receives a paper check must sign a sign sheet. This sign sheet is stored in the Human Resources area. If an employee is absent from work on payday, the check stub or paycheck is returned to the Accountant I to be held in the safe. An employee's paycheck cannot be disbursed to a second party without written approval from the employee.

Check/Direct Deposit Cancellation

If a problem arises with an employee's direct deposit the Office of Administration, Division of Accounting should be notified immediately. For paycheck/direct deposit cancellations, a Supplemental Check/Check Cancellations Request is completed by Human Resources. This form can be found on the web at http://www.missouri.gov/mo/samii/hr/hrp&p.html. The form must be signed by the Director of Administration. A copy is kept in Human Resources and the original is faxed to the Office of Administration, Division of Accounting.

Payroll Accounting Adjustments (PACC) for Corrections to Payroll

If it is determined after a paycheck/direct deposit is distributed that incorrect accounting information has been used to pay an employee, it will be necessary for Human Resources to complete a PACC. A Payroll Accounting Adjustment form must be completed before the PACC change is entered into the SAM II-Accounting system by Human Resources. PACC corrections must be approved by the Director of Administration. The PACC must also be approved by the Office of Administration, Division of Accounting. A copy of the PACC is kept in Human Resources and the original is sent to the Office of Administration. You can find guidelines for PACC corrections at the following website http://www.missouri.gov/mo/samii/hr/hrp&p.html

Information and Communication

The Department of Higher Education (DHE) utilizes two systems to process financial transactions for all business processes. The first system is the SAM II system and the other is an internal system utilizing the department's AS/400.

The programs currently operating from the AS/400 are the Automatic Transfer of Money (ATOM) and all state student financial assistance programs. Changes to these systems include a web-based application for the state student financial assistance programs and the new servicer (ASA) will take over the computer system for ATOM.

The other information system utilized is the SAM II system. The system is used to process all payments through state appropriated funds.

Communication concerning the agencies systems, processes and procedures can be found in various manuals. Those manuals include the DHE Personnel and Policy Manual, DHE Accounting Procedures Manual (draft), DHE Human Resource Procedures Manual (draft), DHE's Integrated Strategic Plan and DHE Information Technology Acceptable Use Policy. As processes change, information is disseminated through e-mails, formal memos and verbally until the appropriate manual can be revised.

Through constant communication, DHE realizes the importance of ensuring its assets are properly safeguarded.

Monitoring

The Director of Administration has the primary responsibility in assuring the adequacy of the system of internal controls for the fiscal operations for DHE. Procedures for establishing and monitoring management controls, reporting on the adequacy of controls, and improvement of controls and corrections action plans will be incorporated into DHE policies and procedures. These policies and procedures will follow guidelines set forth in DHE's Personnel and Policy Manual. In general the internal control review process will encompass reviews completed on an annual basis comparing expenditures, budget and prior year amounts. Ad hoc reviews will include performance, vendor, contract compliance, object code, etc.. Reviews will also include looking at processes and possibly correcting possible weaknesses.

The State Auditor's office performs annual audits of our agency. These audits address internal control issues. Any findings are disseminated among senior staff and acted upon by the appropriate sections. Through this process, DHE can also minimize possible threats to weakening the internal control structure and be proactive in directing a corrective action plan.

Through the ongoing monitoring of DHE's internal control plan, the agency can provide reasonable assurance as to the soundness, accuracy and reliability of its financial information.