United States GAO General Accounting Washington, Office D.C. 20548 Accounting and Information Management Division B-283047 July 15,1999 Mr. James F. Manning National Director Congressional Award Foundation Subject: Congressional Award Foundation Management Action Needed to Establish Control Reauirements and Related Procedures Dear Mr. Manning: In May 1999, we issued a report’ expressing our opinion on the Congressional Award Foundation’s fiscal year 1998 financial statements and on management’s assertions regarding the Foundation’s system of internal control as of September 30,1998. We also reported on the results of our tests of the Foundation’s compliance with selected provisions of relevant laws and regulations during fiscal year 1998. We conducted our audit pursuant to the Congressional Award Act, as amended (2 U.S.C. 807), and in accordance with generally accepted government auditing standards. The purpose of this management letter is to (1) reemphasize the need to establish and document control requirements and appropriate procedures in certain internal control areas identified during prior audits and (2) advise you of additional internal control matters identified during our fiscal year 1998 audit. Results in Brief In conducting our fiscal year 1998 audit, we found that the Foundation had made progress in strengthening internal controls related to accounts receivable, restricted contributions, and facsimile invoices-three of five areas of control weakness identified during our fiscal year 1997 audit.2 During fiscal year 1998, the Foundation strengthened accounts receivable and contribution-related controls by establishing separate subsidiary databases which enabled the Foundation to more effectively ’Financial Audit: Congressional Award Foundation’s 1998 and 1997 F’inancial Statements (GAO/AIMD-99-173, May 14,1999) ’ Congressional Award Foundation: Continuing Attention Needed to h-move Internal Controls (GAO/AlMD-9&229RJuly 31,1998) GAO/AIMD-99-224R Congressional Award Foundation B-283047 (1) monitor overdue accounts receivable and assesstheir collectability and (2) track restricted contributions and circumstances associated with their release. With respect to processing of facsimile invoices, the Foundation began reviewing vendor files and invoice payment lists in an effort to identify potentially duplicate invoices prior to payment. However, the Foundation had not yet established and documented control requirements and related procedures for Foundation staff to follow in processing accounts receivable and facsimile invoices and in monitoring the status of restricted contributions. Likewise, we found that management had not yet progressed in establishing control requirements and related procedures with respect to the other two areas of internal control weakness identified during the fiscal year 1997 audit-documenting and approving accounting adjustments and following up on bank reconciliations. Without established and documented control requirements and related procedures, the Foundation faces the continuing risk that the processing of transactions and preparation of financial reports may not be consistently followed, monitored, and controlled. In commenting on a draft of this letter, you agreed with our conclusions and suggestions regarding the need to establish and document internal control requirements and related procedures and expressed your intention to implement our suggestions. Furthermore, you advised us that the Foundation has hired a director of operations whose responsibilities include strengthening the Foundation’s system of internal control. Also, you told us that our suggestion to establish an audit committee will be addressed at the next meeting of the full board. We will review the Foundation’s status in addressing these matters during our fiscal year 1999 financial audit. MANAGING RECEIVABLES AND MONITORING RESTRICTED CONTRIBUTIONS During fiscal year 1998,the Foundation acted to strengthen controls over accounts receivable and monitoring of restricted contributions. Specifically, the Foundation established subsidiary databases for accounts receivable and for contributions. It used the information in the accounts receivable database, which included invoice numbers, to help it follow up on overdue receivables and assess the collectability of its older accounts receivable. Similarly, it used information in thecontributions database to help it track the specific nature and extent of donor-imposed restrictions and monitor events associated with their release. While the use of these databases served to improve receivable collections, increase the reliability of recorded accounts receivable information, and enhance monitoring of donor-imposed restrictions, the Foundation has not yet established formal control requirements and related procedures for processing, managing, monitoring, and controlling accounts receivable and restricted contribution information. 2 GAO/AIMD-99-224R Congressional Award Foundation B-283047 GAO’s Standards for Internal Controls in the Federal Governmen requires that transactions and other significant events be promptly recorded and properly classified. However, during our fiscal year 1998 audit, we found that, after circumstances prevented the Foundation from satisfying a donor’s intention regarding a $5,000 restricted contribution, it took the Foundation over 9 months to ask how the donor wanted to handle the unspent contribution. Although the Foundation tracked restricted contributions on its database during fiscal year 1998, the Foundation had no documented requirement or procedure to ensure that it promptly notified a donor when circumstances prevented the Foundation from using a contribution for the purpose specified by the donor. Without formal control requirements and related procedures to assist the staff in dealing with such situations, the Foundation increases the risk that recorded amounts may not be accurate, properly classified, or reliably reported. CONTROLS OVER FAX INVOICES Because facsimile invoices may precede or actually substitute for an original invoice, it can be difficult to identify a duplicate invoice received for processing. During our fiscal year 1997 audit, we found that management authorized invoice payments to vendors who submitted facsimile invoices. Because management had not established additional control procedures to provide increased protection against duplicate payments, management did not identify a duplicate facsimile invoice processed during fiscal year 1997 and as a result made a duplicate $2,500 payment to a consultant. We suggested that the Foundation establish specific control requirements and related procedures to provide added assurance that vendor files are reviewed for evidence of an existing invoice prior to making a payment associated with a facsimile invoice. During our fiscal year 1998 audit, we noted that the Foundation successfully recovered the $2,500 duplicate invoice payment identified during our 1997 audit. In addition, while the Foundation continued to authorize vendor payments based on facsimiles of invoices, it initiated additional reviews prior to approving facsimile invoices for payment. According to Foundation management, vendor files and a historical list of invoices (both paid and pending) were reviewed to reduce the risk of making duplicate payments. While we did not identify any duplicate payments during our tiscal year 1998 audit, our review of vendor payments based on facsimile invoices did not identify documentary evidence that the additional reviews were performed. In addition, Foundation management had not established a formal requirement to conduct the additional reviews and document their results. To reduce the risk that %?hileGAOhas proposedrevisionsto the standards(Exposure Draft Standardsfor Internal Control in the Federal Government GAO/AI&ID-22.214.171.124issued May 1999), the proposed revisions retain these specific requirements. 3 GAOIAIMD-99-224R Congressional Award Foundation B-283047 future additional reviews might not be performed, we suggest that the Foundation require formal control documentation detailing the nature and extent of the additional reviews as well as develop a mechanism for documenting the fact that the reviews have actually been performed. PREPARATION AND APPROVAL OF FINANCIAL STATEMENTS AND RELATED ADJUSTMENTS During our fiscal year 1997 audit, we noted that the Foundation had not developed formal control requirements and procedures to ensure that worksheet adjustments needed to prepare and support the Foundation’s financial statements were clearly documented and reflected management’s review and approval before they were included in the financial statements. During our fiscal year 1998 financial statement audit, we found that the Foundation had not yet established control requirements and related procedures that ensure financial statement worksheet adjustments are documented, reviewed, and approved as part of the financial statement preparation process. In addition, we found that the lack of documentation, review, and approval requirements and procedures extended to the year-end process for closing the books. The lack of such requirements and related procedures contributed, in part, to errors in both year-end closing and statement preparation for fiscal year 1998. For example, we found that in closing the books for fiscal year 1998, management did not ensure that $30,705 of certain professional fees were reclassified to program, promotion, and travel expenses consistent with the Foundation’s fiscal year 1997 financial statements. While management initiated the reclassification during the fiscal year 1997 statement preparation process, management did not act to ensure that the fiscal year 1998 year-end closing or statement preparation processes were modified to ensure that the fiscal year 1998 reclassification was made prior to the preparation of draft financial statements. By not modifying the closing and statement preparation process to require the reclassification and subsequent management review, management contributed to classification errors in the Foundation’s draft financial statements for fiscal year 1998 year. Also, in developing certain financial information needed for footnote disclosure in the fiscal year 1998 financial statements, various errors were made that should have been detected by management during a review of the draft fmancial statements and related supporting documentation. For example, we noted that percentages on a key allocation schedule were not consistent with dollar amounts presented. In addition, we found that incorrect assumptions were made in allocating certain salary expenses to functional expense categories such as selecting an employee whose time wasspent primarily on program matters as a basis for allocating the salary of a former administrative assistant who worked almost exclusively on administrative matters. The nature of these errors demonstrates the need for Foundation management to establish documented control requirements and related procedures to govern (1) the 4 GAOIAIMD-99-224RCongressional Award Foundation B-283047 preparation of year-end closing entries, (2) the development of supporting documentation for all closing/adjusting entries, and (3) management review and approval. FOLLOW-UP ON RECONCILIATIONS During our fiscal year 1998 audit, we found that the Foundation did not consistently follow-up on outstanding checks, including those outstanding for an extended period. Bank reconciliations that include following up on unusual outstanding items should be performed regularly to ensure that assets are properly safeguarded and controlled. Performing reconciliations without timely following up on unusual outstanding items serves to diminish the value and usefulness of the reconciliation as a control. Our review of the fiscal year 1998 bank reconciliations found that the Foundation failed to follow-up on a $1,050 check that had been outstanding for about 8 months. Not following up on the outstanding check prevented the Foundation from learning that the check had been voided. This problem occurred, in part, because the Foundation did not have documented requirements and related procedures to identify and follow up as appropriate, on unusual reconciling items, and for managerial review and approval of completed reconciliations. Without such requirements and related procedures to help ensure that effective bank reconciliations are performed, the Foundation faces increased risk that assets are not properly safeguarded and transactions are not properly recorded and summarized. SEPARATION OF DUTIES According to GAO’s Standards For Internal Controls in the Federal Government, key duties and responsibilities in authorizing, processing, recording, and reviewing transactions should be separated among individuals to reduce the risk of errors or fraud and the chance that such actions may go undetected. During our fiscal year 1998 audit, we noted that the Foundation’s bookkeeper is responsible for recording expenditures in the general ledger and for reconciling the Foundation’s checking account. These responsibilities require the bookkeeper to have access to the Foundation’s checkbook. Providing an individual, whose responsibilities include recording revenue and expense transactions in the general ledger, with access to the Foundation’s checkbook and register to perform reconciliations, represents inadequate separation of duties. Management of any organization is ultimately responsible for designing and implementing internal controls based on their associated costs and benefits. While, small organizations, such as the Foundation, face particular challenges in establishing adequate separation of duties, management should take steps to reduce the risk posed by inadequate separation of duties. We suggest that management establish compensating controls such as requiring the National Director to review monthly bank statements, canceled checks, and the results of the monthly reconciliation 5 GAOIAIMD-99-224R Congressional Award Foundation B-283047 process. In addition, the Foundation’s administrative assistant could review the checkbook before and after (1) authorized disbursements have been made and recorded and (2) the periodic bank reconciliation has been performed. MANAGEMENT ACTION NEEDED For the past several years, following the completion of our financial statement audits, we have emphasized the need for Foundation management to establish, document, and implement control requirements and related procedures. The relative importance of doing this increased in April 1999, with the departure of the Foundation’s former national director. Given the Foundation’s relative size and limited staffing, the former national director, who held the position for the last 10 years, played a very significant and central role in the Foundation’s system of internal control. With the lack of established control requirements and related procedures, the loss of her knowledge and experience increases risks associated with not properly recording and summarizing transactions and safeguarding assets. Moreover, it heightens the need to establish, document, and implement appropriate control requirements and related procedures. We suggest that the Foundation obtain technical assistance to establish and document these internal control requirements and related procedures. To oversee and monitor management’s progress in establishing, documenting, and implementing control requirements and related practices, the Foundation’s Board of Directors may wish to consider forming an audit committee. In the private sector, audit committees are typically charged with overseeing and monitoring an organization’s financial management, reporting, and internal control activities as well the annual audit process. Trtforming an audit committee of the Board, we suggest that the Board consider including one or more individuals with specific knowledge of and experience in fmancial accounting and reporting applicable to not-for-profit organizations, as well as internal control-related issues applicable to small private organizations. Because of the heightened need to establish, document, and implement control requirements and related procedures, we are sending copies of this letter to Thomas D. Campbell, Chairman, Board of Directors, and Janice Griffin, Foundation Treasurer and member of the Board of Directors. This report is intended for the use of the Foundation’s management, its Board of Directors, and members of Congress. However, this report is a matter of public record and as such will be made available to other interested parties upon request. 6 GAO/AIMD-99-224R CongressionalAward Foundation B-283047 We appreciate the cooperation and assistance Foundation management and staff provided during our audit of the Foundation’s fiscal year 1998 financial statements. If you have any questions regarding this letter, please contact me or John Reilly at (202) 512-9406. Key contributors to this assignment were Yola Lewis and Ben Smith. Sincerely yours, Robert W. Gramling v Director, Corporate Audits and Standards (917798) 7 GAO/AIMD-99-224R Congressional Award Foundation :. ‘. ,. .: Ordering Information The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and Mastercard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. Orders by mail: U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 or visit: Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may aIso be placed by caBing (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please caB (202) 512-6000 using a touchtone phone. A recorded menu wili provide information on how to obtain these lists. For information on how to access GAO reports on the INTERNET, send an e-mail message with “info” in the body to: infoQwww.gao.gov or visit GAO’s World Wide Web Home Page at: httpz/%ww.gao.gov United States General Accounting Office Washington, D.C. 20548-0001 I Permit No. GlOO Official Business Penalty for Private Use $300 Address Correction Requested
Congressional Award Foundation: Management Action Needed to Establish Control Requirements and Related Procedures
Published by the Government Accountability Office on 1999-07-15.
Below is a raw (and likely hideous) rendition of the original report. (PDF)