Key Takeaways
- Internal controls support reliable financial reporting, efficient operations, and compliance, including over federal grants under Uniform Guidance.
- Segregation of duties separates four functions: authorization, custody, recording, and reconciliation.
- A procedure becomes a control when it’s documented and can answer who, what, when, and how, with evidence.
- Smaller teams can use compensating controls, such as council review, when full segregation isn’t possible.
Every Ohio government has procedures. Invoices get approved, deposits get made, and bank statements get reconciled. But in an audit, the question isn’t only whether these things happen. It’s whether you can show they happened, who did them, and that no single person controlled the entire process.
Why It Matters
Auditing standards define internal control as a process designed by governance, management, and staff to provide reasonable assurance in three areas:
- reliable financial reporting
- effective and efficient operations
- compliance with laws and regulations
For federal grants, 2 CFR 200.303 requires that internal controls be established, documented, and maintained. COSO and GAO’s Green Book are the go-to frameworks.
Management and those charged with governance are responsible for designing these controls. Auditors evaluate them. When segregation of duties is absent or inadequate, auditors may report it as a significant deficiency or material weakness.
The Four Functions to Separate
To achieve proper segregation, these duties should belong to different people:
- Authorization: approving a transaction
- Custody: handling or having access to assets
- Recording: entering transactions into the ledger
- Reconciliation: comparing records to assets and making sure balances align
When one person receives checks, records them, and reconciles the bank account, an error or misappropriation could go unnoticed.
What Segregation Looks Like in Practice
- Cash receipts: The person collecting and recording receipts shouldn’t make the deposit. Someone independent reconciles the deposit to the general ledger, and another person reviews the reconciliation.
- Purchasing: The person initiating a purchase order shouldn’t approve it, and the approver shouldn’t initiate payment or have custody of checks.
- Payroll: HR staff who add employees shouldn’t change bank or pay rate details. The person computing payroll shouldn’t manage the payroll bank account.
- IT systems: Access levels should match each person’s job responsibilities.
Procedure vs. Control
All controls are procedures, but not all procedures are controls. A procedure becomes a control when it’s documented, acted on, and can answer four questions:
- Who is responsible?
- What is the focus?
- When does it happen?
- How can it be tested?
Take “Bank reconciliations are approved by the Finance Director and council monthly.” That clearly covers all four.
Then comes evidence, the only way an auditor can confirm a control is operating:
- initials and dates
- electronic approvals
- receiving stamps
- account coding
- council minutes
If documentation isn’t kept, there’s no proof the control happened.
Practical Control Examples
- Journal entries: Keep the system report, preparer and approver initials and dates, supporting documentation, and the reason for the entry.
- Bank reconciliations: Complete them monthly with bank statements, reviewer sign-off, and detail on outstanding checks and deposits in transit.
- Purchases: Use approved requisitions or POs before ordering and confirm receipt of goods. For grant purchases, have someone approve allowable costs.
- Payroll: Department heads approve time cards and leave. Rate changes are approved before the first payroll of a new contract period.
- Deposits: Restrictively endorse checks immediately and keep a prenumbered receipts log. Have a second person prepare the deposit and a reviewer without cash access reconcile it. Store funds securely.
When Your Team Is Small
Many Ohio villages, townships, and special districts simply don’t have enough staff to fully separate every duty. Auditing standards recognize this.
Management or governing body oversight can serve as a compensating control. One example is council approving a monthly report of manual journal entries or detailed bank reconciliations, documented in the minutes.
Want a fresh look at your controls? Rea’s Government Services team helps Ohio governments design practical controls that fit their size and resources. Connect with an advisor.
About the Author
Tim Herold, CPA, is a Manager in Rea’s Medina office who specializing in governmental auditing. He has experience performing financial statement and Single Audits for Ohio public entities, with a focus on evaluating internal control design and operating effectiveness. Tim works closely with clients to identify control deficiencies, assess risk, and implement practical control improvements, including segregation of duties and monitoring activities. He helps finance teams build practical controls that strengthen accountability and stand up to review. Reach Tim at Tim.Herold@reaadvisory.com.
