1. Establish and maintain guidelines for a system of Internal Control.

Purchase College’s system of internal control integrates the activities, plans, attitudes, policies, skills, and efforts of its employees working together to provide reasonable assurance that the College will achieve its objectives and mission. 

The effectiveness of the College’s system of internal control in assuring the achievement of goals depends upon clearly articulating and communicating Purchase College’s mission and objectives to employees as well as providing employees with the direction and information that allow them to understand their individual responsibilities and priorities and how they relate to that mission. Essentially, they need to know what the College’s goals are, what the College expects of them in their position and the appropriate means for achieving it, and how their performance will be measured and evaluated. 

Purchase College articulates its mission and objectives in several key documents, including: the College’s Mission Statement and its Strategic Plan. Purchase College communicates these goals and accomplishments to employees through a variety of mechanisms, including new employee orientation and training, continued focused training at divisional, departmental and service level and other communication like the President’s annual “tone-at-the-top letter”, the Internal Control brochure, etcetera. The development of the Internal Control website further provides for improved communication. 

2. Establish and maintain a system of internal controls and a program of internal control review.

The College has been divided into reporting segments based on the VP/College Officer level divisions. The divisions are further divided into departments and units.

The College’s organizational structure and system of policies, procedures, and internal controls are designed to govern the effective conduct of the College’s business. 

There are a number of key documents that contain policies, procedures, and practices that govern the operation and conduct of Purchase College and its employees. In addition, various functional areas on campus have specific documents that more narrowly focus on internal controls relating to key aspects of their operation. Taken together, these documents are an integral part of the internal control system (administrative controls) that governs the operation of individual departments throughout the College.

The Internal Control Officer  (ICO) uses a “Proactive Risk Assessment’ methodology for Internal Control review, testing, development, and documentation.  The reviews are designed to equitably target all of the College’s Divisions and are carried out on an ongoing basis.  The ICO is responsible for selecting the areas for review as well as the nature, extent and timing of these reviews.  The ICO also carries out targeted review (testing and documentation) of high-risk areas on an ongoing basis as deemed necessary.

The ICO maintains an annual review schedule as well as a three year overall Internal Control program.  The ICO reviews both general and specific internal controls, on an ongoing basis, with the Controller and CFO.  The Internal Control Committee (comprised of representatives from the six College Divisions) is also briefed once a semester.  The ICO may also refer certain issues to the College Cabinet and/or President if deemed necessary.

As part of the review process, the ICO researches SUNY, New York State, Federal and other authoritative professional guidelines and literature for new developments in order to ensure that the College’s Internal Control program is compliant and reflects current standards.

3. Make available to employees a statement of policies and standards with which they are expected to comply.

A key aspect of internal control is providing staff with clear directions and information relating to what is expected of them.  Specifically, they need to know their individual responsibilities and priorities as well as how their performance will be measured and evaluated.  In addition, people need a sense of understanding of the organization’s missions, specific goals, policies and practices. 

Upon hire, new employees attend a general orientation session intended to provide them with information concerning the College’s mission, goals, policies and practices.  They are also provided access to documents that provide important information to which staff should be able to refer during the normal hours of business. These documents include, but are not limited to:

• Job description of the employee’s position
• Employee’s performance program, if applicable
• The Public Officers Law (relevant sections)
• Policies of the Board of Trustees, where applicable
• Pertinent collective bargaining agreement, where applicable
• Other policies generally applicable to all employees

In addition, employees receive a departmental orientation and ongoing training that provide them with more specific information concerning their responsibilities, priorities and the basis for measuring performance.

The President’s “tone-at-the-top letter” plus the Internal Control brochure, both of which are distributed to employees every spring, serve to further inform employees on their Internal Control responsibilities.  The development of the Internal Control website further provides for improved communication with all employees.

4. Designate an Internal Control Officer (ICO) to implement and review the internal control program.

Since internal control systems should be ingrained into the fabric of the College’s operations, those individuals responsible for day-to-day operations and management decisions must assume the continuous responsibility for assuring the adequacy of the internal controls.  At the same time, each manager’s internal control responsibilities should be coordinated as part of the College’s overall internal controls effort.  To facilitate this coordination, the Act requires the College to appoint an Internal Control Officer (ICO).

The ICO is not solely responsible for carrying out the College’s Internal Control Program but coordinates responsibilities among appropriate College personnel the agency, oversees those activities as part of an overall internal control effort and ensures that the Program meets the requirements of the Act.

Activities to be coordinated through the ICO include, but need not be limited to:

• Organizing and coordinating the internal control program;
• Compiling an inventory of existing internal controls;
• Identifying internal control weaknesses and implementing necessary corrective actions, including the findings and recommendations of internal and external audits;
• Updating, revising, and preparing internal controls to reflect current programs, procedures, and policies;
• Identifying internal control training requirements and providing requisite internal control training; and,
• Conducting vulnerability (risk) assessments and internal control reviews

Purchase College has designated Darrell Perkins to serve as campus ICO.  The ICO reports directly to the College President, or the President’s designee, and is an individual with sufficient authority to act on behalf of the President in implementing and reviewing the University’s Internal Control Program. 

5.  Implement education and training to ensure employees have adequate awareness and understanding of internal control standards.

Purchase College recognizes that an effective system of internal control requires the organization to have competent staff with the skills and knowledge necessary to accomplish their assigned duties.  To this end, the College engages in continuing efforts to provide training, professional and personal development opportunities to employees.

With regard to internal control training, starting in spring 2006, the College provided basic internal control training for all employees.  The sessions, conducted by the ICO, were completed in the fall of that year. Since then, new employees (hired within the previous 12 months) receive similar internal control training every fall.  The ICO also works in collaboration with department heads to provide specialized (focused) training to employees in the various departments. Additional internal control training is also offered at (3) responsibility level segments as necessary.  The segments are; Executive, Deans and Directors, and Faculty/Staff.  Internal control review and development programs also provide for employee training at various levels (for example, the ‘Proactive Risk Analysis’ program has built-in training for management personnel).

6. Evaluate the need for an Internal Audit function.

The College’s senior administration engages in regular review of the need for an Internal Audit function.