Home
Internal Control Responsibilities

Internal Control Responsibilities

Achieving your objectives with internal controls

Internal controls are the methods an organization uses to help ensure its objectives are met. Good internal controls can include such practices as:

Providing written guides to staff for consistent, efficient operations
Adhering to university IT and cybersecurity policies and practices
Closely overseeing the use of procurement cards
Requiring locked offices to discourage theft
Reviewing monthly account statements to verify that transactions are reasonable

University policy designates vice presidents, chancellors, deans, directors, and fiscal officers as being responsible for ensuring that the system of internal controls supports operations, reporting, and compliance.

Types of internal controls

Preventive: Designed to prevent errors, fraud, and other irregularities from occurring
Detective: Designed to identify errors, fraud, or other irregularities after they have occurred

Risk management: the three lines of defense

There are three lines of defense that combine to ensure that financial and operating information is reliable, that university resources are used efficiently and effectively, that institutional data is kept secure, and that the potential for fraud is minimized. These three lines of defense are management, university or campus central offices, and Internal Audit.

Operational management

Management is the first line of defense for an organization to effectively manage risk. At IU, unit, school, or department management is responsible for:

Establishing and overseeing systems of internal controls
Implementing good business practices
Monitoring for compliance with established practices

Campus and university oversight functions

The second line of defense is offices with a broader oversight for risk management, policy development, and compliance. This includes university and central campus offices such as:

Campus Finance and Administration
University Controller’s Office
University Treasurer’s Office
Public Safety and Institutional Assurance
University Compliance Office
University Information Security Office

Internal Audit

As the third line of defense, Internal Audit provides an independent assessment to ensure that internal controls developed by management are operating as intended. Auditors perform evaluations and make recommendations for improvements that further strengthen the university’s controls.

Learn more about internal controls

Read IU’s policy