Internal Control Responsibilities

Achieving your objectives with internal controls

Internal controls are the methods an organization uses to help ensure its objectives are met. Good internal controls can include such practices as:

  • Providing written guides to staff for consistent, efficient operations
  • Adhering to university IT and cybersecurity policies and practices
  • Closely overseeing the use of procurement cards
  • Requiring locked offices to discourage theft
  • Reviewing monthly account statements to verify that transactions are reasonable

University policy designates vice presidents, chancellors, deans, directors, and fiscal officers as being responsible for ensuring that the system of internal controls supports operations, reporting, and compliance.

Types of internal controls

Designed to prevent errors, fraud, and other irregularities from occurring
Designed to identify errors, fraud, or other irregularities after they have occurred

Operational management

Management is the first line of defense for an organization to effectively manage risk. At IU, unit, school, or department management is responsible for:

  • Establishing and overseeing systems of internal controls
  • Implementing good business practices
  • Monitoring for compliance with established practices

Campus and university oversight functions

The second line of defense is offices with a broader oversight for risk management, policy development, and compliance. This includes university and central campus offices such as:

  • Campus Finance and Administration
  • University Controller’s Office
  • University Treasurer’s Office
  • Public Safety and Institutional Assurance
  • University Compliance Office
  • University Information Security Office

Internal Audit

As the third line of defense, Internal Audit provides an independent assessment to ensure that internal controls developed by management are operating as intended. Auditors perform evaluations and make recommendations for improvements that further strengthen the university’s controls.

Learn more about internal controls

Read IU’s policy