Subject:

Certifying Controls over the Agency’s Payment Process 

Reference:

Guide to Financial Operations:
Chapter XII, Section 4.B - Certification of Vouchers
Chapter XII, Section 4.D - Certification of Internal Controls over the Payment Process

Guidance:

Title 2, Chapter I, Part 6, Section 6.6 of the New York Codes, Rules and Regulations requires the head of an agency to certify to the Comptroller annually, or at any time there is a new head of the agency, that the agency has sufficient internal controls over the payment process to ensure claims are appropriate to pay. Agency heads may use a variety of resources and techniques to obtain assurance about the internal controls over the payment process as a basis for that certification.

This certification requirement is separate and distinct from DOB’s annual Internal Control Summary and Certification. 

Section 110 of New York State Finance Law requires the head of the agency certify or approve vouchers for submission to the Comptroller for audit.  Other individuals may also approve vouchers if the head of the agency, or a designee, has granted that authority by a rule or written directive filed with the Comptroller.  Section 110 also requires the designee be identified in writing and filed with the Comptroller. Agencies are required to have proper internal controls over the designation of Voucher Authorizers, including appropriate system access controls. 

Agencies that are customers of the Business Service Center (BSC) or are hosted by another agency are required to certify any controls over the portion of the payment processes that take place at the agency.

Update: 

The Guide to Financial Operations Chapter XII, Section 4.D - Certification of Internal Controls over the Payment Process has been updated to provide agencies with resources and guidance (e.g., Frequently Asked Questions, Audit Program) to assist with the certification due by April 30, 2025, and provide the additional area of review for the certification due by April 30, 2026.

For the certification due by April 30, 2025, in addition to the annual certification of internal controls over the payment process and the voucher authorizers certification, each agency will be required to assess the effectiveness of controls over bulkload and voucher mass approval payment processing. Within the Guide to Financial Operations Chapter XII, Section 4.D - Certification of Internal Controls over the Payment Process, the Bulkload and Mass Approval Audit Program has been included to provide guidance to assist agencies with the upcoming requirement.

For the certification due by April 30, 2026, in addition to the annual certification of internal controls over the payment process and the voucher authorizers certification, each agency will be required to assess controls over SFS attachments and record retention.

For more information, see Guide to Financial Operations Chapter XII, Section 4.D - Certification of Internal Controls over the Payment Process.