Purpose

To determine whether the Division of State Police (Division) submitted timely a quality Internal Control Certification to the Division of Budget (DOB) by April 30, 2012.

Background

In 1987, the Legislature passed the New York State Governmental Accountability, Audit and Internal Control Act (Act) requiring State agencies and public authorities to each institute a comprehensive system of internal controls over their operations. DOB requires the head of each covered State agency and public authority to certify compliance with the Internal Control Act by April 30 of each year by submitting a certification and internal control summary detailing the internal control activities undertaken during the previous year. On April 16, 2012, the Division submitted its annual Internal Control Certification and reported full compliance with all but one provision of the Act: ensuring that continuing professional education requirements are met by the Director and staff of the Internal Affairs unit, which is responsible for internal audits.

Key Findings

• The Division submitted its Internal Control Certification timely. However, it did not provide the required level of detail for two questions. The Division did not list the deficiencies discovered during its annual review of high-risk areas and did not identify audit recommendations that were not implemented.
• The Division did not maintain sufficient, appropriate documentation supporting statements made in two areas – the content of, and participation in, training courses related to internal controls and analyses or assessments supporting how the Division determined its reported list of high-risk areas – and one question that called for examples demonstrating the Superintendent's consistent communications to staff in support of internal controls.
• The Division reported that its internal audit function was only partially compliant with generally accepted professional standards for internal auditing because it did not provide staff with the necessary training due to the lack of funding. However, we noted several other deficiencies that need to be addressed to achieve full compliance, including issues related to organizational placement and the conduct of periodic external quality control reviews.

Key Recommendations

• Provide appropriately detailed responses to questions as requested in the annual Internal Control Certification.
• Ensure all statements contained in the Internal Control Certification are supported by sufficient and appropriate documentation.
• Ensure the internal audit function undergoes the required external quality control assessments and address identified deficiencies to bring the function into compliance with generally accepted internal audit standards.

Other Related Audits/Reports of Interest

Office for People With Developmental Disabilities: Quality of Internal Control Certification (2012-S-44)
Department of State: Quality of Internal Control Certification (2012-S-50)