Purpose

To determine whether the Workers’ Compensation Board’s management of its internal control system appropriately addresses all five components of internal control. Our audit scope included the period January 1, 2013 through August 11, 2015.

Background

In 1987, the Legislature passed the New York State Governmental Accountability, Audit and Internal Control Act requiring each State agency to institute a comprehensive system of internal control over its operations. The Division of the Budget’s Budget Policy and Reporting Manual Bulletin B-350 requires the head of each covered agency to certify compliance with the Act by April 30 of each year by submitting a Certification and Internal Control Summary describing the internal control activities undertaken during the previous year. As the State’s chief fiscal officer, the Comptroller also has several responsibilities under the Act, including providing technical assistance to agencies, conducting audits of internal control, and issuing the Standards for Internal Control in New York State Government (Standards). The Standards form the minimum expectations for internal control in State agencies and public authorities and provide guidance to State officials on establishing and evaluating a comprehensive system of internal controls. Included in that guidance are five specific components of internal control that must be addressed by each system: control environment, control activities, risk assessment, information and communication, and monitoring.

Key Findings

• The Workers’ Compensation Board has recently made significant improvements to its internal control system and, as a result, the current system adequately addresses all five required components of internal control.
• Due in part to the substantial nature of these changes, managers in some units need additional training and outreach to gain a better understanding of how internal controls relate to them.
• The Internal Audit Unit reports to the Director of the Risk Management Unit, who also functions as the Internal Control Officer. This reporting relationship compromises the independence of the internal audit function.

Key Recommendations

• Provide additional training and outreach to unit managers, especially in non-financial functions, to increase their understanding of internal controls present and functioning within their units.
• Separate the duties associated with the internal control and internal audit functions, specifically as they relate to reporting to executive management and the Workers’ Compensation Board.

Other Related Audit/Report of Interest

Office of Temporary and Disability Assistance: Internal Control System Components (2015-S-4)