Purpose

To determine whether the Department of Motor Vehicles’ (Department) management of its internal control system appropriately addresses all five components of internal control. Our audit scope included the period January 1, 2013 through December 1, 2015.

Background

In 1987, the Legislature passed the New York State Governmental Accountability, Audit and Internal Control Act requiring each State agency to institute a comprehensive system of internal control over its operations. The Division of the Budget’s Budget Policy and Reporting Manual Bulletin B-350 requires the head of each covered agency to certify compliance with the Act by April 30 of each year by submitting a Certification and Internal Control Summary describing the internal control activities undertaken during the previous year. As the State’s chief fiscal officer, the Comptroller also has several responsibilities under the Act, including providing technical assistance to agencies, conducting audits of internal control, and issuing the Standards for Internal Control in New York State Government (Standards). The Standards form the minimum expectations for internal control in State agencies and public authorities and provide guidance to State officials on establishing and evaluating a comprehensive system of internal controls. Included in that guidance are five specific components of internal control that must be addressed by each system: control environment, control activities, risk assessment, information and communication, and monitoring.

Key Findings

• The Department has established a system of internal control that incorporates each of the five components of internal control. However, improvements are needed in the evaluation of some of these components, particularly at the unit level.
• The Department has developed an internal control review program that requires unit managers to formally assess risks, test controls, and implement corrective action plans. However, the process has not yet been fully or consistently implemented across most units. For example, the Department had not defined control objectives, identified the risks of objectives not being met, nor identified the controls in place to mitigate such risks for 57 of its 163 discrete operating functions.
• Without a complete internal control review program, the Department does not have appropriate assurance that unit managers are properly evaluating risk, testing controls to verify that they are working as intended, and implementing corrective action plans if controls fail.
• The Department does not provide adequate training to unit managers about their internal control responsibilities.

Key Recommendations

• Develop a process and cycle for each unit manager to assess risk and review controls for major functions.
• As a part of the internal control review program, incorporate a process for unit managers to evaluate the control environment, information and communications systems, and monitoring systems within their units.
• Provide additional training and outreach to unit managers to increase their understanding of internal controls and the internal control review program.

Other Related Audits/Reports of Interest

Office of Temporary and Disability Assistance: Internal Control System Components (2015-S-4)
Workers’ Compensation Board: Internal Control System Components (2015-S-46)