Internal Controls

Protecting University Resources Through Everyday Safeguards

Internal controls are the processes and practices we use to reduce risk and help UVA accomplish its objectives responsibly. Effective internal controls help us:

• Safeguard University assets and resources
• Maintain accurate and reliable financial and management information
• Support efficient and effective operations
• Follow University policies and applicable state and federal requirements

Internal controls are part of everyone's responsibility for good fiscal stewardship. They aren't limited to formal reviews or financial systems. Many are built into the everyday ways we approve, review, document, and safeguard University activity.

What Do Internal Controls Look Like?

Internal controls can take many forms. Common examples include:

• Segregation of duties: Dividing key responsibilities so that one person does not control every part of a transaction or process.
• Approvals and authorizations: Making sure transactions and decisions receive appropriate review before they are completed.
• Account reviews and reconciliations: Regularly reviewing financial activity and resolving errors or unexpected transactions.
• Physical safeguards: Protecting cash, equipment, inventory, and other University assets from loss or unauthorized use.
• Documentation: Maintaining records that demonstrate what occurred, who approved it, and why.
• System access controls: Providing access appropriate to an individual's responsibilities and reviewing that access when roles change.

No single control eliminates all risk. Strong internal control systems use multiple practices together to reduce risk to an appropriate level.

Internal Controls and ARMICS

UVA's internal control program operates within the Commonwealth of Virginia's Agency Risk Management and Internal Control Standards (ARMICS).

ARMICS provides the framework UVA uses to assess and document its internal controls. The Commonwealth Accounting Policies and Procedures (CAPP) Manual also provides guidance for state agencies and institutions in implementing internal control programs.

Learn more about ARMICS

The COSO Framework

The Committee of Sponsoring Organizations of the Treadway Commission (COSO) Framework is a widely accepted framework for evaluating internal control systems and is used by federal and Commonwealth of Virginia agencies.

Visit the Committee of Sponsoring Organizations (COSO) website for additional information about the COSO Framework.

View the 17 COSO Principles

Control Environment

1. Demonstrates commitment to integrity and ethical values
2. Exercises oversight responsibility
3. Establishes structure, authority, and responsibility
4. Demonstrates commitment to competence
5. Enforces accountability

Risk Assessment

6. Specifies suitable objectives
7. Identifies and analyzes risk
8. Assesses fraud risk
9. Identifies and analyzes significant changes

Control Activities

10. Selects and develops control activities
11. Selects and develops general controls over technology
12. Deploys control activities through policies and procedures

Information and Communication

13. Uses relevant information
14. Communicates internally
15. Communicates externally

Monitoring Activities

16. Conducts ongoing and/or separate evaluations
17. Evaluates and communicates deficiencies

Significant Fiscal Processes

As part of UVA's internal control and ARMICS activities, risk assessments are completed for significant fiscal processes to evaluate control activities and document their effectiveness.

A fiscal process may be considered significant when it:

• Uses a substantial share of University resources
• Has high public visibility
• Presents significant risk to mission-critical activities
• Has a significant effect on financial reporting or general ledger balances