Laserfiche WebLink
7 <br />2023-2024 San Mateo County Civil Grand Jury <br />Tone at the Top <br />The oversight body and management set the tone at the top and throughout the organization by <br />its example. Tone at the top is fundamental to effective internal controls. The tone at the top <br />helps ensure: <br /> <br />● the entity’s risk identification is complete <br />● risk responses are appropriate <br />● control activities are appropriately designed or implemented <br />● information and communication are effective <br />● results of monitoring are understood and acted upon. <br /> <br />Accountability for Performance <br />The State Guidelines include a section on Accountability for Performance, including: <br />● establishing mechanisms for holding individuals accountable for internal control <br />responsibilities, which naturally include the oversight body and management <br />● establishing performance measures for all levels of the organization <br />● performing timely evaluations and aligning incentives with the fulfillment of <br />internal control responsibilities. <br />All governing bodies and its management have basic responsibilities regarding internal controls, <br />even if the State Guidelines do not specifically refer to those basic responsibilities. Those <br />responsibilities naturally include: <br />● Oversight boards must demonstrate its oversight of management’s internal <br />controls, such as clear and timely reporting on its review of internal controls <br />● Management’s reports on internal controls should be clearly and readily available <br />to the public <br />● Management must be evaluated for its assessments of internal controls and its <br />external reporting. <br />Role of the External Auditor <br />External auditors are not considered a part of an entity’s internal controls. While management <br />may look into and use recommendations by external auditors, management owns the entity's <br />internal controls. Management may communicate with and get quality information from its <br />external auditors as it monitors and maintains internal controls. <br />Management may hire an external service provider to conduct assessments of internal controls. <br />Data from these assessments can aid management ensuring that the entity’s internal controls are <br />appropriate for that entity. In conducting an audit, external auditors may rely on these <br />assessments, which could result in a more efficient and less expensive external audit. <br />The Civil Grand Jury found through its research that audits uncover only about 4% of fraud. <br />Several entities we interviewed stated that they rely on or interact with its external auditors as <br />part of its internal controls. Comments from respondents included: <br />6.C. - Page 11 of 22 <br />90