Be it enacted by the Senate and House of Representatives
in General Court assembled, and by the authority of the same,
Notwithstanding any general or special law to the contrary, the following internal control standards shall define the minimum level of quality acceptable for internal control systems in operation throughout the various state agencies and departments and shall constitute the criteria against which such internal control systems will be evaluated. Internal control systems for the various state agencies and departments of the commonwealth shall be developed in accordance with internal control guidelines established by the office of the comptroller.
(A) Internal control systems of the agency are to be clearly documented and readily available for examination. Objectives for each of these standards are to be identified or developed for each agency activity and are to be logical, applicable and complete. Documentation of the agency's internal control systems should include (1) internal control procedures, (2) internal control accountability systems and (3), identification of the operating cycles. Documentation of the agency's internal control systems should appear in management directives, administrative policy, and accounting policies, procedures and manuals.
(B) All transactions and other significant events are to be promptly recorded, clearly documented and properly classified. Documentation of a transaction or event should include the entire process or life cycle of the transaction or event, including (1) the initiation or authorization of the transaction or event, (2) all aspects of the transaction while in process and (3), the final classification in summary records.
(C) Transactions and other significant events are to be authorized and executed only by persons acting within the scope of their authority. Authorizations should be clearly communicated to managers and employees and should include the specific conditions and terms under which authorizations are to be made.
(D) Key duties and responsibilities including (1) authorizing, approving, and recording transactions, (2) issuing and receiving assets, (3) making payments and (4), reviewing or auditing transactions, should be assigned systematically to a number of individuals to ensure that effective checks and balances exist.
(E) Qualified and continuous supervision is to be provided to ensure that internal control objectives are achieved. The duties of the supervisor in carrying out this responsibility shall include (1) clearly communicating the duties, responsibilities and accountabilities assigned to each staff member, (2) systematically reviewing each member's work to the extent necessary and (3), approving work at critical points to ensure that work flows as intended.
(F) Access to resources and records is to be limited to authorized individuals as determined by the agency head. Restrictions on access to resources will depend upon the vulnerability of the resource and the perceived risk of loss, both of which shall be periodically assessed. The agency head shall be responsible for maintaining accountability for the custody and use of resources and shall assign qualified individuals for that purpose. Periodic comparison shall be made between the resources and the recorded accountability of the resources to reduce the risk of unauthorized use or loss and protect against waste and wrongful acts. The vulnerability and value of the agency resources shall determine the frequency of this comparison.
Within each agency there shall be an official, equivalent in title or rank to an assistant or deputy to the department head, whose responsibility, in addition to his regularly assigned duties, shall be to ensure that the agency has written documentation of its internal accounting and administrative control system on file. Said official shall, annually, or more often as conditions warrant, evaluate the effectiveness of the agency's internal control system and establish and implement changes necessary to ensure the continued integrity of the system. Said official shall in the performance of his duties ensure that: (1) the documentation of all internal control systems is readily available for examination by the comptroller, the secretary of administration and finance and the state auditor, (2) the results of audits and recommendations to improve departmental internal controls are promptly evaluated by the agency management, (3) timely and appropriate corrective actions are effected by the agency management in response to an audit and (4), all actions determined by the agency management as necessary to correct or otherwise resolve matters will be addressed by the agency in their budgetary request to the general court.
All unaccounted for variances, losses, shortages or thefts of funds or property shall be immediately reported to the state auditor's office, who shall review the matter to determine the amount involved which shall be reported to appropriate management and law enforcement officials. Said auditor shall also determine the internal control weaknesses that contributed to or caused the condition. Said auditor shall then make recommendations to the agency official overseeing the internal control system and other appropriate management officials. The recommendations of said auditor shall address the correction of the conditions found and the necessary internal control policies and procedures that must be modified. The agency oversight official and the appropriate management officials shall immediately implement policies and procedures necessary to prevent a recurrence of the problems identified.