1101 PR.01 Controls and Business Process Questionnaire

Contents

1.     Reason for Procedure

2.     When to Complete

3.     Completing the Questionnaire

4.     Roles and Responsibilities

Policy 1101 Guiding Principles for Business and Financial Administration requires that departments, business support centers, and institutional offices have a sound business and control environment; this is achieved through compliance with the University’s policies and procedures.

Strong internal controls and business processes are essential to safeguard assets, maintain accurate and reliable accounting information, promote operational efficiency, and encourage adherence to prescribed policies and procedures.  The University’s internal control structure consists of the combination of policies and procedures, organizational design, and the personal ethics of the individuals carrying out the assigned responsibilities.

The Controls and Business Process Questionnaire (“CBPQ”) is a tool for use in identifying risk within units responsible for budgetary oversight.

Lead administrators or operations managers are encouraged to use the questionnaire as a foundation to determine if a more in-depth review of structures and controls is required.  This determination should be based on the lead administrator’s or operations manager’s experience and judgment.

Any internal control risks identified by the department during completion of the CBPQ must be addressed.  If at any time the department wishes to discuss any part of the questionnaire, the department representative should contact controllers.office@yale.edu.

Lead administrators or operations managers should complete the CBPQ annually, and:

• Whenever there are significant personnel changes in the department; or
• Whenever there are significant business procedure changes in the department.

The CBPQ is web-based.  The hyperlink of the Questionnaire can change and is therefore not listed in this procedure.

Information containing specific instructions for completion, submission, question content, and the questionnaire URL is sent from the Office of the Controller to lead administrators or operations managers one month prior to the submission deadline.

Only one questionnaire should be submitted for each business unit.  Those completing the questionnaire at the division or department level may want to complete multiple questionnaires.  The levels at which the questionnaires should be completed should be determined by the lead administrator, in cooperation with the operations manager(s) of the unit.

Most “no” and “n/a” responses require a Comment.  When a “no” or “n/a” answer is acceptable without a comment, the comment box is not available.  Generally, a “no” response indicates that internal control procedures or business processes may not be as strong as desired.  If a “no” is indicated (and is not part of the exceptions):

• Correct the situation and determine if additional review is needed on transactions made prior to the correction;
• Document the existing alternative procedure(s) or process(es) that offset the potential weakness; and
• Document the problem, make the Controller’s Office aware of the problem, and determine if the proposed solution is cost prohibitive.

For “n/a” responses, briefly comment on why the question is not applicable.