The Quaestor - Volume 2, Issue 4
Is a Policy Required for Common Sense?
Contributed by: Patrick M. Didas, Associate Director
IACA is comprised of a group of internal audit professionals with nearly 100 years of combined experience. Our work exposes us to many best practices and examples of good internal controls, as well as the “unusual” activity that seems to indicate an apparent lapse of common sense. Upon inquiry of something appearing “unusual,” we often learn that the activity resulted because there was no policy stating that it could not be done that way. Policies often build internal controls into the process. All of us are expected to be fiduciaries of RIT’s assets. Those assets include the bricks surrounding us, the chairs we sit in, and the dollars embedded in budgets funding our operations. Protecting those assets often requires the application of common sense. Here are a few examples of what I mean.
There is no policy for not spending down available budget dollars at the end of the fiscal year; in fact, typically the mindset is “if you don’t use it, you lose it.” However, common sense should tell someone that any leftover funds will still go to a good cause, one that will further RIT’s mission. Who really needs 4,500 pads of sticky notes in storage anyway?
There is no policy to “Buy RIT,” but common sense should tell someone that it’s better to keep the funds internal than to pay external vendors, if possible. For example, it is better to use RIT’s Brick City Catering than to use Uncle Lou’s Backyard BBQ Creations.
While we are talking food, realize that there IS a policy requiring outside caterers to be fully inspected, licensed, and insured. So, common sense should tell someone that the financial and reputational risk to RIT could be huge if Uncle Lou’s uninsured, unlicensed and uninspected creations introduced a food borne illness outbreak.
There is no policy prohibiting the purchase of employee birthday gifts with RIT funds. However, common sense should tell someone that spending $85 on the departmental procurement card for someone’s birthday is not a good use of RIT money. Gifts are a personal gesture and should be paid for as such.
A campus-wide conflict of interest policy has been developed, but has not been implemented fully at this point. However, common sense should tell someone not to use their brother’s machine shop to fabricate parts for installation on a sponsored research project’s fabricated equipment if their paycheck is funded by that research project.
Other campus-wide policy-type activities currently not in place, but being developed, include Disaster Recovery/Business Continuity and Record Retention. Common sense should tell someone that they are still good ideas and practices, and that they are a department’s, college’s, or division’s responsibility to implement until a campus-wide policy or procedure is put in place.
As I mention in the IACA Internal Controls training sessions offered through the Center for Professional Development, many internal controls are simply common sense. Understanding the potential effect that each action could lead to will help everyone be better fiduciaries of RIT’s assets.
Additional Information by IACA
IACA Team
Learn more about your IACA team.