improving internal controls: the ey guide for humanitarian ... · rehabilitation in...

Improving internal controls:the EY guide for humanitarianaid organizations2015

Humanitarian aid resource and delivery framework

ForewordHumanitarian aid resource and delivery framework

Relief, development and non-governmental organizations do exceptional andinspiring work in the immediate aftermath of disasters and, longer term, inhelping communities to rebuild and local economies to recover.

A major challenge for many of these agencies is managing the influx ofdonations they receive when disaster strikes.

How effectively organizations manage these funds not only affects the people thedonations are meant to help, but also the trust people have in the relief effortsand those leading them. If funds aren’t managed well, it can challenge theperceived value that an organization delivers and may damage the image of theaffected country or community. It can also jeopardize future donations.

To help relief, development and non-governmental agencies manage donationsand operate transparently we publish and distribute this free toolkit. It was firstproduced in 2005 in response to the Indian Ocean tsunami. It provides aframework for humanitarian aid resourcing and contains procedures that canimprove operational efficiency and transparency for any organization tasked withresponding to a disaster.

The guide has been used as the basis for disaster-relief training workshopsacross the globe. We hope it continues to be a valuable resource for reliefagencies as they continue their important work.

Mark A. Weinberger,Global Chairman & CEO

Disclaimer and intellectual property clauses

Improving internal controls: the EY guide forhumanitarian aid organizations

For reference only.► Please note that the information contained in this document is for reference only. The information

contained in this document has been prepared solely for the purpose of providing information tointerested parties about establishing proper systems of accountability and internal control within theirorganizations.

► This document is not intended to constitute advice in any particular circumstances. It has beencompiled in good faith by EY, but no representation is made or warranty given (either express orimplied) as to the completeness or accuracy of the information it contains in relationship to yourorganization. You are therefore requested to verify and adjust this information to fit yourorganizational requirements before you act upon it.

► EY gives you no warranty or assurance about the document, and neither we nor any of our affiliates,nor any partner, officer agent, employee, or sub-contractor of EY or any of our affiliates, will be liableto you or anyone else for any losses or damages arising in connection with it. As a result, you shouldnot rely on this document in any way, and you use it at your own risk. You should consult your usualEY contact on any specific matter.

► The copyright of the material contained in this document belongs to and remains solely with EY. Youraccess to it does not imply a license to reproduce and/or distribute this information, and you are notallowed to undertake any such act without the prior approval of EY.


Contents► Introduction

► Who is this guide for? How does it fityour NGO?

► Structure and levels of controlswithin an NGO

► Tailoring Improving internal controlsto your organization

► Core modules

► Expanded modules

► Glossary of terms

► Frequently asked questions

In the accompanying booklet:► Core module details

► Expanded module details

► “Pick List”

5

9

13

32

4452

55

58


Introduction


What does it mean …► Natural disasters are terrifying and shocking,

but they are not unusual. The United NationsDevelopment Programme estimates that 75%of the earth’s population lives in areas that wereaffected at least once by earthquake, tropicalcyclone, flood or drought between 1980and 2000.

► And many more people may be even morevulnerable in the future, as climate changeexacerbates the number and severity ofextreme weather events.

► For relief organizations and non-governmentalorganizations (NGOs) of all kinds, preparing tohelp people at risk means more than justpreparing to spring into action whenever andwherever nature unleashesits fury.

… to be prepared for disaster?► It also means preparing for the generosity of

many, many donors in a world where charity isincreasingly democratized and the ease ofdonating by text message has created manynew givers.

► It means being able to prove to those donorsthat their funds have been used as effectively aspossible to ease immediate sufferings and tohelp rebuild lives in the long term.

► It means developing the organizational capacityto meet the enormous challenges presented bya natural disaster, both in the midst ofemergency and during a rebuilding process thatmay take years, putting the structures in placethat allow you to do your best possible work.

Introduction

Introduction


Philippines

On 8, November, 2013, TyphoonHaiyan devastated parts of thePhilippines. The death tollestimate is 5,500 with a further1,700 missing. Haiyan is believedto have damaged or destroyed atleast 6 million homes.

Chile

On February 27, 2010, anearthquake of magnitude 8.8struck central Chile. Thanks tohigh construction standards,fewer than 500 people werekilled. However, the earthquakeand resulting tsunami causedwidespread property damage,displacing 1.5 million people.

Haiti

On January 12, 2010, anearthquake of magnitude 7.0struck near the capital city ofPort-au-Prince. It killed 230,000people and displaced 700,000 inPort-au-Prince alone, with3 million affected in total. Povertyand low construction standardsamplified the devastation.

Indian Ocean tsunami

With more than 200,000 peoplekilled and an estimated1.6 million people displacedacross 14 countries, the tsunamithat struck on December 26,2004, was the deadliest tsunamiin recorded history.

China

On May 12, 2008, an earthquakeof magnitude 7.9 hit the SichuanProvince, a mountainous regionsin western China, killingapproximately 70,000 people,including thousands ofschoolchildren.

Introduction


What is expected by … the donors?Those affected?Stakeholders at large?Donors, recipients and stakeholders expect that fundsallocated to relief efforts will be spent effectively andefficiently in accordance with:

► What the affected people need

► Objectives set by the donors

Funds must not be diverted unintentionally to other purposesor activities. Such diversion would be contrary to effectiveand efficient use.

Therefore, standards of accountability, transparency andtrust for all those involved in relief work need to be set at thehighest possible levels.

The best way to make sure that both expectations andstandards can be met is to establish a proper system ofinternal controls that is commensurate with the risk involved.

A system of internal controls will safeguard assets, improvereliability of the accounting data, improve compliance withapplicable laws or contractual obligations, and promoteoperational efficiencies.

EY — call to actionWhen the tsunami struck in 2004, EY, along with almostevery other organization in the world, struggled with thequestion of how to best support the relief andrehabilitation in disaster-affected areas.

Our answer was provide organizations with what EYknows best — a toolkit of processes and procedures,incorporated with internal controls, that can beimplemented by an NGO or not-for-profit organization toprovide reasonable assurance that the funds allocated todisaster relief or recovery efforts are spent effectively andefficiently.

Improving internal controls: the EY guide forhumanitarian aid organizationsImproving financial controls provides process maps,controls and flows for humanitarian aid resourcing anddelivery — from fund allocation to aid distribution,including the accounting and reporting of these activities.It describes the control points and provides “what can gowrong” indicators for subsequent review and evaluation ofinternal controls.

Its modular design allows organizations to adopt thecomponents they require depending on their size andoperational requirements.


Who is this guide for? How does it fityour NGO?



Identifying the need for a toolkitCharitable organizations are established to provide vitalassistance to people living in poverty or to those areaffected by natural disasters or war. Often, these situationsare complex and create practical difficulties, even for themost experienced organizations.

When catastrophe first strikes, the primary focus is toprovide as much relief as quickly as possible; often, theremay be only a few systems of control in place during theseactivities.

In affected countries, the extent of the devastation is on ascale that some NGOs are not accustomed to dealing with.Significant reconstruction and rehabilitation is requiredbefore communities can function at even basic levels andnormality returns to the lives of those displaced by thedisaster. Some NGOs providing disaster relief orreconstruction support currently are struggling with a widerange of problems and face important decisions over theproper allocation of money involved in reconstructionefforts. Others do not have the resources, capacity orsystems of control to meet the expectations placedupon them.

To meet such challenging circumstances, NGOs need theflexibility and freedom to decide the best way to achievetheir charitable aims while meeting the overarchingobjective of ensuring that the funds available for charitablepurposes offer maximum benefit for the intended recipients.

To maintain the trust it has been given, an NGO mustdemonstrate that all of its assets are being used to meetstated objectives. Donors need to know that theircontributions are being used for their intended purposes.Accountability and transparency are essential to maintainthe confidence of donors. This can be achieved only ifadequate procedures and controls are in place.

Improving financial controls, as described in the followingsections, highlights how procedures and controls arecrucial in demonstrating accountability and transparency. Atthe earliest possible moment, when there is time to assessoperational requirements, it is critical that systems ofcontrol are established.



Improving financial controls documents the operatingprocesses and procedures applicable to an NGO. It alsoincorporates the internal controls that are intended toimprove the effectiveness and efficiency of an NGO’soperational activities.

Improving financial controls begins with our HumanitarianAid Resource and Delivery Framework, which depicts thethree cycles of aid resource and delivery:

► Receipt — establishing agreements between donor(s)and the NGO

► Expenditure — procuring, delivering, disbursing,accounting and reporting of aid delivery

► Requisition — telling the donors what and how much isneeded, as well as acknowledging receipt of aid given

Within each of the three cycles, this guide is structured as aseries of process modules setting out the variousinformation, document and transaction flows.

These process modules identify and describe the controlpoints and give “what can go wrong” scenarios to determineif the internal controls are working.

It is meant to be a reference guide for an NGO about theprocess modules that are relevant to its operations, startingwith the core modules common among most: cash receipts,inventory management, purchase, human resourcemanagement, delivery, cash disbursement, petty cash,accounting, reporting, budget preparation and requisitionapproval, recipient requisition, and recipient receipt.

In this way, Improving financial controls becomes aresource to help an NGO overcome one of its keychallenges of aligning the needs of its recipients with theongoing purchase, delivery and receipt of aid. The guidealso can help to establish levels of accountability andtransparency intended to satisfy donor objectives.

Who is this guide for? How does it fit yourNGO?


Who is Improving financial controls for?This guide is primarily intended for use by the followingorganizations:

► NGOs that are planning to establish themselves in orbeyond disaster-affected countries (or have beenrecently established) and that would like to adopt asystem of internal controls to help make sure reliefreaches the intended recipients and can beaccounted for

► Existing NGOs that wish to improve the currentstandard of their procedures and internal controls, orenhance the overall capacity of their organization andthat of their partners

► Donor entities intending to grant funds to an NGOpartner and who may require the adoption of suitableinternal controls by the NGO as a condition for the grant

► Government bodies seeking a benchmark forcomparison with processes and procedures used ingovernment aid programs

How does it scale to fit your NGO?This guide can be adapted to fit NGOs, varying from asimple to complex type of operational structure. The Toolkitprovides a scalable system of internal controls for an NGOdepending on its:

► Size

► Organizational structure

► Objectives and kinds of activities undertaken

► What’s required by the ultimate donors

Based on its own set of operational and control objectives,an NGO is able to select different modules that best fit itsrequirements. Through the use of a “Pick List,” Improvingfinancial controls can be adopted to meet varying levels ofsophistication and control requirements.


Structures and levels of controls within an NGO



Why do donors or NGOs need to putinternal controls in place?Internal controls are processes designed to providereasonable assurance regarding the achievement ofobjectives. These processes, effected by an entity’s boardof directors, management and other personnel, can beorganized into the following categories:

► Operational — effective and efficient use of resources

► Compliance — compliance with applicable laws andregulations

► Financial reporting — reasonable assurance onreliability of financial reporting

It is vitally important for an NGO to ensure that thedonations it receives from various donors are usedaccording to their objectives and that no amount or quantityis unintentionally diverted for other purposes or activities.

Material aid such as food, clothing or medicines aretangible items of value that can be used by people otherthan the intended relief recipient. Because these goods canbe exchanged for money, there is inherent risk that“handlers” of these goods may take advantage in thissituation if internal controls are insufficient.

For example, when these goods are moved from theirsource, such as suppliers’ warehouses, to the intendedrecipient, it is possible that some may be “diverted” —possibly through an unauthorized withdrawal from thewarehouse or an authorized withdrawal but a delivery tounauthorized recipient.

Remember, assets are not limited to goods and services;they also include cash, fixed assets, human capital and anyother resource of value.

Internal controls, therefore, are necessary to safeguard allassets of the NGO, improve reliability of the accountingdata, improve compliance with applicable laws orcontractual obligations, promote operational efficiencies,and meet the needs of stakeholders.



How much “control” does an NGO need?There is an inverse correlation between the quality of internalcontrols and the amount of risk an organization faces. Thebetter the quality of internal controls, the greater chance anorganization has to minimize the risks it faces.

In general, large donor organizations, many of which deal withlarge sums of money, have quality internal control systems inplace to minimize the risk of financial loss. However, at points ofaid distribution, controls are fewer and the risk of inappropriatedistribution is greater.

One might argue that the amount of losses that may be incurredin the field are much smaller because the financial scale is somuch different than large donor organizations — “what is thecost of just one blanket?” But aid lost to one recipient suggeststhat aid may be lost to many. Every NGO has an understoodmandate to maximize the reach of its aid distribution and tominimize overhead costs.

There is always a trade-off between the financial andoperational costs of developing a suitable internal controlssystem versus the potential loss that may be incurred.Therefore, it is important to understand the cost benefits of aninternal control system and to determine what is an acceptableamount of risk and loss an NGO is willing to accept beforedeciding to what depth controls should be applied. Individual

aid recipient

Donor(organization)

10

9

8

7

6

5

4

3

2

1

Am

ountofrisk

Qua

lity

ofco

ntro

ls

Low

High

High

Low

Individualaid recipient

10

9

8

7

6

5

4

3

2

1

Am

ountofrisk

Qua

lity

ofco

ntro

ls

Low

High

High

Low



How much “control” does an NGO need?An example …The amount funded by the funding donor should equalthe sum of the total amount distributed to individualrecipients less administrative costs.

Optimal:The funding donor provided money for 10 blankets, and 10recipients acknowledged receipt of 10 blankets.

What if:The funding donor provided money for 10 blankets, and 10blankets were given to the community for distribution. Do we knowwhether 10 recipients received blankets or if some were sold or notdistributed at all? Without acknowledged receipt by intendedrecipients, the answer is no.

Conclusion:To determine the efficacy of an aid model, you need to know andmeasure how much aid was actually received by the intendedrecipients. This type of information allows NGOs to determine notonly how effective their programs are, but also to detect (andcorrect) leakages.

Fundingdonor

InternationalNGO

LocalNGO partner

NGOsubcontractor

Community

Individual

Flow of aidDonor

(organization)



Where does control begin?Standards of accountability, transparency and trust for anNGO should be set at the highest possible levels. Yet, thequality of internal controls and systems within an NGO toprovide these critical aspects may often be weak or lessdeveloped.

For NGOs, control actually starts by knowing and trackingwhat is being provided to the intended recipients. Establishingrecipient needs and putting in place the ability to track howthey are being served enables accurate accountability for howdonated resources are translated into aid given/received.Coupling this with a robust approval process establishes therequired communication between recipients and donors thatallows more effective and efficient relief distribution.

This system not only allows NGOs to measure whatpercentage of each donated “dollar” becomes actual aidreceived by the intended recipients, it also helps them toimprove the effectiveness and efficiency by identifying whichdonations are converted to aid.

Lack of assurance as to the effective delivery of charitableendeavors (e.g., not all spending translates into benefit to therecipients) may not meet the donor’s objectives and goals.

“Donors must apply transparent qualitycontrol processes, which help ensure thatmaterial aid sent will meet explicit needswhile upholding the dignity of therecipients.”

Source: International NGO Aid Guideline

Need

Aidprovisioned

Aiddelivered

Track



Approaching the aid cycle from the intended recipient“Without a recipient there would be no charitable activity.”

Therefore, understanding the needs and gathering information aboutrecipient needs is foremost to establishing control within the aid cycle.Besides giving a “face” to the recipients, this information will accuratelyestablish:

► Amounts of relief goods or services that an NGO needs to buy, procureor build

► Levels of expenditures required

► Required packaging and systems of delivery

By having this information, it is also possible and important to:

► Understand what the expected versus the actual needs were so thatbenchmarks can be set for future relief provisioning

► Identify and correct abnormal consumptive behaviors

Who is a recipient?A recipient can be defined as a person, family, cooperative,municipality, business or even organization. Essentially, it is a“measurable unit” that knows what it needs as well as canacknowledge and be accountable for the aid it receives.

Case studyIn Aceh, Indonesia, a constructioncompany was awarded a contract forthe construction of temporary homes.

The company wanted to build thesehomes nearby or in the fishing villagesthat had been destroyed. Butownership of the land hadn’t beenestablished, and therefore it wasimpossible for construction to begin.

With mounting pressure from both thelocal government and donors to dosomething quickly, a suitable piece ofland was found 2 km away.Construction began nearly as quickly asit ended. Temporary shelters had beenbuilt.

Unfortunately, to this day, few are livingin the shelters because they were builttoo far away from the village’s principlesource of income — the sea.

Were everyone’s objectives met inthis case?



Controls and the Humanitarian Aid Resource and Delivery FrameworkEY’s Humanitarian Aid Resource and Delivery Framework depicts the overall aid cycle and the key processes within it,from the donor to the recipient for the receipt of donations to the procurement, delivery, disbursement, acceptance andaccounting of relief goods and services. The overall aid framework is broken into three cycles, and the requisite controlsare embedded within each business process.

Expenditure cycle: procuring, delivering, disbursing,accounting and reporting of aid delivery; also includeshuman capital, services and other resources used inthe delivery of aid.

Receipt cycle: establishing agreements betweendonor(s) and the NGO; collecting donations inaccordance with objectives and agreements.

Requisition cycle: telling the donors what and howmuch they need as well as acknowledging receipt ofaid given.

Humanitarian Aid Resource and DeliveryFramework


Inventory Management

Human Resource Mgmt.

Delivery

Accounting Reporting(Financial/Mgmt) Bu

dget

and

Anal

ysis

Recipient Requisition Recipient Receipt

Budget Preparationand Requisition

Approval

Funding and Donation Mechanisms

Rec

eipt

Cyc

le

Cash Receipts

Donor Objectives/Goals

Expe

nditu

reC

ycle

Petty

Cas

hC

ash

Dis

burs

emen

t

Rea

cqui

sitio

nC

ycle

Produce/Build

Purchase

Assets Management



Receipt cycle components — the Humanitarian Aid Resource and Delivery FrameworkEstablishing agreements between donor(s) and the NGO; collecting donations in accordance with objectives andagreements.

Rec

eipt

cycl

e

Donor objectives/goalsEstablishing and maintaining humanitarian guidelinesthat include proactively determining what recipientneeds actually are and ensuring that those determinedneeds are responded to appropriately.

Funding and donation mechanismsRequesting or receiving monies, goods or servicesfrom donors through fundraising, donations, grants,sponsorships, collections or other activities.



1

2

1 2



Expenditure cycle components — the Humanitarian Aid Resource and Delivery FrameworkProcuring, delivering, disbursing and accounting and reporting of aid delivery; also includes human capital, servicesand other resources used in the delivery of aid.

Cash receiptsRecording donor funds and other cash received intothe bank account. Reconciling bank balances betweenthe organization’s books and bank statements.

PurchasePurchasing goods/services for the recipients, whichincludes assessing and appointing vendors,contracting, and creating purchase orders.

Inventory managementManaging goods/services from the point they arereceived and warehoused through to distribution to therecipients.

Produce/buildProducing/building goods, facilities or services basedon the recipients’ needs.

Expe

nditu

recy

cle

Budget Preparation andRequisition Approval

Cas

hD

isbu

rsem

ent


Produce/Build

Cash receipt

Purchase

1

3

4

1

2

3

4

2




Budget preparation and requisitionapprovalAssessing proposed budget (new or additional) againstthe recipients’ criteria and donor’s objectives andgoals. Managing receipt information, matching it withapproved requisitions and analyzing variances.

Cash disbursementPayment by check or bank transfer to suppliers foremployee payroll and petty cash replenishment.

Expe

nditu

recy

cle

Budget Preparation andRequisition Approval

Cas

hD

isbu

rsem

ent


Produce/Build

Cash receipt

Purchase1

21 2




Asset managementManaging the life cycle of a fixed asset from purchaseto transfer and maintenance and finally disposal.

DeliveryLoading, transporting and unloading materialsand goods.

1 3

Assets Management


Delivery

Petty

Cas

h


dget

and

Anal

ysis

Human resource managementAdministering human resources from recruitment andpromotion to resignation or termination. Calculatingpayroll amounts based on employee attendance.

2

2

3

1

Expe

nditu

recy

cle




Petty cashManaging petty cash: requests, issuance andreplenishment.

Reporting (financial/management)Preparing financial statements, analyzing financialinformation, monitoring operational performance andreporting on it.

1 3

Assets Management


Delivery

Petty

Cas

h


dget

and

Anal

ysis

AccountingRecording, valuing, classifying, summarizing andposting daily transactions.

2

1

2 3

Expe

nditu

recy

cle



Requisition cycle components — the Humanitarian Aid Resource and Delivery FrameworkTelling the donors what and how much recipients need as well as acknowledging receipt of aid given.

Recipient requisitionRequesting goods and services by the recipients.

Recipient receiptDistributing goods and services to the recipients andcollecting evidence (receipts) that they have beenreceived.

1 2

Recipient requisition Recipient receipt1 2

Req

uisi

tion

cycl

e



Tracing the first-time provisioning of relief goods and servicesBased on its mission, donor establishes perceived recipient needs.

Monies, goods or services are collected from funding mechanisms(i.e., from other donors, fundraising, etc.).

Monies, goods or services collected are made available for aid workthrough a deposit into a bank account or into an inventorymanagement system.

Goods, facilities or services are purchased, produced or builtaccording to the mission and perceived needs of the recipients.

Goods or services are distributed through aid delivery channels.

Goods or services are received and acknowledged by the recipient.

Based on better understanding of recipient needs, requisition foradditional aid is made.

Requisition for additional aid is approved by matching requisitionsand receipts along with donor mission and objectives.

Periodically:

Payments are made for goods, facilities or services purchased,produced or built.

Amounts used and amounts paid are recorded. Periodic reports areproduced that account for activities conducted and aid received.

12

3

4

67

5

8

1

2

�

�

�

�

��

�

�

�

�



Tracing the ongoing provisioning of relief goods and servicesBased on better understanding of recipient needs, requisition foradditional aid is made.

Requisition for additional aid is approved by matching requisitionsand receipts along with donor mission and objectives.

Goods, facilities or services are purchased, produced or builtaccording to the mission and perceived needs of the recipients.

Goods or services are distributed through aid delivery channels.

Goods or services are received and acknowledged by the recipient.

Periodically:

Based on its mission, donor establishes perceived recipient needs.

Monies, goods or services are collected from funding mechanisms(i.e., from other donors, fundraising, etc.)

Monies, goods or services collected are made available for aid workthrough a deposit into a bank account or into an inventorymanagement system.

Payments are made for goods, facilities or services purchased,produced or built.

Amounts used and amounts paid are recorded. Periodic reports areproduced that account for activities conducted and aid received.

1

2

3

45

12

3

4

5

�

�

�

�

�

�

� �

�

�



Applying COSO to the Humanitarian Aid Resource and Delivery FrameworkThe Committee on Sponsoring Organizations of the Treadway Commission (COSO) issuedInternal Control — Integrated Framework, which contained five key components of internalcontrol for an organization: control environment, risk assessment, control activities,information and communications, and monitoring. This framework is one of the key guidelinesof internal control upon which most auditing standards are based.

COSO reminds NGOs to also develop a reasonable control environment (e.g., code ofconduct) and continually assess the risks they face.

Embe

dded

inco

rebu

sine

sspr

oces

ses

Control environment:Attributes of the people conducting the entity’s activitiesand the environment in which they operate.

Control activities:Policies and procedures established and executedthat enable management’s directives to becarried out.

Information and communication:Systems enabling identification, capture and exchangeof information for the conduct and control of operations.

Monitoring:Assess performance of internal control over time andmake modifications as conditions change.

Risk assessment:Establish objectives and mechanisms to identify, analyzeand manage risks.

Code of conduct Organizational structure “Doing what is right” Transparency

Environmental Financial Information

Risk assessment

Control environment

Control activities

Information and communication

Monitoring



Control environmentThe control environment sets the tone of an organization,influencing the control consciousness of its people. It is thefoundation for all other components of internal control,providing discipline and structure. The successful operationof the other elements of internal control depends on buildinga control environment in which top management continuallyemphasizes the performance of control procedures. Sub-elements of the control environment include:

► Integrity, ethical values and behavior of key executives

► Management’s control consciousness andoperating style

► Management’s commitment to competence

► Board of directors and/or audit committee participationin governance and oversight

► Organizational structure and assignment of authorityand responsibility

► Human resource policies and practices

Risk assessmentBecause the operatingconditions in which theorganization functions willcontinue to change,mechanisms are needed toidentify and deal with thespecial risks associatedwith change.Risk assessment is the identification and analysis ofrelevant risks that represent a threat to the achievement ofthe organization’s objectives, which then requiresconsideration of how to address and manage the risk.

Risk assessment by top management requires them to:

► Identify, analyze and assess the risks faced by theorganization

► Determine risk limits and the techniques for control ofthe risks

► Develop and implement internal controls for theorganization to address these risks

COSO and the Humanitarian Aid Resource andDelivery Framework


Code of conduct Organizational structure “Doing what is right” Transparency

Environmental Financial Information

Risk assessment

Control environment

Control activities

Information and communication

Monitoring


Tailoring this guide for your organization

Tailoring this guide for your organization


How can these principles of control be appliedto our organization?“One size does not fit all.”

Each NGO services recipients in different ways. Someprovide medical services while others may manage schools,reunite separated family members or even build sewagetreatment facilities. However, common among them all isthe requirements of internal control, accountability andtransparency.

Because this guide is modular, an NGO can pick and adoptthe process modules that apply to its organization,organizational structure, charitable activities, operationalstructure and/or the desired level of internal controls.

Core modulesBudget preparation andrequisition approval

Budget preparationRecipient data maintenanceFund requisitions

Cash receipts

Bank receipts

Inventory management

Receipt of goods or services

Purchase

Vendor assessmentDirect appointmentTenderContractPO managementVendor database maintenance

Human resource management

RecruitmentPromotionsTerminationsResignationsEmployee master dataPayroll

Delivery

Delivery schedulingGoods delivery

Cash disbursement

Account payableBank payment

Petty cash

Petty cash payment andreplenishment

Accounting

Journal entriesReconciliations

Reporting

Closing and reporting

Recipient requisition

Recipient requisition of goodsor services

Recipient receipt

Recipient receipt of good orservice

Tailoring the EYe Toolkit for your organization


How can I make use of the expanded modules?“One size does not fit all.”

The expanded modules of the guide are most applicable toNGOs that, in addition to distributing funds, areresponsible for:

► Managing inventories of tangible items (food, medicines,shelter, etc.) to aid recipients

► Overseeing or implementing projects

► Acquiring and then managing fixed assets

In addition, the expanded modules also cover budgetanalysis and recipient satisfaction surveys, both importantaspects of overall controls within the funding cycle.

Expanded modulesFunding and donationmechanisms

Funding and donationmechanisms

Inventory management

Inventory planningGoods issuancePhysical countInventory monitoring

Produce and build

Planning and schedulingProject execution andmonitoringProject inspectionProject amendmentProject acceptance/delivery

Asset management

Fixed asset requisitionFixed asset receipt,capitalization andidentification tagFixed asset transfersFixed asset disposalsFixed asset physicalinspectionFixed asset maintenance

Budget and analysis

Budget analysis

Recipient receipt

Recipient satisfaction survey

Tailoring the guide for your organization


Before applying the guide, it is important to align itsconcepts to your organization and vice versa. To dothis, it is important to first look at:

► Who is your “recipient”?

► What is your desired level of internal control?► How much information technology is (or will be)

available?

► What type of transactions are you involved with?

► How many people are in your organization, andwhat are their current roles?

Who is your “recipient”?Does your NGO deal directly with individual aid recipients?Engage other NGOs to provide aid relief? Hire third-partycontractors to provide services on behalf of your NGO?Use various combinations of aid disbursement?

The foundation for controlling the aid process requires:1. Understanding who the individual aid recipients are and what they

actually need. A recipient is a measurable unit that knows what itneeds as well as can acknowledge and be accountable for aid itreceives (e.g., person, family, organization, business, etc.).

2. Measuring the disbursement of the aid to the recipient throughsome form of receipt acknowledgement.

3. Reconciling needs with amounts disbursed and understanding anyvariances.

4. Having the ability within any sub-contractual arrangement toeffectively measure the distribution and acknowledged receiptof aid.

Who is yourrecipient?

NGO’srecipient

Example 1Your NGO

Individual aidrecipient

Example 2Your NGO


Another NGO

Example 3Your NGO


Third-party contractor

Example 4Your NGO

Third-party contractor

Individual aidrecipient*

Another NGO



*Important note: although your “recipient” may be an intermediary, being able to establish what the ultimate recipients need and actually received adds significantly to confirming adequacy of controls from thedonor to the ultimate individual aid recipient.

Step 1: setting the stage



Step 1: setting the stage Who is your “recipient”?An exampleYour NGO deals with ultimate individual aid recipients and at the sametime engages Another NGO and Third-party contractor to provide reliefaid to other locations.

When Your NGO provides aid to Individual aid recipients, its likely thatYour NGO can determine the Individual aid recipients’ needs through aneeds requisition form.

What about the other situations? How will Your NGO know 1) how muchfinancial support to give to Another NGO or Third-party contractor and 2)whether it was used properly?

In both of these cases, the recipients’ needs (Individual aid recipients ofAnother NGO and Third-party contractor) should be communicated toYour NGO through the completion of a needs requisition form. Individualaid recipients will request specific goods and services, while AnotherNGO and Third-party contractor will request money that will be used tobuy relief goods for delivery to the recipients.

In all cases, the transaction flow will start with a needs requisition(request for relief goods, services or funds) from the Individual aidrecipient. The request should be reviewed and approved. For goodsand/or services, the transaction will flow through purchases and then tocash disbursements. For requests for funds, the transaction will go tocash disbursements. Delivery then will follow the usualdelivery channel.

Example 4Your NGO

Third-partycontractor


Another NGO



*Note: although your “recipient” may be an intermediary, being able to establish what the ultimaterecipient needs and consumes improves the quality of control that can be achieved.

Who is yourrecipient?

NGO’srecipient



Step 1: setting the stage What is your desired level of internal control?Before applying the guide, it is important to align itsconcepts to your organization and vice versa. To dothis, it is important to first look at:


► What is your desired level of internal control?► How much information technology is (or will be)

available?



It’s easy to imagine the difficulties of not only determiningwhat each recipient actually needs but also of measuringand getting acknowledgements of the aid received. Yet, thislevel of information provides an organization with thehighest levels of internal control. The key question is: doesthe cost of gathering this level of information (in terms oftime, money and capability) outweigh the benefits gainedfrom this level of control?

Optimal

Less optimalIf not (because of cost,condition, level of capacity,the nature of the work, etc.),be aware that certainlimitations are beingintroduced into your systemof internal control that will bedifficult to monitor.

If it is possible for yourorganization to measure needand acknowledge receipt atthe lowest recipient level,then it is advised that you doso. Anything less introducesthe risk that leakages will notbe detected.



Step 1: setting the stage How much information technology is (or will be)available?Before applying the guide, it is important to align its

concepts to your organization and vice versa. To dothis, it is important to first look at:


► What is your desired level of internal control?

► How much information technology is (or willbe) available?



Using information technology (IT) to manage theinformation throughout Humanitarian Aid Resource andDelivery Cycle creates an opportunity for even higherlevels of internal control because transactions, as well asthe source and use of information, can be tracked,summarized and analyzed. Undoubtedly, an IT-basedsystem allows an organization to manage, analyze andreport from vastly larger amounts of data than a manualsystem. However, initial investments in an IT-basedsystems could be prohibitively large and would requirequalified people to run it.

In general, manual systems may be more applicable tosmaller-sized NGOs where data storage, managementreporting and budget creation remain straightforward, aswell as in an environment that limits access to IT and itsinfrastructure.



Step 1: setting the stage What type of transactions are youinvolved with?Before applying the guide, it is important to align its




► How much information technology is (or will be)available?

► What type of transactions are you involvedwith?


Does your NGO employ staff? Build schools? Buymedicines? Purchase automobiles or motorcycles? Use apetty cash system? Pay vendors for goods purchased?Hire contract social workers?

Transactions will be regularly undertaken by anorganization in the ordinary course of activities to meet itscharitable objectives. Transactions represent either:

► An inflow of economic resources into the organizationOr

► An outflow of the organization’s economic resources toother parties, either externally for purposes directlyrelated to charitable programs (such as purchase ofgoods for aid relief), or internally, such as employeesalaries

Understanding what types of activities your NGO doesthroughout the course of its operations and the transactionsthose activities create will help to determine exactly whattypes of processes and controls will be required.



Step 1: setting the stage How many people are in your organization,and what are their current roles?Before applying the guide, it is important to align its







Improving internal controls was designed for anorganizational structure with 15 key employees, eachundertaking a different function with varied responsibilities.As many NGOs will have fewer than 15 employees, inmany cases it will be necessary to assign more than onefunction to an employee.

In order to help employees properly perform the proceduresand to prevent any temptation to misuse funds, there mustbe a segregation of duties within certain functions. Thecritical functions and the respective procedures that shouldbe separated between employees are:

Function Duties or procedures to keep separate

Cash disbursement andpetty cash

Authorizing payments, handling cash andrecording transactions

Procurement Ordering goods and receiving goods

Fixed assets andinventory management

Custody and safekeeping of the assetsand maintaining records

PayrollMaintaining payroll records and authorizingsalary payment to employees

AccountingMaintaining the detailed accountingrecords and performing reconciliations










Segregation of dutiesThe concept of segregation of duties is crucial to the successfuloperation of an internal control system as it introduces a series ofchecks by employees on each others’ work and can significantly reducethe risk of fraud.

The basic requirement is that one employee should not have theresponsibility to execute all stages of a transaction, from initiation andprocessing to recording payment or receipt of funds into the accountingsystem. Apart from weakening financial control, placing too muchresponsibility for a particular function on one person creates the riskthat if he or she leaves the organization or is absent for long periods,then operation of that function will cease.










Delegation of authority and authorization limitsTrustees delegate authority through the NGO executive director for theday-to-day running of the organization. However, in most organizationsit is not practical to expect one person to make all the decisions andauthorize all transactions. The executive director therefore, will furtherdelegate authority to other managers and grant them restricted levels ofdecision-making in areas related to their job responsibilities.

Basic guidelines that should be followed when delegating authorityinclude:

► Any limits or conditions that apply to delegated authority must beclearly defined. For example, a person may be authorized tocommit expenditures up to a specified amount. These limits areusually documented in an authorization table that defines theauthority to approve transactions for various levels ofmanagement.

► No one should authorize any transaction from which they willpersonally benefit. This exposes the individual to claims ofimpropriety and calls into question the honesty of management.

► Subordinates must not authorize payments to managers; theymust be passed to someone who is more senior in themanagement structure.



Step 2: picking the right modules for your NGOAs a guide, EY has developed a “Pick List” to captureoperational factors that would indicate what modules areappropriate and should be adopted.

How to use the “Pick List”The “Pick List” will ask you to answer some simple questionsabout your organization. Different modules will berecommended depending on your responses.

1. Find the “Pick List” in the Framework manual andanswer Yes to each question that applies to your NGO.

2. Look at the list of modules (core or expanded) and findthe module or modules that match each affirmativelyanswered question.

3. Gather the applicable modules and remap the frameworkby highlighting only those that you will need.

This will be your guide for selecting the applicable processesand procedures for implementation. Be sure to include therecommended internal control points as well.

Answer Yes/No to thequestions in the Pick List

Applies ToOur NGO?

(YES or NO)Relevant Module Relevant Process(es)

TRUE CASH RECEIPTS B.02.1 Bank Receipts

FALSE INVENTORYMANAGEMENT B.03.2 Receipt of Goods or Services

What are the type resources thatyour are allocated or received?

Allocated monies are transferred orreceived

Allocated / donated goods or servicesare received Yes

Yes

Select the appropriatemodules/processes as indicated

Pick List

core modules

Humanitarian Aid Resource and Delivery Framework

Remap theframeworkindicatingonly the modulesrequired

1

3

2


Toolkit core modules

Toolkit core modules


Core modules included in the EYe ToolkitActivities of nearly all charitable organization focus on either raising funds ands donations, procuring the goods andservices that the recipients need using the donated resources and then delivering those goods and services to theintended recipients.

Assuming that funding is already available, most transactions of financial significance would fall within the expenditurecycle of the toolkit. Therefore, the core modules of this toolkit (listed below) focus on these activities most commonamongst charitable organizations:

► Cash receipts

► Inventory management

► Purchase

► Human resource management

► Delivery

► Cash disbursement

► Petty cash

► Accounting

► Reporting

► Budget preparation and requisition approval

► Recipient requisition

► Recipient receipt

Humanitarian Aid Resource and DeliveryFramework — core modules




Delivery


dget

and

Anal

ysis



Approval


Rec

eipt

Cyc

le

Cash Receipts


Expe

nditu

reC

ycle

Petty

Cas

hC

ash

Dis

burs

emen

t

Rea

cqui

sitio

nC

ycle

Produce/Build

Purchase

Assets Management

A.01

A.02

B.01

C.01 C.02

B.11 B.12

B.03

B.04

B.05

B.06

B.07

B.08

B.09

B.10

B.13

B.02

Core modules

Core modules


What’s included in each module?For each module, the guide contains:

► A process flow that depicts the process initiation,process activities, roles responsible, processtermination and links to other processes

► Goal of the process

► Definition and description of each activity, includingcontrol applications, relevant prevent and detectcontrols, and the functions involved

Core modules


What’s included in each module?For each module, the guide contains:

► A checklist of prevent and detect controls for easyevaluation of the workings of your internalcontrol system

► A “what can go wrong” list or “watch” guide for use by adonor, finance department, internal/external auditor orany person responsible for closer monitoring andsubsequent testing of internal control compliance,including quality of performance

Note: use of automated systems will depend on the size ofthe organization and the volume of transactions. However, abasic computerized accounting system is preferablebecause of the additional controls and the reportingcapabilities that it would provide.

SAMPLE

Budget preparation and requisition approval


B.01.1 Budget preparationTo ensure budgets are accurate, complete and reasonable

To 1 Assess Proposed Budget/Additional Fund Requisition inWorkflow Modeler: A.02.1 Funding and Donation Mechanisms

To 1 Prepares budget analysis monthly in Workflow Modeler:B.13 Budget Analysis

From 3 Analyze Survey Results in Work Flow Modeler:C.01.2 Recipient Satisfaction Survey

1Disaster data gathering

2Conduct meeting on

information/datagathering

3Budget preparation

4Review and approve

Field Community Staff

Community Relation

Executive Directorand Trustee

Donors

SAMPLE




Activity:1. Field/community staff gathers preliminary data to assess the recipient’s requirements (R1).

2. Field coordinator discusses with the team regarding the information/data gathering process and determines whethersufficient work has been done as the basis for the budget.

3. Field coordinator prepares budget for prospective donors. Proposed budget consists of estimated number ofrecipients, description of relief aid, implementation plan and the total project value (R2).

4. Executive director and trustee review the completeness and reasonableness of the proposed budget, ensure theproposed budget is aligned with the NGO’s objectives and approve proposed budget for submission toprospective donors.

Function(s) involved:► Field/community staff

► Field coordinator

► Executive director

► Trustee

► Donors

SAMPLE




What can go wrong? Key control point checklist

R1 — Data not accurate or incomplete (C1)

R2 — Proposed budget is incomplete andinaccurate (C1, C2)

Performed by field coordinator

C1 — Reviews the completeness and accuracyof needs assessment (R1, R2)

Performed by executive director

C2 — Clearly state/formalize and communicatethe assumptions underlying theproposed budget to related implementingpartners (R2)

SAMPLE


Expanded modules

Expanded modules


Expand modulesActivities of nearly all charitable organization focus on either raising funds and donations, procuring the goods andservices that the recipients need using the donated resources and then delivering those goods and services to theintended recipients.

The expanded modules not only include the funding and donating mechanisms, but also focus on activities that may notbe common across all charitable organizations:

► Funding mechanism

► Inventory management

► Produce/build

► Asset management

► Budget and analysis

► Recipient receipt

In addition, some other processes have been addedto the core modules to help NGOs manage morespecific situations.

Humanitarian Aid Resource and DeliveryFramework — core modules




Delivery


dget

and

Anal

ysis



Approval


Rec

eipt

Cyc

le

Cash Receipts


Expe

nditu

reC

ycle

Petty

Cas

hC

ash

Dis

burs

emen

t

Rea

cqui

sitio

nC

ycle

Produce/Build

Purchase

Assets Management

A.01

A.02

B.01

C.01 C.02

B.11 B.12

B.03

B.04

B.05

B.06

B.07

B.08

B.09

B.10

B.13

B.02

Expanded modules Core modules


Glossary of terms

Glossary of terms


► Account. A record of historical transactions, eitherwritten into a book designed for the purpose or enteredonto a computer file.

► Accruals. Outstanding expenses for an accountingperiod that have not yet been paid or invoiced.

► Authorization. The process of approval overtransactions, normally the decision to purchase orcommit expenditure. Authorization may be done by wayof confirming that spending is in line with budget and isappropriate.

► Budget. An amount of money that an organizationplans to raise and spend for a set purpose over a givenperiod of time.

► COSO. Committee of Sponsoring Organizations of theTreadway Commission. COSO developed a guidingframework that defines internal control and describesthe application of internal control in a corporateenvironment. It has become the globally acceptedbenchmark against which to evaluate the adequacy ofinternal control systems.

► Database. A computerized data storage system thathas an advantage over a manual filing system byenabling users to easily present, reformat and analyzeinformation according to different user preferences.

► Detective controls. Controls that are meant to detector correct errors that may have occurred during theprocessing of the transactions.

► Donation in-kind. Where a grant or contribution to aproject is made in the form of goods or services ratherthan a cash grant or donation.

► Fixed assets. Items (such as equipment, vehicles orbuildings) owned by an organization that retain asignificant part of their monetary value for more thanone year.

► Inherent risks. Risks that are intrinsic to theorganization, based on its particular activities and othercharacteristics.

Glossary of terms


► Internal control. COSO defines internal control as “aprocess, effected by an entity’s board of directors,management and other personnel, designed to providereasonable assurance regarding the achievement ofobjectives in the categories: 1) effectiveness andefficiency of operation; 2) reliability of financial reporting;and 3) compliance with applicable laws andregulations.”

► Inventory. Goods purchased (often in large volume) forthe purpose of aid relief that are held in temporarystorage in a warehouse and require safekeeping untilthey are ready to be distributed to recipients.

► NGO. Non-government organization, a generic termused to refer to organizations that are established forcharitable activities and other non-profit purposes. Whilethey may receive government funding (as well asdonations from private sources), they do not operate asan instrument of government policy.

► Petty cash imprest. A type of cash float, set at anagreed level, that is replenished by the exact amountspent since it was last reimbursed to bring it back to itsoriginal level.

► Preventive controls. Controls that are meant toprevent errors from occurring during transactionprocessing.

► Reconciliation. A detect control procedure that verifiesthe integrity of accounting information throughcomparison of the balances compiled by two differentsources; for example, reconciliation of the bankstatement with the general ledger balance for thebank account.


Frequently asked questions



► How can Improving financial controls helpimprove the efficiency and effectiveness ofhow relief goods and services reach theintended recipient intact?► Answer — Improving financial controls contains

preventive and detective internal controls thatimprove and identify accountability as the goods orservices move from supplier to recipients.

► Is the guide foolproof?► Answer — There is no system of controls that is

foolproof. People of authority can override thesystem of internal controls. People can also colludeto beat the system of controls.

► What is the benefit of adopting thehumanitarian aid framework?► Answer — While this guide cannot provide 100%

assurance, it can help to provide reasonable levelsof assurance that relief assets are safeguarded.

► Do I need to attend training to understandthe Improving financial controls?► Answer — If the user has basic understanding of

internal controls, there is no need for training.However, EY advises that a user should attend atraining session for better appreciation of theguide’s capabilities or seek professional advicewhen adopting it to a specific situation ororganization.

► Who can I call for questions that I have?► Answer — EY or any other professional services

organization with skills and strengths inimplementing and testing internal control systemscan be contacted for advice.

► What do I need to do first to bring theconcepts within this guide to myorganization?► Answer — Read this booklet first to get a

foundational understanding of what internalcontrols are, and then complete the Pick List toidentify the modules that best fit your organizationaland operational structure.



► What if I complete the Pick List wrong?► Answer — You will find that there are transactions

that cannot be processed because of a missingmodule or that you have processed all yourtransactions but a module has not been used.Either adopt what is missing or remove what is notbeing used.

► What should I do when I learn that reliefgoods or services are taken by deliveryworkers for personal use or sale?► Answer — Gather relevant information and conduct

investigation using your finance department,internal auditors or a professional fraud investigator.

► What are some of the reports Ishould require?► Answer — Statement of receipts, disbursements

and fund balance. This should show the requireddetails in accordance with the terms of donation

► Answer — Budget to actual comparison. Thiswould analyze actual receipts and disbursementsagainst budgeted amounts.

► What is the guiding principle used formaterial aid?► Answer — No material aid should be sent prior to

consent by the recipient, and a donation should bemade with full respect for the wishes and theauthority of the recipient.

► What if an NGO doesn’t have access toadequate (or any) IT resources?► Answer — One alternative that can be explored is

for several NGOs to set up a shared computerizedprocessing service. The savings created byimproved controls and accurate and fasterprocessing could be used to pay for the cost of thiscommon services platform.



► What are some things I should consider at the end of a project or program?► Answer — Although every program and project has an ending date, there are often many things to do after that

— analyze results, prepare final reports, close the books and more. It is important to consider these activities inyour overall plan and continue the systems of internal control already in place during that post-period.

► Answer — When a program or project ends, the project or its recipients often need something more to ensure thesustainability and success of work just completed that was not included as part of that work. This may includetraining, the purchase of inventory, money for salaries and start-up expenses, additional equipment, etc. As part ofyour closing activities, consider helping the recipients prepare appropriate applications for additional support forsuch requirements.

For more information


Adlai GoldbergMaagplatz 1Zurich 8005 SwitzerlandP: +41 58 286 44 88F: +41 58 286 3004E: [email protected]

Thank you


EY | Assurance | Tax | Transactions | Advisory

About EY

EY is a global leader in assurance, tax, transaction and advisoryservices. The insights and quality services we deliver help build trustand confidence in the capital markets and in economies the worldover. We develop outstanding leaders who team to deliver on ourpromises to all of our stakeholders. In so doing, we play a critical rolein building a better working world for our people, for our clients andfor our communities.

EY refers to the global organization, and may refer to one or more, ofthe member firms of Ernst & Young Global Limited, each of which isa separate legal entity. Ernst & Young Global Limited, a UK companylimited by guarantee, does not provide services to clients. For moreinformation about our organization, please visit ey.com.

© 2014 EYGM Limited.All Rights Reserved.

EYG no.ED None

This material has been prepared for general informational purposes only andis not intended to be relied upon as accounting, tax, or other professionaladvice. Please refer to your advisors for specific advice.

ey.com

improving internal controls: the ey guide for humanitarian ... · rehabilitation in...

Documents