Policies and Procedures Documentation

Communication is one of the elements of, and an essential component of, a comprehensive framework of internal control.[1] One method of communication that is particularly effective for controls over accounting and financial reporting is the formal documentation of financial and accounting policies[2] and procedures. A well-designed and properly maintained system of documenting financial and accounting policies and procedures enhances both accountability and consistency. The resulting documentation can also serve as a useful training tool for staff.

An appropriate level of management should openly promote accounting policies and procedures to emphasize their importance and authority. The documentation of financial and accounting policies and procedures should be evaluated annually and updated periodically, at least every three years, according to a predetermined schedule. Changes in policies and procedures that occur between these periodic reviews should be updated in the documentation promptly as they occur. Governments should also update any related internal control documentation associated with the updated policy and procedure. For example, if a procedure related to cash disbursements is changed, the internal control documentation for cash disbursement should be updated accordingly. An employee who is knowledgeable about and has the responsibility for oversight of the government’s procedures and internal controls should be assigned the duty of overseeing this process.1 Management is responsible for ensuring that this duty is performed consistently, and an audit committee or governing body should oversee management’s administration of the government’s internal control system.

The published version of the financial and accounting policies and procedures should be readily available to all employees who need it and contain the following information:

• A date stamp to inform the user the last time the item was updated.
• A list of key control activities and delineation between authority and responsibility of all employees, especially the authority to authorize transactions and the responsibility for the safekeeping of assets and records.
• A description of which employees (by title, as well as the identity of incumbents) are assigned to perform which procedures.
• A reference to the board policy the procedure supports.
• A practical, step-by-step explanation of how procedures should be performed rather than descriptions of controls that are vague or stated in an idealized form.
• Written as directly and succinctly as possible. Highly detailed step-by-step instructions, while necessary for employees to perform their job assignments, should not be included in the policies and procedures manual.
• Explain the design and purpose of control-related procedures to increase employee understanding of and support for controls.