Skip to main content Skip to navigation
Office of Internal Audit Reference Guide

Internal Audit has provided several procedures as a quick reference for departments. They represent University policies and procedures, or best practices, that Internal Audit believes will contribute to good internal controls.

This is not an all-inclusive list of all University procedures and at any time these procedures may change. Current policies and procedures can be found at Procedures, Records, and Forms.

The following information is provided in alphabetical order by subject:

Budget/Financial Monitoring Responsibility

Every administrator is responsible for budgets within his/her area. Budgets should be monitored and reconciled to actual activity and supporting documentation on a regular basis, ideally within two weeks from the month-end close dates. It is important that the accounts be reconciled to ensure they accurately include authorized transactions. Each transaction should be supported by documentation. Allocations and recurring charges should be reviewed for reasonableness. Reconciling the department’s accounts provides for a good internal control.

Change Funds

If a department requires or uses a change fund, see General Receipting section below for more information.

Computer Security and Integrity

A significant amount of money is spent each year on computer equipment. Departments rely heavily on information created, processed and stored on computers. Consequently, departments should implement good computer, security and password controls.

To provide adequate safeguarding of critical information, critical computer files should be backed up on a periodic basis. The importance of the information and the amount of time needed to recreate the information should be considered when determining how often to backup computer files. The backup disks or tapes should be stored off-site. We recommend that departments refer to Information Technology Services website to determine the latest software options used on campus for automatic backup.

New computer viruses are being created at an alarming rate. Computers using WSU networks are required to have adequate protection against viruses that may be harmful to the continued integrity of the network and infrastructure; this includes the requirement for antivirus software and regular updates.

Use of the WSU network is for business purposes only. Employee use of computers, network and digital devices is to carry out the functions of their official duties; for students, the purpose is for education and research. University employees have a responsibility to safeguard state resources. This includes the database systems, and confidential or sensitive information they may use to carry out the functions of their jobs. The best ways for employees to adequately safeguard these resources is to ensure software (antivirus) is updated and protects from malicious intrusion.

Also, employees should ensure computers and files are protected with passwords that are known only to them and properly safeguarded. It is recommended  passwords be changed regularly. Never walk away from a computer for any period of time without logging out or locking it up to prevent unauthorized access. Laptops and other portable digital devices should be physically safeguarded; do not leave in extreme weather or unattended. Limit the amount of confidential or sensitive data on portable devices; this type of data should be on office models that are not as mobile and susceptible to theft and subsequent data breach.

Computer Software

Most purchased software programs used at the University are copyrighted and/or patented. These copyrights and patents prohibit the University or its employees from making duplicates of the software and may also restrict the use of the software program to a particular machine. As users and/or purchasers of software packages, departments have the responsibility to be aware of the various agreements pertaining to each software package. Making illegal copies of licensed software may result in an individual and/or the University being held liable.

A good rule of thumb regarding software purchased is to assume the software:

  • is not to be copied except for making a backup
  • is designated for use with only one PC/laptop at a time and is not to be used by multiple users on a local area network
  • is not normally maintained and updated by the vendor unless departments have paid an annual maintenance/support fee or paid for an updated version

If you do copy software for a backup, the manufacturer’s copyright notice should be placed on all copies or portions of the software reproduced.

Departments should maintain an inventory of software licenses and users to ensure  proper future transfer and accountability for licensing.

Equipment/Inventory

Departments are responsible for maintaining accurate records of property and inventory purchased, proper safeguard of assets in its control, and the proper disposition of equipment. Capitalized equipment purchases (all tangible, non-expendable property, having a useful life of more than one year and a value of $5,000 or more, plus laptops, weapons, and other property with exception) are posted to a central inventory system upon purchase. Purchases of equipment that do not meet capitalization criteria, or is inventory for the purpose of resale (merchandise) or consumption in the unit, may have tracking requirements. Consumption inventory (such as non-resale publications, office supplies, etc.) with inventory values over $25,000 must be periodically inventoried.

Capitalized Equipment

The Property Inventory Unit of Business Services/Controller’s Office maintains a record of capitalized equipment in the AIS Property system. When purchases are made of capitalized equipment, numbered identification tags (state tags) are issued to the department for placement on the equipment; the state tag number correlates with the identification number in the Property system. This state inventory record should be physically verified on a periodic basis. We recommend annually; University policy requires equipment on state inventory lists be verified every two years.

Noncapitalized Equipment

Departments are responsible for safeguarding small and attractive assets and developing a system for managing and monitoring. Typical “small and attractive assets” include cameras, digital cameras, stereos, audio visual equipment, televisions, VCRs, DVDs, printers, computers, electronics, and digital media equipment. These items, if under $5,000, are not automatically posted to the state inventory system, so are not tagged by the University. The departments can either purchase state tags and request to add to the state inventory system in order to include in the verification process, or establish an independent inventory monitoring procedure to account for these assets.

Whenever equipment is transferred from one department to another or moved to a substantially different physical location but stays within the same department, the inventory records should be updated. This information will allow for accurate tracking of equipment locations. If equipment is taken off campus, the department should require employees to complete a sign-out sheet. This provides written support for the location of the equipment.

When equipment becomes obsolete or replaced, the inventory records should be updated as to disposition. No departments other than Surplus have authority to sell or transfer University property to non-University units, including recycling or other disposition.

General Receipting

Though it is ideal to process revenue through the Cashier’s Office, departments occasionally receive cash and checks directly from the payee, via mail or in person. When this occurs, the following receipting policies should be considered:

  1. Endorse checks immediately upon receipt. A proper endorsement includes “Washington State University” and “For Deposit Only” on the back of the check.
  2. Money collected must be physically secured at all times. Do not leave cash or checks unattended. Store cash and checks in a secure location, such as a locked filing cabinet, lock box or safe. Keys or combinations should only be given to those employees that need them to perform their job responsibilities. Preferably, only two people (one serving as a backup) should have access to the keys or know the combinations. If an employee who has access to one of these devices leaves the employ of the department, keys should be returned and any combinations should be changed.
  3. Deposit all payments to WSU intact at least weekly with the Cashier’s Office in total and in the same form as received. Deposit amounts totaling $100 or more should be deposited the day of receipt.
  4. Cash signing machines, blank checks, and partially prepared checks should be secured. Voided checks should be mutilated to prevent unauthorized use.
  5. Periodically reconcile Cash Deposit Reports to the online Account Balances/Detail to ensure all revenue has been properly posted to the appropriate accounts. See Budget/Financial Monitoring Responsibility.
  6. The safety of employees who deliver deposits should be considered.

Only WSU-approved receipt forms or systems should be used. Receipt systems should have edit controls preventing unauthorized changes to receipt integrity. Receipt forms should be pre-numbered, preprinted, and used and retained in order to account for completeness of record, including voided receipts. Supervisory review and approval should be required for all voids, paid-outs, non-cash credits and refunds.

Gifts

There are restrictions on gifts WSU employees may receive individually – see Ethics in Public Service. The University may receive gifts without such restriction. WSU Foundation Gift Accounting should be notified when gifts or donations are received. Policies for the proper accountability of funds in transit from donor to department to Gift Accounting have been established and should be followed.