Internal Control Policy

In 1987, the New York State Governmental Accountability, Audit and Internal Control Act, Chapter 814, became law and was effective April 1, 1989.  This law requires that all State Agencies, including SUNY Plattsburgh, establish and maintain a system of internal controls and internal control review.

Date	Version Number	Change Description	Referenced Section
Pre-2006	1.0	New Document	Entire Document
c. 2006	1.1	Minor Revision
9/22/16	1.2	Minor Revision
1/5/17	1.3	Minor Revision
12/2/18	1.4	Minor Revision
9/26/25	2.1	Major Revision	2.0, 3.0, 4.0, 7.0, 8.0, 9.0, 10.0
2/19/26	2.2	Minor Revision	7.0

 Review Process / Approval

Action:	Units	Date
Policy Review	VP of Administration Management Services
Policy Approval	Executive Council

All employees

Internal controls encompass the plan of organization and all of the coordinate methods and measures adapted within an organization to meet its mission; promote performance leading to effective accomplishment of goals; safeguard assets; check the accuracy and reliability of accounting data; promote operational efficiency; and encourage adherence to prescribed managerial policies and procedures.

At every position level, all employees should be aware of the university's goals and their participation roles in attaining those goals. They should routinely exercise judgment and act to protect the institution and its resources from loss, waste, or damage. Our competence and professional integrity are essential components of a sound internal control program. By knowing what our responsibilities are, we can help to provide reasonable assurance that our internal control systems are adequate and operating in an efficient manner.

Employee Responsibilities

• Fulfilling the duties and responsibilities established in one's job description.
• Meeting applicable performance standards.
• Attending education and training programs as appropriate to increase awareness and understanding.
• Taking all reasonable steps to safeguard assets against waste, loss, unauthorized use and misappropriation.
• Reporting breakdowns in internal control systems to your supervisor.
• Refraining from the use of your official position to secure unwarranted privileges.

Managers Responsibilities

• Maintaining an office environment that encourages employees to understand the purpose of such policies and procedures and support the maintenance of a positive internal control environment.
• Documenting policies and procedures that are to be followed in performing office functions.
• Identifying the control objectives for the functions and implementing cost effective controls designed to meet those objectives.
• Regularly testing the controls to determine if they are performing as intended.
• Commitment of Campus Leaders Employee attitude affects the quality of job performance and, as a result, the quality of internal controls.
• A positive attitude is initiated and fostered when internal controls are a consistent priority.
• From the president and vice presidents to the deans and directors, everyone must demonstrate commitment to the Internal Control Program.
• In addition, university officials should be open to employee suggestions concerning the campus' internal control systems. Users are the best source of improvements to a system.  

The policies which, by law, each employee is reasonably expected to comply with include: 

• Public Officers Law
• Policies of the SUNY Board of Trustees
• Performance Programs
• Job Descriptions

These policies and standards, may be viewed within the SUNY Plattsburgh Campus Handbook  or SUNY Board of Trustees Policies

In addition to the policies and standards listed above, there are many others that are periodically issued by the President and other University Officers, which employees are expected to comply with where applicable. Examples of such policies and standards:

• Campus smoking policy
• Alcohol and drug use policy
• Time and attendance policy & procedures
• Travel Regulations 
• Parking Regulations.
• Contract Service Guidelines.
• All other informational documents are often issued and distributed by the President, Vice Presidents, Business Officers, Deans, Directors, and Department Heads.  

Specific Internal Control questions, may be directed to the Internal Control Risk Management Coordinator, Kehoe 709, 518-564-2539.

When conducting internal control reviews for the campus, the members of the Internal Control Committee (ICC) work group may identify deficiency in the review system. Committee members document deficiencies in their final report. Review tests which result in “partially compliant”, “not compliant”, “satisfactory with weaknesses” or “weaknesses” will be accompanied with recommendations. The responsible department(s) will review deficiencies and recommendations to prepare a written response. For actionable recommendations, the department will populate the Internal Control Review Corrective Action Plan document. The completed document will be submitted to the Internal Control/Risk Management Coordinator. The department(s) will provide progress updates to the Internal Control/Risk Management Coordinator at least quarterly until the plan's completion. The Internal Control/Risk Management Coordinator will provide updates to the ICC until completion.

Procedure to Finalize an Internal Control Review

1. Appointed reviewers from the Internal Control Committee complete control tests evaluating standards from the SUNY provided review template. Reviewers evaluate control tests ranking each as Satisfactory, Satisfactory with Weakness or Weakness. Associated recommendations can be included where applicable. The completed review template is submitted to the Internal Control Risk Management Coordinator.

2. The Internal Control Risk Management Coordinator prepares a final report to summarize the review and provides an overall rank Satisfactory, Satisfactory with Weakness or Weakness based on review results.

3. The Internal Control Risk Management Coordinator presents the final report to the Internal Control Officer. If the overall assessment of the review is Satisfactory with Weakness, Weakness or includes recommendations, the Officer will direct the Internal Control Risk Management Coordinator to begin the Corrective Action Plan procedure. 

4. The Corrective Action Plan procedures include the Internal Control Risk Management Coordinator meeting with the Department Head(s) of the review area and their associated Vice President. The Department Head will be charged with creating a Corrective Action Plan in response to the review recommendations. The Corrective Action Plan will be signed by the associated Department Head(s) and Associated Vice President. 

High Risk Area Internal Review Department Head and Vice President Contacts include;

Internal Control Review	Associated Department Head(s)	Associated Vice President
Emergency Management	Emergency Management	VP Enrollment and Student Success
Financial Aid	Budget & Reporting Services, Student Financial Services	VP Administration & Finance, VP Enrollment and Student Success
General Control Environment	Campus Ethics Officer, Internal Control Risk Management Coordinator, Human Resource & Payroll Services	VP Administration & Finance
Information Technology	Chief Information Officer	Provost
Personnel & Payroll	Human Resource & Payroll Services	VP Administration & Finance
Procurement	Budget & Reporting Services, Procurement Services	VP Administration & Finance
Property Control	Procurement Services	VP Administration & Finance
Revenue/Cash Management	Budget & Reporting Services, Student Financial Services	VP Administration & Finance, VP Enrollment and Student Success

 5. The Internal Control Risk Management Coordinator presents complete review templates, final report and if applicable corrective action plan to the Internal Control Committee. Progress Reports of Corrective Action Plans will be presented to the committee until the plan is completed.

6. All completed reviews will be included in the state agency Internal Control Certification due annually in March. 

 

• Internal Control Review Corrective Action Plan

• Internal Control Program Guidelines (SUNY)
• SUNY Plattsburgh Internal Control Program 

Method	Date
Campus Handbook	N/A
Faculty / Staff Digest	9/28/25
Student Digest	N/A
Other	N/A

SUNY Internal Control Policy states campuses should identify staff requiring internal control training and the depth and content of that training. The education and training efforts should be ongoing and may vary depending upon the degree of responsibilities of the employee.