The audit trail includes more than just "the money."
SHOW ME THE MONEY! But also…. the deposit slip, bank statement, receipts, void logs, adjustment/write-off logs, general ledger, and the daily count forms verifying proper chain of custody.
Districts should periodically perform a risk assessment on their internal controls for collections at their various locations. First, ensure a list of all collection points is on record. These primarily will include child nutrition, the tax office, and collections for activity funds. Next, ensure formal policies/procedures are established and are consistent across the District. Finally, evaluate the risk that the misappropriation of assets could occur due to fraud and/or abuse. Locations with a higher volume of cash receipts will inherently be higher risk.
The technology utilized for each area plays a critical role in building the internal control structure. For example, cashiers in the tax office should not have the ability to make adjustments to customer accounts without proper approval. The user access for all employees involved in the process should be reviewed each time there is turnover in the department and no less than once a year.
Sometimes the technology system is limited and is unable to provide adequate restrictions. In this case, the segregation should be defined by job duties set forth in a policy/procedure manual. Then, authorized individuals can review change logs and unusual activity can be more easily identified. For example, all 5 cashiers in an office may have the ability to make adjustments to customer accounts. However, Cashier #1 is designated to have this role assigned to them and Cashier #2 is their backup. Change logs can be reviewed at the end of each day to verify that Cashier #1 made all (or most) of the adjustments. Cashier #2 may have had to process a small number of adjustments, but there should have been no adjustments made by Cashiers #3-5.
Manual adjustments to customer accounts should not be ignored when gathering daily reports to submit to Finance. These end-of-day reports should include lists of all manual adjustments, including voids and any other various non-cash adjustment activity. All manual adjustment should have proper support retained which includes review/approval from an authorized individual. Maintaining proper support should be a standard set for every single transaction occurring in the general ledger.
As for a few housekeeping items: (a) deposits should be made on a timely basis, (b) surprise cash counts and review of activity fund bank activity should be performed periodically across various collection sites, (c) if PayPal/Venmo, or equivalent, is used to accept payments, the account should be in the District’s name and proper oversight should be maintained, (d) all employees need to have their own username to login to the District system, and (e) passwords should not be shared.
