VA Form 10-10073B NPPO Internal Control Questionnaire

OMB Number: 2900-0783

Estimated Burden: 4 hours

OMB Exp Date XX/XX/XXXX

Nonprofit Program Office (NPPO)

Office of Research and Development

Veterans Health Administration (VHA)

Internal Controls Questionnaire (ICQ)

Self-Assessment for

VA Affiliated Nonprofit Research and Education Corporations (NPCs)

October 1, 2021

The Paperwork Reduction Act of 1995: This information is collected in accordance with Section 3507 of the Paperwork Reduction Act of 1995. The public reporting burden for this collection of information is estimated to average 4 hours per response, including the time to review instructions, search existing data sources, gather and maintain data needed, and complete and review the collection of information. Respondents should be aware that we may not conduct or sponsor, and you are not required to respond to, a collection of information unless it displays a valid OMB number. This collection of information is intended to assist the Nonprofit Program Office (NPPO) in assuring that internal controls are present and effective for VA affiliated Nonprofit Research and Education Corporations (NPCs) and identify areas requiring improvement. Your response to this information collection is mandatory as an NPC participating in the program.

Privacy Act Statement: VA is asking you to provide the information requested in this form under the authority of 38 U.S.C. section 7366 in order for the VA NPPO to evaluate internal controls and assure they are present and effective for NPCs. VA may disclose the information that you provide as permitted by law. VA may make a "routine use" disclosure of the information for: civil or criminal law enforcement; congressional communications; the collection of money owed to the United States; litigation in which the United States is a party or has interest; the administration of VA programs, including verification of your eligibility to participate; and personnel administration. You must provide the requested information to VA to continue participation with the NPPO as an NPC. This information also may be used for other purposes as authorized or required by law.

Nonprofit Program Office (NPPO)

Office of Research and Development

Veterans Health Administration (VHA)

U. S. Department of Veterans Affairs (VA)

Self-Assessment for VA-Affiliated Nonprofit Research and Education Corporations (NPCs) established pursuant to sections 7361-7366, title 38, United States Code

Table of Contents

Introduction iii

Internal Controls Questionnaire 1

A. Control Environment 1

B. Financial Reporting Cycle 6

C. Budget Reporting Cycle 7

D. Revenue Cycle……………………………………………………………….. 7

E. Cash Receipts Cycle 8

F. Accounts Receivable Cycle 9

G. Purchasing/Accounts Payable Cycle………………………………………10

H. Human Resources Cycle…………………………………………………….11

I. Computer Security………………………………………………..…………...12

J. VHA Directive (formerly Handbook) 1200.17………..…….………………..13

Introduction

The Self-Assessment of Internal Control, commonly referred to as the Internal

Control Questionnaire (ICQ), is a tool to be utilized by NPPO and NPCs. At this time, we are not expecting documentation for each of these items.

The ICQ is a NPPO review or audit tool. The purpose will be to confirm that internal controls are present and effective, or to identify areas requiring improvement. NPPO will develop formal written recommendations for improvements to the NPC’s management, the VA Medical Center Director, and the NPC’s board of directors.

NPPO estimates that it will take an average of four hours to answer the ICQ. However, because of the huge size disparities in the NPCs and other factors peculiar to some of the NPCs, more or less time may be required. If you would like to comment upon the estimated burden of answering this ICQ, or have any questions or suggestions, please contact Kimberly Collins, NPPO Director, at (202) 731-6973 or kimberly.collins@va.gov.

VA and NPPO cannot ensure that the ICQ answers will be kept confidential or private. However, NPPO will make a reasonable effort to confine the answers to those within VA who have a need to know.

This ICQ does not contain any information that can reasonably be regarded as sensitive.

This ICQ will be made available to respondents electronically by email or a download from the NPPO Website. The answered ICQs must be returned to NPPO electronically. There is no additional record-keeping requirement for the ICQ.

This ICQ will be answered by the NPC’s Executive Director, Chief Executive Officer, Chief Financial Officer, Controller or other person with equivalent authority, ability and knowledge of the NPC’s operations and internal controls.

Fill out the required information at the top of page one and then check the correct box. If you are uncertain about how to answer a question, leave it blank and go on to the next one.

System of Internal Controls

A proper system of internal control provides reasonable assurance that the financial statements are fairly presented and that management’s goals are being properly pursued. Such a system includes fully documented policies and procedures that ensure, among other things, that:

A. Transactions are executed according to management's general or specific authorization.

B. Transactions are recorded, as necessary, to:

1. prepare the financial statements that conform with generally accepted

accounting principles, and

2. account for assets, liabilities, net worth, cash flow, revenues and

expenses.

C. Access to assets is permitted according to management's authorization.

The ultimate responsibility for a good system of internal control rests with management. Periodically, when submitting financial statement information, management must attest to the accuracy of that information along with the soundness of internal controls. This ICQ should be used as a key tool in making those assertions. Additionally, many aspects of internal control are currently documented in VHA Handbook 1200.17.

Framework

The ICQ consists of the following accounting cycles or sections:

1. Control Environment

2. Financial Reporting

3. Budget Reporting

4. Revenue

5. Cash Receipts

6. Accounts Receivable

7. Purchasing/Accounts Payable

8. Human Resources

9. Computer Security

10. VHA Directive (formerly Handbook) 1200.17

Acknowledgement

The framework for the ICQ is taken from sources both within and outside NPPO and VA, particularly the State of North Carolina and the Committee of Sponsoring Organizations of the Treadway Commission (COSO) as published in Internal Control– Integrated Framework in 1992.

Nonprofit Program Office (NPPO)

Office of Research and Development

Veterans Health Administration

U.S. Department of Veterans Affairs (VA)

Self-Assessment of Internal Controls

for VA Affiliated Nonprofit Research and Education Corporations (NPCs)

NPC:

City:

State:

Prepared by:

Title:

Telephone #:

Address:

Date Prepared:

A. Control Environment

Please check box for correct answer. Leave other boxes blank.

Yes No N/A 1. Does the NPC have a designated Financial Officer with the title of Chief Financial Officer, Financial Officer, Controller, or Director of Finance? If the answer is “No”, please skip to Question No. 5 below.

Yes No N/A 2. If the NPC’s gross assets under management at year-end or annual revenues are greater than $4 million, is the designated Financial Officer a full-time NPC employee?

Yes No N/A 3. Is the designated Financial Officer trained and experienced in financial management, accounting, auditing, internal controls, and financial reporting?

Yes No N/A 4. Is the designated Financial Officer empowered by a Board approved job description or resolution to perform the following duties and responsibilities?

Yes No N/A a. Maintaining generally-accepted sound internal controls within the NPC and in accordance with GAO’s Standards for Internal Control in the Federal Government a/k/a the “Green Book”?

Yes No N/A b. Promptly reporting all significant internal control lapses and irregularities to the NPC’s Board and to NPPO by email?

Yes No N/A c. Periodic, at least annual, evaluation of the NPC’s internal controls using this Self-Assessment of Internal Controls and certifying those evaluations to the Board and to NPPO?

Yes No N/A d. All financial accounting functions including the following?

Yes No N/A a. Regular monthly financial statements to the

Board and to other management users?

Yes No N/A b. Monthly budget reporting with explanations of

significant variances to the Board and to other

management users?

Yes No N/A c. Review and approval of all cash

disbursements?

Yes No N/A d. Review of all cash receipts?

Yes No N/A e. Review of all NPC contracts and awards?

Yes No N/A f. Monthly reconciliation of Investigators’ project

accounts to the general ledger summary

account?

Yes No N/A g. At least monthly reporting to the Executive Director and the Board of the NPC’s administrative reserve and other discretionary funds not earmarked for research and education projects or for Investigators’ residual accounts?

Yes No N/A h. Planning and conduct of the year-end audit by the Board-selected independent auditing firm, if required?

Yes No N/A i. Assisting the Executive Director with NPPO’s audits and interfacing directly with the NPPO auditing team?

Yes No N/A j. Such other unspecified duties as may be assigned from time-to-time by the Executive Director or required by the Board.

Yes No N/A 5. Does a written Conflict of Interest Policy (COI) exist and does it apply to all officers, employees and directors?

6. Does the COI Policy contain:

Yes No N/A a. A definition of COI?

Yes No N/A b. A training requirement for directors, officers

and employees about the policies within 90

days of hire or affiliation with the NPC?

Yes No N/A c. An annual refresher training requirement

about the policy for directors, officers and employees with decision-making authority?

Yes No N/A d. A requirement for directors, officers and employees with decision-making authority to disclose potential COI?

Yes No N/A e. A requirement that each director, officer and employee sign a statement of acknowledgement of understanding and agreement to comply with the policy upon hire or affiliation with the NPC?

Yes No N/A f. A process for identifying and managing

COI?

Yes No N/A 7. Is there a written policy and procedure for managing real or perceived conflicts of interest resulting from the hiring of subordinates with a financial, social, familial or romantic relationship?

Yes No N/A 8. Is Internal Controls training provided to directors, officers and employees with decision-making authority within 90 days of hire or affiliation?

Yes No N/A 9. Does the NPC have an anonymous and confidential Whistleblower policy for communicating and receiving information regarding fraud, errors in financial reporting, and misrepresentations or false statements made by management?

Yes No NA 10. Are job responsibilities formally documented and reviewed annually by supervisors or management?

Yes No N/A 11. Does management ensure compliance with the NPC’s

personnel policies and procedures

Yes No N/A 12. Do senior management and the board review financial results at least quarterly?

Yes No N/A 13. Are large or unusual variances between budget and actual examined and explained?

Yes No N/A 14. Is there a process for internal review of the NPC’s operations, such as, by periodically completing this questionnaire at least annually?

Yes No N/A 15. Does the Executive Director report to the board of directors?

Yes No N/A 16. Does the NPC follow the annual audit requirements for an independent outside audit in accordance with VHA Handbook 1200.17?

Yes No N/A 17. Does the NPC accept VA-appropriated funds only when pursuant to reimbursement for an approved Intergovernmental Personnel Act (IPA) assignment agreement?

Yes No N/A 18. If material weaknesses or control deficiencies were identified in the outside independent auditor’s letter to management, has the NPC board approved management’s corrective plan?

Yes No N/A 19. If applicable, does management follow-up on other outside audit and internal review findings and recommendations?

Yes No N/A 20. Has the NPC obtained an exemption from state sales and use taxes, if allowed by the state?

Yes No N/A 21. Does the NPC provide research investigators with financial reports of their active projects at least quarterly, including income and expenditures (annually for dormant accounts)?

Yes No N/A 22. Does the NPC send donor acknowledgment letters reflecting the purpose and conditions of gifts that conform to IRS requirements?

Yes No N/A 23. Are written policies and procedures reviewed periodically, approved by senior management, and readily available for use by all employees?

Yes No N/A 24. Is there an organizational chart that clearly defines the lines of management authority and responsibility?

Yes No N/A 25. Are board elections conducted in accordance with the NPC’s bylaws?

Yes No N/A 26. Are dollar limits established for check signing authority and

equipment and other purchases?

Yes No N/A 27. Does management understand the concept and importance of internal controls, including division of responsibility?

Yes No N/A 28. Does the NPC have a designated Financial Officer other than the Executive Director?

Yes No N/A 29. Is the internal control structure supervised and reviewed by management to determine whether it is operating as intended?

Yes No N/A 30. Are responsibilities segregated so that no single employee controls all phases of a transaction?

Yes No N/A 31. Are there adequate policies and procedures for authorization and approval of transactions at the appropriate level?

Yes No N/A 32. Is risk identification, e.g. fraud, embezzlements, decrease in CRADA revenue, decrease in federal funding, etc. incorporated into management’s short-term and strategic planning?

Yes No N/A 33. Is it true that there have been no thefts, embezzlements, or other irregularities in the organization since the last audit?

If no to 33, please answer questions 30-32, if yes proceed to 37.

Yes No N/A 34. If there were any thefts, embezzlements, or other irregularities since the last audit, have they been properly reported to NPPO, VA OIG, and VA police?

Yes No N/A 35. Has corrective action been taken to prevent a recurrence of any thefts, embezzlements, or other irregularities that may have happened?

Yes No N/A 36. Has an appropriate effort been made to recover any thefts, embezzlements, or diversions of funds?

Yes No N/A 37. Are there any project accounts that are overdrawn and in a

deficit status?

Yes No N/A 38. Is the Board aware when accounts are overdrawn with no anticipated revenues?

B. Financial Reporting Cycle

Yes No N/A 1. Are accounting policies and procedures written and are they communicated to all accounting and applicable personnel?

Yes No N/A 2. Is the general ledger chart of accounts properly maintained by authorized accounting personnel?

Yes No N/A 3. Is an accountant assigned responsibility to supervise the conversion from cash basis to accrual basis accounting for the year-end financial reporting?

Yes No N/A 4. Does the NPC maintain the trial balances, adjustments and supporting work papers to support the process of closing the general ledger, preparing financial statements, and making financial statement footnote disclosures?

Yes No N/A 5. Are the financial statements and footnote disclosures supported by the underlying supporting documentation (i.e. general ledger, reconciliations, journal entries, and work papers)?

Yes No N/A 6. Is the supporting documentation attached to the general ledger journal entries and secured in a safe location?

Yes No N/A 7. Are the financial statements and footnote disclosures updated to reflect any new FASB and GASB pronouncements or any other significant standards?

Yes No N/A 8. Are comparative (current period to prior year and current period to budget) quarterly financial statements prepared and distributed to management and the board?

Yes No N/A 9. Is there a financial highlights narrative accompanying the monthly or quarterly financial statements?

Yes No N/A 10. Are IPA assignment agreement reimbursements from VA accounted for as governmental revenues and not as offsets to salaries and fringes expenses?

C. Budget Reporting Cycle

Yes No N/A 1. Has the Board approved an annual administrative budget?

Yes No N/A 2. Have procedures been adopted and communicated establishing authority and responsibility for budget revisions?

Yes No N/A 3. Are comparative statements, actual to budget, prepared and distributed to management and the Board at least quarterly?

Yes No N/A 4. Does the NPC’s Executive Director or Financial Officer determine the availability of funds before the issuance of a purchase order or expenditure commitment?

D. Revenue Cycle

Yes No N/A 1. Is there a written policy and procedure defining responsibilities for processing and recording revenue transactions?

E. Cash Receipts Cycle

Yes No N/A 2. Do written procedures exist regarding the collection, recording and depositing of funds?

Yes No N/A 3. Is a restrictive endorsement placed on incoming checks at the earliest point of receipt?

Yes No N/A 4. Do deposit slips have an official depository bank number preprinted on the document?

Yes No N/A 5. If payments are made in person (for seminars, workshops, etc.), are manual receipts used, accounted for, and balanced to the deposits?

6. Are the following responsibilities performed by different people:

Yes No N/A a. Custodian of the funds, reconciliation of the funds, and access to cash receipts?

Yes No N/A b. Listing the cash receipts, making cash disbursements, and preparing reconciliations?

Yes No N/A c. Making a deposit, billing, making general ledger entries and collecting cash?

Yes No N/A d. Collecting cash, balancing cash, making a deposit, maintaining accounts receivable records and making general ledger entries?

Yes No N/A e. Preparation of the deposit and verifying the validated bank deposit?

Yes No N/A 7. Is a log maintained for mail receipts?

8. Is the mail receipts log reconciled to:

Yes No N/A a. The cash receipts journal?

Yes No N/A b. Validated deposit slips?

Yes No N/A 9. Are bank deposits made timely after receipt?

Yes No N/A 10. Are there controls in place for signature stamps?

Yes No N/A 11. Are there controls to ensure each cash disbursement is properly supported by documents and approved by the proper authorities before the disbursement occurs?

Yes No N/A 12. Are there controls over the supply of unused and voided checks?

Yes No N/A 13. Is effective control maintained over receipts of grants, donations, etc. and is a follow-up made by a responsible employee to see that they have been classified and recorded properly?

Yes No N/A 14. Does management review and approve, sign and date bank reconciliations of operating and investments accounts on a monthly basis?

Yes No N/A 15. If credit cards are accepted for payment, is there documentation to reflect that the NPC is PCI (Payment Card Industry) compliant?

F. Accounts Receivable Cycle

Yes No N/A 1. Is there a written policy and procedures for accounts receivable?

Yes No N/A 2. Does the NPC have established policies and procedures concerning refund of overpayments and the issuance of billing adjustments?

3. Are the following amounts properly recorded:

Yes No N/A a. Amounts due from the VAMC for Intergovernmental Personnel Act assignment agreements (IPAs)?

Yes No N/A b. Amounts due from funders?

Yes No N/A c. Amounts due from other grants?

Yes No N/A d. Amounts due from other misc. sources?

Yes No N/A e. Interest receivable?

Yes No N/A 4. Are remittance advices and billings retained to support entries to accounts receivable records?

Yes No N/A 5. Is accounting notified in a timely manner of billings and collection?

Yes No N/A 6. Is access to the accounts receivable accounting system limited to authorized individuals?

G. Purchasing / Accounts Payable Cycle

Yes No N/A 1. Is there a written policy and procedure defining the responsibilities of preparing, recording, and approving all purchases and accounts payable functions?

Yes No N/A 2. Is each purchase or expenditure justified by its relation to VA approved research, VA approved education, or the NPC’s authorized business purpose?

Yes No N/A 3. Has the NPC established procedures to ensure that all voided checks are properly accounted for and effectively canceled?

Yes No N/A 4. Does the NPC have a travel reimbursement policy that conforms to IRS requirements, that is to only reimburse for actual expenses incurred up to specified limits or for GSA per diem amounts?

5. Do invoice processing procedures provide for:

Yes No N/A a. Obtaining copies of requisitions, purchase orders and receiving reports?

Yes No N/A b. Comparison of invoice quantities, prices, and terms with those shown on the purchase order?

Yes No N/A c. Comparison of invoice quantities with those shown on the receiving reports?

Yes No N/A 6. Is an adequate record of open purchase orders and agreements maintained?

Yes No N/A 7. Is there a prohibition against splitting orders to avoid higher levels of approval?

Yes No N/A 8. Are returned items correlated with vendor credit memos?

Yes No N/A 9. Does the accounting department or accountant record and follow-up on partial deliveries?

Yes No N/A 10. Are credit card purchases reviewed monthly by higher management, other than the card holder?

H. Human Resources Cycle

Yes No N/A 1.Are there written policy and procedures defining the responsibilities of processing, recording, approval and distribution of payroll and of personnel activities?

Yes No N/A 2. Are there written NPC personnel policies?

Yes No N/A 3. Are individual personnel files maintained for all employees?

Yes No N/A 4. Is access to payroll and personnel files limited to authorized individuals?

Yes No N/A 5. Are completed payroll transmittals reviewed and approved by a responsible person before check processing?

Yes No N/A 6. Are payroll registers reconciled to the payroll accounts in the general ledger by a knowledgeable person not otherwise involved in payroll processing?

7. Are individual employee time and attendance records:

Yes No N/A a. Prepared and signed by each employee for each pay period?

Yes No N/A b. Sufficiently detailed to show time charged

properly?

Yes No N/A c. Reviewed and signed by each employee's supervisor?

Yes No N/A d. Reconciled with summarized time and attendance records?

Yes No N/A 8. If applicable, is overdrawn vacation or sick leave deducted when calculating final compensation upon employee termination?

Yes No N/A 9. Are employee leave records updated each pay period to ensure payment is available when needed?

I. Computer Security

If your IT system is administered by VA, then please skip to Section I following.

Yes No N/A 1. Is there a competent manager or administrator, either an employee or contractor, assigned to administer the IT system?

Yes No N/A 2. Is there a written disaster recovery plan for IT?

Yes No N/A 3. Is a formal documented security administration process in place to ensure that access to all applications, including restricted access to financial applications, is approved?

Yes No N/A 4. Does a login name and a password uniquely identify users

when they sign on to the system (e.g. no group user IDs)?

Yes No N/A 5. Do the NPC’s computers use a recognized anti-virus (A/V) program and is it run on a regular schedule?

Yes No N/A 6. Does the NPC have a security firewall established for its LAN for individual workstations?

Yes No N/A 7. Has the NPC taken steps to prevent and minimize potential damage and interruption through the use of daily offsite back-ups.

Yes No N/A 8. Have procedures for the retrieval of daily back-ups been tested.

Yes No N/A 9. Is the IT equipment regularly inspected and maintained?

Yes No N/A 10. Does the NPC monitor information systems access, investigate apparent violations, and take appropriate remedial and disciplinary action?

Yes No N/A 11. Does the NPC ensure that all sensitive data and programs are removed from computers before they are disposed of?

J. VHA Directive (formerly Handbook) 1200.17

Yes No N/A 1. Are policies and procedures consistent with statutes and VA guidance, particularly with VHA Directive 1200.17?

Yes No N/A 2. Is a control list maintained for required WOC appointments and is the list reviewed monthly?

Yes No N/A 3. Do you have documentation that the Medical Center Director concurred in the appointment of the Executive Director on behalf of the Under Secretary for Health?

Yes No N/A 4. Are the Medical Center Director, Chief of Staff, Associate Chief Staff for R&D, and/or Associate Chief of Staff for Education (or those with equivalent titles) participating members of the Board?

Yes No N/A 5. Is the composition of the Board in compliance with the VHA Directive 1200.17?

Yes No N/A 6. Does the NPC have a record retention policy that satisfies IRS requirements and standard practices for retaining and disposing of business records?

Yes No N/A 7. If the NPC has in its custody documents subject to VA retention policies (e.g. completed case report forms or signed informed consent forms), does the NPC follow applicable VA requirements regarding storage, retention and disposition?

Yes No N/A 8. Has the VAMC’s HR Department issued Without Compensation Appointments (WOC’s) to all NPC employees who are engaged in approved VA research or education and are under VA supervision?

Yes No N/A 9. Has the VAMC’s HR department issued Without Compensation Appointments (WOC’s) to VA employees working at the NPC outside of their VA tour of duty but who are engaged in approved VA research or education and are under VA supervision?

Yes No N/A 10. Has the VAMC's HR department issued an affiliate badge to NPC Administrative Personnel (those not engaged in VA approved research or education) in accordance with VA Handbook 0735 issued on February 17, 2011?

Yes No N/A 11. Are copies of current WOC appointments kept on file at the NPC?

Yes No N/A 12. Are NPC employees placed on IPA appointments at the VAMC hired and paid by the NPC at least 90 days prior to the IPA appointment?

Yes No N/A 13. Are IPA appointments used strictly for hard-to-hire scientific and technical personnel and not administrative employees?

Yes No N/A 14. Are reimbursements claimed from VA for IPA assignment agreements for salaries and payroll fringes only, no processing fees or other extraneous charges?

Yes No N/A 15. Are all cash receipts from VA for IPA assignment agreement salaries and payroll fringes only, with no other receipts from VA of any kind or nature whatsoever?

Yes No N/A 16. Are IPA appointments made for limited durations and are copies maintained on file at the NPC?

Yes No N/A 17. Are there current, signed COI statements and disclosure forms on file at the NPC for all board members and key NPC employees?

Yes No N/A 18. Do time sheets used for joint VA -- NPC employees clearly document the tour of duty for each entity so that there is no dual compensation for the same hours worked?

Yes No N/A 19. Does the NPC have a residual fund policy that is in accordance with Handbook 1200.17?

Yes No N/A 20. Are transfers of active projects including associated funds and equipment approved by the donor?

Yes No N/A 21. Does the NPC pay for publications and subscriptions only when they facilitate VA’s research and/or education missions or are related to appropriate NPC business purposes?

Yes No N/A 22. Does the NPC pay for professional memberships only when justified by gaining access to research-related subscriptions or reduced registration fees for scientific conferences or for NPC business purposes?

Yes No N/A 23. Does the NPC have a Memorandum of Understanding (MOU) with the VAMC regarding reimbursing the medical services appropriation for clinical services provided purely for NPC research purposes?

Yes No N/A 22. Does the NPC provide reimbursement to the VAMC as stated in the MOU?

Yes No N/A 23. Are all investments held in instruments backed by the full faith and credit of the U.S. Government or U.S. Government insured?

Yes No N/A 24. Are there approved written policies and procedures that document the purchase of investments and identify control procedures for these purchases?

Other notes or comments:

Click here to enter text.

viii

VA Form 10-10073C