SEGREGATION OF DUTIES GUIDELINES

• Contents

• 1 Introduction / Background 2
• 2 Scope / Purpose 2
• 3 Principles 2
• 4 Segregation of Duties 2
• 5 Roles & Responsibilities 3
• 6 Version Control and Change History 3

1 Introduction / Background

• 1. These guidelines set out how the University of Wollongong implements segregations of duties as an internal control measure.
• 2. The University of Wollongong has established a system of controls to carry out its operations in an economical, efficient, effective and orderly manner. The primary objectives of the University’s internal control systems are to ensure:
• a. The reliability and integrity of information;
• b. Compliance with policies, plans, procedures, laws and regulations;
• c. The safeguarding of assets;
• d. The economical and efficient use of resources; and
• e. The achievement of operational goals.

2 Scope / Purpose

• 1. The key organisational control is the University’s Delegations of Authority Policy. This is web deployed for easy access and maintained by Governance. The Delegations of Authority Policy details parameters for specified University officers.

3 Principles

• 1. The following principles have been adopted by the University to ensure effective control:
• a. Clearly established lines of responsibility and delegation
• b. Risk assessment and best practice is the basis for evaluation of the control framework
• c. Preference for system controlled on-line transactional environments with appropriate security and audit trails.
• d. Reconciliation of bank statements, payroll records, accounts receivable records, and other suspense accounts to general ledger records.
• e. Responsibility for initiating business transactions on the University's behalf and for custody of the University's assets is normally separated from responsibility for maintaining the accounting records.
• 2. Where the risk is assessed as significant and the above principles require strengthening, the following additional factors apply:
• a. End-to-end responsibility for any series of financially related transactions to be distributed among two or more staff members or departments.
• b. Registration of the receipt, issue and usage of all residual, paper-based, accountable documents, in particular, cheques and receipt books.
• c. Internal Audit responsible for continuing review and study of the internal control system. Non-compliance with established procedures are reported directly to the Vice-Chancellor and Risk, Audit and Compliance Committee of Council.

4 Segregation of Duties

• 1. The following summarises the key job functions where other measures are insufficient and segregation of duties is required:
• a. Users with access to create purchase orders or enter accounts payable invoices are not allowed access to add or change records in the address book. The Payee Control function in JDE has been enabled to facilitate this.
• b. However, users with access to create accounts receivable invoices have retained access to add or change customer records in the address book. The University understands and recognises the risk associated with this particular lack of segregation.
• c. Staff who create purchase orders must not approve those purchase orders. That is, a person independent of the purchase order creation must approve the purchase order.
• d. Staff who create purchase orders may approve receipt of goods for those purchase orders. However, where a variation to the original purchase order occurs, it must be approved by a person independent of the variation to the order (subject to being a material variation).
• e. Staff who enter or review accounts payable invoices must not approve payment of those invoices. Additionally a user may not review or enter invoices and also approve invoices within the same user group. A person independent of the invoice review process must approve invoice payments.
• f. Staff who create accounts receivable invoices may also process credit notes and debt write-offs. However, these transactions are supported by documentation with sign-off by authorised delegates, who do not have access to create accounts receivable invoices.
• g. Staff who create general journals and other system journals must not approve those journals for posting to the general ledger. A person independent of the journal creation process must approve the posting of journals (subject to the Journal Posting and Approval Guideline).

5 Roles & Responsibilities

• 1. Roles and responsibilities are as detailed in these guidelines.

6 Version Control and Change History