Financial Analysis and Control

Principles of Financial Controls

In past decades, the topic of financial controls has received a lot of attention. One of the main events that emphasized this topic was the passage of the Sarbanes-Oxley Act of 2002 (SOX). Although this legislation primarily affected publicly traded companies, its impact has indirectly been felt by universities as well. A number of states issued legislation similar to SOX, but more important, financial auditing firms began to examine their roles more closely after the demise of major accounting firm Arthur Andersen. Therefore, a better knowledge of internal controls of financial systems has become increasingly important.

The most well known and highly respected internal control framework was developed by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) in 1992. This integrated framework established effective internal controls that have served most industries well. This section provides an overview of these principles.

Before considering COSO principles, one should examine the following key fiduciary responsibilities of a board of directors:

• Set strategic directions
• Protect the owners and other key stakeholders
• Monitor financial health of the organization
• Evaluate the work of outside auditors
• Overall duty of care, loyalty and confidentiality

It is important for board members to recognize their personal responsibility and liability. The passage of SOX unequivocally made this duty clear. Within such a framework is internal control; a collection of processes that are designed to give reasonable assurance about:

• Efficiency and effectiveness of operations
• Reliability of financial statements
• Compliance with laws and regulations

In other words, management must provide reasonable assurance that the organizational objectives will be met in a safe and cost-effective manner. Internal controls are procedures that are performed every day, and therefore should be:

• A means, and not an end
• Affected by people
• Not merely policies and procedures
• Integral to every aspect of the business
• Built into, not onto, business processes

The COSO framework illustrates internal controls in a three-dimensional cube as shown below:

Figure 1. COSO Framework: Three-dimensional criteria for evaluating internal controls

(Copied from COSO’s Integrated Framework)

The first dimension of the framework provides three categories of objectives: operations, reporting and compliance.

• For operations, the organization must provide reasonable assurance to the board of directors and management that the entities’ operations are being achieved.
• For compliance, the organization must provide reasonable assurance to the board of directors and management that the entity is in compliance with applicable laws and regulations.
• For reporting, the organization must provide reasonable assurance to the board of directors and management that the published financial statements are prepared reliably. The board, and in most cases the financial committees of the board and management, should review all financial reports for accuracy and completeness in order to:
  • Establish and maintain disclosure control and procedures
  • Ensure inclusion of all material information
  • Evaluate the effectiveness of disclosure control and procedures

More important, the financial statement is required to disclose to auditors and audit committees:

• All significant deficiencies in design of internal controls
• Any material weakness or significant changes in internal controls
• Any fraud

The 5 components, representing the second dimension, relate to internal control:

• Control environment
• Risk assessment
• Control activities
• Information/communication
• Monitoring activities

Control Environment

The control environment sets the tone of the organization, influencing the control consciousness of everyone and providing discipline and structure. Key factors include:

• Integrity and ethical values
• Commitment to competence
• Management philosophy and style
• Organizational structure
• Assignment of authority and responsibility
• Human resources policies and procedures
• Audit committees

The responsibilities of an audit committee are as follows:

• Members may not accept consulting, advisory, or other compensatory fees, other than normal Director fees
• Directly responsible for appointment, compensation, retention, and oversight of those preparing audit reports and related activities
• Establish procedures for receiving, retaining, and addressing complaints
• Have authority to engage independent counsel
• Board must provide audit committee the resources necessary to fulfill its responsibilities

Another important element of control environment is having code of conduct, code of ethics, and conflict of interest statements for the organization. These documents must be filed annually and apply to all employees who have direct or indirect financial responsibilities.

Risk Assessment

Risk assessment relates to identification and analysis of risk in key processes, such as accounts receivable, accounts payable, payroll, procurement, and technology changes. Some common strategic risk factors include the following:

• Planning
• Resource allocation
• Leadership and vision
• Authority and accountability
• Ethics and values
• Illegal acts
• Compliance with laws and regulations
• Competition
• Politics

The universal business risk categories include the following:

• Overpaying
• No or inappropriate policies, procedures and/or training
• Non-compliance with management policies and procedures
• Erroneous data/info
• Employee safety
• Business interruption
• Natural or human-made disasters
• Fraud/conflict of interest

Risk management activities can be divided into the following four categories:

• Accept (monitor)
• Avoid (eliminate)
• Reduce (institute control)
• Share (partner, such as through insurance)

A simple way to examine these categories is to plot the probability of occurrence against the impact in a graph, as shown below.

Examples of policies and procedures that help management directives are carried out in the following key functions:

• Approvals
• Authorizations
• Verifications
• Reconciliations
• Review of operating performance
• Segregation of duties
• Security of assets

Control Activities

Control activities encompasses the policies and procedures companies establish to mitigate risks and ensure institutional objectives are realized. Control activities may be preventive or detective in nature. A “segregation of duties” policy that requires approval from both the initiating department and a finance officer on all purchase orders over $5000 is an example of a control activity.

Information and Communication

This requirement implies that pertinent information must be identified, captured, and communicated in a form and timeframe that enables people to carry out their responsibilities. Key information qualities include timeliness, accuracy, currency, and accessibility. An additional factor that should be kept in mind is information security. This topic is covered in more detail in other parts of the manual.

Monitoring Activities

Monitoring requires having a process that assesses the quality of system’s performance over time through a combination of ongoing and separate evaluation activities.

The third dimension of the COSO framework deals with applying the above criteria for every organizational sector and in every activity. This approach is helpful for business processes such as the following:

• Cash
• Investments
• Donations, program service fees, and other income
• Receivables (including pledges)
• Procurement
• Payroll
• Property and equipment
• Debt and other liabilities
• Reserves and net assets
• Computer controls

In conclusion, internal financial control is essential for any organization because it keeps the organization on course, plays a critical role in achieving the organization’s mission, minimizes surprises, improves an organization’s capability to deal with a changing environment, and provides a standard for assessment and improvement. In the wake of the global financial meltdown of 2008, COSO issued updates to its internal control framework in May 2013.  Further, new federal, state, and local legislation may be passed to address the efficacy of organizations’ current internal financial controls.

Control is so closely interlinked with planning that the two are virtually inseparable. Planning is the process of deciding what needs to be done and anticipating the steps needed to produce the desired outcome. Control involves implementing the planning decision, comparing actual results with what was planned, and taking corrective action if there is an unacceptable deviation. This close relationship is illustrated by the planning and control cycle, which continues until goals are achieved:

• Goals are set.
• Steps to achieve the goals are chosen.
• Actual performance occurs, either according to plan or with variation.
• Performance is monitored through feedback mechanisms.
• Adjustments are made to goals, plans, or actions.
• Additional feedback is received.
• Additional adjustment takes place.

Control

To control, it is necessary to have a way of measuring performance and a standard to which that performance will be compared. The cost accounting system, when properly structured, provides a means of measuring cost performance. The standards for comparison can take many forms. The two most common comparisons are present versus past and actual versus budget.

Present-Versus-Past Comparison

Even the most rudimentary accounting systems permit a comparison of present to past costs for the same time period. If conditions are generally the same and the account breakdown is sufficiently detailed, this can be an effective control method. Even in the presence of other, more sophisticated techniques, a present-versus-past comparison is usually useful. Its usefulness is enhanced if trend lines are established that depict performance over a series of time periods.

The chief difficulty with using past performance as a standard is that there is no indication of what performance should have been. Historical data could represent excellent or poor performance. Unless past conditions are known, a standard may be adopted that contains inefficiency and extraordinary costs.

Although present-versus-past comparisons should not be dismissed entirely, they must be used with extreme caution and skepticism. They are most valuable when used in conjunction with other indicators.

Actual-Versus-Budget Comparison

Comparison of actual costs to budget is perhaps the most important technique available to the facilities manager. It is generally superior to comparisons against past performance because of the characteristics of budgets in general and the unique role they play in nonprofit organizations. When properly prepared, budgets represent the plan, stated in monetary terms, that has been formulated to meet the objectives of the organization. As such, they force the manager to anticipate changes.

In nonprofit organizations, budgets play an even more important role in management control. In such organizations, control is generally viewed to be more difficult because of the absence of profit as an objective, as a criterion for appraising alternative courses of action, and as a measure of performance. This shifts the focus from profits to plans and budgets and makes the budget the principal means of overall control.

When budgets are used, cost control will be much more effective if the cost accounting system is designed to be consistent with the budget, and vice versa. Unless the two are stated in the same terms and structured similarly, there is no way of determining whether spending occurred according to the budget plan. This does not mean that a budget should be set for each detail account, but it does mean that there should be accounts in the cost accounting system that match each line item in the budget so that a direct comparison can be made.

Types of Analysis

There are many different types of analysis that can be performed to get better insight into the effect of management on the institution’s financial performance. The most common ones are comparative analysis, constant dollar analysis, performance analysis, ratio analysis, variance analysis, and exception analysis.

Comparative Analysis

Comparative analysis involves comparing specific internally stipulated objectives against those of other similar institutions. However, because of the inconsistency of interinstitutional data, the validity of this technique is questionable. Most managers are interested in how their operations compare with those at other universities, or with the average of those at other universities, and seek performance measures common to all facilities. For example, the time required to run 100 ft. of electrical conduit can be measured on an absolute basis. The task should take the same amount of time anywhere, assuming that workers of equal ability do the job and similar conditions exist. However, few absolute measures exist against which actual performance can be compared. Most measurements are relative to past performance, are in index or ratio form, and are most meaningfully analyzed using trend lines and charts.

Every year, APPA: The Association of Higher Education Facilities Officers surveys its members and publishes the results in its Facilities Performance Indicators report (FPI.). The information reported by each participating institution includes the following:

• Full-time equivalent (FTE) student enrollment
• Total gross square footage of all buildings
• Gross square footage maintained in facilities budget
• Ground acreage
• Administrative cost per gross square foot
• FTE administrators
• Engineering cost per gross square foot
• FTE engineering personnel
• Maintenance cost per gross square foot
• FTE maintenance employees
• Custodial cost per gross square foot
• FTE custodial personnel
• Landscape and grounds cost per gross square foot
• FTE landscape and grounds personnel

The report presents this information in a format that permits comparisons. Managers can compare their institution’s performance with those of institutions of similar size, type, and educational purpose.

Other information, although not nearly as comprehensive as APPA’s report, is published periodically in various trade journals. For example, American School & University magazine annually publishes a maintenance and operations cost survey, with costs analyzed as follows:

• Custodial salaries, stated in dollars per student and per square foot
• Maintenance salaries, stated in dollars per student and per square foot
• Heat, other utilities, and other costs, stated in dollars and per square foot
• Average custodial and maintenance salaries
• Square feet per custodian
• The above data are presented for each of ten regions of the United States, including Alaska and Hawaii

At best, published indicators can serve only as a guide. Large differences are often noticeable, even among similar organizations. These wide variations reflect the differences not only in costs but also in methods of accounting for costs. For this reason, caution is required in using such comparative data.

A better approach to comparative analysis is benchmarking, which is discussed later in this chapter.

Constant-Dollar Analysis

This analysis is a primary concern for institutions and indicates the impact of inflation on the institution’s budget. These are several sources that can be used for comparison; an example is the Higher Education Price Index, from which an institution-specific cost index can be developed.

Performance Analysis

This analysis seeks to establish standards other than budgets against which to measure and compare actual performance. These standards are frequently nonmonetary and are intended to complement, not replace, budgets. In many cases, these standards provide the detail on which budgets are built.

Performance standards may be generated internally, or they may come from outside sources. Both are useful. Internal standards usually relate to the budget in some way or to an individual department’s unique goals and objectives. Examples of internal standards are the following:

• A 20-day backlog of work should be maintained at all times.
• Actual job costs should be within 10 percent of the estimates.
• Actual labor performance should be from 95 to 105 percent of standard labor.
• Energy use should not exceed 100,000 Btus per square foot per year.

Ratio Analysis

This constitutes trending ratios of key financial indicators over time to determine their stability or instability over time. The following are some examples of these ratios:

• Current asset/current liability
• Long-term asset/long-term liability
• Fund balances/debt
• Fund balances/types of expenditures and mandatory transfer
• Creditworthiness ratios
• Return-on-investment ratios

Variance Analysis

Deviation from a standard is known as variance. The standard can be historical data, comparable data from another university, or any other predetermined yardstick.

For cost control, it is of little use to know only the dollar amount of the variance, especially if many factors are at work to influence cost. To take effective action, it is necessary to break down the total difference into its individual elements using variance analysis.

There are basically two types of variance: price and quantity. Several other variances can be developed for specialized purposes, but each one is ultimately traceable to variations in price, variations in quantity used, or a combination of the two.

Any cost can be stated in terms of price and quantity, as follows:

Cost = Price x Quantity

If two costs are involved, one can be considered the standard and the other, the actual. The difference between them represents the variance. From this come the basic definitions of price and quantity variances:

• Price variance V_P = the difference between actual price (P_A) and standard price (P_S) multiplied by the actual quantity (Q_A):

• Quantity variance V_Q = the difference between actual quantity (Q_A) and standard quantity (Q_S) multiplied by the standard price (P_S):

Exception Analysis

A cost control system operated on the exception principle is one in which management’s attention is focused on the relatively small number of items for which actual performance is significantly different from the standard. This principle acknowledges that management time is a scarce resource that should be applied to problems that have the greatest impact on the organization. The relatively large number of minor variances from standard are either ignored or left to become the priority concern of a lower level manager in the responsibility accounting hierarchy.

Management by exception is implicitly based on Pareto’s Law. Vilfredo Pareto (1848–1923), an Italian economist and sociologist, first proposed the theory that in any type of activity, a small percentage of forces will influence a large percentage of results. This is also known as the 80-20 rule: 80 percent of any result is controlled by 20 percent of that which is producing the result. Management by exception focuses on the 20 percent of the deviations from standard that account for 80 percent of the problems.