As a research institution leader, have you ever found yourself part of an internal audit or compliance review, and the term "internal controls" left you puzzled? Or perhaps you've received an internal audit report or read an Office of Inspector General (OIG) report that flagged "internal control breakdown" as an issue, but the report's message didn't quite click? If so, you’re not alone in this experience.
The world of research administration professionals responsible for research operations management and compliance revolves around internal controls and compliance frameworks. Your mission is to ensure your organizations meet their operational and strategic goals and adhere to compliance requirements. Internal control structures are the backbone of efficient, effective and compliant operations, supporting these objectives’ achievement across research administration and compliance.
When internal or external auditors engage with your department or unit during an audit or review, they often request and discuss various internal controls elements, such as roles and responsibilities, policies and procedures, process flows, internal controls matrices and various documentation. These components collectively make up the internal controls system. These assessments aim to evaluate how well controls function and offer feedback on how effectively your organization manages sponsored research and program funds and activities.
While terms like "internal controls" and related concepts come naturally to some, they may not be as familiar to everyone. In this article, we interpret these concepts. We will explain what internal controls are, why they are necessary, delve into their implementation in research administration and compliance, identify common areas where problems arise (and where risks are exposed), and offer suggestions from both internal audit and compliance perspectives to balance process with resources.
Part II of this article will be featured in NCURA Magazine’s December 2024 issue. It will dive deeper into:
