According to Florida Statutes:

• “Fraud” means obtaining something of value through willful misrepresentation, including, but not limited to, intentional misstatements or intentional omissions of amounts or disclosures in financial statements to deceive users of financial statements, theft of an entity’s assets, bribery, or the use of one’s position for personal enrichment through the deliberate misuse or misapplication of an organization’s resources.
• “Waste” means the act of using or expending resources unreasonably, carelessly, extravagantly, or for no useful purpose.
• “Abuse” means behavior that is deficient or improper when compared with behavior that a prudent person would consider a reasonable and necessary operational practice given the facts and circumstances. The term includes the misuse of authority or position for personal gain.

• Directive controls ensure a particular outcome is achieved. Examples include guidelines, training and incentives.
• Preventive controls are designed to reduce the chance that errors or irregularities may occur. For example, reading and understanding policies and procedures or approving payments before they are processed. Additional examples include the tone at the top, authorization, segregation of duties and password protection.
• Detective controls are designed to detect errors or irregularities after they have occurred so they can be corrected. Examples include reconciling the bank statement and performing periodic inventories of equipment.
• Corrective (or compensating) controls correct undesirable outcomes that have occurred or reduce risk to an acceptable level when other controls have failed or are not cost-effective. Examples include close supervision and management review.
• Everyone plays a part in the district’s internal control system. Management ensures that controls are in place and every employee makes sure the internal control system functions by following the controls and reporting any breakdowns in them. Internal Audit examines the adequacy and effectiveness of the district’s internal controls and makes recommendations where control improvements are needed.

• Risk assessment
  Managers should identify and analyze relevant risks to the achievement of business unit goals and objectives by determining what could go wrong, what areas have more risk, what assets are at risk, and who is in positions of risk. Risks may include:
  • Damage to reputation and public image
  • Revenues not received
  • Assets not used efficiently
  • Assets not used properly
  • Assets diverted to outside or personal use
  • Unreliable, untimely or unavailable information needed for decision making
• Reasonable assurance
   Internal controls should provide reasonable assurance that the objectives of the systems will be accomplished.
• Supportive attitude
  Managers and employees should maintain and demonstrate a positive and supportive attitude towards internal controls at all times.
• Competent personnel
  Managers and employees should have personal and professional integrity and maintain a level of competence that allows them to accomplish their assigned duties. They should also understand the importance of establishing and implementing good internal controls. 
  • Personal and professional integrity is demonstrated when you: 
    • Commit to honesty and fairness
    • Respect the organization and authority
    • Adhere to laws and policies
    • Respect the rights of all employees
    • Commit to excellence
    • Control objectives

Internal control systems should help assure compliance with laws and that the district is meeting its goals and objectives based on risk assessments 

• Control techniques
  • These are the means by which we accomplish the objectives of internal control systems.
  • Our specific standards of internal control involve the following techniques:
  • Documentation – adequate records of all internal control systems and all transactions and events should be maintained.
  • Records – all transactions and events should be recorded promptly and accurately.
  • Authorization – all transactions and events should be authorized and executed by persons within the scope of their authority.
  • Structure – key duties and responsibilities in authorizing, processing, recording and reviewing transactions should be separated.
  • Supervision – adequate supervision should be provided to ensure that internal control objectives are achieved.
  • Security – access and accountability for assets and records should be limited to authorized individuals.

• Where there is an inadequate segregation of duties
• Where there is inappropriate access to assets
• Where there is inadequate knowledge of district policies and procedures
• Where control procedures are performed in a perfunctory manner (as when a reviewing manager signs a document without adequate review and evaluation)
• Where controls are overridden
• Where inherent limitations cannot be overcome by compensating controls

The Association of Certified Fraud Examiners’ (ACFE) Report to the Nations, 2024 Global Study on Occupational Fraud and Abuse noted more than HALF of fraud cases occurred due to lack of internal controls or override of existing controls. Tips are the most common initial detection method by a wide margin with more than half of the tips coming from employees and nearly one-third coming from vendors and customers. The presence of anti-fraud controls is associated with lower fraud costs and quicker fraud detection.

The report noted that, aside from a lack of internal controls in the first place, a large percentage of frauds attributed to internal control weaknesses were due to overrides of existing controls and lack of management review. This is why the district’s internal control program is critically important. Employees and managers should ensure that controls are not overridden and managers should never take shortcuts in their review responsibilities. Additionally, managers should encourage employees to speak up if they believe something is wrong.