Internal Controls

University Policy: 04-005 Internal Controls
Last Revised:
Responsible Executive: Vice President for Finance and Administration
Responsible Office: Controller
Download the Policy: (PDF)
**The PDF is the official text of the policy. If there are any incongruities between the text of the HTML version and the text within the PDF file, the PDF will be considered accurate and overriding.**

1. Policy Statement

1.1. Oregon State University (“university”) shall establish and maintain an effective system of internal controls. Internal controls are designed to assure that the university meets its mission, promotes performance leading to effective accomplishment of objectives and goals, safeguards assets, provides accurate and reliable financial and other key data, promotes operational efficiency and economy, and encourages adherence to applicable laws, regulations, and prescribed management policies and practices. The control model for the university is the Integrated Framework of Internal Control as promulgated by the congressionally established Committee of Sponsoring Organizations (“COSO”).

2. Reason for Policy

2.1. This university policy is intended to ensure that the university has a system of accountability for and oversight of its operations, and to assist the university in reaching its goals and meeting its objectives.

3. Scope & Audience

3.1. This university policy applies to all university employees, contractors, and volunteers.

4. Definitions

4.1. Internal Control. A process, affected by the OSU Board of Trustees, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories:

4.1.1. Effectiveness and efficiency of operations;

4.1.2. Reliability of financial reporting; and,

4.1.3. Compliance with applicable laws and regulations.

5. Responsibilities & Procedures 

5.1. Guiding Principles

5.1.1. The university’s internal control and risk assessment practices shall help ensure that:

a. University activities and operations function effectively and efficiently;

b. University activities and operations comply with laws, regulations, and university policies and standards;

c. University processes result in accurate and reliable financial information and reports;

d. University resources are adequately protected;

e. All material risks facing the university, including, but not limited to, strategic, operational, financial, compliance, and reputational, are routinely identified and assessed, and appropriately managed;

f. Control activities and other mechanisms are proactively designed to address and manage significant risks;

g. Information critical to identifying risks and meeting the university’s mission and strategic objectives is communicated through established channels throughout the university; and,

h. Controls are monitored and identified problems are addressed in a timely manner.

5.2. OSU’s Adopted Internal Control Elements

5.2.1. The internal control system for the university is to utilize the COSO model, which includes Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring, as described in this section.

5.2.2. Control Environment. The control environment sets the tone of an organization, influencing the control consciousness of its people. It is the foundation for all other components of internal control, providing discipline and structure. It is the foundation for all other components of internal control, providing discipline and structure. Control environment factors include the integrity, ethical values, and competence of the entity's people; management's philosophy and operating style; the way management assigns authority and responsibility, and organizes and develops its people; and the attention and direction provided by the board of directors.

5.2.3. Risk Assessment. Every entity faces a variety of risks from internal and external sources that must be assessed. A precondition to risk assessment is establishment of objectives, linked at different levels and internally consistent. Risk assessment is the identification and analysis of relevant risks to the achievement of objectives, forming a basis for determining how the risks should be managed. Because economic, industry, regulatory, and operating conditions will continue to change, mechanisms are needed to identify and deal with the special risks associated with change.

5.2.4. Control Activities. Control activities are the policies and procedures that help ensure management directives are carried out. They help ensure that necessary actions are taken to address risks to the achievement of objectives. Control activities occur throughout the organization, at all levels and in all functions. They include a range of activities as diverse as approvals, authorizations, verifications, reconciliations, reviews of operating performance, security of assets, and segregation of duties.

5.2.5. Information and Communication. Pertinent information must be identified, captured, and communicated in a form and timeframe that enable people to carry out their responsibilities. Information systems produce reports containing operational, financial, and compliance-related information that make it possible to run and control the university’s business. They deal not only with internally generated data, but also information about external events, activities, and conditions necessary to informed business decision-making and external reporting. Effective communication also must occur in a broader sense, flowing down, across, and up the organization. All personnel must receive a clear message from top management that control responsibilities must be taken seriously. They must understand their own role in the internal control system, as well as how individual activities relate to the work of others. They must have a means of communicating significant information upstream. There also needs to be effective communication with external parties, such as customers, suppliers, regulators, and shareholders.

5.2.6. Monitoring. A process that assesses the quality of the internal control system over time. This is accomplished through ongoing monitoring activities, separate evaluations, or a combination of the two. Ongoing monitoring occurs in the course of operations. It includes regular management and supervisory activities and other actions personnel take in performing their duties. The scope and frequency of separate evaluations will depend primarily on an assessment of risks and the effectiveness of ongoing monitoring procedures.

5.3. University President

5.3.1. The university president, through directed leadership, shared values, and a culture that emphasizes accountability, is responsible for ensuring that an effective internal control system is established and maintained for the university. The president shall be responsible to the OSU Board of Trustees for the faithful execution of this policy, consistent with the other policies of the Board and applicable law.

6. Forms & Tools 

6.1. None.

7. Frequently Asked Questions

7.1. None.

8. Related Information

8.1. Committee of Sponsoring Organizations (“COSO”):

8.2. OSU Office of Audit, Risk and Compliance:

9. History

9.1. Adopted by OSU: July 1, 2014

9.2. Amendment: Housekeeping, September 27, 2019

9.3. Reviewed: October 18, 2022.

9.4  Next scheduled review date: October 2027.

10. Website

10.1. University Policy 04-005 Internal Controls:

11. Contacts

Controller's Office