1. BACKGROUND:

Section 2800(1)(a)(9) and Section 2800(2)(a)(8) of Public Authorities Law require all public authorities to complete an annual assessment of the effectiveness of their internal control structures and procedures.

2. INTENT:

The intent of the Fulton County Industrial Development Agency’s (IDA) system of internal control shall be to:

1. Promote effective and efficient operations so as to help the IDA carry out its mission.
2. Provide reasonable assurance that the IDA’s assets are safeguarded  against inappropriate or unauthorized use.
3. Promote the accuracy and reliability of accounting data and financial reporting to ensure transactions are executed in accordance with the IDA’ Board’s authorization and recorded properly in accounting records.
4. Encourage adherence to the IDA Board’s policies and procedures for conducting programs and operations.
5. Ensure compliance with applicable laws and regulations.

This system of internal control includes performing an annual assessment to identify potential weaknesses in policies or procedures and to implement corrective actions.

This assessment shall identify significant weaknesses in controls, recognize emerging or inherent risks, and to enable early detection of existing or potential problems.

If an internal control system is working effectively, the IDA Board will have a reasonable indication of the reliability of its operating practices and the accuracy of the information it is using to measure its activities and performance. Any deficiencies identified as a result of the assessment shall be addressed by the IDA Board.

3. IDA’S INTERNAL CONTROLS ASSESSMENT PLAN:

 A. Define the IDA’s Primary Functions:

1. Annually review the mission of the IDA and verify that its primary  operating responsibilities, operations and functions that will help fulfill its mission.
2.  Annually evaluate the IDA’s written mission statement to ensure that it clearly defines the IDA’s purpose.
3. Define IDA’s objectives and ensure they are understood by IDA staff.
4. Review policies, procedures and guidelines to ensure that they guide IDA staff in the operations of the IDA and provide methods and procedures to assess the effectiveness of those functions.

B. Determine Risks:

1. Assess the internal and external risk exposure and associated vulnerability of each function of the IDA and assign a corresponding risk level (i.e. high, medium, or low).
2. If a risk is identified, the IDA Board shall determine how to best handle it by evaluating its significance, likelihood, and cause.
3. Based on the assigned risk levels, the IDA Board shall determine how frequently to review the controls in place for each function.

C. Review Existing Internal Control Systems in Place:

1. The IDA Board and staff shall annually review and be aware of the policies and practices in place to ensure that the IDA is effective and to address the risks that are relevant to the operation.

D. Assess the Extent to Which the Internal Control System is Effective:

1. The assessment of internal controls should be a structured and monitored process to identify and report any weaknesses of the internal control structure to the IDA Board.
2. This process should determine if the existing control structure and procedures are adequate, to then mitigate risk, minimize ineffectiveness and deter opportunities that could lead to the abuse of assets.
3. The assessment should provide the IDA Board with information as to whether the IDA’s policies and operating practices were understood and executed properly, and whether they are adequate to protect the  organization from waste, abuse, misconduct, or inefficiency.
4. This assessment shall be completed through a combination of inquiry and observation, a review of documents and records and by replicating transactions to test the sufficiency of the control system.

E. Take Corrective Action:

1. When a weakness is identified, a corrective action plan should be developed, adopted by the IDA Board and then monitored by the IDA Board to ensure that the vulnerability is addressed.

4. INTERNAL CONTROL CERTIFICATION:

A. Section 2800(2)(a)(8) of the Public Authorities Law:

1. To satisfy the requirement of Section 2800(2)( a)(8) of Public Authorities Law, the IDA shall incorporate, either within its annual report or as a separate document, a statement explaining that the authority has conducted a formal, documented process to assess the effectiveness of their internal control structure and procedures, and indicating whether
   or not the internal controls are adequate.
2. This statement should eventually be posted to the IDA’s website.
3. The statement shall state:
   

   “The IDA Board of Directors has documented and assessed the internal control structure and procedures off the Fulton County Industrial Development Agency for the year ending December 31, 2015. This assessment found the IDA’s internal controls were determined to be adequate, and to the extent that deficiencies were identified, the IDA has developed corrective action plans to reduce any corresponding risk.”

4. The IDA shall retain documentation to support the assessment of its internal controls.
5. If the IDA finds any deficiencies with the internal controls over its functions or operations, additional documentation should be maintained to demonstrate that the IDA has adopted corrective action plans to address these weaknesses.
6. This documentation should be made available upon request to the IDA’s independent auditor or to ABO compliance review staff.

B. Public Authorities Reporting Information System (PARIS):

1. As part of the PARIS Annual Report tab, the IDA will be required to indicate whether or not they have prepared this assessment and to provide the URL link to the statement, if available.

Approved by IDA Board of Directors on March 9, 2011.
Approved by IDA Board of Directors on March 23,2012.
Approved by IDA Board ofDirectors on January 31,2013.
Approved by IDA Board of Directors on January 14, 2014.
Approved by IDA Board ofDirectors on February 5, 2015.
Approved by IDA Board of Directors on January 6, 2016.