Because of long-standing concerns over internal control weaknesses at state agencies, the Legislature passed Senate Bill 460 in 1995 to strengthen these controls. This legislation requires each agency head to periodically review the agency's system of internal control and report the results to the Department of Administration. However, many agencies have not complied with this law. Some agencies did not perform the required review, many did not report timely, and two did not report at all. The lack of compliance is caused, in part, by agencies not assigning a high priority to improving their internal control systems. In addition, the Department of Administration has not been effective in getting agencies to comply. The result of poor internal controls can be seen in recent audit reports that show how these weaknesses have cost the state millions of dollars. Because of the importance of improving internal control systems through periodic reviews and reporting, legislation is needed to hold agencies accountable for complying with the law.

Improvements are also needed to ensure the review and reporting process produces useful information. Although the Department of Administration has issued written instructions to assist agencies in this process, more specific guidance is needed. For instance, agencies were not instructed to maintain documentation supporting conclusions or explain how reviews were performed. In addition, agencies were not required to identify specific organizational units included in the review, and the instructions did not fully address internal controls over supervision. By improving the review and reporting process, results can more effectively be used to identify control weaknesses. With this knowledge, the State can take steps to strengthen its internal control systems.

• Some agencies do not review internal controls as required by law. Of four agencies we examined, one agency had not reviewed its system of internal controls. Furthermore, in their 1998 responses on internal controls, six agencies indicated management has not reviewed internal controls within the last two years. Several of these agencies dated their last review as 1995 or prior. (page 14)

• Many agencies are not submitting reports timely. In 1996, 55 percent of the agencies did not meet the statutory deadline of July 1. In addition, the Controller's Office and the Nevada Beef Council never submitted a report in 1996. Agencies did show some improvement in 1998; however, 36 percent still did not meet the statutory deadline. (page 15)

 
• Some agencies have not maintained documentation of internal control reviews. In addition, these agencies have not tested existing controls. Of the four agencies we examined, two did not maintain any documentation of reviews. Also, these same two agencies did not test their internal controls to ensure they were appropriate or followed by employees. Furthermore, another agency indicated they tested controls but did not maintain documentation that this occurred. (page 21)

• Some reports do not indicate if all organizational units are reported on. The Department of Employment, Training and Rehabilitation (DETR), and the Secretary of State's Office did not indicate which divisions were covered by the report. The Securities Division, which received $7 million in revenue in fiscal year 1998, was not included in the Secretary of State's report. In contrast, we identified other agencies that list each division or section that is included in the report. (page 21)

 
• Agency reports address only part of the supervision internal control standard--authorizing and reviewing the work of employees. Supervision includes more than this. It also requires supervisors to provide guidance and training to ensure errors, waste, and wrongful acts are minimized and specific management directives are achieved. Agencies have not reported on additional aspects of supervision because they were not required to by the Department of Administration. (page 22)

 3                 Require state agencies to indicate the organizational
                        units that are covered by the report on internal
                        controls.......................................................................................................................... X
 

 4                 Expand the report instructions to include additional
                        elements of supervision.............................................................................................. X
 

                                TOTALS                                                                                                                 4                         0