BOP Program Statement 8510.02 § 24

are common to any effective internal control system and must be a

part of all UNICOR internal control systems:

a. Documentation. Internal control procedures, policies,

authorities, and responsibilities must be clearly and adequately

documented. Once documented, they should be available to

personnel involved in their execution. Documentation usually

takes the form of operations manuals and organization charts

which describe and depict the roles and responsibilities of all

individuals engaged in the control system.

Proper documentation provide assurance that the method of, and

responsibility for, the following procedures is communicated

clearly and used as a valuable tool in training new employees.

Effective documentation must include a process for incorporating

system changes and communicating those changes to user personnel.

The process must include management approval of all system

changes.

b. Organizational Structure. Segregation of duties is

accomplished through well documented and communicated

organizational structures. Clearly established lines of

authority and responsibilities should be provided for each

operating activity (i.e., UNICOR corporate, program and field

location program/entity).

Position descriptions must be designed to define those

authorities and responsibilities clearly. Assigned authorities

and responsibilities should include requirements for complying

with UNICOR regulations and policies and should establish the

basic requirements for acceptable performance. The planned

PS 8510.02

1/21/2003

Page 16

process for evaluating the performance quality should be

described effectively in position descriptions.

To provide an effective internal control system, the

organizational structure must be designed to keep personnel from

taking advantage of their assigned responsibilities and

authority.

— Control and granting of transaction permissions within

FPI's automated system must be compatible with sound

internal control principles.

— No individual or small group of individuals should be

in a position to control all aspects of a transaction.

Responsibilities should be segregated and tasks so structured

that one individual or group of individuals does not perform more

than one "key" processing function or activity such as

authorizing, approving, certifying, accounting, or disbursing.

This involvement of various knowledgeable individuals in

processing transactions is essential to ensure the system’s

integrity and reliability.

— Staff assigning the permissions within the automated

system must maintain documentation supporting these

permissions.

c. Qualified Continuous Supervision. Qualified and continuous

supervision is essential to an effective system of internal

accounting and administrative control. Strict adherence to

established procedures is necessary to ensure agency management

that desired internal control procedures are being applied to

safeguard the agency’s resources.

d. Competent Personnel. Personnel should be competent, by

education, training, and experience, to execute the control

responsibility which they have been given. Unless personnel are

technically qualified to execute the responsibilities of their

positions in accordance with agency qualification standards,

agency heads cannot expect the effective execution of control

policies and procedures.