UC San Diego SearchMenu

How to Complete Key Control Documentation

Learn how to fill out the Department Key Controls Document, which provides documentation that departments are performing the controls required by SAS 112 audit standards.

Download the form

Use this form to document key control activities: UCSD Department Key Control Documentation (Word file).

This following information gives guidance on how to use the form. For background on key controls and their documentation, or to learn why it's important, see Documenting Your Department's Key Controls.

Who's responsible

Effective internal controls include the proper segregation of tasks. No one person should have complete control of any activity. While there may be situations due to staffing or resources that prevent this, make every effort to maintain separation of duties.

  • Performers are responsible for completing the functions described on the form. Performers should not certify their own work.
  • Certifiers (department head, DBO, or MSO) verify that the function has been performed appropriately and within the prescribed accounting period. It may be appropriate to delegate this activity, but department heads are still responsible for ensuring it is completed. Contact the Controller's Office if you have questions about delegation.

Note: Department managers or delegated staff may use the Internal Key Controls Checklist (Excel) as a more manageable avenue to track and review department-wide controls. This does not replace the need to document performance and certifications on the UCSD Department Key Controls Document.

When key controls should be performed

Key controls activity should occur on a regular and periodic basis to demonstrate that the controls are working properly. Use the following guidelines:

  • Monthly activities: Conducted 12 times a fiscal year. Should occur as soon after the operating ledger closing date as possible and no later than 30 days afterward.
  • Quarterly activities: Conducted 4 times a fiscal year. Should occur as soon after the September, December, March, and June final ledgers close as possible and no later than 30 days afterward.
  • Annual activities: Conducted one time during the fiscal year. Should be performed as soon as the June final ledgers are available, and no later than 60 days afterward (usually around late August).

Completing the form

Document by filling in the following fields each time you perform a key control:

  • Accounting Period: The period of time that the key control represents (month, quarter, or year).
  • Department/Division: The entity (project, index, or organization code) or area that is being reviewed and certified.
  • Performed by/date: The person who performed the control activity (performer) and the date performed.
  • Officer Certified/date: The department head, DBO, or MSO who made sure the control was performed (certifier) and when certified.
  • Comments: Anything additional that needs to be communicated
  • Evidence of Review: Select the way that the specified control function was performed.

Retention

Once the key controls have been performed and verified, keep the signed document in a central place where where you can access it in case the Office of the Controller or an auditor needs to review it.

Other documentation methods

Although other methods to document several control activities are available using Web-based financial systems, document the certification of such controls on the UCSD Department Key Controls Documentation form. This allows department heads, MSOs, and DBOs to better manage their areas to assure that all key controls are performed and any issues documented.