Standards for public agencies

2020 Edition

Financial Management (PA-FIN) 1: Internal Control Environment

An internal control system promotes sound financial practices and fosters a culture of accountability at all levels of the agency including mechanisms for:
  1. review and approval by agency leadership;
  2. conducting and/or participating in internal and external risk assessments, as applicable;
  3. management review by more than one individual;
  4. ensuring that management directives are carried out;
  5. prevention of error, mismanagement, or fraud; 
  6. safeguarding and verification of assets; and 
  7. conducting ongoing monitoring to assess the effectiveness of internal control procedures and policies.
NA The agency does not have a finance department.
2020 Edition




The agency's ability to achieve its mission is based on sound financial managment practices that ensure efficient, data-informed use of its resources in accord with applicable legal and regulatory requirements.
Example: Internal controls include "preventive" controls that address the question, "What could go wrong?” which are often part of an agency’s risk prevention and management activities. Internal controls also include "detective" controls which address the question, "What did go wrong?" which can be incorporated into an agency’s performance and quality improvement activities.
Full Implementation, Outstanding Performance
A rating of (1) indicates that the agency's practices fully meet the standard and reflect a high level of capacity.  
  • All elements or requirements outlined in the standard are evident in practice, with rare or no exceptions: exceptions do not impact service quality or agency performance. 
Substantial Implementation, Good Performance
A rating of (2) indicates that an agency's infrastructure and practices are basically sound but there is room for improvement.
  • The majority of the standards requirements have been met and the basic framework required by the standard has been implemented. 
  • Minor inconsistencies and not yet fully developed practices are noted; however, these do not significantly impact service quality or agency performance.

Partial Implementation, Concerning Performance
A rating of (3) indicates that the agency's observed infrastructure and/or practices require significant improvement.  

  • The agency has not implemented the basic framework of the standard but instead has in place only part of this framework.  
  • Omissions or exceptions to the practices outlined in the standard occur regularly, or practices are implemented in a cursory or haphazard manner.  
  • Service quality or agency functioning may be compromised.  
  • Capacity is at a basic level.
Unsatisfactory Implementation or Performance
A rating of (4) indicates that implementation of the standard is minimal or there is no evidence of implementation at all.  
  • The agency’s observed administration and management infrastructure and practices are weak or non-existent; or show signs of neglect, stagnation, or deterioration.
Self-Study EvidenceOn-Site EvidenceOn-Site Activities
County/Municipality Administered Agency, State Administered Agency (Central Office), or other Public Entity
  • Internal control procedures
State Administered Agency (Regional Office)
  • No Self-Study Evidence
No On-Site Evidence
County/Municipality Administered Agency, State Administered Agency (Central Office), or other Public Entity
  • Interviews may include:
    1. Fiscal authority
    2. Agency leadership
    3. CFO or equivalent
    4. Financial management personnel
State Administered Agency (Regional Office)
  • Interviews may include:
    1. Regional Director
    2. Financial management personnel