Internal Controls 101 June 23, 2011

Internal Controls 101June 23, 2011

Introductions Tim Waterman – General Dynamics Advanced Information Systems (GDAIS) Keith Rivers – United Technologies (UTC) Sam Onwuanaibe - Harris Corporation Benjamin Lindorf - Institute for Defense Analyses

General Dynamics Advanced Information Systems Delivering end-to-end intelligence and cyber mission integration and solutions to defense, intelligence and homeland security communities Over 7,200 employees 75% hold security clearances Headquarters in Fairfax, VA Many locations including customer sites

Internal Controls Internal controls are designed to provide reasonable assurance that objectives are achieved in the following categories: Effectiveness and efficiency of operations Compliance with laws and regulations Reliability of financial reporting = Sarbanes Oxley Internal controls are evaluated at two levels: Entity-level (contains control environment) Activity-level (transaction-level) Examples of each on the following slide

Internal Controls (cont.) Internal controls are evaluated at two levels: Entity-level Example The company has policies and procedures for all major business processes, they are reviewed on a regular basis and updated, if necessary. All policies and procedures are located on the Company's intranet and are accessible by all employees. Activity-level (transaction-level) Example Each timecard is approved by the employee’s supervisor, or designated alternate in the event of supervisor absence.

Life Cycle of an Internal Control

Life Cycle of an Internal Control (cont.) Example of Vendor Management Controls Risk = Fictitious vendors are input to the system, allowing for fictitious cash disbursements Control #1 = New vendors are added in Oracle by the Purchasing department and the accounts payable department has inquiry only access to this vendor information Control #2 = Oracle only allows the user (accounts payable department) to pay an established vendor

Examples of GD Controls Ethics Controls: There is an Ethics Officer at CHQ and at each business unit There is an Ethics Helpline to facilitate anonymous reports The organization publicizes the existence and importance of the GD Standards of Business Ethics and Conduct to employees on an annual basis All new hires complete an Ethics Acknowledgement Form, which acknowledges that the employee has received and read the GD Standards of Business Ethics and Conduct Employees are required to participate in ethics training every other year Corporate Internal Audit performs implementation and follow-up reviews of each of the Ethics Programs

Examples of GD Controls Other Controls: Each business unit and Corporate Internal Audit conducts a detailed annual Risk Assessment that is updated periodically throughout the year All finance new hires have a background and credit check completed prior to start date (background check for all new hires) Each business unit has created its own Delegation of Authority (DOA) subject to the CHQ DOA, and is used to scrutinize transactions in the conduct of its business The company has policies and procedures for all major business processes Policies and procedures are reviewed on a regular basis and updated, if necessary All policies and procedures are located on the Company’s intranet, or equivalent, and are accessible by employees

Internal Controls 101 June 23, 2011