Who Is Really Responsible for TUSD’s Internal Control System?
Understanding the Responsibilities of the Governing Board, Superintendent, Chief Financial Officer, Department Managers, and Internal Audit
John C. Blackshire, Jr. The Accountware Group | November 2026
TUSD's recent $16.1 Million Financial Reporting Error highlights the lack of basic internal controls over financial reporting (ICFR) at the District. My observations during my time as a member of the TUSD Audit Committee was the current Governing Board, Superintendent and CFO do not understand their fiduciary duty to own and operate an effective comprehensive system of internal controls at the District.
The Tucson Unified School District (TUSD) manages substantial public resources, employs thousands of individuals, operates numerous schools, and delivers educational services to students throughout the Tucson community.
With those responsibilities comes an obligation to establish and maintain an effective system of internal control.
But who is actually responsible for that system?
Is it the Governing Board? The Superintendent? The Chief Financial Officer? The Internal Audit Department? Or the independent external auditors?
The answer is fundamental to understanding organizational governance:
TUSD management is responsible for establishing, implementing, operating, and maintaining the district's internal control system. The Governing Board is responsible for oversight, and Internal Audit provides independent assurance concerning the system's effectiveness.
These responsibilities are distinct. Confusing them can create significant gaps in accountability.
1. Internal Control Is a Management Responsibility
The Committee of Sponsoring Organizations of the Treadway Commission (COSO) defines internal control as a process effected by an organization's board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives relating to operations, reporting, and compliance.
This definition contains several important concepts.
Internal control is not simply a collection of accounting procedures. It is an organization-wide process involving leadership, personnel, policies, information systems, operating activities, and monitoring.
An effective internal control system helps an organization achieve three broad categories of objectives:
Operations: Effective and efficient use of resources, including safeguarding assets.
Reporting: Reliable, timely, and accurate financial and nonfinancial reporting.
Compliance: Adherence to applicable laws, regulations, policies, and contractual requirements.
For TUSD, internal control encompasses everything from student enrollment and payroll processing to procurement, transportation, grant administration, cash management, facilities, and financial reporting.
The responsibility for these controls rests with district management.
Internal Audit does not own them.
2. The Superintendent: Executive Accountability for Internal Control
As the district's chief executive administrator, the Superintendent has overarching management responsibility for ensuring that an effective internal control system is established and maintained throughout TUSD.
This responsibility includes establishing an organizational culture that emphasizes ethical conduct, financial accountability, transparency, and compliance.
The Superintendent should ensure that department leaders understand their internal control responsibilities and have the resources, authority, and accountability necessary to fulfill them.
An effective executive management process should address:
District-wide internal control policies and standards.
Assignment of responsibility for significant business processes.
Identification and evaluation of major operational and financial risks.
Communication of control responsibilities to department managers.
Monitoring of significant control deficiencies.
Timely implementation of corrective actions.
The Superintendent cannot reasonably perform every control activity personally.
However, delegating control responsibilities does not eliminate executive accountability for ensuring that an effective system exists.
Internal control is not something the Superintendent can delegate to Internal Audit and then consider the responsibility fulfilled.
3. The Chief Financial Officer: A Central Role in Financial Internal Controls
The Chief Financial Officer occupies a particularly important position within TUSD's internal control structure.
The CFO should have executive responsibility for the design, implementation, and monitoring of controls over the district's financial management activities.
These typically include:
Budget development and expenditure monitoring.
Cash management and liquidity forecasting.
Financial accounting and reporting.
Accounts payable and vendor payments.
Payroll and employee compensation.
Procurement and purchasing controls.
Grant accounting and financial compliance.
Capital assets and inventory accounting.
Financial reconciliations and general ledger integrity.
Prevention and detection of financial reporting errors and irregularities.
However, the CFO's responsibility extends beyond answering questions about financial statements or explaining accounting transactions.
The CFO should be able to explain how the district's financial internal control framework is designed, how management determines whether key controls are operating effectively, and how deficiencies are identified and corrected.
For example, when a district experiences delayed vendor payments, the CFO should be able to determine whether the cause involves insufficient liquidity, weak accounts payable procedures, approval bottlenecks, or other factors.
Similarly, when financial reconciliations are not being performed, management should determine why the control is missing and establish an effective corrective process.
A CFO's responsibility is not merely to report financial results. It is also to ensure that the financial processes producing those results are appropriately controlled.
This does not make the CFO solely responsible for every operational control across TUSD.
Transportation, human resources, information technology, facilities, and other department leaders retain responsibility for controls within their respective functions.
4. Department Managers: The Actual Owners of Internal Controls
The most important internal controls often operate at the departmental level.
Consider TUSD's Transportation Department.
The district's October 5, 2026, Transportation and Fuel Operations Internal Audit Report identified several issues involving operational processes and control activities.
These included missing monthly fuel reconciliations, weaknesses in vehicle parts inventory management, incomplete student bus badging, and insufficiently controlled changes to transportation schedules.
These findings illustrate why internal control cannot be managed exclusively from the CFO's office.
Transportation management should own the controls governing fuel consumption, inventory custody, vehicle maintenance, student transportation tracking, and routing decisions.
The CFO should establish appropriate financial control requirements and coordinate with Transportation management where those processes affect accounting, budgeting, expenditures, or financial reporting.
The Superintendent should ensure that the relevant executives are held accountable for correcting significant deficiencies.
The same principle applies throughout the district.
School principals, program directors, department heads, and other managers are responsible for the controls embedded in the activities they supervise.
The individuals who manage a business process should also be accountable for managing the risks and controls associated with that process.
5. The Governing Board: Oversight, Not Daily Control Operation
The TUSD Governing Board has an essential governance responsibility.
Its role is not to perform bank reconciliations, approve individual fuel transactions, or maintain purchasing records.
Those are management functions.
The Board's responsibility is to oversee management's establishment and maintenance of an effective internal control system.
Effective oversight requires more than receiving periodic financial statements.
The Governing Board should seek reasonable assurance that:
Management has established an appropriate internal control framework.
Significant financial, operational, and compliance risks are identified.
Responsibilities for key controls are clearly assigned.
Material control deficiencies are reported to appropriate governance authorities.
Management implements corrective actions in a timely manner.
Internal Audit has sufficient independence, authority, and resources.
Financial and operational reporting is reliable enough to support informed decisions.
The Board should also challenge management when significant deficiencies remain unresolved or when corrective actions are repeatedly delayed.
Importantly, oversight does not mean that the Board guarantees that every control will operate perfectly.
Internal control provides reasonable assurance, not absolute assurance.
Nevertheless, the Board must have a credible process for evaluating whether management is fulfilling its responsibilities.
6. The Audit Committee: An Important Link in the Governance Structure
A properly constituted Audit Committee can help the Governing Board discharge its oversight responsibilities.
The Audit Committee should provide focused attention to internal control, risk management, financial reporting, external auditing, and the internal audit function.
In particular, it should receive meaningful information about significant control deficiencies and management's plans for addressing them.
The Audit Committee should also evaluate whether the Internal Audit Department has sufficient organizational independence and access to the information necessary to perform its work.
Under the Institute of Internal Auditors' Global Internal Audit Standards, governance of the internal audit function includes responsibilities involving authorization, positioning, oversight, and support.
These standards distinguish the governing body's responsibilities from management's responsibilities.
The Audit Committee should not assume management's role in designing or operating controls.
Instead, it should evaluate whether management's control processes are appropriately designed, implemented, and monitored.
An Audit Committee that merely receives reports without tracking significant unresolved deficiencies may have limited effectiveness as an oversight mechanism.
7. Internal Audit: Independent Assurance, Not Ownership of Controls
One of the most common misunderstandings in organizational governance is the belief that Internal Audit is responsible for establishing the internal control system.
It is not.
Internal Audit evaluates the effectiveness of governance, risk management, and internal control processes.
Its responsibilities may include assessing whether:
Significant risks have been identified and evaluated.
Control activities are appropriately designed.
Controls operate as management intended.
Financial and operational information is reliable.
Laws, regulations, and policies are being followed.
Assets are adequately safeguarded.
Management has corrected previously identified deficiencies.
Internal auditors may provide advice about control design and improvements, provided they preserve their objectivity and do not assume management responsibilities.
But the distinction is critical.
If Internal Audit designs, operates, and approves the same controls it later audits, its independence and objectivity may be compromised.
The appropriate process is for Internal Audit to identify and communicate deficiencies, management to determine and implement corrective actions, and Internal Audit to evaluate whether those actions effectively address the risks.
Internal Audit should not become management's substitute for an effective internal control system.
8. External Auditors Have a Different Responsibility
External financial statement auditors also evaluate certain aspects of internal control, but their responsibilities are different from those of district management.
External auditors generally consider internal controls relevant to planning and performing a financial statement audit.
Depending on the engagement and applicable auditing standards, they may test selected controls and communicate identified deficiencies.
However, a financial statement audit does not necessarily provide an opinion on the effectiveness of the district's overall internal control system.
Even when external auditors identify control deficiencies, management remains responsible for correcting them.
An unmodified financial statement audit opinion should not be interpreted as proof that all financial, operational, and compliance controls are effective.
9. Entity-Level Controls: Where TUSD's Internal Control System Begins
The COSO Internal Control—Integrated Framework identifies five interconnected components:
The five components of the COSO Internal Control—Integrated Framework
These components operate together to support an effective internal control system.
For TUSD, entity-level controls are particularly important because they establish the district-wide environment in which departmental controls operate.
Examples include a code of conduct, clear organizational authority, executive risk assessment, district-wide financial policies, management performance monitoring, and processes for reporting significant control deficiencies.
Without effective entity-level controls, individual departments may develop inconsistent procedures, apply different risk tolerances, or fail to report emerging problems.
A district can have numerous detailed transaction controls and still experience significant governance problems if its overall control environment is weak.
This is why the Superintendent and CFO must understand internal control as a management system rather than merely an accounting function.
10. The Three Lines Model: Clarifying Responsibility
The Institute of Internal Auditors' Three Lines Model provides a useful way to distinguish management, oversight, and independent assurance responsibilities.
Responsibility | TUSD function |
Governing body | Governing Board, supported by the Audit Committee |
First line | School principals, department directors, and operational managers |
Second line | Financial oversight, compliance, risk management, and other management monitoring functions |
Third line | Internal Audit |
External assurance | External financial statement auditors and other independent reviewers |
The Superintendent and senior management coordinate and direct first- and second-line responsibilities.
The first and second lines are both part of management.
The third line provides independent assurance.
This structure helps explain why assigning internal control responsibility to Internal Audit is fundamentally inconsistent with effective governance.
The Internal Audit Department is intended to evaluate management's system, not operate it.
11. What TUSD Should Be Able to Demonstrate
A district-wide internal control system should be documented well enough that management and the Governing Board can answer several basic questions.
Who is responsible for the district's overall internal control framework?
What formal framework has management adopted?
How are significant risks identified and evaluated?
Who owns the key controls for each major business process?
How does management determine whether controls are operating effectively?
How are control deficiencies reported, prioritized, and corrected?
What information does the Audit Committee receive concerning unresolved deficiencies?
How does the Governing Board determine whether management's corrective actions have been effective?
These are not theoretical questions.
They concern the practical governance of public resources.
The October 2026 transportation audit provides a useful example. It identified missing reconciliations, inventory weaknesses, vendor payment delays, and opportunities to reduce significant expenditures.
The appropriate response requires more than acknowledging the audit findings.
Management should determine the causes, evaluate the associated risks, develop corrective actions, assign responsibility, and report progress.
Internal Audit should subsequently assess whether those actions addressed the identified risks.
The Governing Board and Audit Committee should oversee the process.
12. Accountability Cannot Be Delegated Away
An effective internal control system depends on clearly assigned responsibilities.
When those responsibilities become confused, organizations may experience predictable problems.
Department managers may assume the CFO is responsible for their controls.
The CFO may assume Internal Audit will identify significant weaknesses.
Internal Audit may issue reports without obtaining sufficiently specific management action plans.
The Audit Committee may assume management is addressing deficiencies.
The Governing Board may receive financial reports without understanding the control weaknesses affecting the underlying processes.
The result can be an organization in which everyone participates in the internal control process but no one clearly accepts responsibility for the overall system.
The solution is not to assign every control to one executive.
It is to establish a coordinated system of executive accountability, operational ownership, independent assurance, and governance oversight.
Conclusion: TUSD Management Owns Internal Control
The question of who is responsible for TUSD's internal control system has a clear answer.
The Superintendent has overarching executive accountability for ensuring the district maintains an effective internal control system. The CFO has a central responsibility for financial controls. Department managers own the controls within their operations. The Governing Board provides oversight, supported by the Audit Committee. Internal Audit independently evaluates the system.
These responsibilities should be understood, documented, and consistently exercised.
TUSD's financial and operational challenges make this distinction particularly important.
Internal auditors can identify weaknesses, evaluate risks, and provide valuable assurance.
External auditors can assess financial reporting risks and communicate deficiencies.
Audit committees can question management and monitor corrective actions.
But none of these functions replaces management's responsibility to establish and maintain effective controls.
The ultimate test of TUSD's internal control system is not how many audit reports are issued. It is whether management can demonstrate that significant risks are being identified, controls are operating effectively, and deficiencies are being corrected.
That is the accountability taxpayers, parents, employees, and the Governing Board should expect.
Comments