N.Y. Comp. Codes R. & Regs. tit. 2, § 6.6 – Certification of internal controls over the payment process.

(a) Each agency must maintain adequate internal controls over the payment process to support the validity of the agency claim certification. The agency should establish sufficient internal controls over claims processing to ensure claims are appropriate to pay. These controls must include, but are not limited to, the following:
1. (1) to the extent feasible, separation of duties relating to vendor registration, ordering, receiving and payment functions;
2. (2) to the extent feasible, separation of on-line data entry of claims from claim certification functions; and
3. (3) security over authorized access to agency controlled systems in the form of operator identification and passwords.
(b) The commissioner or head of each agency will be required, annually or upon change of commissioner or agency head, to submit an internal controls certification to the Comptroller's office certifying that the agency has established such a system of internal controls over the payment process.