Chief Audit Executive Roundtable and Discussion. Association of Healthcare Internal Auditors 2010 Annual Conference

Transcription

1 Chief Audit Executive Roundtable and Discussion 2010 Annual Conference

2 Official Disclaimer The views expressed in this presentation and the accompanying materials are solely that of the authors and should not be represented as the policy or opinion of either the MultiCare Health System, Providence Health & Services, Johns Hopkins Medicine, or Select Medical Corporation Annual Conference 2

3 The Panelists Gary Flaming Providence Health & Services Frank Bossle Johns Hopkins Institutions Bob Breighner Select Medical Corporation Catherine Wakefield MultiCareHealth System 2010 Annual Conference 3

4 Introductions Providence Health & Services Johns Hopkins Select Medical Corporation MultiCare Health hsystem 2010 Annual Conference 4

5 Gary Flaming, CPA Vice President Integrity, Compliance & Audit Services Providence Health & Services 3601 SW Murray Blvd., Suite 130 Beaverton, OR g g 2010 Annual Conference 5

6 PH&S Statistical Overview Serving Alaska,Washington, Montana, Oregon & California 26 Hospitals > 35 Non-Acute Facilities Physician Clinics Health Plan (379,000 members) Liberal Arts University High school Home Health/Hospice Occupational Health 52,000 employees Annual Net Revenues $7.8 Billion Licensed Beds Acute 5,314 Long-term Care 1, Annual Conference 6

7 PH&S Locations 2010 Annual Conference 7

8 PH&S Staffing Integrity, Compliance & Internal Audit (32) Privacy (26) 2 Directors 1 Director 5 Managers 11 Managers 20 Auditors 10 Specialists 3 IT Auditors 2 Compliance Auditors 2 CAAT Specialist 2 Analysts Compliance & Audit (3) 2 Directors Other Staff: 1 Vice President 1 Training Manager 6 Support Staff 2010 Annual Conference 8

9 Johns Hopkins Frank Bossle Executive Director Office of Hopkins Internal Audits Annual Conference 9

10 Johns Hopkins Institutions The University and Health System are separate legal entities: Large research intensive university Four hospital health system Combined revenue of approximately $7 billion; largest private employer in Maryland. Office of Hopkins Internal Audits covers both entities 2010 Annual Conference 10

11 Hopkins Internal Audits Total staff is 26: Executive Director and two admin assistants Ten person team that focuses on healthcare delivery Six person team that focuses primarily on research administration Six person IT audit team One investigator 2010 Annual Conference 11

12 Hopkins Scope of Responsibility Process audits of core financial and operational processes across all entities Example: Surgical and Anesthesiology operations, with emphasis on charge capture Compliance is separate for both University and Health System Emerging role in Enterprise Risk Management 2010 Annual Conference 12

13 Bob Breighner, Compliance Officer Vice President, Compliance and Audit Services 13 Select Medical Corp Gettysburg Road Mechanicsburg, PA Annual Conference 13

14 Select Medical Company Statistical Overview Department Staffing Department Scope of Audits OtherDuties as Assigned 2010 Annual Conference 14

15 Select Medical Statistical Overview 89 Long Term Acute Care Hospitals (Select Specialty Hospitals in 25 states) 6 Acute Medical Rehab Hospitals (Kessler Rehab, Penn State Hershey Rehab, and SSM) 959 Outpatient Rehabilitation Clinics (NovaCare, Select Physical Therapy, Kessler Rehabilitation, and KORT in 36 states and D.C.) Medical rehabilitation services on a contract basis at nursing homes, assisted living and senior care centers, schools and worksites. Annual Net Revenues $2.2 2 billion 23,500 Employees 2010 Annual Conference 15

16 Select Medical Staffing Corporate Compliance Director, Clinical Compliance 2 Clinical Compliance Specialists Manager, Training and Education Training Coordinator Internal Audit Director 2 Financial Auditors 3 Clinical Auditors 2010 Annual Conference 16

17 Select Medical Scope of Audits Compliance Compliance Audits OIG Work Plan Monitoring Exclusion Monitoring Coding Audits Outpatient (internal) Inpatient (Outsourced) Internal Audits Compliance (physician contracts, licensure, credentialing, documentation and billing) SOX and Ops (integrated financial and operational by cycle) l) External Audit assistance Monitoring Billing outliers Utilization outliers Vendor/Employee matches Sr. Mgmt Expense Reports 2010 Annual Conference 17

18 Catherine Wakefield, kf CPA, CIA, CHC, FHFMA Vice President, Corp Compliance and Internal Audit MultiCare Health System 737 Fawcett, PO Box 5299 MS CCIA Tacoma, WA Catherine.wakefield@multicare.org 2010 Annual Conference 18

19 MultiCare Health System Company Statistical Overview Department Staffing Department Scope of Audits OtherDuties as Assigned 2010 Annual Conference 19

20 MHS Statistical Overview Serving the S. Puget Sound 1 Pediatric & 3 Adult Hospitals 344 Employed Providers (FTEs) Primary Care Adult & Pediatrics Only Pediatric Hospital in Southwest Washington Fellows / Residents Pediatric & Adult Hospitalists Level II Pediatric & Adult Trauma Centers Surgicalists Pediatric Specialists Only Level III NICU in Pierce County Adult Specialists 818 Licensed Beds Pulmonologists 7 Outpatient Surgery Centers Oncologists Annual Net Revenues $1.4 billion Orthopedic Surgeons Urologists 3 Foundations with a combined annual fund raising of more than Perinatologists $20.1 million in 2008 (annual average 2 Multi-Specialty Medical Centers of $15 million over 5 years) 7 Urgent Care Centers 9,100 Employees 2 MultiCare Express Retail Clinics Home Health/Hospice Occupational Health 2010 Annual Conference 20

21 Location & Delivery Sites Gig Harbor Multi-specialty Tacoma General & Mary Bridge Children s Hospitals I-5 Covington Multi-Specialty Medical Center Medical Center 169 Allenmore Hospital I Good Samaritan Hospital 2010 Annual Conference Legend Hospitals Multi-specialty Medical Centers Primary Care Clinics 21

22 MHS CCIA Staffing Corporate Compliance Manager Specialist 2 Compliance Auditors 1 Nurse Auditor 1 Pharmacy Auditor Internal Audit Manager 3 Auditors 1 Audit Assistant 1 IT Auditor 1 Sr Data Analyst Other Staff: 1 HIPAA Privacy Consultant 1 Contracts Administrator 1 Executive Assistant 1 VP 2010 Annual Conference 22

23 MHS CCIA Scope of Audits Compliance Compliance Audits Facility and other regulatory audits Security Audits OIG Work Plan Monitoring Coding Audits (out sourced) Other Contracted Audits Payment Card Industry Medical Claims Audits Selected AP Recovery Audits Internal Audits Internal Audits (Fin & Op) Construction (co sourced) IT Audits System Install Readiness Assessments ( day) Charge Capture Monitoring Cash Spot Audits Ghost Vendors/Employees Excluded Providers 2010 Annual Conference 23

24 MHS Other Duties as Assigned Sarbanes Oxley Internal Controls documentation Recovery Audit Contractors (and other government audits) Financial Statement review External Auditor support Enterprise Risk Management 2010 Annual Conference 24

25 Discussion Topics and Leaders 1. Internal Auditing of the Future Gary Flaming 2. ERM and Risk Assessments Frank Bossle 3. Compliance and Internal Audit Together or Separate Bob bbreighner 4. IIA Professional Standards and Quality Reviews Catherine Wakefield 5. Audit Committee Reporting Group 2010 Annual Conference 25

26 1. Internal Auditing in the Future 2010 Annual Conference 26

27 1. Predictions Enterprise Risk Management Audit Scope Auditor Skills Types of Audits Audit Duration 2010 Annual Conference 27

28 1. Enterprise Risk Management Boards will get more involved Finance and internal audit will lead the charge No standard healthcare methodology in < 5 yrs 2010 Annual Conference 28

29 1. Audit Scope Totally driven off of risks Many traditional audit steps will be dropped Results in shorter reports 2010 Annual Conference 29

30 1. Auditor Skills Expansion of skills needed for Internal Audit Financial (can t skip the basics) Nurses Coders IT specialists CAAT specialists Construction specialists Certification will remain important 2010 Annual Conference 30

31 1. Types of Audits Core financial i audits remain Special areas of emphasis Quality Compliance IT Security Construction 2010 Annual Conference 31

32 1. Audit Duration Shorten audits to increase coverage 2010 Annual Conference 32

33 1. Internal Audit in the Future Predictions about the future of internal audit from other panelists: Frank Bossle Johns Hopkins Medical Institute Bob Breighner Select Medical Corporation Catherine Wakefield MultiCare Health System 2010 Annual Conference 33

34 2. Enterprise Risk Mgmt and Risk Assessments Current state: Trustees expect management to manage risks Trustees do not feel engaged in understanding and discussing risks Risk is managed in silos Trustees directed management to derive a meaningful approach to ERM 2010 Annual Conference 34

35 2. Approach to Starting ERM Research among peers a few standouts were far ahead! Cataloging risks generic risk assessment did not capture meaningful risks Top down identification of most significant risks Bottoms up approach at a smaller Hopkins entity 2010 Annual Conference 35

36 2. Subcommittee The Audit Committee Chair appointed a subcommittee that include chairs of Finance and Facilities committees Engage them in discussion about approaches Tentative approval to proceed, with no incremental cost, and one year reauthorization 2010 Annual Conference 36

37 2. Starting the Process Risk Oversight Committee comprised of senior leaders Brief overview of most significant risks, with examples, mitigation, reaction to adverse occurrences Overview to be shared with applicable trustee 2010 Annual Conference 37

38 2. ERM Could Change Internal Audit s focus Many of the major risks are things we have never audited, such as faculty/physician retention We may be auditing the mitigation strategies to make sure they are effective and operating as intended Annual Conference 38

39 2. Enterprise Risk Mgmt and Risk Assessments Input and feedback on ERM and Risk Assessments from other panelists: Bob Breighner Select Medical Corporation Catherine Wakefield MultiCare Health System Gary Flaming Providence Health System 2010 Annual Conference 39

40 3. Compliance and Internal Audit Separate or Combined? Combined information sharing of trend data Compliance modify training to address audit issues Audit modify testing to address compliance trends Separate maintain independence of investigations and compliance calls 2010 Annual Conference 40

41 3. Assistance to External Auditors? How many hours provided? Internal Audit staff have better understanding of operations Internal laudit staff tfflearn more about tthe Bl Balance Sheet and can transfer knowledge to operational audits Internal Auditstaff typically havelonger tenureand provide consistency Internal Audit staff typically y have access to internal systems minimizing disruption to Accounting staff Internal Audit staff pulled away from other aspects of the Audit work plan 2010 Annual Conference 41

42 3. Compliance and Internal Audit Separate or Combined? The panelists perspective on Compliance and Internal Audit: Catherine Wakefield MultiCare Health System Gary Flaming Providence Health System Frank Bossle Johns Hopkins University 2010 Annual Conference 42

43 4. IIA Quality Assurance Review and Professional Certification Do you adhere to IIA Professional Practice Standards? Does it matter? Does your Board expect it? What education have you provided d on this? Have you had a Quality Assurance Review? Have you completed a self assessment? What did you learn? How did it add value to your department? 2010 Annual Conference 43

44 4. IIA Quality Assurance Review and Professional Certification Are you certified and do you encourage certification for your staff? Is a CIA a required certification in your job descriptions? At what level? How does certification add value to your department? 2010 Annual Conference 44

45 4. IIA Quality Assurance Review and Professional Certification Input from the panel on Quality Assurance Reviews and Professional Certifications: Gary Flaming Providence Health System Frank Bossle Johns Hopkins University Bob Breighner Select Medical Corporation 2010 Annual Conference 45

46 5. Audit Committee Reporting What types of reports are provided d to the Audit Committee? What is the level of detail provided? Who typically makes presentations to the Audit Committee? What gets reported routinely (at every Audit Committee meeting) vs. what gets reported occasionally or on ad hoc basis? What is the Management representation at the Audit Committee meetings? 2010 Annual Conference 46

47 5. Audit Committee Reporting Who typically attends the Audit Committee meetings? How large is theauditcommittee? Andhow often does it meet? How long are the meetings? Has theaudit Committee asked for new types of reports in the past year? What sorts of information has the Committee requested? 2010 Annual Conference 47

48 5. Audit Committee Reporting Input from the panel on Audit Committee Reporting: Catherine Wakefield MultiCare Health System Gary Flaming Providence Health System Frank Bossle Johns Hopkins University Bob Breighner Select Medical Corporation 2010 Annual Conference 48

49 Questions? Thank you Annual Conference 49