ACUIA October Office of the Utah Legislative Auditor General. Examples of High Impact Auditing. High Impact Auditing

Transcription

1 Office of the Utah Legislative Auditor General ACUIA October 2015 High Impact Auditing Examples of High Impact Auditing Slide 2 Auditing for Impact May Be Difficult Sometimes Slide 3 1

2 Risk Definition: The possibility of an event occurring that will have an impact on the achievement of objectives and it is measured in terms of impact and likelihood FOR MORE INFORMATION Performance Auditing: A Measurement Approach Slide 4 Risk Assessment Definition: The determination of quantitative or qualitative value of risk related to a concrete situation and a recognized threat FOR MORE INFORMATION Performance Auditing: A Measurement Approach Slide 5 Risk Assessment Goal To prioritize internal audit activities on the basis of the most significant risks. The risk assessment process entails a systematic review of the risks facing an organization. Slide 6 2

3 Auditing for Impact May Be Difficult Sometimes Slide 7 Our Business Model: Attributes of a Finding Condition What is happening? Criteria What should be happening? Cause What created the condition? Effect What is the impact of the condition? Recommendation What should be done? (corrective or preventative action) Slide 8 Criteria & Effect Relationship Weakest Effect Weakest Criteria Laws or Mission Statements Industry or Professional Standards Historical Data or Goals & Objectives Expert Opinion Prudent Business Practices Auditor Opinion No Significant Impact Implied Savings Small Dollar Impact Improved Services Large Dollar Impact Loss of Life or Public Danger Strongest Effect Slide 9 3

4 Identify Additional Risk Areas School Busing Slide 10 Identify Additional Risk Areas School Busing Audit request was to evaluate the financial operations of School Busing Risk Assessment Bus Drivers Big Concern Found drivers with criminal histories and driving records that should have prevented them from transporting children Led to a recommendation of an audit of background check procedures for all of public education Found public educators with criminal histories ranging from felony drug convictions to felony sex assault Slide 11 Identify Additional Risk Areas School Busing Audit request was to evaluate the financial operations of School Busing Data used to reimburse busing costs needed to be revamped School districts buying bigger more expensive buses than necessary Utilization and depreciation of buses needed to be revisited School districts not paying their fair share of transportation costs Bus usage needed to be addressed Insurance not adequate over state lines Slide 12 4

5 Be Independent - DABC Audit request was for us to look at operations because they had not been audited since the early 1980s, but thought nothing wrong Slide 13 Listen, But Don t Be Fooled And Follow The Documentation Slide 14 Listen, But Don t Be Fooled And Follow The Documentation Selected highlights from May & October 2010 audit: DABC did not adequately consider alternatives to budget cuts & used made up numbers DABC Commission had habitually violated open meeting laws, organization had significant conflicts of interests, and lacked any sort of business planning Slide 15 5

6 Listen, But Don t Be Fooled And Follow The Documentation Slide 16 Sometimes Management Is The Problem Slide 17 Sometimes Management Is The Problem Selected highlights from May and October 2011 audits: Poor management contributed to increased state losses and management tried to conceal the issues DABC had been incompetently managed DABC had been rigging bids and falsifying financial documentation and artificially splitting invoices in violation of state law Business done with DABC Directors son was potentially illegal DABC management failed to ensure oversight of financial affairs Other management practices were inappropriate and questionable Slide 18 6

7 Relationship with Auditee What Does This Mean? Slide 19 Radiation Control Audit Slide 20 UTA Slide 21 7

8 Fraud Detection Association of Certified Fraud Examiners Over 40% of all fraud cases were detected by a tip more than twice the rate of any other detection method *. ACFE, tips have been the most common means of detection in every study since 2002, when we began tracking the data. * Employees know where problems are must work with them to help improve * 2014 Report to the Nations. Relationship with Auditee Build Relationships and Use The Relationship To: Define Risk Areas Ensure Highest Risk Areas Are Found Increase Accuracy Slide 23 Who We Are Looking For Slide 24 8

9 NBC Nightly News Clip This is who we are trying to find. Management will often tell us everything is fine Must get to those with the information Slide 25 Relationships Management Tell you what they want you to believe Staff Tell you what they believe Slide 26 Organization to Audit What they willingly contribute Their message Management Policies Criteria What they want you to believe is happening / intend to happen *Mid-level* Cause Documentation What is happening Staff Criteria Allegations What they think is happening 9

10 Examples Examples Where Relationships Turned Into Key Findings Slide 28 Department of Corrections: Favoritism Allegations of: Unfair Promotions Sexual Misconduct with Employees and Inmates Drugs Use Not Punished Punitive Sting Operations Lying to Other Law Enforcement Breaking of Policies Not Punished Slide 29 Utah Medicaid Lack of Prior Authorization Controls Allowed For Non Covered Procedures and Unnecessary Medical Costs Circumcisions (not a covered Medicaid benefit) Mid face reconstruction Graft of Ear or Nose Rhinoplasty Breast Augmentations Slide 30 10

11 Utah Medicaid Estimate: $20 million MORE could be recovered in Utah Medicaid Slide 31 Management Response The recommendations we will look at careful and we will implement them whenever we can.... I do not think for a minute that if we recover every inappropriately covered Medicaid service, we would find anything close to $20 million in Utah.... the Utah medical community has a higher ethical standard... I don t think there is as much of it there as has been implied. Slide 32 What Happened.... Slide 33 11

12 Upcoding/Upcharging State Clinics Frequency in Billing E&M Codes Compared to State Average Slide 34 Upcoding/Upcharging Results from Independent Sample of Claims at Salt Lake Health Clinic. 99% of claims were billed incorrectly coded. Clinic Sample Correctly Coded 1 0.8% Upcoded One Level Upcoded Two Levels Upcoded Three Levels Not Medically Necessary/ Insufficient Documentation Non-E&M Code* Total % Slide 35 Transportation of Unborn Babies Utah Medicaid over at least five years Reimbursed a company for transporting a pregnant mother and the unborn fetus. Problem was identified 2 other times but problem continued Slide 36 12

13 Layer Your Evidence USTAR Slide 37 Layer Your Evidence USTAR Slide 38 Layer Your Evidence USTAR USTAR Reported ROI* University of Utah Utah State Outreach Total Sponsored Research $ 92,314,316 $ 50,000,000 $ 142,314,316 Engineering Contracts 134,000, ,000,000 Private Investment 130,000, ,000,000 Technology Outreach and Innovation Program 38,000,000 38,000,000 BioInnovations Gateway 12,847,000 12,847,000 SBIR-STTR Assistance Center 5,814,977 5,814,977 Total USTAR Revenue Raised $ 462,976,293 General Funds Invested 112,232,600 Federal ARRA Stimulus 33,000,000 Total State and Federal Contribution $ 145,232,600 Total USTAR ROI 219% *Source: USTAR Return on Investment Report, January 2013 USTAR s Reported Numbers Are Overstated and Inaccurate Slide 39 13

14 Layer Your Evidence USTAR No documentation to support reported jobs created and the reported jobs didn t exist Lacked performance standards and reporting mechanisms Lacked sufficient contracts covering USTAR funding Spending $ on projects not tied to the USTAR program Lacked oversight of USTAR research buildings on university campuses Lacked oversight of outreach programs Slide 40 Principles for High Impact Auditing Slide 41 Principles For A High Impact Audit Exit for Understanding How: Reveal findings often Benefit: Strengthens audit findings Obtain Participation Recommendations can be joint effort Implementation is the key to success Slide 42 14

15 Principles For A High Impact Audit Organize Audit Shop to Be Effective Team Environment: Layers of strength. Ensure a weak link doesn t damage the audit Invest in quality: reference review, editing, sufficient levels of management review, exit process Slide 43 Risk Areas Are Often Missed Compared OLAG Risk Survey to Internal Auditors Often they are very different OLAG risk assessment has ailed to identify key risk issues WHY ARE Risk Areas MISSED? Slide 44 Is Your Risk Survey Designed to Find High Impact Areas? Less Effective Defined by number of hours More Effective Do you have time needed to find high impact areas? Limited in Scope (are certain issues or areas off limits?) Do you have approval to extend beyond assigned areas? Do you go beyond initial request to find high impact areas? (Your body of work must demonstrate impact) Slide 45 15

16 Barriers to High Impact Auditing Conflict Adverse Fear to address impact issues. Take on Management Bias Coming to a conclusion too early in audit Difficulty of the Task Conceptual Ability Laziness Staffing Mix Some audits require specialized skills Slide 46 Outcome OLAG Implementation Rate OLAG Started Improving Relationship with Auditees Audit: Uncover Truth and Facts Exit: Understanding, Cooperation, Implementation Slide 47 Office of the Utah Legislative Auditor General Questions? 16

17 Contact Information Brian J. Dean Kade R. Minchey Utah State Capitol Complex 315 House Building Salt Lake City, Utah (801) Office Website: Slide 49 17