EFFECTIVE STRATEGIES IN PLANNING AND EXECUTING A SUCCESSFUL INTERNAL AUDIT

Transcription

1 EFFECTIVE STRATEGIES IN PLANNING AND EXECUTING A SUCCESSFUL INTERNAL AUDIT 1 CHRISTY DECKER DIRECTOR OF INTERNAL AUDIT SHARP HEALTHCARE RUSSELL HARDER INTERNAL AUDIT SENIOR MANAGER DELOITTE & TOUCHE LLP AHIA 31 st Annual Conference August 26-29, 2012 Philadelphia PA

2 Introductions 2 Russell Harder is a Senior Manager with Deloitte & Christy Decker is the Director of Internal Audit at Touche LLP in their healthcare internal audit practice. Sharp HealthCare in San Diego, CA. Since joining Russell has more than 16 years of experience Sharp HealthCare in 2005, Ms. Decker has been providing risk management and internal audit responsible for managing operational, financial services. He has managed the execution of multiple and compliance audits. She is a Certified Public Accountant (CPA), Certified Internal Auditor financial, operational, IT, and compliance based internal audits in a hospital environment. He has also completed multiple fraud risk assessments and fraud investigations. Russell is a CPA, CIA, CISA and CFE and currently sits on the education committee of the Association of Healthcare Internal Auditors (AHIA). (CIA), Certified Fraud Examiner (CFE) and an HFMA Credentialed Revenue Cycle Representative (CRCR). She is currently the District #4 Representative for the West Region of the Institute of Internal Auditors (IIA).

3 Rules Of The Road 3 Share your ideas and experiences Ask questions Participate! i

4 Poll 4 Which category do you fit into: Working in internal audit > 1 year Transitioned into Internal Audit from another department t Still have to look at conference badge to see what AHIA stands for

5 Objectives 5 After this learning session, participants will gain a better understanding of: The International Standards for the Professional Practice of Internal Auditing (Standards) The life cycle for an effective internal audit Examples and planning tools that can be leveraged when planning and executing an audit The importance of communication during the continuum of an internal audit Industry practices and examples for reporting structure and styles to the Audit Committee

6 International Standards for the Professional Practice of Internal Auditing (Standards) 6 The purpose of the Standards is to: Delineate basic principles that represent the practice of internal auditing. Provide a framework for performing and promoting a broad range of value-added added internal auditing. Establish the basis for the evaluation of internal audit performance. Foster improved organizational processes and operations.

7 Why are The Standards Important? 7 The Standards include International Standards for the Professional Practice of Internal Auditing, Code of Ethics and Practice Advisories that show you how to apply the Standards in your work. We may not have a profession without The Standards.

8 The Standards Address Purpose, Authority, and Responsibility 1100 Independence and Objectivity 1200 Proficiency and Due Professional Care 1300 Quality Assurance and Improvement Program 2000 Managing the Internal Audit Activity 2100 Nature of Work 2200 Engagement Planning 2300 Performing the Engagement 2400 Communicating Results 2500 Monitoring i Progress 2600 Resolution of Management s Acceptance of Risks

9 Internal Audit Life Cycle Develop Internal Audit Scope Internal Audit Planning and Kick-off Meeting Perform Fieldwork & Status Updates Obtain Management Concurrence and Responses Pre Audit Comm. Meetings with Audit Chair Issue final Internal Audit Report Exit Meeting with department Draft Internal Audit Report 9 10 Report to Audit/Finance Committee Open Issues Follow-Up

10 Scoping and Planning an Audit 10 The timelines that are established for audits should be developed by collaborating with the Key Process Owner(s) responsible for the department(s) being audited. Timeline Considerations Availability of: Internal Audit team member(s) to devote time to conduct the audit such as vacation time, competing open audits, etc. Availability of external departments to devote time to participate in the audit Is the department currently being audited by another external agency (CMS) limiting their availability to assist your team with be difficult? Prioritization of the audit Is there an upcoming external agency review in near future where the vulnerability of the process needs to be internally assessed? Expectations of key stakeholder(s) Are key stakeholders expecting results to make a business decision (Legal, Board of Directors, etc.)?

11 11 Scoping & Planning an Audit

12 Scoping & Planning an Audit 12 Kick-off Meeting Outline About Us We are an internal resource, providing a systematic evaluation of processes and functions within <insert organization s name). Our mission is to ensure that operations are efficient and effective, financial reporting is reliable, laws and regulations are complied with, and company assets are safeguarded. We have been asked by the (President/CEO) and the Board of Directors to review <insert name of project>. At today s meeting, we will share our plan for approaching this project, introduce you to the individuals from Internal Audit Services who will be working on this, solicit your input on who from your team should be involved, and discuss what type of information we ll need from you and your team. Feel free to stop us if you have any questions or if we use any terms that you may not be familiar with. From the post review client surveys that we conduct, we ve learned that what seems like an unnecessary activity at first turns out to be valuable exercise. Our training is in business practices and business controls, and we try to serve as fresh eyes, offering suggestions for improving processes and practices and to validate that internal controls are working as designed. Our goal is to make this a positive experience for you. If you would like to learn more about our department, see our intranet site at

13 Performing an Audit 13 Develop an Engagement Work Program (Audit Program) Identify, analyze, evaluate, and document sufficient information to achieve the engagement s objectives Base conclusions and engagement results on appropriate analyses and evaluations Document relevant information to support the Document relevant information to support the conclusions and engagement results

14 Performing an Audit 14 Develop an Audit Program Planning Internal Control Documentation Fieldwork Reporting Reviews and Wrap-up

15 Performing an Audit 15 Sample Communications status update Current Period s Accomplishment Observations and Challenges Next Steps

16 Communication of Findings 16 Validating Observations: Throughout the fieldwork and the reporting process, it is important to: Inform and obtain feedback from process owner Validate results with process owner The auditor should document an observation and discuss the observation with the auditee whenever the auditor identifies a possible: Opportunity for operational improvement, Discrepancy, Error, Irregularity, Weakness, or Deviation from regulations, policies, etc. Prior audit reports and linked audit observations should be reviewed and used to the extent possible to avoid re-creating an audit observation already developed. It is critical that the process owner and relevant parties should be aware of all observations prior to receiving a draft report

17 Wrap-up/Exit p/ Meeting 17 Minimize surprises Send 48-hours in advance of the scheduled wrap- up meeting Formalizes management s agreement to the observations Obtains verbal commitment to action plans to remediate the observations communicated Sets reporting timeline and expectations

18 Communicating Results 18 Sample Communications of Results Wrap-up p Document Review Risks, Objectives and Scope Review Procedures Positives and Highlights Review Observations Reporting Process Next Steps

19 Internal Audit Report 19 Key components of an effective internal audit report: Succinct Direct Understandable Factual Descriptive Consider your audience Executive Summary False Assumptions commonly made of the audience/recipient That the person who will first read or edit the report is the audience That the audience is a group of specialists in their field That the audience is familiar with the subject of the report That the audience has time to read the entire report That the audience has a strong interest in the subject of the report That the author will always be available to discuss the report **********It is critical that the process owner and relevant parties should be aware of all observations prior to receiving a draft report*******

20 Sample Report Format 20 Sample Draft report

21 Audit Committee Reporting 21 Some key tenets of Audit Committee Reporting Brief Focus on key issues Presentation styles Tailored to audience Tracking of management action plans Educational

22 Questions? 22 Thank you for your participation!

23 Save the Date: August 25-28, nd Annual Conference Chicago, IL 23