Revisions to Audit and Compliance Committee Charter

Transcription

1 DATE: November 2, 2017 TO: FROM: SUBJECT: Audit and Compliance Committee Members Rick Kibler, VP, Compliance and Internal Audit Revisions to Audit and Compliance Committee Charter Background: Compliance Resource Group (CRG) performed an independent assessment of the Compliance Program as currently implemented. CRG assessed program documents and conducted on-site interviews during March and April 2017 and documented the results of their assessment in a report dated 5/12/17. There were 3 separate recommendations relating to improving the Audit and Compliance Committee Charter as follows: Governance Structure: The CCO should have unmediated access to the CEO and the Board of Trustees and the Board Audit and Compliance Committee. This is a requirement of virtually every government document detailing the components of an effective Compliance Program. The CCO s job description details responsibilities of the position, but there should be a Board adopted charter with specific responsibilities and authorities for the CCO. The advantage of a charter, versus a job description, is that it can only be modified by Board action, which in turn demonstrates that the CCO acts on authority of the Board. Governance Structure: There is no indication that the Board has a role in the hiring, evaluation and termination of the CCO, and such a role is not specified in the documents we reviewed. We recommend that the Board play a defined role in these matters, particularly in the termination of the CCO. This role should be memorialized in a Board adopted charter for either the Board itself or the Board Audit and Compliance Committee. Compliance Officer: Many organizations supplement the CCO job description with a charter of authorities and responsibilities approved by the Board. This charter has the multiple purposes of documenting that the Board has delegated day-to-day management of the Compliance Program to the CCO, which is protective of the Board, with the added benefit of making it clear to the organization that the authorities and responsibilities of the CCO position are derivative of the

2 Alameda Health System Board of Trustees Audit and Compliance Committee Members Audit and Compliance Committee Draft Charter November 2, Board. Unlike a job description, a charter can be changed only by Board action. We urge consideration of such a charter with respect to the CCO. Action Taken: Attached is a draft charter for the committee to consider in addressing the CRG recommendations. The charter is shown in edit mode to highlight modifications from the previously approved charter. This edited version is presented to stimulate conversation and identify areas for revision. The final version will be presented at the next meeting for approval East 31 st Street Oakland, CA (510)

3 Alameda Health System Board of Trustees Appendix H AUDIT AND COMPLIANCE COMMITTEE CHARTER 1. Membership Trustees. The Board President will appoint up to four (4) Trustees to serve on this committee. The Chair of the Committee will be appointed by the President Staff Liaison. Internal Auditor/Chief Compliance Officer 2. Meetings. The Committee will meet quarterly. Meetings of this committee are subject to the agenda/notice requirements of the Brown Act. The Committee may meet in closed session with its External or Internal Auditor or the Chief Compliance Officer as required by law. 3. Purpose/Goals/Responsibilities 3.1. General. The primary function of the Audit and Compliance Committee (the Committee ) is to assist the Alameda Health System ( AHS ) Board of Trustees in fulfilling its oversight responsibilities relating to: the integrity of AHS s financial statements, the systems of internal control, the audit process, and AHS s compliance with legal and regulatory requirements and the AHS Code of Conduct. In so doing, it is the responsibility of the Committee to approve the annual financial statements as presented by the external auditors and to maintain free and open communication among the Committee, management, the internal auditors and compliance officers/staff of AHS. The Committee delegates the day-to-day management of Internal Audit and the Compliance Program to the VP Internal Audit/Corporate Compliance Officer and shall take all appropriate actions to set the overall AHS tone for quality financial reporting, sound business risk practices, ethical behavior and to create a culture of compliance within the organization. The VP Internal Audit/Corporate Compliance Officer shall have free and unrestricted access to members of the Board of Trustees, the Audit and Compliance Committee, the CEO and management as necessary to effectively discharge their duties Audit Responsibilities General Evaluate the extent to which internal and external auditors review computer systems and applications, the security of such systems and applications, and the contingency plan for processing financial information in the event of a systems breakdown Determine whether internal control recommendations made by internal and 1

4 external auditors have been implemented by management Provide a forum for internal audit to report identified fraud, illegal acts, deficiencies in internal control, and corrective action plans to ensure appropriate action is taken by management Review the Committee charter on an annual basis and update as necessary; present changes to the Board of Trustees for approval Regularly update the Board of Trustees on Committee activities, any key external audit issues, and make appropriate recommendations Review and approve AHS s standards of conduct and other compliance-related policy guidance Internal Audit Program Review and ensure that AHS has the appropriate structure, staffing and capability to effectively carry out the internal audit responsibilities Concur in the appointment, replacement, reassignment, or dismissal of the Internal Auditor Review and approve the annual audit plan and all major changes to the plan At least annually, review the performance of the Chief Audit Executive On a regular basis, meet with the Internal Auditor to discuss any matters that the Committee or internal auditor believes should be discussed privately, consistent with the Ralph M. Brown Act External Audit Appoint, review contracts and approve fees of outside auditors Review the external auditors proposed scope and approach Review the performance of the external auditors and exercise final approval on the appointment or discharge of the auditors Establish policies that ensure independence of outside auditors, including revolving door employment restrictions and prohibiting external auditors from providing management consulting services, particularly with respect to information technology and systems Financial Statement Reporting. Review significant accounting and reporting issues, including recent professional and regulatory pronouncements, and understand their impact on AHS s financial statements Review the annual audited financial statements and determine whether they are complete and consistent with the information known to Committee members, and assess whether the financial statements reflect appropriate accounting principles Review the annual report before its release and consider whether the information is adequate and consistent with members knowledge about AHS and its operations Review with management and the external auditors the results of the audit, including any difficulties encountered Review with management and the external auditors all matters required to be communicated to the committee under generally accepted accounting standards Compliance. Maintain familiarity with the compliance standards established by the 2

5 Office of the Inspector General (OIG), U.S. Department of Health and Human Services. Monitor the effectiveness of systems to ensure that appropriate information as to compliance with applicable laws comes to the attention of the full Board as a matter of ordinary operations Evaluate the organizations policies and procedures to ensure that compliance risk areas are adequately addressed and that effective education and training on compliance responsibilities is conducted across the organization Evaluate, and refine as appropriate, the organization s compliance infrastructure to ensure the competency of compliance personnel, to provide adequate resources to meet compliance obligations, and to confirm that compliance personnel are vested with appropriate authority Review the effectiveness of the system for monitoring compliance with laws and regulations and the results of management s investigation and follow-up (including disciplinary action) on any fraudulent acts or other irregularities Periodically, and as necessary, obtain updates from management, the Chief Compliance Officer and AHS s General Counsel regarding compliance Be satisfied that all regulatory compliance matters have been considered in the preparation of the financial statements Review the findings of any significant examinations by regulatory agencies Approve and oversee the development, implementation and performance of an AHS Compliance Program following the OIG guidance for the 7 Elements of an Effective Compliance Program At least annually, review the performance of the Chief Compliance Officer. 3.9 Other Responsibilities Concur in the appointment, replacement or dismissal of the VP Internal Audit/Corporate Compliance Officer. Formatted: Indent: Left: 0", Hanging: 0.75", No bullets or numbering Formatted: No bullets or numbering Reporting to Full Board A written report to the full Board will be submitted by the Committee at least quarterly. 3

6 4