2014 PACAH Annual Conference Affinity Health Services Senior Community Management and Consulting Services

Conducting a Business Office Internal Audit  How to protect your assets, increase your controls and utilize best practices for the operation of your business office and accounting functions

Program Objectives  What are internal controls  Why are they important  How to maintain compliance with policies and procedures  Duties segregated for small/large facilities  Downfall/Risk of Non compliance

Program Objectives  Best Practices with GAAP (Generally Accepted Accounting Principals)  Segregation of Duties  Sample written policies and procedures

Definitions Internal Control  Systematic measures (such as reviews, checks and balances, methods and procedures) instituted by an organization to:  1. conduct its business in an orderly and efficient manner  2. safeguard its assets and resources  3. deter and detect errors, fraud, and theft  4. ensure accuracy and completeness of accounting data  5. produce reliable and timely financial and management information  6. ensure adherence to its policies and plan

Why are Internal Controls Important and What am I protecting?  Your professional reputation  Your decision making  Your cash flow/expense management  Your facility  Your County  Your dedicated employees  Your …………………..

This is for real – criminal activity  Former Conecuh County nursing home employee convicted of theft of resident funds  Former nursing home bookkeeper in DeKalb County convicted of stealing funds  Payroll Fraud – A big threat and how to avoid it

This is for real – criminal activity  Payroll Fraud  Happens in 27% of businesses  Occurs nearly twice as often in small organizations (100 or less)  Ghost employees  Checks/direct deposit  Employee Personal Care Home  Approximately half of the payroll checks were direct deposit and others paper checks  Payroll clerk put herself on direct deposit and cut a paper check – administrator and accountant signed checks  How was that caught? – through the financial statement budget variance review process - (internal control)

Differences between just bad business, common mistakes/lack of training and theft/fraud  Resident Trust doesn’t reconcile  Payroll errors – payroll clerk doesn’t understand overtime calculation  Aging past due not being collected – wrong information, billing errors, lack of collection progress. Incorrect 162 recorded  Miscoded Accounts Payable  Incorrect Cash Balances  Untimely reports  No review process – financials/A/P - aging  Census reconciliation incomplete  How do we train without policies and procedures

Policies and Procedures  Foundation for all business processes  The who, what and how tasks are performed  Brings structure to the organization  Serve as internal controls  Managers have guidelines and do not make unauthorized decisions  Employees need to know how to apply, how to enforce  Training of new employees

Best Practices How to avoid bad things from happening  Policies and Procedures Do you have them? Do you follow them? When was the last time they were updated? Do you know where they are?  Bad Things  No guidance for new employees  Costly errors  Theft  Surveys  Audits  Inaccurate reports  Bad management decisions

What Policies should I have?  Accounting Policies  Accounts Payable  Accounts Receivable  Adjusting Entries  Bank Reconciliation  Capitalization / Depreciation  Check Requests  Month End Closing  Petty Cash  Purchase Order  Request for Capital  Void Check  Chart of Accounts and management of same  Bad Checks  Cash Receipts  Check signing

What Policies should I have?  Business Office Policies/Procedures  Admissions  Bad Debt  Billing Adjustments  Billing Process  Census Reconciliation / Adjustments  Collections  Central Supply  MSP  Monthly Calendar  Personnel Records  Resident Trust Fund  Segregation of Duties  Other: Financial Statement Review Process / Budget Variance Internal Audit Record Retention

Procedure – Segregation of Duties  Most effective procedures are those with the greatest segregation of duties. The more people in the process the less likely of an error or theft will occur  For example the person that writes the checks should not be the person signing the check  The person who orders the products should not approve the invoice  The person with budget responsibility should not code the invoice  The person who receives the checks does not make the deposit

Cash Receipts/Accounts Receivable One Person Office Procedure Person Responsible Administrator Controller/Clerk Receive Payments X Issue Receipts X Prepare Deposit X Verify Record of Receipts to Deposit Slip Detail (pre-deposit) X Verity $ Total of Receipt to Validated Deposit Total (post-deposit) X Take Deposit to Bank X Post Payments X Ensure Daily Depositing X Title:SEGREGATION OF DUTIES MODEL FOR CASH RECEIPTS Accounts Receivables: One-Person Business Office

Cash Receipts/Accounts Receivable Three Person Business Office Procedure Person Responsible Admin. Fiscal Director Bookkeep er Clerk Receive Payments X Issue Receipts/Prepare Log X Prepare Deposit X Verify Record of Receipts to Deposit Slip Detail (pre- deposit detail) X Verify $ Total of Receipt to Validated Deposit Total (post- deposit) X Take Deposit to Bank X Post Payments X Ensure Daily Depositing X

Generally Accepted Accounting Principals (GAAP)/Audits  GAAP- Accrual basis Set of principals to establish reporting and disclosures Relevance helps decision maker understand past, present and future outlook and make informed decision in a timely manner Reliable is verifiable and objective Consistent is using the same methods allowing meaningful decisions  CPA audited financials create credibility, detects fraud and is the main source of management performance  During the audit the auditors are responsible to test internal controls  *Counties and single County audits do not necessarily encourage GAAP or internal controls

AUDITS – GAAP and Standard Letter  Standard representation letter is signed by management  We acknowledge our responsibility for the design, implementation and maintenance of internal control relevant to the preparation of the financial statements, notes and supplemental schedules that are free from material misstatement, whether due to fraud or error  We acknowledge our responsibility for the design, implementation and maintenance of internal control to prevent and detect fraud  We are responsible for the estimation methods and assumptions used in measuring assets and liabilities  Typically in Counties these are signed by Courthouse employees that manage the County

Compliance – Internal Audit

Maintaining Compliance Internal AuditWhy?  Identify control problems and aims at correcting lapses before they are discovered during an external audit.  Your policies are your audit. Without policies you don’t have an audit.  Frequent or ongoing audits conducted by a firm’s own accountants to:  1. monitor operating results  2. verify financial records  3. evaluate internal controls  4. assist with increasing efficiency and effectiveness of operations and  5. to detect fraud

NURSING HOME MANAGEMENT  We audit everything except the accounting and business functions – why? Its not a law, the County is responsible for the audit and internal controls or we lack the resources/knowledge.

Nursing Facilities Internal Controls/Audit - Medications  Controlled Substances - Medication subject to abuse or diversion  Stored in double locked compartment  Accountability record  Keys maintained by nurse and when keys are transferred a physical inventory is conducted  If seals are broken report immediately WHY – it is required and we deal with drug diversion

Nursing Facilities Internal Controls - Medications  Nurse forging physician orders  Fax script to pharmacy  Pick up the medication while she is on duty when delivered  Indicated in the MAR that medication was given (PRN med)  Pharmacy bill was indicating a lot of Oxycodone  WHY? It is regulated, reportable and it is the Best Practice. Many administrators and directors of nursing have had to have people arrested and deal with the nursing board.

Nursing Facilities Internal Controls - Triple Check Audit  Identify errors in billing  Identify missing chart required documentation  Identify documentation to support skilled services  Check appropriate diagnosis  Check basic data fields  WHY –RAC audits, to avoid a ZPIC audit, to get paid, to avoid rejected claims and recouped monies

Conducting internal audits/policy enforcement

Account Receivable Funny I am making money but don’t have any?  Are there proper policies and procedures that address:  Are there regular aging reviews? Who conducts the review? Are their credit balances and an explanation of past due accounts  Have resident refunds been processed timely  Are there collection progress reports on all outstanding balances  Are MA 162’s in an organized binder  Are there established timelines for billing  Are pending MA residents paying their private resources  Are MA Co insurances logged onto Medicare Bad Debt log  Are bad debt forms for write offs completed with the proper approvals/controls  Are adjustments monitored on a monthly basis  Follow adjustments through the system to verify validity  Is the aging used as a real time document

Petty Cash Audits  Are there limits on how much can be paid out of petty cash  Is there a policy specifically stating the use of petty cash  Are receipts signed by both the petty cash custodian and the employee  NO SLUSH FUNDS Policies  The following items must not be paid out of petty cash:  Payroll transactions  Business Travel  Resident Trust Fund  Cashing of personal checks  Barber and Beauty charges

Bank Reconciliations  Are all the accounts on the General Ledger  Is there a preparer and reviewer  Is the vendor name included on the outstanding check list?  If a check appears on the list of outstanding checks for more than one month, what happens and how is it investigated

Accounts Payable/Resident Refunds  Are there two signatures required for all checks  Is there a purchase order policy  Does the signer review the actual invoice along with the check being signed  Are vendor invoices stamped paid  Test a sampling of invoices for the proper coding  Validate the credit balance on the aging  Process the refund through the A/P process with the appropriate signatures  Test timeliness of refunds  Verify that all charges have been received and entered prior to issuing a refund request

Payroll s   Direct Deposits are the same as your payroll checks. Simply because you do not sign paychecks does not negate the approval process, the preliminary check register should be approved by the Administrator and signed and dated prior to the direct deposit and manual checks being processed. If the administrator is not available there will be a designated approval process in place in their absence.   Do Department managers authorize overtime  Do checks require more that one signature  Does the same person that does payroll enter new employees into the system  Does the same person who does payroll handle the employee files  s

Processing Payroll – Control Activity Form - Auditors  Individuals who prepare payroll checks cannot:  Sign payroll  Review and authorize electronic payroll disbursements  Disburse payroll checks  Control unclaimed payroll inquiries  Resolve employee payroll inquiries  Edit the payroll master file  Open mail or copy checks received

Financial Statement Analysis  Balance Sheet  Do you compare balance sheet accounts from month to month Income Statement  Do you compare financial performance against budget and identify variances  Do you compare year over year numbers to determine reasonable variances  Are financial statements timely therefore relevant  Are financial statements presented in an accrual basis of accounting  Do you evaluate expenses on a cost per patient day basis  Do you have a method to monitor cash

Resident Trust Funds  Are residents/families required to authorize a resident fund account  Does the policy clearly identify what can be paid out of resident funds  Are the funds in excess of $50 in interest bearing account  Are the trust funds account sent out in accordance with the regulation  Are refunds completed timely  Is the Surety Bond adequate  Is the staff trained on the unclaimed property procedures  Are the duties for resident fund segregated appropriately  Deposits separate from posting and reconciliation

Summary  Nursing facilities are responsible for policies and procedures of the facility as a whole. These are not limited to care related and HR policies. (Policies and Procedures create your internal audit)  Employees are most successful with clear guidelines.  Facilities are responsible to ensure safekeeping of resident funds.  The nursing home administrator is responsible for the financial performance of the home, the integrity of the business office operations and accounting transactions.  Mistakes happen and without the proper audits, controls and segregation of duties they are difficult to detect.  Fraud happens and without the proper audits, controls and segregation of duties it is difficult to detect.

Questions Thank you for your time and attention! Denise McQuown-Hatter, President Jeff Aiken