Transcription
Corporate Audit & Assurance ServicesINTERNAL AUDITING FORMEDICARE PART DScott RobinsonSenior Internal AuditorCareFirst BlueCross BlueShield0
Is Internal Audit Important? In a word: Absolutely! If Internal Audit does not monitor yourPart D program, who is going to do it? Simple truth – Part D contains too manyrequirements for the Compliance Officeto take full responsibility for auditingand monitoring the Program. Collaboration between Complianceand Internal Audit is essential.1
So, You Have Internal Audit’s Buy-In, Now What? Brainstorm:– Compliance Office– Internal Audit– Senior Management What are the major areas to focus upon? Have you outsourced any functions to first-tier ordownstream entities? Do you want to audit internally or externally? RISK: What is the acceptable level of riskSenior Management is willing to accept?2
Tools To Aid In Decision-Making Use the tools the government providesyou:– Medicare Part D Audit Guide– www.cms.hhs.gov– OIG Annual Work Plan Rx for the Sponsor Dose of reality– You cannot audit the entire program. Too labor intensive. Too cost inefficient.3
Compel Them It all starts with the Tone At The Top:– Your (the Sponsor’s) Control Environment What are your CEO’s expectations? What are your CEO’s actions? Has the CEO communicated clearly with allinvolved?– Contracts Did you require all first-tier and downstream entities to sign a contract? Does the contract provide the opportunityfor you – the sponsor – to audit yourcontractors?4
Control Environment The Control Environment isthe Tone At The Top. It not only reflects the CEO’sattitude. It also reflectsmanagement’s attitude in alldifferent business operations. It crosses through all activities and all unitsof an organization. Requires the management of the differentbusiness units within the Medicare Part DProgram to be on board.5
Assessing the Control Environment: LookingBeyond the Obvious Does the CEO want to be in the Part Dbusiness?– Pressures from competition– Growing senior population Is the CEO committed to anenvironment of compliancewith CMS regulations?– Does the rest of the management team share theCEO’s enthusiasm?– What is management’s overall commitment tocompliance with CMS’ ever-changing regulations?– Is everyone committed to ensuring the propercontrols (policies & procedures) are in place andoperating as intended?6
Control Environment Failures The control environment cannot besuccessful unless everyone inmanagement buys into the plan. One bad egg can spoil the whole carton. ETHICS ASSESSMENT IS KEY!7
Self-Assessments: A Great Audit Tool Part D Self-Assessments:– Use CMS’ Medicare Part D AuditGuide as a tool.– Disburse the chapters among internal andexternal business units (first-tier/downstream entities).– Choose your guinea pig! Assist in the self-assessment process First-hand knowledge of deficient areas– Require each business unit to assess theircompliance with the requirements of theAudit Guide.8
Example of Self-Assessment ToolAuditGuideElementRequirement Meets PartiallyMeetsER01Enrollment FormsThe Part DSponsor must usean enrollment formAnd may use anyEnrollment ER02Remediation PlanDate ofAnticipatedCompletionCheck the field showingwhether the departmentmeets, partially meets ordoes not meet the CMSrequirement appearingto the left.If the businessunit partiallymeets or doesnot meet therequirement,they must statea remediationplan.What datedo theythink theplan will becompleted.aProcedures willbe implementedto 12/31/2007Procedures willbe implementedto f the enrollment ER03Denial ofEnrollment RequestaIf the Part D ER04Notice ofAcknowledgementa9
Moving Forward Assess the assessments– Set a drop-dead date for eachbusiness unit to return their selfassessments.– Encourage them to be completely honest.– Review each unit’s assessment.– Note the self-confessed problems!– Rate the issues in order of importance.– Communicate, communicate, communicate!10
Next Step: Self-Assessment Validations What might people do when they are assigneda task, but they do not have the time and/orresources to complete the task?– They tell you what they think you want to hear! There must be some form ofvalidation to ensure that whatseems to be, is! Fool me once, shame on you! Fool me twice, shame on me!11
Now What? Time to implement the Part D Audit Plan.–––––Self-assessments indicate problems.Validations reveal more problems.Compliance Officer is aware of yet more problems.Internal Audit has discovered important issues.Senior Management wants to focus upon certain hotbutton issues. All of these stakeholders must collaborate anddecide how to proceed.12
Time For A Dose Of Reality Medicare Part D is a HUGE program. You simplycannot audit the entire Program. Time to answer some tough questions:– What are your obligations as the sponsor?– What resources do you have to devote to auditingMedicare Part D?– What audit objectives do you want to accomplish?– What do you want your scope to be? Will the scope cover a short time period, such asone calendar quarter? Will the scope cover a longer period – problemsdating to the beginning of the program?13
Time For A Dose Of Reality (continued) Samples lots of little samples:– Example: Your Grievance/Appeals Units assessesthat they meet CMS’ burden for ruling on an appeal– Collect documentation for proof– Pull a sample of 5 appeals– Test did they meet CMS standards? Document, document, document Written reports to management– Address the findings to internal management.– Reporting the findings to external management.– Should include recommendations for improvement.14
Audit Aspects Recommendations for improvement should beincorporated into written reports.– Compliance Officer should confirm thatrecommendations are consistent with CMSregulations. Management should be provided anopportunity to respond to findings andrecommendations. Routine follow-up (monitoring) should beconducted to ensure problems are resolved.15
Other Considerations: Inside Or Out Where is the business unit located:– Internal (same building, campus, or city)– External (different state or outsourcedvendor) Whether the problem is internal orexternal could impact what action istaken.– Go back to the contract!16
Terms of the Contract Audit rights Restrictions Duties correspond to CMSregulations Who pays the travel expenses17
Consider Resources Time– How much time will be requiredto correct a deficiency?– Can remediation realisticallyoccur in a shorter time frame? Human Resources– Who will have primary responsibility forresolving the issue?– Are more people needed to remediate thedeficiency than are available?18
Key Questions How egregious is the deficiency?What would CMS say about it?What would CMS do about it?At what point does the sponsor’s responsibility kick inwhen they should inform the government about thedeficiency? Does the business unit fully understand theimplications of the deficiency? How much oversight is necessary to ensure thebusiness unit becomescompliant with CMSregulations?19
It’s Never Too Late This is a continuous process.– Self-assessments should be completedperiodically. Do the business unit managers know all of theCMS requirements pertinent to their businessunit? Can they say with 100% certainty that theyfollow all the requirements? Is it possible that they are sofocused on one aspect of theirunit, they forgot something else?– Periodic self-assessments aid inreinforcement of important issues.20
QUESTIONSCOMMENTSSUGGESTIONSScott R. Robinson, CPASenior Auditor10455 Mill Run CircleOwings Mills, MD 21117Telephone 410-998-7668Fax 410-998-7143E-mail: scott.robinson@carefirst.com
Self----Assessments: A Great Audit Tool Part D Self-Assessments: –Use CMS’Medicare Part D Audit Guide as a tool. –Disburse the chapters among internal and external business units (first-tier/down-stream entities). –Choose your guinea pig! Assist in the self-assessment process First-hand knowledge of deficient areasFile Size: 626KBPage Count: 22
