0

INTERNAL AUDITING FOR INTERNAL AUDITING FOR

MEDICARE PART DMEDICARE PART D

Scott RobinsonScott Robinson

Senior Internal AuditorSenior Internal Auditor

CareFirst BlueCross BlueShieldCareFirst BlueCross BlueShield

Corporate Audit & Assurance Services

1

Is Internal Audit Important?Is Internal Audit Important?

• In a word: Absolutely!• If Internal Audit does not monitor your Part D program, who is going to do it???

• Simple truth – Part D contains too many requirements for the Compliance Office to take full responsibility for auditing and monitoring the Program.

• Collaboration between Compliance and Internal Audit is essential.

2

So, You Have Internal AuditSo, You Have Internal AuditSo, You Have Internal AuditSo, You Have Internal AuditSo, You Have Internal AuditSo, You Have Internal AuditSo, You Have Internal AuditSo, You Have Internal Audit’’’’’’’’s Buys Buys Buys Buys Buys Buys Buys Buy--------In, Now What?In, Now What?In, Now What?In, Now What?In, Now What?In, Now What?In, Now What?In, Now What?

• Brainstorm:– Compliance Office

– Internal Audit

– Senior Management• What are the major areas to focus upon?

• Have you outsourced any functions to first-tier or downstream entities?

• Do you want to audit internally or externally?

• RISK: What is the acceptable level of risk Senior Management is willing to accept?

3

Tools To Aid In DecisionTools To Aid In DecisionTools To Aid In DecisionTools To Aid In DecisionTools To Aid In DecisionTools To Aid In DecisionTools To Aid In DecisionTools To Aid In Decision--------MakingMakingMakingMakingMakingMakingMakingMaking

• Use the tools the government provides you:– Medicare Part D Audit Guide

– www.cms.hhs.gov

– OIG Annual Work Plan

• Rx for the Sponsor = Dose of reality– You cannot audit the entire program.

• Too labor intensive.

• Too cost inefficient.

4

Compel ThemCompel ThemCompel ThemCompel ThemCompel ThemCompel ThemCompel ThemCompel Them

• It all starts with the Tone At The Top:– Your (the Sponsor’s) Control Environment

• What are your CEO’s expectations?• What are your CEO’s actions?• Has the CEO communicated clearly with all involved?

– Contracts• Did you require all first-tier and down-stream entities to sign a contract?

• Does the contract provide the opportunity for you – the sponsor – to audit your contractors?

5

Control EnvironmentControl EnvironmentControl EnvironmentControl EnvironmentControl EnvironmentControl EnvironmentControl EnvironmentControl Environment

• The Control Environment is the Tone At The Top.

• It not only reflects the CEO’s attitude. It also reflects management’s attitude in all different business operations.

• It crosses through all activities and all units of an organization.

• Requires the management of the different business units within the Medicare Part D Program to be on board.

6

Assessing the Control Environment: Looking Assessing the Control Environment: Looking Assessing the Control Environment: Looking Assessing the Control Environment: Looking Assessing the Control Environment: Looking Assessing the Control Environment: Looking Assessing the Control Environment: Looking Assessing the Control Environment: Looking

Beyond the ObviousBeyond the ObviousBeyond the ObviousBeyond the ObviousBeyond the ObviousBeyond the ObviousBeyond the ObviousBeyond the Obvious

• Does the CEO want to be in the Part D business?– Pressures from competition– Growing senior population

• Is the CEO committed to an environment of compliance with CMS regulations?– Does the rest of the management team share the CEO’s enthusiasm?

– What is management’s overall commitment to compliance with CMS’ ever-changing regulations?

– Is everyone committed to ensuring the proper controls (policies & procedures) are in place and operating as intended?

7

Control Environment FailuresControl Environment FailuresControl Environment FailuresControl Environment FailuresControl Environment FailuresControl Environment FailuresControl Environment FailuresControl Environment Failures

• The control environment cannot be successful unless everyone in management buys into the plan.

• One bad egg can spoil the whole carton.

• ETHICS ASSESSMENT IS KEY!

8

SelfSelfSelfSelfSelfSelfSelfSelf--------Assessments: A Great Audit ToolAssessments: A Great Audit ToolAssessments: A Great Audit ToolAssessments: A Great Audit ToolAssessments: A Great Audit ToolAssessments: A Great Audit ToolAssessments: A Great Audit ToolAssessments: A Great Audit Tool

• Part D Self-Assessments:– Use CMS’ Medicare Part D AuditGuide as a tool.

– Disburse the chapters among internal and external business units (first-tier/down-stream entities).

– Choose your guinea pig!• Assist in the self-assessment process• First-hand knowledge of deficient areas

– Require each business unit to assess their compliance with the requirements of the Audit Guide.

9

Example of SelfExample of SelfExample of SelfExample of SelfExample of SelfExample of SelfExample of SelfExample of Self--------Assessment ToolAssessment ToolAssessment ToolAssessment ToolAssessment ToolAssessment ToolAssessment ToolAssessment Tool

aNotice of Acknowledgement

ER04

12/31/2007Procedures will be implemented to …

aDenial of Enrollment Request

If the Part D…

ER03

12/31/2007Procedures will be implemented to …

aIncomplete Enrollment Requests

If the enrollment…

ER02

What date do they think the plan will be completed.

If the business unit partially meets or does not meet the requirement, they must state a remediation plan.

Check the field showing whether the department meets, partially meets or does not meet the CMS requirement appearing to the left.

Enrollment Forms

The Part D

Sponsor must use

an enrollment form

And may use any

Enrollment…

ER01

Date of Anticipated Completion

Remediation PlanDoes Not Meet

Partially

Meets

MeetsRequirementAudit Guide Element

10

Moving ForwardMoving ForwardMoving ForwardMoving ForwardMoving ForwardMoving ForwardMoving ForwardMoving Forward

• Assess the assessments– Set a drop-dead date for each business unit to return their self-assessments.

– Encourage them to be completely honest.

– Review each unit’s assessment.

– Note the self-confessed problems!

– Rate the issues in order of importance.

– Communicate, communicate, communicate!

11

Next Step: SelfNext Step: SelfNext Step: SelfNext Step: SelfNext Step: SelfNext Step: SelfNext Step: SelfNext Step: Self--------Assessment ValidationsAssessment ValidationsAssessment ValidationsAssessment ValidationsAssessment ValidationsAssessment ValidationsAssessment ValidationsAssessment Validations

• What might people do when they are assigned a task, but they do not have the time and/or resources to complete the task?– They tell you what they think you want to hear!

• There must be some form of validation to ensure that what seems to be, is!

• Fool me once, shame on you!

• Fool me twice, shame on me!

12

Now What?Now What?Now What?Now What?Now What?Now What?Now What?Now What?

• Time to implement the Part D Audit Plan. – Self-assessments indicate problems.

– Validations reveal more problems.

– Compliance Officer is aware of yet more problems.

– Internal Audit has discovered important issues.

– Senior Management wants to focus upon certain hot button issues.

• All of these stakeholders must collaborate and decide how to proceed.

13

Time For A Dose Of RealityTime For A Dose Of RealityTime For A Dose Of RealityTime For A Dose Of RealityTime For A Dose Of RealityTime For A Dose Of RealityTime For A Dose Of RealityTime For A Dose Of Reality

• Medicare Part D is a HUGE program. You simply cannotcannot audit the entire Program.

• Time to answer some tough questions:– What are your obligations as the sponsor?

– What resources do you have to devote to auditing Medicare Part D?

– What audit objectives do you want to accomplish?

– What do you want your scope to be?• Will the scope cover a short time period, such as one calendar quarter?

• Will the scope cover a longer period – problems dating to the beginning of the program?

14

Time For A Dose Of Reality (continued)Time For A Dose Of Reality (continued)Time For A Dose Of Reality (continued)Time For A Dose Of Reality (continued)Time For A Dose Of Reality (continued)Time For A Dose Of Reality (continued)Time For A Dose Of Reality (continued)Time For A Dose Of Reality (continued)

• Samples…lots of little samples:– Example: Your Grievance/Appeals Units assesses that they meet CMS’ burden for ruling on an appeal

– Collect documentation for proof– Pull a sample of 5 appeals– Test…did they meet CMS standards?

• Document, document, document• Written reports to management

– Address the findings to internal management.– Reporting the findings to external management.– Should include recommendations for improvement.

15

Audit AspectsAudit AspectsAudit AspectsAudit AspectsAudit AspectsAudit AspectsAudit AspectsAudit Aspects

• Recommendations for improvement should be incorporated into written reports.– Compliance Officer should confirm that recommendations are consistent with CMS regulations.

• Management should be provided an opportunity to respond to findings and recommendations.

• Routine follow-up (monitoring) should be conducted to ensure problems are resolved.

16

Other Considerations: Inside Or OutOther Considerations: Inside Or OutOther Considerations: Inside Or OutOther Considerations: Inside Or OutOther Considerations: Inside Or OutOther Considerations: Inside Or OutOther Considerations: Inside Or OutOther Considerations: Inside Or Out

• Where is the business unit located:– Internal (same building, campus, or city)

– External (different state or outsourced vendor)

• Whether the problem is internal or external could impact what action is taken.– Go back to the contract!

17

Terms of the ContractTerms of the ContractTerms of the ContractTerms of the ContractTerms of the ContractTerms of the ContractTerms of the ContractTerms of the Contract

• Audit rights

• Restrictions

• Duties correspond to CMS regulations

• Who pays the travel expenses

18

Consider ResourcesConsider ResourcesConsider ResourcesConsider ResourcesConsider ResourcesConsider ResourcesConsider ResourcesConsider Resources

• Time– How much time will be required to correct a deficiency?

– Can remediation realistically occur in a shorter time frame?

• Human Resources– Who will have primary responsibility for resolving the issue?

– Are more people needed to remediate the deficiency than are available?

19

Key QuestionsKey QuestionsKey QuestionsKey QuestionsKey QuestionsKey QuestionsKey QuestionsKey Questions

• How egregious is the deficiency?• What would CMS say about it?• What would CMS do about it?• At what point does the sponsor’s responsibility kick in

when they should inform the government about the deficiency?

• Does the business unit fully understand the implications of the deficiency?

• How much oversight is necessary to ensure the business unit becomes compliant with CMS regulations?

20

ItItItItItItItIt’’’’’’’’s Never Too Lates Never Too Lates Never Too Lates Never Too Lates Never Too Lates Never Too Lates Never Too Lates Never Too Late

• This is a continuous process.– Self-assessments should be completed periodically.• Do the business unit managers know all of the CMS requirements pertinent to their business unit?

• Can they say with 100% certainty that they follow all the requirements?

• Is it possible that they are so focused on one aspect of their unit, they forgot something else?

– Periodic self-assessments aid in reinforcement of important issues.

QUESTIONS QUESTIONS QUESTIONS QUESTIONS QUESTIONS QUESTIONS QUESTIONS QUESTIONS

COMMENTSCOMMENTSCOMMENTSCOMMENTSCOMMENTSCOMMENTSCOMMENTSCOMMENTS

SUGGESTIONSSUGGESTIONSSUGGESTIONSSUGGESTIONSSUGGESTIONSSUGGESTIONSSUGGESTIONSSUGGESTIONS

Scott R. Robinson, CPA

Senior Auditor

10455 Mill Run Circle

Owings Mills, MD 21117

Telephone 410-998-7668

Fax 410-998-7143

E-mail: scott.robinson@carefirst.com