January 10, 2003
MEMORANDUM
TO:
University Executive Administrators
FROM:
Carroll S. Little
Director
SUBJECT:
Fiscal Year 2003 Audit Plan
Enclosed is the Office of the Internal Auditor’s Fiscal Year 2003 audit plan. The President and the Board
of Trustees’ Audit and Legal Committee Chairperson approved the plan in December 2002.
Because quality audit work requires us to interview many people and examine numerous pieces of
documentation, there will be occasions where we will visit, perhaps on short notice, offices under your
authority. However, I will meet with you or your staff before significant audit work is performed in your
respective areas.
The plan is located at http://www.howard.edu/administration/internalauditor/default.htm.
If you have any questions about our audit plan or wish to discuss aspects of the plan, please call me on
(202) 238-2470.
cc:
H. Patrick Swygert (w/o attachment)
HOWARD UNIVERSITY
OFFICE OF THE INTERNAL AUDITOR
AUDIT PLAN
FISCAL YEAR 2003
JULY 1, 2002 - JUNE 30, 2003
NOVEMBER 15, 2002
OFFICE OF THE INTERNAL AUDITOR
AUDIT PLAN – Fiscal Year 2003
July 1, 2002 – June 30, 2003
Table of Contents
APPROVAL LETTERS…………………………………………….....i
President, Howard University
Chair, Audit and Legal Committee, Board of Trustees
INTRODUCTION...….............................................…….…...…..…1
LIST OF AUDITS.................................................…………….…....3
GRAPHIC PRESENTATION OF AUDIT PLAN.........….....….…...4
DATA SHEETS FOR INDIVIDUAL AUDITS...…........……….….10
Assistance to the External Auditors-University......…...........………..11
University/Campus Bookstore Inventory..…….....…............………..12
Grants Administration: Processing Time Analysis.....……….………..13
Financial Aid Office: Program Participation Agreement.....…………..14
Howard University Law School: South Africa
Summer Program………..……….……………………......…..…...…15
Construction Projects..………….….….……………..…….. .…...…..16
Cash Handling Process – Internal Controls.………….…....….....…....17
Education of Principal Investigators Involved in
Clinical Research ……….…..…………….….……….…....…...…….18
Controls Related to Research Projects Covering
Human Volunteers.………………..…………….……...….……..…..19
Use of the “Right to Audit Clause” in University and
Hospital Contracts………………..….…….….….……………..........20
Table of Contents
(continued)
Grants Administration: Federal Drawdowns and Receipt
of Non-federal Funds………….....….………….…………………..21
Risk Management: Identification of High-Risk Program
and Mission Areas………………..….…………...….……..…..……22
Time and Attendance Procedures: Reconciliation of
Department to Payroll Leave Balances……………..…..…...….……23
Special Audit Requests from University Management.…….…...……24
Credentialing Process at Howard University Hospital..………..…….25
Howard University Hospital: Risk Management Process…….………26
Cash Handling Process - Internal Controls….…………..…….……...27
Institutional Compliance Agreement (ICA)….………...………..……28
Assessing the Reliability of Medication Charges to Patients'
Accounts………………..……...…….…….…….…….…..….....…..29
Special Audit Requests from University and Hospital
Management……………………………………………...……..……30
Risk Management: Disaster Recovery – Hospital Information
Technology Function……….………………..….….…….…..……....31
December 31, 2002
MEMORANDUM
TO:
Carroll S. Little
Director
Office of the Internal Auditor
FROM:
H. Patrick Swygert
President
SUBJECT:
Fiscal Year 2003 Audit Plan
I approve your Fiscal Year 2003 Audit Plan. The plan is consistent with our shared commitment to
best practices, efficient and effective administration of University policies, and appropriate use and
dedication of University resources.
Please provide copies to the University Provost, Senior Vice Presidents, Academic Deans, and the
Executive Director of the Hospital for their information.
December 19, 2002
Mr. Carroll S. Little
Director
Office of the Internal Auditor
Howard University
2225 Georgia Avenue, NW
Suite 701
Washington, DC 20059
Dear Mr. Little:
I approve the Office of the Internal Auditor’s Fiscal Year 2003 Audit Plan. The members of the Audit
and Legal Committee of Howard University’s Board of Trustees and I look forward to helping you
implement your plan. Please keep the Committee informed on the results of your audits and reviews.
If the Committee or I can assist you in carrying out your internal audit responsibilities, please feel free to
contact me.
Sincerely,
Gerald D. Prothro
OFFICE OF THE INTERNAL AUDITOR
AUDIT PLAN – Fiscal Year 2003
July 1, 2002 – June 30, 2003
INTRODUCTION
The Office of the Internal Auditor’s Fiscal Year 2003 audit plan is characterized by its emphasis on risk
identification and management, internal reporting assurances, and organizational governance processes.
The plan, which is an extremely aggressive one but one that can be accomplished with the support of
University management, will continue the office's concentration on internal controls that reduce the
occurrence of unwanted and undesired occurrences at the University and the University Hospital. The
plan will take auditors into an area not emphasized in prior audit plans, but has become more and more
the trend in internal auditing -- risk management. To develop this annual plan, the Office of the Internal
Auditor used a formal process to identify, review, set priorities, and select the audits we will perform.
Some of the factors that were used to select the audits were the date and results of the last audit, the
University’s financial exposure and potential for loss, opportunities to achieve operating benefits, the
potential for adverse publicity, and the audit plans of the external auditors. This process also included
participation by all Internal Auditors. We focused on the importance of the University President’s
Strategic Framework for Action II issues that were noted in his Charter Day remarks, the Board of
Trustees’ concerns with the external auditor's Management Letter findings and recommendations, and
input provided to us by the University Vice Presidents, Directors, and Deans.
The Office of the Internal Auditor conducts audits according to established internal auditing standards
promulgated by the Institute of Internal Auditing. The primary objectives of the audit program are to
determine whether:
•
financial and other management information is reliable;
•
funds have been expended and accounted for in accordance with University policies
and governing grant or contract provisions;
•
programs and operations are managed economically, efficiently, and effectively, and,
•
adequate internal controls exist to prevent fraud, waste, and mismanagement.
We plan each audit with an overall objective and specific objectives. At the conclusion of each audit,
we will issue a draft report for management comment. Using these comments, we will hold further
discussions with the auditee or finalize the written report, including management’s comments as an
attachment to the final report. Our report will identify specific recommendations intended to improve
University operations. Our report will also identify efficient and effective management practices that
come to our attention.
-1-
As of July 1, 2002, the on-board complement of the Office of the Internal Auditor was six (6) auditors,
not including the Director and a Secretary. Allowing for growth, the Fiscal Year 2003 audit plan
schedules approximately 5.0 staff-years of effort to be expended on carry-over and new audits. The
remaining time is programmed for annual and sick leave, holidays, audit planning, and continuing
professional development.
-2-
LIST OF AUDITS - FY 2003
Annual Audit Commitments
Assistance to the External Auditors - University
University/Campus Bookstore Inventory
University Audits
Carry-over Audits As of July 1, 2002
Grants Administration: Processing Time Analysis
New Starts
Financial Aid Office: Program Participation Agreement
Howard University Law School: South Africa Summer Program
Construction Projects
Cash Handling Process - Internal Controls
Education of Principal Investigators Involved in Clinical Research
Controls Related to Research Projects Covering Human Volunteers
Use of the “Right to Audit Clauses” in University and Hospital Contracts
Grants Administration: Federal Drawdowns and Receipt of Non-federal Funds
Risk Management: Identification of High-Risk Program and Mission Areas
Time and Attendance Procedures: Reconciliation of Department to Payroll Leave Balances
Special Audit Requests from University Management
-WHUR
Hospital Audits
Carry-over Audits As of July 1, 2002
Credentialing Process at Howard University Hospital
Howard University Hospital: Risk Management Process
New Starts
Cash Handling Process - Internal Controls
Institutional Compliance Agreement
Assessing the Reliability of Medication Charges to Patients’ Accounts
Special Audit Requests from University and Hospital Management
EDP Audits
Risk Management: Disaster Recovery - Hospital Information Technology Function
-3-
-4-
-5-
-6-
-7-
-8-
-9-
- 10 -
DATA SHEETS FOR INDIVIDUAL AUDITS
The following pages identify the functions, projects, programs, organizations, or activities we plan to
audit during Fiscal Year 2003.
The Office of the Internal Auditor will carryover into Fiscal Year 2003 a number of audits that were
opened, but not completed during Fiscal Year 2002. Our carryover resulted from an overwhelming and
very much appreciated number of requests for our services. Requests that we honored included four
requests for special investigations and three requests to participate in focus groups or special studies.
- 11 -
Function, Project, Program, Organization, or Activity
Assistance to the External Auditors - University
Reason(s) Why Audit Is Needed
As per the contract with the University’s external auditors, the fee to conduct the financial audits of the
University and University Hospital is based upon the internal audit department providing approximately
1,500 hours of support.
Audit Objectives:
The objective of this work is to report on the results of audit tests and evaluations that the Office of the
Internal Auditor performs for the external auditors during the annual financial statement audit. Audited
areas included portions of the A-133 audit, subrecipient monitoring, fundraising/contribution activities,
accounts payable, accrued expenses, plant funds, federal appropriations, accounts receivables, and
cash balances. We also perform the National Collegiate Athletic Association (NCAA) financial audit.
Priority: High
- 12 -
Function, Project, Program, Organization, or Activity:
University/Campus Bookstore Inventory
Reason(s) Why Audit Is Needed:
The Office of the Internal Auditor has, in the past, reviewed, observed and verified the Bookstore’s
inventory counts. This work ultimately supports the external audit of the University’s financial
statements.
Audit Objectives:
The objective of this work is to report on the results of audit tests and evaluations that the Office of the
Internal Auditor will perform for the external auditors during the annual financial statement audits.
Priority: High
- 13 -
Function, Project, Program, Organization, or Activity
Grants Administration: Processing Time Analysis
Reason(s) Why Audit Is Needed:
This audit was requested by the University's Provost as part of her efforts to identify and eliminate the
impediments associated with grant and contract proposal processing. An "overarching goal" in the
Strategic Framework for Action II is to "Promote excellence in teaching and research." Within this
overarching goal is the goal to develop a coherent incentive system for faculty research. This incentive
system will work when avoidable processing delays are identified and eliminated.
The Operating Budget for FY 2003 calls for government grants and contracts to provide a revenue source
totaling $52 million dollars, up from $49 million in FY 2002.
Audit Objectives:
The objectives of this review are to: (1) identify inefficiencies, e.g., "bottlenecks", in the pre-award and
post-award grant and contract processes and (2) recommend actions that we believe will allow for more
timely, efficient and effective processing of grants and contracts.
Priority: High
- 14 -
Function, Project, Program, Organization, or Activity
Financial Aid Office: Program Participation Agreement
Reason(s) Why Audit Is Needed:
The Chair, Audit and Legal Committee expressed interest in this issue. The Chair wants the Internal
Auditor to determine and assess the changes that have occurred in the Office of Student Financial Aid since
October 9, 2001, the date the University entered into a provisional approval agreement. The University
entered into a Program Participation Agreement with "provisional approval" with the Department of
Education. The approval's expiration date is June 30, 2003, but the University must reapply for continued
participation in any Title IV Higher Education Act (HEA) programs on or before March 31, 2003.
Audit Objectives:
The objective of our work is to identify and assess the University's actions to gain full and unconditional
approval for its student financial aid program.
Priority: High
- 15 -
Function, Project, Program, Organization, or Activity
Howard University Law School: South Africa Summer Program
Reason(s) Why Audit Is Needed:
The Interim Dean of the Law School requested this audit. The Howard University School of Law Summer
(Abroad) Program is approved by the American Bar Association (ABA) and allows students to earn up to
six semester hours of law school credit while becoming familiar with the "new South Africa". The program
takes place entirely in Cape Town, South Africa and does not entail the use of any Howard University
facilities. The majority of the students are from other ABA approved law schools. The only contacts law
school summer abroad students have with Howard are: registration, fee deposits, and issuance of
transcripts.
Since FY 1996, the total cost of the program is a little more than $546,000. Approximately $140,000 was
attributed to salaries, another $111,000 was charged to "Miscellaneous", and more than $161,000 has been
charged to "Foreign Travel".
Audit Objectives:
The objective of our work is to gain an understanding of and to assess the system of internal controls in
place to control expenditures incurred by the South Africa Summer (Abroad) Program. Our audit work will
determine whether funds were allowable, properly approved and supported with sufficient and competent
documentation. We will also address the reasonableness of specific expenditures charged to the program.
Priority: High
- 16 -
Function, Project, Program, Organization, or Activity
Construction Projects
Reason(s) Why Audit Is Needed:
The Office of Physical Facilities Management tracks construction projects valued at more than $11 million
at any point during the fiscal year. The projects range in value from a few hundred dollars to $2.2 million.
As recent as October 2002, the office was tracking more than 70 projects, excluding the large capital
projects handled by the University's Capital Projects Office.
When auditing this area in FY 1999, we found that job sites were not visited as often as upper management
desired and as a result payments to vendors, in some cases, exceeded what would have been appropriate
for the percentage of work completed. There were instances where contractors did not complete work and
appeared to be not concerned with collecting contract holdbacks. In these instances, the University did not
exercise "remedies" available in contract clauses. We also found instances where jobs were not competed
when University policies required competitive bids and we found instances where it appeared that adequate
planning did not allow for competition.
Audit Objectives:
The audit objectives will include: (1) verifying that contracts were awarded based on competitive bids or
another appropriate basis; (2) determining that work is performed in accordance with contract
stipulations; (3) ascertaining that payments to contractors are in accordance with the contract; and (4)
insuring that payments for escalations, modifications, or overruns are appropriate and approved. If time
is available, we will also review the clarity and comprehensiveness of written contracts.
Priority: Medium
- 17 -
Function, Project, Program, Organization, or Activity:
Cash Handling Process – Internal Controls
Reason(s) Why Audit Is Needed:
This is an annual audit. Cash handling is a high risk and very vulnerable area in any organization and is
highly susceptible to theft when adequate controls are not in place and working as intended. Past audits
of the Cashier's Office have concluded that it is a benchmark operation that handles hundreds of
thousands of dollars each year. Because of its operational volume -- numbers of transactions and the
associated dollar value -- internal controls must be in place and consistently followed.
In FY 2001, we performed a study to identify University locations that "handled" cash or negotiable
instruments, e.g., personal checks, cashiers checks, money orders, etc. Our study identified more than
30 locations that in some way received money that should be properly receipted, documented and
safeguarded before being sent to the University Cashier's Office.
Audit Objectives:
The objective of this audit is to identify and assess the University's internal controls that exist for handling
cash and negotiable instruments. The more important objectives of the audit will be to assess the
comprehensiveness of existing written policies and procedures; to assess the extent to which employees
who handle cash and negotiable instruments are aware of the University's cash handling policies; and to
assess employees adherence to existing cash handling policies and procedures. The audit will include
surprise cash counts that will occur randomly throughout the fiscal year. We intend to visit at least 50
percent of the locations that handle cash.
Priority: High
- 18 -
Function, Project, Program, Organization, or Activity
Education of Principal Investigators Involved in Clinical Research
Reason(s) Why Audit Is Needed:
The National Institutes of Health (NIH) released three notices on June 5, 2001, containing changes and
clarifications of policies in the following areas: (1) education of investigators involved in clinical research; (2)
data and safety monitoring in clinical trials; and (3) financial conflicts of interest for clinical investigators. In
terms of immediate action, the first announcement is the most significant. After October 1, 2001,
investigators submitting annual reports for research and development contracts that involve human subjects
research or non-competing renewal applications for grants must include a description of the Principal
Investigator's education on the protection of human research participants. Also, before funds are awarded
for competing applications or contract proposals involving human subjects, investigators must provide a
description of education completed in the protection of human subjects for each individual identified as "key
personnel" in the proposed research. Obtaining additional research funds is a goal of the President's
Strategic Framework for Action II. Proactive policies and procedures that support this thrust must be put
into place.
Audit Objectives:
The objective of our work is to identify and assess the University's, specifically the Office of Research
Administration's, strategy to prepare for NIH's new educational requirement.
Priority: Medium
- 19 -
Function, Project, Program, Organization, Activity
Controls Related to Research Projects Covering Human Volunteers
Reason(s) Why Audit Is Needed:
This area has never been audited. Federal regulators recently suspended clinical trials at Virginia
Commonwealth University and the Duke Medical Center because Institutional Review Boards (IRBs)
did not provide sufficient oversight of human subject research studies. In the case of Duke, the trials
were halted because it failed to review continuing research projects,"at least once a year". Federal
regulators also indicated that the board lacked formal training on regulations covering human volunteers.
Suspension of the trials not only had a pecuniary impact on the institution, it also "embarrassed" the
institution, according to articles published in the Chronicle for Higher Education.
Audit Objectives:
The objective of this audit is to determine the adequacy of controls over the monitoring of experiments
involving humans. Specifically, we will determine whether the current system of oversight adheres to
University policies and procedures and federal regulations.
Priority: Medium
- 20 -
Function, Project, Program, Organization, Activity:
Use of the “Right to Audit Clause” in University and Hospital Contracts
Reason(s) Why Audit Is Needed:
The University enters into hundreds of contracts and contractual arrangements each year that result in
the expenditure of millions of dollars. Many of the contracts establish relatively short-term
arrangements, but some contracts are multi-year, million dollar arrangements that involve multi-tasking
efforts where the University pays for the contractors' hourly efforts.
Because of questions raised during internal audits about support for contractor invoices, and because of
the uneasiness experienced by University personnel who have approved invoices for payments, the
Office of the Internal Auditor developed and provided to the Materials Management Department
examples of "right to audit" clauses. University officials agreed to consider using the clauses in
contracts where they thought appropriate. The clause, as a matter of policy, is used in government
contracts. We queried other colleges and universities and found that similarly-worded clauses were
included in some, not all, of their larger service-oriented contracts.
Succinctly, the clause requires the contractor to retain and make available to the University or its
representatives the support for all invoices issued under the contract.
Audit Objectives:
The objective of the audit is to determine the extent to which the "right to audit clause" has been used in
University contracts that have a total value of $100,000 or more. If we find that the clause is not
consistently included in the University's larger contracts where we believe the clause would benefit the
University, the audit will then attempt to identify situations where the University would have benefited
had the clause been used. The audit will also look for opportunities where use of the clause can benefit
the University in the future by reducing risk and exposure.
Priority: Medium
- 21 -
Function, Project, Program, Organization, or Activity:
Grants Administration: Federal Drawdowns and Receipt of Non-federal Funds
Reason(s) Why Audit Is Needed:
This will be one of a series of audits we will conduct in the Office of Research Administration area or
research administration related areas. Grant administration is an important area in any organization receiving
large amounts of grant funds. Documentation supporting grant funds received, grantor restrictions, grant
expenditures, and project results must be maintained on file as evidence of the University’s compliance with
grantor wishes and to bolster the University’s ability to receive future grant funds. In the same manner, it is
extremely important for the University to seek reimbursement for its expended costs as soon as fiscally
possible.
The following subject areas will be reviewed in our series of audits:
•
•
•
•
•
•
Receipt of Grant funds
Monitoring of Grant restrictions
Establishment of Grant accounts and budgets
Approval of Grant expenditures
Monitoring of Required Grant reports
Close-Out of Completed Grants
Audit Objectives:
The principal objective of this series of audits is to determine and assess the policies and procedures
associated with the University’s grant administration function. This audit will examine the policies and
procedures that guide the:
•
•
•
Prompt drawing down of federal grant funds;
Prompt invoicing and receipt of non-federal grant funds; and
Establishment of grant accounts and budgets
The objective of this portion of our audit series is to determine that the University requests federal grant
and non-federal grant funds in a timely manner.
Priority: High
- 22 -
Function, Project, Program, Organization, Activity:
Risk Management: Identification of High-Risk Program and Mission Areas
Reason(s) Why Audit Is Needed:
The Office of the Internal Auditor will attempt to provide a new service to the executives of the
University and the Board of Trustees. This new service, which will be refined as it is implemented, is an
attempt to identify the "high-risk" programs and mission areas within the different divisions of the
University and the Hospital. The final selections will be made in consultation with the Board of Trustees
and the Office of the President and coordinated with the Provost and Senior Vice Presidents.
The Office of the Internal Auditor has attempted in the past to direct its audits to University and Hospital
functions that were highly susceptible to fraud, abuse, and mismanagement and/or areas where we
believe the University and Hospital could save funds or decrease expenditures. We believe we have
been successful in doing this and the results of our works have increased management attention on
clarifying vague polices, updating old policies and procedures, and retraining University staff on new or,
in some cases, old, but forgotten or misunderstood management policies and procedures. Where
policies and procedures did not exist, management has developed and implemented them.
Audit Objectives:
The objective of this effort is to identify, for continuous audit monitoring and reporting, University
functions, programs, and activities that are considered "high risk", in accordance with an adaptation of
the criteria used by the federal government's General Accounting Office (GAO).
To determine whether an individual performance and accountability challenge merits a high-risk
designation, we will first determine whether it involves: 1) a program or mission area that is significant to
the University or Hospital (for example, individual goals of the Strategic Framework for Action II or
special areas of interests of the Board of Trustees) or 2) a management function that is key to the
University's performance and/or accountability (for example, the admission's office responsibility to
timely process student applications or the student financial services' responsibility to periodically provide
information to the federal government). Our effort will develop qualitative and quantitative factors to use
when making judgments on University performance and accountability challenges, i.e., University and
Hospital goals and objectives.
Priority: High
Function, Project, Program, Organization, Activity:
- 23 -
Time and Attendance Procedures: Reconciliation of Department to Payroll Leave Balances
Reason(s) Why Audit Is Needed:
As a result of internal audit work that was primarily performed in fiscal years 1999 and 2000, the Office
of Human Resource Management and the Office of the Comptroller began working to develop a more
reliable process to insure that leave balances in University departments agreed with leave balances in the
University's financial records. Of particular importance was the annual leave balances because they are
the basis for accounting record accruals which ultimately appear as a liability on the University's financial
statement. The liability associated with leave balances in fiscal year 2000, alone, was approximately $2
million. Also, we have reported in past audit reports anecdotal instances where individuals have been
paid thousands of dollars more than they were due or were due thousands of dollars for leave that
appeared on department records, but not on the accounting records from which financial statements
were based.
The Office of the Assistant Vice President for Human Resource Management in late fiscal year 2001
and early fiscal year 2002 developed a time and attendance awareness and training program and is
directing the program at University managers, supervisors, and timekeepers. A significant portion of the
overall program and its associated training is intended to reconcile (and to keep reconciled)
departmental and payroll leave balances.
Audit Objectives:
The audit's primary objective is to determine the success of the Office of Human Resource
Management's program and training. Our sub-objectives are to: 1) determine the number of
supervisors, managers, and timekeepers who took the time and attendance training in FYs 2002 and
2003; 2) identify the University offices that reconciled their leave balances to the balances in the
University's accounting records; 3) where appropriate, document the reasons why offices have not
reconciled their balances to the payroll office's balances; 4) test the accuracy of a sample of
reconciliations; and 5) assess the teaching material that was used during time and attendance training.
Priority: High
- 24 -
Function, Project, Program, Organization, or Activity:
Special Audit Requests from University Management
Reason(s) Why Audit Is Needed:
We receive requests for special audits throughout the year from University officials. We budget time to
honor these requests and attempt to perform an audit in an expedited manner. Requests that we
honored during the last fiscal period included four requests for special investigations and three requests
to participate in focus groups or special studies.
Audit Objectives:
Audit objectives will be determined at the time of audit and will be based on management’s needs.
Priority: Medium
- 25 -
Function, Project, Program, Organization, or Activity:
Credentialing Process at Howard University Hospital
Reason(s) Why Audit Is Needed:
Before physicians can treat patients, the Hospital must maintain on file current copies of the following
credentials:
Medical Licenses;
Malpractice Insurance Coverage;
Federal Drug Enforcement Administration (DEA) Certification to Store, Prescribe and Dispense
Control Substances; and
District of Columbia Certification to Store, Prescribe and Dispense Control Substances.
Under certain circumstances, other information must be obtained and verified prior to physicians being
given privileges to treat patients at Howard University Hospital.
Credible information has surfaced that indicated physicians might have been allowed to work for months
before the credentialing process was completed.
Audit Objectives:
To assess the Hospital’s credentialing policies and procedures by selecting a sample of physicians and
ascertaining the timeliness and completeness of their credentialing.
Priority: Medium
- 26 -
Function, Project, Program, Organization, or Activity:
Howard University Hospital: Risk Management Process
Reason(s) Why Audit Is Needed:
KPMG, LLP, the Hospital’s external auditors, addressed the Hospital’s risk management process as a
reportable condition in its FY 1998 Management Letter. The significant issues were that the Hospital’s
Risk Manager position had been vacant since July 1997, and the in-house claims administration
program was not operating in accordance with industry best practices.
The Hospital hired a consulting firm to review specific claims pending against its self-insurance program.
The firm’s report recommended material adjustments to the Hospital’s loss run report – indicating that
the loss run report could not be relied upon, in the consultant’s opinion. The firm’s other findings were
that the Hospital’s risk management approach did not effectively address claims and other issues, and
did not allow for centralized responsibility and accountability.
KPMG made specific recommendations to improve the risk management process at the Hospital.
Audit Objectives:
To determine and monitor the Hospital’s actions that respond to the consultant’s and KMPG’s reports.
Priority: High
- 27 -
Function, Project, Program, Organization, or Activity:
Cash Handling Process – Internal Controls
Reason(s) Why Audit Is Needed:
Cash management is a high risk and very vulnerable area in any organization and is highly susceptible to
theft when adequate controls are not in place and working as intended. Past audits of the Hospital’s
cash management processes recommended improvements to systems that existed at the time of the
audit.
Audit Objectives:
The objective of this audit is to follow-up on the recommendations that were made during past audits
and to determine that existing policies and procedures provide effective controls over the cash handling
processes at the Hospital. Our audit will include a review of the internal controls that exist in the
Business Office, cafeteria, cash processing areas, patients’ accounts, and other areas relating to cash
handling that we determine need review. Surprise cash counts will also be a part of our audits.
Priority: High
- 28 -
Function, Project, Program, Organization, or Activity
Institutional Compliance Agreement (ICA)
Reason(s) Why Audit Is Needed:
On June 26, 2002, the College of Medicine, the Howard University Hospital, and the University signed an
Institutional Compliance Agreement with the Office of the Inspector General of the Department of Health
and Human Services. The agreement was entered into to promote the compliance of the College of
Medicine and the Hospital with the statutes, regulations, and written directives of Medicare, Medicaid, and
all other Federal health care programs as defined in 42 USC 1320a-7b(f). There are significant
requirements under the ICA. For example, under the ICA all employees and contractors, unless specifically
excepted, are required to receive "general" and "specific" training as detailed in the document. The ICA
also requires that "all employees, contractors, suppliers and agents" be screened to determine if they are
ineligible to participate in Federal health care programs or in Federal procurement programs or if they have
been convicted of an offense involving a federal health care program. Another significant requirement is the
retention of an "Independent Review Organization" to perform reviews that assess and evaluate Howard's
billing and coding practices.
Audit Objectives:
The objective of our work is to identify and assess the University's and Hospital's efforts and
accomplishments that were (and are) directed at accomplishing the requirements of the ICA.
Priority: High
- 29 -
Function, Project, Program, Organization, or Activity:
Assessing the Reliability of Medication Charges to Patients’ Accounts
Reason(s) Why Audit Is Needed:
This area has not been audited in several years. The Hospital dispenses at least 720,000 doses of
medication annually and spends approximately $7M to purchase medications. The revenue generated
from dispensing medication to both in-patients and out-patients is approximately $23M. During our
previous audit, we noted omissions, unexplained credits and unexplained charges on patient bills.
Audit Objectives:
The overall objective is to determine that the Hospital charges patients for medication that was
prescribed and consumed. The audit will identify and assess procedures that are in place to insure that
patients are charged for medication actually received and that the unit cost and total cost for the
medication charges are accurate.
Priority: Low
- 30 -
Function, Project, Program, Organization, or Activity:
Special Audit Requests from University and Hospital Management
Reason(s) Why Audit Is Needed:
We receive requests for special audits throughout the year from University and Hospital officials. We
budget time to honor these requests and attempt to perform an audit in an expedited manner.
Audit Objectives:
Audit objectives will be determined at the time of audit and will be based on management’s needs.
Priority: Medium
- 31 -
Function, Project, Program, Organization, Activity:
Risk Management: Disaster Recovery - Hospital Information Technology Function
Reason(s) Why Audit Is Needed:
The Hospital's disaster recovery process has never been audited. The Office of the Internal Auditor is
aware of the preparations that were performed during the University's and Hospital's activities to
prepare for the Y2K effort. We understand that the Y2K work resulted in a disaster recovery plan.
Audit Objectives:
The objective of the audit is to obtain an understanding of the Hospital's disaster recovery plan and the
procedures that the Hospital will implement if a "disaster" occurs. Our initial audit work will not be an indepth assessment of the recovery plan. Our initial work will be characterized by high-level questions
similar to, "What is considered a 'disaster' that will trigger implementation of the disaster recovery plan?',
"Has the plan been tested?", "Will the University use a "hot site?, etc. The results of our initial work will
dictate whether or not the Office of the Internal Auditor seeks outside expertise to perform a more
thorough and technically sound review.
Priority: High
- 32 -
- 33 -