Lauren Sundararajan, CFE, Internal Audit Manager

Transcription

1 Interdepartmental Correspondence Sheet Date: June 17, 2016 To: From: Copies to: Subject: Harry Black, City Manager Lauren Sundararajan, CFE, Internal Audit Manager Internal Audit Committee Reginald Zeno, Finance Director Attached is the Workers Compensation audit report. The primary objective of this performance audit was to determine the effectiveness of the City in assessing and reducing workers compensation claims. This audit was completed in accordance with Internal Audit s current work plan. If you need any further information please contact me. Attachment

2 June, 2016 Lauren Sundararajan, CFE Internal Audit Manager Ann Herzner Internal Auditor

3 City of Cincinnati Table of Contents Executive Summary I. Introduction Background Audit Selection Audit Objective Audit Scope and Methodology Statement of Auditing Standards Commendations 1 2 II. III. IV. Audit Findings and Recommendations Conclusion Finance Department Response i

4 City of Cincinnati Executive Summary Internal Audit (IA) conducted an audit of the Workers Compensation Program in the Risk Management Division (RM). The audit objective was to determine the effectiveness of the City in assessing and reducing workers compensation claims. Injury prevention programs are vital to the operations of any organization. They play an important role in reducing the number of workplace injuries and costs each year. The most successful injury prevention programs are based on a common set of key elements. This includes management leadership, worker participation, hazard identification, hazard prevention and control, education and training, and program evaluation and improvement. 1 IA found Risk Management does not provide proper oversight to accurately monitor safety policies and procedures based on the current structure in place within the City of Cincinnati. This includes minimal involvement in reviewing safety procedures, and not maintaining copies of the department s safety plans. IA also reviewed Administrative Regulation 65. Its purpose is to clarify the departmental requirements for basic safety procedures, and to help reduce work related injuries. The policy refers to the City s compliance with the Occupational Safety and Health Administration (OSHA) minimum standards; however, it does not specifically state the standards. Having this information available to City employees is imperative to the City s safety environment and helps eliminate unnecessary risks. Near miss data collection and analysis is a critical component of the risk management process. IA found that RM does not record or track near miss incidents, leaving the responsibility to the Division Heads. Without having this information shared and available to analyze, RM is unable to calculate all of the risk associated with the work environment. According to the Coalition Against Insurance Fraud, an estimate of $80 billion in fraudulent claims are made each year in the United States. 2 IA found there was no citywide policy for addressing workers compensation fraud that will aid in the detection and prevention of fraudulent claims. Performance measures are used to indicate operation effectiveness. Best practice indicates there are several ways to measure the success of a self-insured Workers Compensation Program. IA found RM does not clearly define performance goals. This could include analyzing closing ratios or determining caseload reasonableness. Without having performance measures in place, RM is unable to accurately gauge whether the program is operating to its maximum efficiency. Overall, the audit revealed several opportunities for RM to increase its performance. IA recommends proper monitoring over the City s safety policies, reporting and tracking all near miss incidents, instituting internal controls to segregate duties, establishing a comprehensive fraud policy, documenting the methodology used to create the funding appropriation for workers compensation, and defining performance measures and goals. By addressing these areas, RM will create a more efficient and effective operation for reducing workplace injuries and decreasing workers compensation claims. 1 Training Requirements in OSHA Standards

5 City of Cincinnati I. Introduction Background Employee Safety (ES) and Workers Compensation (WC) are located in the Division of Risk Management. The two sections overlap when they process injury related information, which is used to assist with tracking injuries and reporting requirements. Employee Safety Employee Safety provides guidance to City departments through safety knowledge, training development, and safety audits. The section consists of three employees. Its policies and procedures are governed by the Public Employment Risk Reduction Program (PERRP), OSHA standards, and the City s Employee Safety Instruction Manual (aka Green Book). Risk Management established a City Safety Committee for ES to provide guidance, direction, and set priorities based on city-wide criticality and need. The committee meets quarterly and is attended by representatives from various departments. City departments are responsible for budgeting capital and expense items, and approving the expenditures of funds to support safe work processes. This includes training, certifications, and other means to support safe working environments. Workers Compensation In 2003, the City switched from a state funded WC Program to a self-insured program, becoming one of the first public employers to elect self-insurance. This means that, though the City must comply with Ohio Bureau of Workers Compensation (BWC) standards and regulations, the City administers and pays out their own claims, rather than rely on the State to pay the claims on the City s behalf. After the City became self-insured, it contracted some of the administrative duties associated with the program. This included claim administration, bill review, nurse case management, and hearing representation. Matrix Claims Management, Inc. has been the third party administrator since 2012, and continues to perform the necessary administrative functions. The WC budget is calculated by reviewing previous years expenses and the City s payroll to help estimate the amount needed for the current year. The average amount of money spent per year on workers compensation claims for the last five years was approximately $3.86 million. 2

6 City of Cincinnati Audit Selection IA conducted this audit as part of the FY16 audit agenda. Audit Objective The primary objective of this audit was to determine the effectiveness of the City in assessing and reducing workers compensation claims. Audit Scope and Methodology To accomplish this audit, IA reviewed pertinent policies and procedures, interviewed relevant staff members, analyzed data, examined reports from , and reviewed contracts related to workers compensation. IA also reviewed applicable local, state, and federal laws. Statement of Auditing Standards As required by the Cincinnati Administrative Code Article II 15, this audit was conducted in accordance with the Generally Accepted Government Auditing Standards (GAGAS), except for standard 3.96 pertaining to external peer review requirements. This exception did not have a material effect on the audit. IA continues to conduct internal quality reviews to assure the conformance with applicable GAGAS. IA performed the fieldwork between January 2015 and April Commendations IA would like to thank the Finance Department for their cooperation throughout the audit process. 3

7 City of Cincinnati II. Audit Findings and Recommendations Injury prevention programs are vital to the operations of any organization. They play an important role in reducing the number of workplace injuries and costs each year. The most successful injury prevention programs are based on a common set of key elements. This includes management leadership, worker participation, hazard identification, hazard prevention and control, education and training, and program evaluation and improvement. 3 Risk Management does not provide proper oversight to accurately monitor safety policies and procedures. An oversight body is responsible for overseeing the strategic direction of the entity and obligations related to the accountability. This includes overseeing management s design, implementation, and operation of the internal control system. IA found several examples where RM could improve their role in effectively monitoring department s safety policies and procedures. The Employee Safety Instruction Manual recommends each City department establish a clear plan of safety goals and objectives, because it is the policy of the City that no person shall ever be required or allowed to work in unsafe conditions. IA found that RM has minimal involvement or oversight in reviewing safety procedures, and they do not maintain copies of department safety plans. The lack of monitoring prevents RM from gauging compliance with established policies and laws. IA also reviewed Administrative Regulation 65. Its purpose is to clarify the departmental requirements for basic safety procedures, and to help reduce work related injuries. The policy refers to the City s compliance with OSHA minimum standards; however, it does not specifically state the standards. Having this information available to City employees is imperative to the City s safety environment and helps eliminate unnecessary risks. Administrative Regulation 65 also discusses the role of the Safety Committee and their purpose. Unfortunately, not every department is represented on the committee and privileged to the information. Having all departments represented entails successful communication of pertinent safety risks to all City departments. Recommendation 1: RM should monitor and maintain proper documentation of departments who established safety plans. This enables them to review documents for accuracy, and update regulatory information, as needed, and enforce safety policies and procedures. Recommendation 2: RM should update Administrative Regulation 65 and disclose all of the minimum standards set forth by OSHA. This will ensure all departments have access to the federal guidelines that the City adheres to and make changes to their departmental policies and procedures, as necessary. Recommendation 3: RM should include representatives from all City departments to be members of the Safety Committee. This will entail effective communication between RM and all City departments that outlines pertinent safety risks and hazards in the work environment. 3 Training Requirements in OSHA Standards 4

8 City of Cincinnati Recording and tracking of near miss incidents did not occur. When a City employee sustains a work-related injury, the injury is reported to their immediate supervisor. The supervisor documents the injury by completing the Supervisor s Investigation of Employee on the Job Injury or Illness Form (Form 91-S). Per Green Book policy No. 101, Division Heads are responsible for reviewing near miss incidents, which is defined as an unplanned event that did not result in injury, but had the potential to do so. 4 However, IA found the information is not reported to and tracked by RM. Near miss data collection and analysis is a critical component of the RM process. Examining near miss incidents can help identify what went wrong and provide data for improved policies, procedures, and training. Failure to report near miss incidents to RM for monitoring creates an ineffective injury prevention program, because RM is unable to calculate all of the risks associated with the work environment. History has shown repeatedly that most loss producing events (incidents), both serious and catastrophic, were preceded by warnings or near miss incidents. 5 Recommendation 4: RM should update Green Book policy No. 101, and work with City departments to ensure all near miss incidents are documented and reported to RM. This will allow RM staff to carefully monitor, track, and analyze any unsafe work environments. Proper segregation of duties did not exist in Risk Management. Segregation of duties is a key concept of internal controls that helps prevent error. In order to maintain proper segregation of duties, no single employee should have the ability to create, execute, and monitor activities within a function. IA found there is one employee assigned to WC who provides a variety of services both internally and externally. Some of the duties include reviewing and certifying new claims, approving hearing invoices prior to issuing payment, and preapproving nurse case management. The small size of RM can pose challenges; however, mitigating controls should be in place when circumstances do not allow for proper segregation of duties. For example, additional oversight or monitoring controls conducted by someone not involved in the reviewing, processing, and payment of claims would be acceptable. Recommendation 5: RM should review the workers compensation claims process and implement proper internal controls for segregation of duties. A comprehensive workers compensation fraud policy was not established. Solid policies and procedures are necessary to maintain proper internal controls and to ensure an effective and efficient operation. Without these policies, the City increases its risk of fraud, waste and abuse. IA found there is no citywide policy for workers compensation fraud that would assist departments with identifying and detecting fraudulent injuries. 4 Near Miss Reporting Systems 5 Near Miss Reporting Systems 5

9 City of Cincinnati IA also found that RM has not established adequate internal procedures for their role in processing potential fraudulent claims. The City contracts with Matrix to process workers compensation claims, and they offer a variety of services used to detect fraud for additional fees. These services are vital for pursuing fraudulent claims and consist of background checks and investigations, surveillance, undercover operations, and fraud and abuse training. Per RM administrative guidelines, the RM employee should contact Matrix if suspected information has been obtained. However, the guidelines do not address who should be interviewed, what documents should be obtained, and how the information should be complied and analyzed to determine if additional resources are needed by Matrix. A lack of written procedures outlining the specific steps necessary to identify fraudulent claims leads to RM inability to detect and prevent them. Recommendation 6: RM should establish a citywide workers compensation fraud policy. The policy will provide guidance to supervisors to detect and prevent fraudulent injuries. Recommendation 7: RM should develop and document an internal procedure used for processing fraudulent claims. This entails how cases are investigated, reviewed, and analyzed. RM should also define the criteria used to refer a case to Matrix. The methodology used to create the funding appropriation was not documented. The workers compensation budget is calculated by reviewing previous years expenses and estimating an amount needed for the current year. The payroll from the prior year is used to determine the proportionate charge to each fund. Each fund is billed its proportionate share and the money is deposited into Internal Service fund 213 to pay workers compensation expenses. IA inquired with Finance staff regarding the process or methodology used to create the funding appropriation for workers compensation. IA found internal documentation was not maintained, and RM personnel did not have sufficient knowledge of this process. Creating and maintaining proper documentation of internal policies and procedures are necessary to ensure an operation is effective. Without establishing a written process or methodology for capturing accurate data, the risk of overestimating or underestimating increases. Recommendation 8: The Finance Department should maintain internal documentation used to create the funding appropriation. Recommendation 9: RM personnel should be knowledgeable of the funding appropriation process managed by other divisions within the Finance Department. Performance measurements and goals were not clearly defined. The foundation for a successful Workers Compensation Program is goal setting. Benchmarking provides a formal framework for setting goals, measuring performance, and achieving results. Measuring performance is also a control activity. This allows the organization to compare and assess different sets of data so that an analysis can be made and appropriate actions are taken to achieve the organization s goals. 6

10 City of Cincinnati IA reviewed the total number of new claims filed with the City each year. The chart below shows the number of new claims filed per year over a five year period. Claims filed Workers' Compensation Claims Filed Total no. of claims filed Source: Matrix Claims Management, Inc. IA reviewed the City of Cincinnati s FY16 FY17 approved bi-annual budget performance agreement for the Finance Department, and found RM has not clearly defined WC performance goals. This could include analyzing closing ratios, which shows how quickly claims are resolved, or determining if caseloads are reasonable. Currently, RM has one employee who processes over 400 claims per year. Best practice dictates that organizations should measure the success of its WC program on an on-going basis by setting performance goals. Solid Workers Compensation Programs are managed in a manner that focus on achieving goals, performance and results. Establishing performance metrics based on data and ratios is necessary to the success of the program s operation. Recommendation 10: RM should establish goals that measure the performance of the Workers Compensation Program. This could include evaluating closing ratios and accessing the caseloads. RM does not routinely train Safety Liaisons. RM relies heavily upon Safety Liaisons for a variety of functions. This includes discussions of safety-related issues at the department level, and injury reporting information. IA found that some Safety Liaisons work full time in a department s safety unit or function, whereas others split their time between administrative responsibilities and safety-related issues. IA met with representatives from five departments and found there was no routine training performed by RM to keep all Safety Liaisons abreast of injury reporting requirements, safety trends, and other pertinent information that allows them to succeed in their roles. 7

11 City of Cincinnati In addition, IA found through interviews that the injury reporting process poses challenges for RM staff. IA found there are delays in the current operation. This includes the entering of injury information into CHRIS, incorrect pay codes being used, and incomplete 91-S Forms. RM has provided some training upon the department s request. This was to assist the liaisons with injury prevention techniques and how to respond to workplace injuries. Unfortunately, the risk for errors remains high, because RM does not routinely train the liaisons. Effective communication through the use of routine training is essential to key personnel involved with the process. Recommendation 11: RM should implement a comprehensive training program for all Safety Liaisons. On-going training should be performed by RM staff on a routine basis and address the key issues in the reporting process. 8

12 City of Cincinnati III. Conclusion Providing an effective Workers Compensation Program is necessary for any organization. It serves many employees each year and costs the City millions of dollars. The program s success depends on having the essential internal controls in place to properly manage its daily operations. The audit revealed several opportunities for Risk Management to increase its efficiency and performance. This included monitoring the City s safety policies, recording and tracking of all near miss incidents, establishing a comprehensive fraud policy, documenting the methodology used to create the funding appropriation for workers compensation, defining performance measures and goals, and providing routine training for Safety Liaisons. Implementing these tools will promote an efficient and effective Workers Compensation Program and reduce workplace injuries. 9

13 City of Cincinnati IV. Finance Department Response 10

14

15

16

17

18

19

20

21

22