Managing the Risk of Employee Theft

Transcription

1 This tool accompanies Lessons for Financial Success available at mgma.com/lessons. Lessons is a free, easy-to-use guide for office administrators and physicians who manage their own practices but may not have a formal business background. Managing the Risk of Employee Theft Fraud is in the news on a daily basis. Enron, WorldCom, Bernie Madoff and countless other smaller scale frauds are headlines in local and national media coverage. It is impossible to measure how much fraud exists or what portion is caught, but fraud fighters agree employee theft is far more prevalent than what is identified and prosecuted. Small and medium sized businesses, including most medical practices, are particularly susceptible to fraud and embezzlement because too few employees are involved in financial processes to segregate duties. Medical practices also tend to be more trusting workplace environments. It is impossible to completely prevent employee theft. However, medical practices can and should assess their vulnerabilities and take steps to mitigate the risks. This checklist provides an overview of key risk areas for medical group practices. Any no response may be a red flag for employee theft and should be closely evaluated as part of a comprehensive risk assessment. Yes No Control Environment/Tone at the Top Is a fraud risk assessment performed annually? Are results of the assessment reported to the Board of Directors or Audit Committee with a plan for improving the fraud risk management processes? Does a code of conduct exist based on the practice s core values, identifying how employees should seek additional advice when faced with uncertain ethical decisions and how to communicate concerns about known or potential wrongdoing? Are all employees, including providers, trained when hired and periodically thereafter concerning the code of conduct? Does the Board of Directors or Audit Committee secure a periodic review of compliance with established policies and procedures designed to mitigate the risk of fraud? Are ethics, compliance and fraud prevention goals incorporated into management performance measures for evaluation and compensation purposes? Are policies, procedures and processes monitored & tested regularly for compliance? Yes No Cash Receipts Is mail received and opened by someone independent of cashier, accounts receivable and bank statement reconciliation functions? Does the employee who opens the mail restrictively endorse checks as well as copy checks or prepare a detailed list of receipts? Are all receipts processed and deposited in the bank the same day they are received? Is the deposit taken to the bank daily? If not, is it locked up securely overnight? P R Ø Resource Group, PLLC July 2009 Page 1

2 Is the person who posts to the general ledger independent of cash receipts and accounts receivable functions? Does a person independent of the cashier and accounts receivable functions handle patient billing questions? Is the bank reconciliation done by someone independent of deposit preparation, accounts receivable, purchasing, accounts payable and payroll functions? If not, does an owner or independent consultant receive the bank statement and cancelled checks directly from the bank? Are cash receipts per the bank statement reconciled to receipts posted in the billing system and the general ledger at least monthly (preferably more frequently)? Are credit card processing machines restricted from processing refunds to credit cards? Yes No Accounts Receivable/Billing System Are duties segregated such that no one is able to post charges, receipts, contractual adjustments and write offs? Does billing system security parallel job responsibilities, e.g., employees who post charges are restricted from posting receipts, contractual allowances and write offs? If not, are random audits conducted to test if contractual allowances and write offs are proper? Are receipts posted in the billing system reconciled to the deposit and general ledger at least monthly? Are patient billing questions handled by someone independent of charge and receipt posting? If not, are calls routed randomly to more than one person? Does a policy exist specifying how bad debt write-offs are reviewed, approved and posted? Are random audits conducted to test compliance with the policy? Are denials reviewed and researched by someone who cannot post contractual allowances or write offs? Are employees involved in the billing system restricted from deleting transactions? Is there a log or audit file that tracks all deleted transactions? If so, is it reviewed regularly by someone not involved in the billing Yes No Refunds of Patient Accounts Are refund requests reviewed and approved by someone independent of the accounts receivable/billing Is detailed documentation required supporting each refund request? Are refund checks prepared by someone independent of the accounts receivable/ billing system, i.e., someone who cannot post charges, payments, contractuals or write offs to accounts? Are refund checks mailed by someone independent of the accounts receivable For refunds due to patients, is the patient address verified in the billing system before the check is prepared? For refunds due to third parties (e.g., insurance companies) due to duplicate payment, P R Ø Resource Group, PLLC July 2009 Page 2

3 are EOBs and/or patient payments inspected for duplicate payments as part of the review and approval Are refunds posted/coded to a unique category in the billing system and general ledger? Are the billing system and general ledger accounts reconciled monthly? Yes No Cash Disbursements Are voided checks retained? Is the signature line mutilated? Are voided checks per the check register compared to the physical check? Does someone other than the person who processes accounts payable verify that checks listed as void on the check register have not been processed by the bank? Are cancelled checks regularly reviewed for proper endorsement, payee, signature and unusual items? Are vendor names spelled out completely, i.e., acronyms are not used? Is the numerical sequence of accounts payable checks verified by someone independent of the accounts payable Are the supply of checks and signature plates stored in a secure location with access restricted to authorized personnel only? Are printed and signed checks mailed immediately after signing? Does someone independent of accounts payable periodically compare check payees on cancelled checks to payees on cash disbursement journals? Is the person who processes accounts payable restricted from adding vendors and changing vendor information? If not, are audit trail reports routinely reviewed for set up of new vendors and changing vendor information? Do authorized check signers refuse to sign blank checks? Do authorized check signers refuse to sign checks unless valid documentation is provided? Is the following supporting documentation required before a check is signed: the order or approved purchase order, packing slip signed by person receiving goods, vendor invoice? Is access to company credit cards restricted and usage tracked? Is all company credit card activity reported on a single statement detailing activity on each card? Yes No Payroll Are the following duties either outsourced or segregated: payroll preparation, distribution of checks, disbursement of withholdings and payroll taxes, bank reconciliation, approval of hours? Are personnel records maintained independently of payroll & timekeeping functions? Is the payroll accounting function independent of the general ledger function? Are payroll checks pre-numbered and issued in numerical sequence? Is numerical sequence verified and are voided checks inspected during the bank reconciliation Is the payroll bank account reconciled by someone independent of payroll check P R Ø Resource Group, PLLC July 2009 Page 3

4 processing, signing checks and distributing checks? Are cancelled check endorsements scrutinized as part of the bank reconciliation Are direct deposit transfers made or authorized by someone independent of payroll processing? Are the supply of checks and signature plates stored in a secure location with access restricted to authorized personnel only? Yes No Expense Reimbursement Are expense reports required to include the following information: original receipts, business purpose, nature of expenditure, time period, place of expenditure, amount? Are employees required to submit one expense report for each incidence of travel? Are expense reports carefully scrutinized and approved by someone who is not involved in payroll processing? If employee reimbursement is included on direct deposit paychecks, are reimbursements scrutinized and approved by someone not otherwise involved in payroll processing and/or scrutinized as part of the bank reconciliation Yes No Human Resource & Hiring Functions Are employees involved in the cash receipt and accounting processes required to take vacations? If so, does someone else perform their job functions when they are gone? Are references checked for at least the past 5-10 years on all employees before they are hired? Are background checks conducted on key employees (especially those involved in financial/accounting processes) before they are hired? If background checks are conducted, internally or by an outside firm, are steps taken to assure legal compliance, e.g., with the Fair Credit Reporting Act and other laws and regulations? Are credit checks conducted on key employees involved in the financial process before they are hired? If so, are they also done every 1-3 years after hire or for employees promoted internally to a key financial position? If degrees or credentials are a key element for a position, are candidates credentials verified before they are hired? Yes No Identity Theft & Medical Identity Theft Is a policy in place to prevent, detect and mitigate identity theft and medical identity theft? Is government issued photo identification checked & verified on all patients when they check in? If the address does not match other practice records, is a recent utility bill required to verify address? P R Ø Resource Group, PLLC July 2009 Page 4

5 Are employees trained to recognize identity theft red flags, particularly employees checking in patients? Is a policy in place for investigating and documenting reports of identity theft? Is a policy in place for verifying changes of patient address? Is compliance with these policies monitored and documented? Are employees trained at least annually in the practice s policies & procedures? Yes No IT Controls Is a risk assessment performed at least annually addressing confidentiality, integrity and availability of IT and communications systems? Is access to computer systems restricted such that users have access only to those elements of the system(s) necessary to complete assigned functions? Is there a written policy or set of standards defining what the practice considers unacceptable or unauthorized use of networks, applications, hardware & software? Are passwords required to be changed at least quarterly in accordance with a written policy? Are employees required to maintain confidentiality of their passwords? Are passwords required to be at least 8 characters consisting of letters, numbers and other characters? Is computer system access of terminated employees revoked or disabled immediately upon termination of employment? Are group passwords and sharing of passwords prohibited? Is this policy enforced? Are network servers and other communications hardware physically secure (in a locked room) with access restricted only to those who require it. Is the system administrator password restricted to one or two individuals not involved in the accounting Does an owner have access to it (e.g., in a sealed, signed envelope) in the event the custodian(s) of the password are terminated or otherwise unavailable in an emergency? Is intrusion detection hardware and software in place for network and communication resources? Are exception reports and violation reports/logs reviewed regularly by appropriate personnel? Does the practice have a back up policy that includes off site storage of backups? Is the back up restore process tested periodically? Are programmers restricted from having unsupervised access to production programs and data files? Are program users restricted from access to program code/source code? This checklist was created by Denise McClure, CFE, CPA, President, PRØ Resource Group, PLLC, a consultant specializing in fraud risk management designed to prevent, detect and deter employee theft. In addition to public accounting experience, Denise was a medical group administrator for 18 years prior to becoming a full time fraud fighter. Denise can be reached at 208/ or Denise@pro-resource-group.com. P R Ø Resource Group, PLLC July 2009 Page 5