Continuous Auditing at HCA Fifth Continuous Assurance and

Continuous Auditing at HCA Fifth Continuous Assurance and Auditing Symposium Chase Whitaker, CPA Audit Director HCA, Inc. Internal Audit & Consulting Services November 22, 2002 1

Overview § § About HCA Potential Areas for Continuous Auditing Lessons Learned – Diverging Paths HCA Automated Tools Developed & Next Steps 2

About HCA § § § § 180 hospitals 70 surgery centers 23 states, England, & Switzerland $18 B total assets $18 B annual revenue $2 B EBDITA 170, 000 employees 140 Internal Auditors 3

HCA Internal Audit Continuous Auditing Mission Statement Develop a continuous auditing methodology that will help management accomplish the strategic goals and objectives of the company through risk mitigation. This methodology will include: § Identifying key risk indicators related to Ø achievement of business objectives, Ø reliability and accuracy of financial information and Ø compliance with laws, regulations and company policies. Ø IT system and interfaces. § Designing automated processes, tools and a management reporting system to enable Internal Audit to continuously monitor these key risk indicators. 4

Challenges § § § § Significant investment in R&D and QA process What, when, and how to test Level of assurance – attestation vs. exception reporting FTEs needed for preparation and review IT resources (Organization & Internal Audit) IT infrastructure Acceptance by organization management teams (e. g. difference in deliverables, commitment to respond) § Change management 5

Other Considerations § § § Strength of operations management Audit universe Understand key organizational risks Clearly defined audit objectives - Avoid “scope creep” Design “exception only” reports 6

Technology Tools Evolution § Currently used by HCA Ø Data downloads with Focus Ø ACL processing Ø Excel presentation Ø E-mail delivery § Future? Ø Data tags (e. g. XML) Ø Application intelligent agents Ø Embedded audit modules Ø Application or intranet “real time” reporting 7

Potential CA Areas § General ledger vs. subsidiary ledger balances § HR, Payroll, and Benefits § Unnatural or unexpected balances, transactions, statistics &/or relationships § Clinical or other operational trends/indicators § Information technology trends/indicators § Regulatory compliance § Adherence to system master file standards § Cash disbursement transactions/trends § Purchasing/inventory quantities, pricing, activity § Third party relationships 8

Silver Bullet Solutions 9

Lessons Learned - Diverging Paths § Continuous Audit Ø Deviations easily defined and explainable Ø Reports delivered following occurrence § Continuous Risk Assessment/Monitoring Ø Knowledge gathering and trending Ø Limited or no CA reports to management Ø Results may impact audit plan decisions Ø Time intensive to research initial results Ø Spurs ideas for new tests 10

Automated Tools Developed – Accounts Receivable § Monthly comparison of A/R on subsidiary system to G/L control accounts to identify out-of-balance conditions. § Monthly comparison of patient A/R aging buckets on subsidiary system to G/L allowance for doubtful accounts control account to identify potential under reserves. § Quarterly analysis of Medicare cost report settlement account transactions § Periodic analysis of negative receivables 11

Automated Tools Developed – Human Resources/Payroll § Quarterly analysis of invalid Social Security Numbers Ø Compare all SSNs to permissible Area and Group numbers Ø Search for ascending/descending SSNs Ø Search for serial numbers with all zeroes Ø Look for SSNs used in marketing Ø Consider SSNs Employee Verification Service (EVS) 12

Automated Tools Developed – Human Resources/Payroll § Analysis of unusual vacation/paid-time-off taken & available Ø Limited or no PTO hours Ø Terminated employees with remaining PTO balance Ø PTO banks in excess of corporate limits § Analysis of unusual hourly rates, regular and OT hours, and/or gross earnings § Active employees without YTD earnings § Full time employees averaging less than 32 hours/wk § Incomplete or inconsistent key dates (e. g. DOB > DOH) 13

Automated Tools Developed – Patient Account Service Centers § Trending graphs & analysis of: Ø “Promise to Pay” codes aged greater than 60 days Ø Average days to bill Ø Final bill alert exceptions Ø Insurance greater than 90 days § Daily analysis of selected master file settings § Comparison of credit balances – subsidiary system vs. management reporting system 14

Automated Tools Developed – Patient Account Service Centers First month results communicated to management 15

Automated Tools Developed – Assets/EBDITA Analyses § Changes to goodwill and related amortization accounts § § Review for non-performing assets &/or dormant entities Analysis of unusual general ledger/financial reporting activity Review entities with significant asset/EBDITA changes Review entities having assets but without earnings & vice versa 16

Automated Tools Developed – Vendors/Accounts Payable § Bio-Med & Diagnostic Imaging equipment servicing inventory and billing Ø Duplicate records Ø Trend charges Ø Erroneous/illogical data elements § Duplicate payments: Ø Trend and report problematic vendors, facilities, employees, etc. Ø $17 million prevented or recovered to date – reduces/ eliminates need for review by 3 rd party vendor 17

Automated Tools Developed – Other § Daily analysis of changes in consolidation indicators including any consolidating “test” entities § Monthly analysis of daily cash transfers from facilities to corporate treasury function 18

Next Steps § Dedicate FTE(s) to audit information generated from our automated tools § Develop an expedient management reporting process § Continue development of new automated tools and audit procedures for areas such as: Ø Adherence to system master file standards Ø Employee benefits Ø Purchasing/Inventory (inventory quantities, warehousing metrics, SKU usage, billing of high-cost supplies, etc. ) Ø Cash disbursements Ø Laundry/linen expenses 19

20

Contact Information Chase Whitaker Audit Director HCA, Inc. Internal Audit & Consulting Services (615) 344 -5973 Chase. Whitaker@HCAHealthcare. com 21