Evaluation Processes, Investigations, and Noncompliance Responses Flashcards
What is Internal Monitoring?
The U.S. Sentencing Commission Guidelines Manual and OIG support auditing and internal monitoring as vital components of an effective compliance program. The joint publication by the HHS OIG and American Health Law Association—The Health Care Director’s Compliance Duties—affirms the importance of auditing and monitoring, stating that, “Monitoring and auditing provide early identification of program or operational weaknesses and may substantially reduce exposure to government or whistleblower claims.”[6] Additionally, the COSO risk management model places monitoring as one of five principal components of good risk management and control practices. COSO looks to monitoring to help ensure “that internal control continues to operate effectively.”
Auditing and internal monitoring are processes to measure program effectiveness and detect criminal conduct. While auditing is a formalized independent approach to measuring effectiveness, monitoring is not. Internal monitoring can be daily reviews of a process by an employee at any level throughout the organization, and the individual performing the monitoring does not have to be independent of the activity. Monitoring is needed to ensure controls are in place and operating effectively. Monitoring also assures accountability by steering behavior toward compliance, alerting management to potential concerns (such as a breakdown in controls so that corrective action may be taken), highlighting areas of risk within the organization, and allowing management to report on the overall effectiveness of the compliance program. The compliance department may be responsible for some monitoring activities, but the function primarily depends upon management to report internal monitoring results based on a predetermined schedule. All internal monitoring activities should be well documented. The results should be captured, and any action taken should be memorialized. It is through documentation of monitoring activities as part of the seven elements that the compliance function demonstrates program effectiveness.
Internal monitoring will assist an organization in exposing potential issues before they become a compliance risk requiring investments of time and money to determine the nature and extent of the problems. An analysis of risks within an organization should begin with a prioritized list of regulatory exposures and can be delegated by department or functional area. As previously noted, any employee within the organization can be assigned a monitoring activity depending on their subject matter expertise. Once the risks for the organization have been assessed, the auditing and monitoring plan is developed. Internal monitoring should be woven into the fabric of the organization and used to promote an ethical culture from the top down. All levels of management should be involved in monitoring activities for their assigned areas based upon the high risks within their area. Monitoring can be as simple as an employee reviewing the work of a new employee for three to six months to verify that new employee’s education is appropriately applied to the job.
Other examples of internal monitoring activities include the following:
A coding supervisor reviews five accounts per week that have been coded by a new inpatient coder to ensure appropriate application of coding rules and understanding of medical terminology.
A compliance employee monitors physician timecards for medical directorship payments to ensure all required fields are completed and the time submitted to accounts payable is within the contract limits.
A registration supervisor monitors a number of new patient registrations per week using a checklist to verify that the required acknowledgment for the Notice of Privacy Practices has been scanned and also that other required registration documents are present.
Another example of internal monitoring is establishing internal controls that alert the organization to variants in their processes. Again, an employee of the functional area can be assigned to monitor the internal controls and report on any skews or trends in the data.
It is important to note that monitoring does not replace auditing. The two are very distinct processes. The ongoing auditing of operations needs to be performed by parties independent of those operations. This will ensure objectivity in performing the audits. The audit objectives are to determine whether the monitoring program is operating as it should and that adopted policies, procedures, and internal controls are adequate and their effectiveness is validated in reducing errors and risks.
Remember, monitoring is a form of self-assessment that can be performed at any level within any healthcare organization to strengthen the culture of compliance with the policies, procedures, rules, and regulations that govern the healthcare industry.
Why and How should you partner with stakeholders when developing and monitoring plan?
The best auditing and monitoring programs are also opportunities for teaching and collaborating with stakeholders. In designing a monitoring program for a process or functional area, the stakeholders whose work will be monitored should be involved from the beginning. Monitoring can take many forms, so be flexible and open to ideas. Gather stakeholder feedback on the scope (i.e., what will be monitored) and procedures (i.e., how the evaluation, documentation, and follow-up will take place). Take the opportunity to educate business partners about applicable legal, regulatory, and other requirements; the importance of compliance; and the role of monitoring in preventing problems.
Risk assessment is integral to developing a valuable monitoring program.[8] Operations staff have a critical role in defining the risks that will drive the scope of monitoring. Through these conversations, compliance staff should also seek to gain a practical understanding of the business partners’ workflow, operational needs, and day-to-day challenges. This lends important context to the monitoring program and helps compliance professionals recommend not only actionable remedies for any issues in need of correction, but also relevant strategies for quality improvement. When monitoring moves beyond finding and fixing problems and into a collaborative conversation about how to mitigate future risks and streamline business processes, everybody wins.
Before engaging in monitoring activities, let business partners know time expectations for their preparation and monitoring process. Ask them how much time they spend throughout the process, and track this information so that future estimates are based on real-life data. Demonstrating respect for business partners’ time helps set a collaborative tone from the start.
Provide the criteria to be used to evaluate compliance well before monitoring begins. If possible, have a premonitoring meeting with business partners to discuss the criteria and establish a shared understanding of how they relate to key risk areas for the organization.
Specify what compliance staff will need business partners to provide or do (e.g., documentation, observation of an event, interviews with particular individuals) to verify that each criterion is met. This makes the process transparent, streamlines preparation, and opens the door for discussion of any questions or concerns before monitoring activities begin.
Monitoring meetings conducted in person can be a great way to connect with business partners and establish solid working relationships. In advance of the monitoring meeting, let business partners know that it is a two-way exchange, and encourage them to bring compliance questions that may be unrelated to the specific monitoring activities. Encourage business partners to invite someone from their area to the meeting, as it is often the frontline employee who may be tasked with some of the monitoring activities. The frontline employee should understand the purpose of the assignment. Through words and actions, reinforce the idea that the compliance program is a partner to them with similar goals—to work as effectively and efficiently as possible while maintaining compliance. Keep the following in mind when preparing for meetings:
Schedule sufficient meeting time to allow the conversation to expand.
Point out areas of success in addition to any corrective actions needed.
Discuss long-term quality-improvement goals and ask how compliance can lend support.
Ask about any training or education needs and make a plan to address them.
Have a point-of-contact compliance professional in attendance who will be available to answer questions and follow up after the meeting.
The OIG points out that open lines of communication are a product of an organizational culture that encourages open communication without fear of retaliation.[9] Transforming an interaction like compliance monitoring (which can sometimes be viewed as intimidating or punitive) into a productive, forward-thinking dialogue can do wonders to build an organizational culture with strong relationships and free-flowing communication between compliance and the operational departments. This will help business partners feel more comfortable reaching out to compliance in the future as questions or issues emerge and before those issues become serious.
Monitoring meetings may reveal reports already used by management each day to manage operations. These reports may be used to detect issues and could be used as evidence of detective monitoring for compliance. Further discussion with business partners may reveal daily activities resulting in highlighting and correcting mistakes. The activities could be captured in a report as evidence of preventive monitoring. In all likelihood, monitoring is already occurring in the organization, and compliance may need to educate the business partner on how to capture the monitoring efforts in a format to demonstrate compliance effectiveness.
How can Employee Interviews and Surveys be used to monitor compliance?
Employees are a wealth of knowledge who can help drive or supplement monitoring activities and who often enjoy participating in their organization’s improvement processes. Thus, they can offer an unexpected amount of information about an organization’s risk areas. Ask them openly about risk, their daily activities, and the processes and procedures they follow and the soundness of each. In addition to targeted interviews, periodically send out questionnaires to staff for feedback or conduct focus groups. Remember always to reassure employees that the organization maintains a strict nonretaliation policy and that employees will not be retaliated against for reporting suspected misconduct.
At performance review time, ask employees if there are any areas of potential wrongdoing or noncompliance. Pose compliance-related questions in employee exit interviews to identify potential risks. Here are some sample compliance-related exit interview questions:
Do you think the organization lives up to its code of conduct?
Did you have any concerns about ethical issues or compliance-related practices? If so, please explain.
Did you have any hesitation in raising any issues in your chain of command?
Would you go around your chain of command if there were areas you felt weren’t being addressed?
How can training be monitored for effectiveness?
Training is an area that should be monitored. Effective training can help ensure compliance within the organization. Monitoring training effectiveness should be included on the monitoring plan. Although training may appear to be straightforward to most healthcare leaders, the effectiveness of follow-up is anything but clear-cut. After training is completed, the primary focus is on the individual employee’s behavior. Did the employees learn the material, and can they use it effectively in their current or future roles? If at the end of the training program there is a certification test, the goal is to have all trainees pass. If there is no official certification test, management still wants some type of assurance that employees have learned the course material and know how to apply it. How does management gain that assurance?
Effectiveness requires one to validate the results in a meaningful way to determine if employees learned the material. If they have not, technical or other assistance may be provided before the participant moves on to the next subject or more advanced training modules. Training is always done with specific objectives. Validating through measurable metrics based on specific objectives gives leaders the answers they need regarding the training’s effectiveness.
When participants do retain information from training sessions, the metrics should prompt the instructor to revise the training material or deploy a different training methodology. If the desired results are generated with other instructors, perhaps the instructor requires additional mentoring or training.
Often, organizations may provide participants with a course evaluation form when training is completed. This is an effortless way to get feedback, but it is not the best way to measure the training’s effectiveness. Some organizations have moved post-training feedback evaluations to a new level, one in which the content of the training is evaluated with an assessment as to whether the participant’s post-training knowledge is greater than pre-training knowledge.
Commonly referred to as knowledge assessment, it measures knowledge retention long beyond the “pass the test” phase—at least six months post-training. When the long-range objective is to affect behavior, passing the test, whenever it is given, does not guarantee the knowledge is going to be used by the employees when performing daily duties.
There are no set metrics used to measure an organization’s training effectiveness. What is important is that the selected metrics are meaningful, decided on prior to the training event, and monitored over set time periods. It is important for Operations, Compliance, and Human Resources to agree on the metrics and how to report them to leadership. The data alone provides little value. Its interpretation is key because it may include a root cause analysis to a known or an unknown problem or lead to improvements in both additional training programs, operations, and the overall culture of the organization.
One thing to avoid in selecting metrics is inadvertently to incentivize negative behavior. For example, it would be counterproductive to measure the increase in coding productivity without factoring in the quality of the work following a training program on new CPT (Current Procedural Terminology) or ICD-10 codes. When designed, managed, and monitored properly, metrics are a valuable tool to help determine the effectiveness of training programs. These efforts, along with partnering with stakeholders and surveying staff, lead to the development of a documented monitoring plan.
How can a monitoring plan be developed?
The risk assessment process described in chapter 3 will drive an organization’s auditing and internal monitoring plan. Compliance will work with business partners to determine how best to leverage resources to manage identified risks within an acceptable level. Some monitoring will be conducted at set intervals, and some monitoring will be continuously performed. As previously noted, monitoring activities already used within business segments may simply need to be documented and routed to compliance. The size and complexity of the organization, along with careful analysis of organizational risks, will determine the types of monitoring activities necessary to effectively measure organizational compliance.
Monitoring may be conducted in a variety of ways. Self-monitoring is conducted when employees report on their own performance. Self-monitoring can be used for activities that present a low risk to the organization. Self-monitoring is conducive to a culture where negative results do not result in punitive actions. This kind of monitoring creates personal accountability, and then auditing can be used to verify self-monitoring results.
Continuous monitoring is an ongoing process that permits accurate trending of data. It highlights breakdowns in processes so that workflow adjustments can be made immediately to correct issues. It is most often an automated process.
Compliance should develop a policy and procedures for their auditing and monitoring program. The frequency of reporting results from monitoring activities by business partners should be established prior to implementation of the procedures, and consequences should be agreed upon for a business partner’s failure to report. This is when the “tone at the top” becomes vital to the success of the monitoring plan. The Association of Certified Fraud Examiners defines “tone at the top” as “the ethical atmosphere that is created in the workplace by the organization’s leadership. Whatever tone management sets will have a trickle-down effect on employees of the company.”[10] The success of any monitoring program is grounded in the support of the board and senior leadership. Senior leadership should be vocal in support of the monitoring plan and set the expectation for management’s participation in the compliance program.
The results of monitoring are not simply stored on a computer to be provided as evidence of a compliance program. The results from monitoring activities, any corrective action taken if monitoring results fall below an acceptable preestablished threshold, and the timeliness of the corrective actions should be discussed with management. Organizations must determine an acceptable accuracy threshold based upon their risk appetite—what the organization is willing to live with regarding an error rate. When monitoring results fall below the preestablished threshold, compliance should work with management to determine the corrective action that should be taken. Management owns the corrective action plan and should be responsible for the remediation deemed necessary. Management should work to implement the corrective action and report steps taken to correct the issue to compliance. Depending upon the issue monitoring reveals, the results may indicate the need for an independent audit, at which time the organization shall take reasonable steps to do the following:
Respond appropriately to any violations of the law or policies to prevent future misconduct.
Modify and improve the organization’s compliance program.
Make restitution when appropriate if criminal conduct is found.
Compliance should also develop a process to address when monitoring results exceed expectations on a continuous basis. The results may indicate a need to reduce the monitoring period (for example, moving to a quarterly report from a monthly report). This helps leverage limited resources to focus on areas of risk.
The type of activities to monitor is not only based upon a risk assessment but will also depend upon the type of healthcare organization. According to Strategic Management Services CEO Richard P. Kusserow, “Monitoring programs should be designed to test for inconsistencies, duplication, errors, policy violations, missing approvals, incomplete data, dollar or volume limit errors, or other possible breakdowns in internal controls. Monitoring techniques may include sampling protocols that permit program managers to identify and review variations from an established baseline.”
How can monitoring efforts be reported and evaluated?
Once risks have been identified, a monitoring plan has been developed, and reports of monitoring efforts have been disseminated to Compliance, the compliance officer will focus on a reporting tool to capture monitoring and corrective action plans from the business units. The tool used will depend on the organization’s size. Some organizations utilize software purchased to assist in documenting auditing and monitoring results with report capability. Other organizations will use Excel to generate a scorecard and/or summary with graphs.
Documentation that should be captured on the plan includes the following:
The date of the activity and the individual(s) conducting and participating in it
A summary of the data or activities reviewed
A description of any noncompliance, potential noncompliance, data irregularities, or other identified deficiencies
A description of any actions taken, to be taken, or recommended, including the person responsible for completing actions and the anticipated date of completion
Documentation of monitoring should include sufficient detail to allow verification that the monitoring plan was followed.
Regardless of the tools used, the compliance department will determine what monitoring to report to senior leadership and the board compliance committee. The reports may vary for each group, as each group may require a differing level of detail. The compliance officer’s goal is to educate the board on monitoring efforts so that the board members are knowledgeable about risks and activities performed to manage organizational risks identified. Board minutes should reflect the compliance officer’s report on monitoring efforts within the organization and discussions held regarding specific monitoring efforts and corrective action plan. This discussion, documented in the minutes, provides evidence of board involvement in the management of the organization’s compliance program and knowledge of the risks within the organization. This reporting should be performed on a regular and timely basis.
What is auditing?
Auditing is a discrete, planned event in which a focused and structured process is designed to independently evaluate a distinct area of the organization or practice. Audits help to ensure that the practice or organization remains vigilant in its compliance efforts. There are many types of audits, including internal and external audits and prospective and retrospective audits.
What are internal audits?
These audits are formal reviews of compliance with a particular set of standards (for example, policies, procedures, laws, and regulations) used as base measures. Internal audits are performed by individuals who are independent of the process being audited. In other words, by individuals who do not actually work in or manage the area being studied. The idea is to concentrate attention on matters that have been causing the organization or practice problems with compliance, as indicated by the results of ongoing monitoring activity, risk assessment, or other reports, or areas that may cause the organization compliance concerns, such as issues identified by the Centers for Medicare & Medicaid Services (CMS), areas of heightened enforcement concerns as reflected in the Office of Inspector General (OIG) Work Plans, special fraud alerts, audits, CIAs, and other law enforcement initiatives.
Internal audits should focus on one aspect of the responsibilities of a department or section. If the policy is multifaceted, then detailed criteria for the audit should be itemized. It is best to keep each audit directed so that both the review and the results are manageable. An audit that attempts to accomplish too much at one time has an increased opportunity for failure. Consider conducting several smaller audits rather than one large investigation unless you have the time and workforce to complete the bigger scope.[2]
Audits may be prospective or retrospective. Prospective audits examine a system in action, as it is happening, whereas a retrospective audit looks at work that has already been done. An example of a prospective audit is a prepayment claim review in which claims are reviewed before they are submitted for payment, therefore allowing for correction if a problem exists. On the other hand, claims that have already been submitted for payment and are then selected for audit are being reviewed retrospectively (or after the fact). Retrospective audits are often used because the data is more easily obtained for sampling and the sample is usually more complete. Retrospective audits are also used to establish a baseline or reference point of the provider’s current policies and practices.
Based on the findings of an internal audit, the organization or practice may implement a corrective action plan that may alter work processes and current policies, establish measurable improvement goals, result in repayment of an overpayment, or conclude that there is not enough evidence to warrant significant changes. Internal audits provide a mechanism for preventing, or at least mitigating, problems before they create significant legal risk. Audits are an important element of an effective compliance program.
Audit findings must be documented and reported to senior management, the compliance or audit committee, and the governing body. The audit report should include findings of noncompliance and/or suspicions of misconduct and an action plan to address and resolve each potential problem, including planned follow-up actions.
If the audit identifies reportable violations, the provider should plan for voluntary disclosure to the applicable government agency. Before acting, however, the provider should contact its attorney for guidance.
What are external audits?
These audits are performed by someone outside of the organization or practice, such as an independent auditor, a government contractor, the OIG, a government program, or a commercial payer. External audits will be discussed later in this article.
Who are external auditors?
Because external auditors are hired by the company and not employed by it, they have no stake in the outcome of an audit and can therefore examine records without bias. They can provide important and valuable insights about the operations of the organization and share best practices based on their experience. Also, with increasing government oversight of compliance programs, an external auditor may strengthen the company practices regarding government program compliance.
External auditors may be retained to perform a variety of auditing services, including, for example, audits that pose a conflict of interest for the compliance officer or financial officer, to perform a compliance program effectiveness audit, to perform an objective coding audit, or to supplement resources.
Who are government auditors?
Government auditors are authorized to investigate claims submitted by any entity or provider that provides Medicare beneficiaries with procedures, services, treatments, or equipment. Each government auditor is established independently with a different mission and scope of work. Therefore, there is no standard for the number of record requests, timeline, appeals process, or type of review.[10] The goal of most government program audits is to identify improper payments and to identify fraud and abuse. Each provider must ascertain for themselves the types of government audits that apply to their practice or organization and prepare in advance for those audits.
In addition to improper payment and fraud and abuse audits, many government agencies conduct audits of a provider’s compliance program for evidence that demonstrates program effectiveness. Failure to do so can result in an increased risk of fines and sanctions. Medicare Advantage Plans undergo intense compliance program effectiveness audits as part of a program audit. Per the CMS 2021 Program Audit Process Overview document, in the third week of fieldwork, CMS may travel to the sponsoring organization’s location for a period of four to five business days to conduct the compliance program effectiveness (CPE) portion of the audit. Otherwise, fieldwork will continue with webinars for the CPE portion of the audit. During this time, CMS evaluates the sponsoring organization’s comprehensive approach to addressing an identified issue or noted deficiency through tracer samples.[11] The “Medicare Parts C and D Program Audit Protocols, Attachment 1 CPE Audit Process and Data Request” provides an excellent roadmap to conducting a compliance program effectiveness self-audit.
How is the audit defined?
Auditing is not a one-size-fits-all process. Auditing topics, scope, and methodology will vary by provider type, size, risk priority areas, and available resources. The OIG’s Compliance Program Guidance for various healthcare providers and suppliers was meant to encourage the development and use of internal controls to monitor adherence to applicable statutes, regulations, and program requirements.[3] These guidance documents are a must-read for anyone in healthcare compliance and audit. Provider-specific risk areas are identified and discussed, as are methodology and sample selection, best practices, and recommendations.
An important element in all compliance programs is the risk assessment (discussed in chapter 3). A thorough risk assessment should identify all known and suspected risk areas applicable to the provider, assess the probability and impact to the provider if the risk were to occur, and prioritize risks to establish a most-to-least-critical importance ranking. Those risks identified as having a high probability and high impact should be assessed for ongoing monitoring or auditing.
Common High-Risk Areas for Providers and Suppliers
Coding
Billing
Documentation
Medical necessity
Financial relationships with physicians (compliance with Stark Law)
Anti-kickback schemes
HIPAA privacy and security
Cybersecurity
Telehealth is also a high-risk area, particularly as a result of the COVID-19 public health emergency when CMS implemented a number of waivers and flexibilities that allowed Medicare beneficiaries to access a wider range of telehealth services without having to travel to a healthcare facility. This resulted in unprecedented increases in telehealth and the possibility for fraud in telemedicine. CMS and other payers will need to monitor program integrity implications and address the potential for fraud and abuse in telemedicine. Hence, there will probably be an increase in external audits of services provided by telemedicine.
Other areas to monitor closely for potential high risk include government actions—or headline-making settlements—as they are a bellwether of future audits, CMS contractor audits, and the OIG Work Plan. The OIG Work Plan lists various audits and evaluations that are underway or planned during the fiscal year and beyond.[4] The Work Plan is dynamic, and the public-facing Work Plan is updated monthly.
Monitoring activity, findings in an audit, and reports made to the compliance officer may also result in the need for a discrete audit, which may be a full audit or a smaller, focused or probe audit. The OIG states in its guidance documents that one of the most important components of a successful audit protocol is an appropriate response when the practice or facility identifies a problem. This action should be taken as soon as possible after the date the problem is identified, noting that the specific actions should depend on the circumstance of the situations. So an audit plan should remain flexible to accommodate changing risks and audit needs.
How is an audit plan created?
Once the risk assessment is completed, the risks are ranked, and the mitigation strategies currently in place have been identified, sort the risks from highest to lowest. Highest risks should be prioritized for audit. Additionally, other areas may need to be considered for audit, including matters that may have been the subject of a regulatory finding, observation, or recommendation; follow-up on corrective action plans that require auditing or monitoring to confirm compliance; and any incomplete audits from the previous year. However, since most providers do not have unlimited resources, the next step is to assess the time and resources needed to audit the high-risk and other areas against current resources to determine which audits can realistically be completed with current staff and which audits may need to be performed by an independent third party. To help determine this, ask: What information will be needed for the audit? Is the needed information readily available? Who will perform the audit? How long will each audit take? Can more than one audit be conducted at the same time? Will legal counsel need to be involved in any of the audits? Will an outside consultant be required? With answers to these questions, a compliance officer can begin to map out the audit plan, bearing in mind that an audit plan is dynamic and may need to be readdressed if an urgent compliance concern presents itself during the year that requires an audit investigation.
Audit plans are typically created at the end of a calendar year for the following calendar year. Many providers schedule audits by quarter and update the audit plan quarterly. Note that if the provider is under a corporate integrity agreement (CIA), the audit plan may be dictated by the CIA. Individual audits must be planned and scheduled with sufficient resources assigned to those who are trained about the audit area, independent, objective, and free of conflicts.
What are the phases of the audit process?
An audit is a methodical examination and review that follows an established audit procedure and generally requires considerable preplanning to be carried out effectively to ensure valid results. The process can be divided into four stages: planning, execution, reporting, and follow-up.
Planning Phase
The planning phase can be further divided into five distinct phases:
Determine audit subject and purpose
Define audit objectives
Define audit scope
Perform preaudit planning
Notify the area(s) being audited
- Determine Audit Subject and Purpose
This first step in the planning phase determines the specific area to be audited and the reason why this area is the subject of audit. The reason for the audit, for example, could be that it ranked high on the risk assessment, is being conducted as a result of a regulatory recommendation, is on the OIG Work Plan, or is part of a compliance investigation.
At this point, if you have reasonable suspicion to believe that a fraud or other irregularity may have occurred, with legal input, decide whether the audit should be implemented under the attorney-client privilege (discussed in more detail later in this article).
- Define Audit Objectives
Objectives should be specific to the audit being performed. For example, an audit objective might be to determine compliance with organization policy and procedures applicable to the function under review, or to determine compliance with applicable federal and state regulations that pertain to the function under review, or to verify conformity with contractual requirements. Be specific and clear about what the audit is expected to achieve. - Define Audit Scope
Define the population, dates of service, area(s) of the operation that will be involved, and people to be questioned. Determine whether the audit will be prospective or retrospective, whether it will be a sampling or probe audit (a small random sample) or comprehensive in scope. Establish the time frame, including milestone dates for conducting the audit. Determine who will perform the audit. Determine if legal counsel should be involved in the audit process. - Perform Preaudit Planning
Determine audit criteria and identify specific regulations applicable to the audit. Determine appropriate sample selection method. Determine which documents will be audited and how the data will be submitted (for example, claims to be listed on a spreadsheet with predetermined data fields). Create a data collection tool to track the items requested, as well as additional documentation collected and/or submitted, dates, times, findings, notes, etc. - Notify the Area(s) Being Audited
Prepare a notice to employees who will be impacted by the audit and include pertinent information about the audit, the purpose of the audit, objectives, scope, timing, documentation to be submitted, and any expectations of them before, during, and after the audit.
Execution Phase
The execution phase can be divided into two distinct phases: initial meeting with team and conducting the audit.
Initial meeting with team: Plan and schedule a preaudit meeting with all impacted employees to explain the audit, review the process and any associated documents, review data collection tools, and set milestone dates. Answer questions. Set expectations.
Conduct the audit: Keep impacted organizational area(s) apprised along the way of any findings and urgent actions to be taken if necessary (for example, temporarily hold submission of claims for a particular error until a mitigation strategy can be implemented).
Reporting Phase
The reporting phase can be divided into three distinct phases: draft audit report, management response, and final report.
- Draft Audit Report
Develop a draft audit report that includes findings, recommendations designed to correct any potential weaknesses or areas of noncompliance discovered during the audit, and requests for management response to each finding/recommendation, including corrective action plan(s) to be developed and implemented. - Management Response
Submit audit report with findings in draft form to impacted employees to obtain their comments and feedback. Include a request for root cause analysis and corrective action plans, as applicable. Provide specific due dates for responses. - Final Report
Review and incorporate feedback into a final report. Send the final report to all impacted employees, senior leadership, and compliance or audit committee. The final report should include the following sections:
Purpose
Objectives
Scope
Methodology
Regulatory framework
Findings
Recommendations
Follow-up Phase
The timing of the follow-up phase will vary depending on the type of audit, audit findings, management responses, and corrective actions to be implemented. However, each of the elements below must be confirmed prior to closing the audit:
Confirm successful implementation of corrective actions.
Verify that management responses are implemented.
Assess new processes, procedures, and actions.
Once confirmed, a pass/fail notification may be issued, as appropriate, and the audit can be closed.
What are the differences between statistical and non statistical sampling?
In studying a population, it can be reviewed it in its entirety, or a sample of the population can be reviewed using statistical sampling where the results can be extrapolated to the entire population, or a sample of the population can be reviewed using nonstatistical (judgmental) sampling where the results are constrained to the sample itself.
Statistically valid sampling is the most credible for identifying a risk problem. However, it is resource intensive and requires expertise in defining the statistically valid sample.[5] Statistical sampling is mostly about the practice of making statements regarding the characteristics of a large population based on a reasonable, thorough review of a representative sample. This practice has many relatively formal rules largely based on scientific knowledge. These rules concern how a population is defined (and how a “sampling frame” of the population is created), a random sample is drawn, a thorough review is accomplished, and an extrapolation about the population is determined. Randomness is essential to assert that the sample is an unbiased estimator of the population mean.[6]
Use of statistical sampling is widespread in healthcare audits and investigations. For example, CMS uses statistical sampling methodology to estimate the amount of overpayment(s) made on claims and provides guidance to its contractors (Unified Program Integrity Contractors (UPICs), Recovery Audit Contractors (RACs), Supplemental Medical Review Contractors (SMRCs), and Medicare Administrative Contractors (MACs)) on the use of statistical sampling for overpayment estimations. These instructions are provided to the auditors so that a sufficient process is followed when conducting statistical sampling to project overpayments.[7]
The OIG’s Office of Audit Service relies on statistical sampling and, in the late 1970s, created the RAT-STATS statistical software that is still used today and is available for free on its website. Providers can download this software to assist in claims review. Among other things, this software assists the user in determining the appropriate size of a sample to achieve a desired confidence, selecting random samples, and evaluating results of a sample to estimate improper payment amounts. Providers, however, are not required to use RAT-STATS in their own sampling.[8]
Other types of sampling are also available, even though not statistically valid. These tend to be more commonly utilized due to resource limitations and other variables. Nonstatistical sampling does not involve the use of statistical calculations. It removes probability theory and is entirely dependent on the auditor’s judgment. Nonstatistical sampling is more frequently used by very experienced auditors with a good knowledge of the data set.
