Transcript Get a Handle on Internal Controls2

Get a Handle on Internal Controls
William D. Miller
Johnson County Auditor
Why?
Internal Control = Common Sense
Fiscal Officers are guardians of
taxpayers’ money
Think of it as YOUR money, not the
government’s, would you spend the
same way
It’s All About Risk
• If money is involved there is risk
• If it can be converted to money, there
is risk
• If it can be used for personal gain
there is risk
• If it can be misused there is risk
Common Problems
• Organization attitude
• Internal controls not documented
• Internal control policies not followed
• Failure to review controls for adequacy
• Too much trust in entrusted employees
• Top management oversight is lacking
• Staffing levels impinge on ability to control
Organization Attitude
• Critical Element
• Does top management pay attention?
• Is the internal control system proactively
employed or reactive to problems (horse out of
the barn)?
• Do managers and staff think about internal
controls?
• Are there systematic reviews of IC systems?
Documentation and Execution
• Have organization risks been assessed,
prioritized and targeted for controls?
• Can employees find the policies and procedures
needed to implement internal controls?
• Do employees have a working knowledge of the
system?
• Are IC procedures available and do they
specifically define responsibilities?
• If documented, are they followed?
Who do you Trust-Johnny Carson?
• Internal Controls = Trust
• Trust is the archenemy of internal controls
• Trust is bestowed automatically
• Trust is challenged after the fact
• There are always footprints when internal
controls are breached—Gee, I should have
known!
Top Management Oversight
Top managers need to make presence known
Use reporting systems to ensure controls are
working
Spot check controls in action
Review controls to ensure they are working and to
identify changes over time
Staffing Requirements
Not enough staff is not good enough
Compensating controls can be implemented
Remote locations require oversight for
internal control—Use and verify reporting
systems and spot checks
If contracted out, require independent audit
Consequences
Waste—taxpayer funds spent unwisely
Abuse—taxpayer funded programs improperly
managed sometimes with harmful consequences
Fraud—Perpetrators find weaknesses and exploit
them for ill-gotten gains
Contract Change Orders
Identification of cause for change order
Assessment of liability for change
Independent estimate of cost for change
Comparison of independent estimate to estimate
provided by contractor
Development of negotiation strategy
Change Orders
Documentation of negotiations
Review, approval and documentation of
agreed upon costs
Verification of accuracy of invoices
submitted for payment
INVOICE
Labor 10 hours @ $48.10
Materials
10% Markup on Materials
3% Small Tools
Amount Due
$491.00
151.36
15.23
59.18
________
$716.77
3% of 657.59 = $19.73
The internal control was to add up the 4 figures!
657.59
WRONG
Purchase Cards
Highly vulnerable for misuse
Speed of transactions and after the fact
review and approval
Good for small purchases and cost saver
Requires diligence in managing use
Poor controls lead to big problems
P-Card Internal Controls
Establish who needs them-& review
regularly
Limits, review authorities & chain of review
Establish appropriate/inappropriate charges
clearly
Review invoices—don’t rubber stamp
Cancel the account as well as the card
Inventory Controls
Inventory records were poor
Process was faulty—allowed self reporting
and not at time of purchase
Not enough information collected
Falsified dates of purchase (2011, 2012)
RESULT: Missing assets
DFS Hotline System
• Cited Unable to Investigate When
Could
• 18 cases received subsequent call and
action was taken—not so for 313
• 25% of all calls received were treated as
unable to investigate
Quality Control Issues—Failure to Respond
• Unable to Investigate Calls
• Many calls could/should have been
referred to field offices for some type of
action
•
•
•
•
•
Out in the cold
Cage boy
Hockey stick
Excrement in home
Breast feeding
DFS Reasons
• Call taker cited did not meet a lock out law—a law
that does not exist
• 38 degrees never killed anyone
• Did not attempt to locate or identify individual
when could have gone to school
• Could not locate address—audit found it in DFS’
own system
Can Fraud Be Far Behind?
Lack of internal controls can lead to
fraud
Failure to apply established internal
controls can lead to fraud
Failure to oversee internal controls can
lead to fraud
VA Loan Guaranty Program
Guarantees up to $56,000
The purpose of the program is to allow
veterans to get into homes with no down
payment and to induce lenders to accept
VA loans
The program is a benefit program,
supported by Congress, Veterans Groups,
and is viewed as an entitlement by the
veterans
VA Loan Guaranty Program
• In the event of foreclosure, the VA will
either pay the lender the guaranty or take
the property and try to sell it.
• VA's foreclosure rate is about 10%. VA
took possession of most homes
• The loan program had never been audited
by outside auditors.
CONDITIONS FOR PROGRAM
Source: William D. Miller
•
•
•
•
All Favorable
Houses Sold Well
Few Complaints
Foreclosures were Low Compared to Total
Program
• Everyone was Satisfied with Program
Management
Situation 3
AUDIT APPROACH
• Target bad loans with low number of
payments
• Compare foreclosure rates to other
housing programs
• Determine if occupants were veterans
• Determine patterns in foreclosures
• Occurring in same general area
• Specific Regional Offices or Lenders
Situation 3
Audit Procedure
• Key on the loan application
• Verify everything on it, income,
expenses, number of children,
savings accounts
• Drive by job locations
• Interview applicants
• Interview employers
What we found
• Poor underwriting of loans (ties into
Mgt Philosophy-benefit program)
• Patterns showed suspicious activity
in Colorado
• Major fraud against 3 govt agencies
discovered
What was happening
• Condo mgt company was recruiting
soldiers and spouses to buy their
condos
• Condos went into foreclosure when
soldiers were reassigned
• VA stuck with the guaranty payment
What was happening
• The condo operation was an
elaborate scam to get the guaranty
money from the government (VA,
HUD, FHA)
• 5 companies were involved—2 loan
processing companies-1 condo mgt
company, 1 financial lending
company, 1 builder
How did we prove it
• Developed corporate matrix and
tracked players (some were silent
partners)
• Determined that the 3 key officers in
all the companies were the same
people although the companies were
in 4 states
How did we prove it
Verification of loan app included:
• Bank inquiries re: amounts in accts
• Interviews with applicants at their homes
(could see evidence of false info on appspictures of kids they didn’t declare)
• Tracked defaulters to Europe and Okinawa
How did we prove it
• Reviewed lender files and compared
to VA files—very interesting notes in
those files (required subpoenas)
• Interviewed loan processors and with
some criminal investigation work
cracked a loan processor
Outcome
• Attorney for the firms was disbarred
• Owners and officers plea bargained
• Settled on cases for $13 million
dollars
• Shut down the operation
• Thwarted an attempt to establish
same operation in Pensacola Fla
MEDICAID
PRESCRIPTIONS
• State offers prescription drug services under the
MEDICAID program. (Optional)
• 420,000 residents obtained $681.4 million through
the MEDICAID program in 2001
• Funding is split at 60% and 40% between federal
and state
• State performs drug utilization reviews
NARCOTICS AND CONTROLLED SUBSTANCES
• Two major therapeutic drug classes (antianxiety and analgesics/narcotics) have
addictive qualities that increase potential
for inappropriate use by recipients
• Oxycodone/Oxycontin products are highly
addictive and are abused in epidemic
proportions
ABUSE OF MEDICAID PROGRAM
• 3,900 recipients visited 5 or more
physicians to obtain multiple quantities of
controlled substances.
• $8.7 million was spent on these drugs
• Not all prescriptions were for legitimate
purposes
OXYCODONE/OXYCONTIN
• Legitimate use for intractable pain
• Legitimate doses can be high
• Illegitimate use, euphoric highs similar to
cocaine
• Lethal
OXCONTIN ABUSE
• Oxycontin is a 24-hour time-release
capsule version of the single dosage
oxycodone
• Abusers found that if crush capsule and
ingest contents it will give cocaine level
highs
• Because this is a 24-hour time-release, the
act of crushing and consuming can have
fatal results
USAGE TREND-OXYCONTIN
Number of
Prescriptions
Number of
Recipients
27,842
5,405
2001
45,636
7,860
Increase
64%
45%
Year
2000
RECIPIENTS’ OXYCONTIN ACTIVITY
Number who:
Visited many
doctors and got
controlled drugs
Obtained 1 or more
Oxycontin
prescription
Percent obtaining
Oxycontin
FY
2000
FY
2001
1,826
2,074
661
986
36%
48%
HOW THEY DID IT
• Recipients :
• Visited multiple doctors
• Obtained multiple prescriptions
• Visited multiple pharmacies
• The top 5 potential abusers in 2001
visited between 27 and 53 doctors
ABUSE OF MEDICAID PROGRAM
Number of
Number of
Number of
Prescribers Pharmacies Prescriptions
53
25
92
42
12
76
38
5
92
29
12
56
27
3
92
ABUSE EXAMPLE
• Drug-Oxycontin
• Recipient visited 10 pharmacies in 90 days
• On 1 day obtained 26 prescriptions
• This activity triggered alerts that showed
therapeutic duplication
AUDIT METHODOLOGY
• Analyzed State’s Medicaid paid
prescription drug claims for 2 fiscal years
• Matched pharmacies’ data to paid claims
data and sorted on dates of issue &
interviewed pharmacy and state staff
• Identified controlled substances subject to
high abuse (contacted DEA)
Take Them Serious
As the examples show, missteps will occur
Whether innocently or intentionally, failed controls
lead to extra costs and CRIME
Management levels HAVE to stay involved
Use oversight techniques such as trending
analysis, invoice reviews, reporting and verifying
systems
Take immediate action