Continuous Auditing at HCA

1. Continuous Auditing at HCA Fifth Continuous Assurance and Auditing Symposium Chase Whitaker, CPA Audit Director HCA, Inc. Internal Audit & Consulting Services November 22, 2002

2. Overview • About HCA • Potential Areas for Continuous Auditing • Lessons Learned – Diverging Paths • HCA Automated Tools Developed & Next Steps

3. About HCA • 180 hospitals • 70 surgery centers • 23 states, England, & Switzerland • $18B total assets • $18B annual revenue • $2B EBDITA • 170,000 employees • 140 Internal Auditors

4. HCA Internal Audit Continuous Auditing Mission Statement Develop a continuous auditing methodology that will help management accomplish the strategic goals and objectives of the company through risk mitigation. This methodology will include: • Identifying key risk indicators related to • achievement of business objectives, • reliability and accuracy of financial information and • compliance with laws, regulations and company policies. • IT system and interfaces. • Designing automated processes, tools and a management reporting system to enable Internal Audit to continuously monitor these key risk indicators.

5. Challenges • Significant investment in R&D and QA process • What, when, and how to test • Level of assurance – attestation vs. exception reporting • FTEs needed for preparation and review • IT resources (Organization & Internal Audit) • IT infrastructure • Acceptance by organization management teams (e.g. difference in deliverables, commitment to respond) • Change management

6. Other Considerations • Strength of operations management • Audit universe • Understand key organizational risks • Clearly defined audit objectives - Avoid “scope creep” • Design “exception only” reports

7. Currently used by HCA Data downloads with Focus ACL processing Excel presentation E-mail delivery Future? Data tags (e.g. XML) Application intelligent agents Embedded audit modules Application or intranet “real time” reporting Technology Tools Evolution

8. Potential CA Areas • General ledger vs. subsidiary ledger balances • HR, Payroll, and Benefits • Unnatural or unexpected balances, transactions, statistics &/or relationships • Clinical or other operational trends/indicators • Information technology trends/indicators • Regulatory compliance • Adherence to system master file standards • Cash disbursement transactions/trends • Purchasing/inventory quantities, pricing, activity • Third party relationships

9. Silver Bullet Solutions

10. Lessons Learned - Diverging Paths • Continuous Audit • Deviations easily defined and explainable • Reports delivered following occurrence • Continuous Risk Assessment/Monitoring • Knowledge gathering and trending • Limited or no CA reports to management • Results may impact audit plan decisions • Time intensive to research initial results • Spurs ideas for new tests

11. Automated Tools Developed – Accounts Receivable • Monthly comparison of A/R on subsidiary system to G/L control accounts to identify out-of-balance conditions. • Monthly comparison of patient A/R aging buckets on subsidiary system to G/L allowance for doubtful accounts control account to identify potential under reserves. • Quarterly analysis of Medicare cost report settlement account transactions • Periodic analysis of negative receivables

12. Automated Tools Developed – Human Resources/Payroll • Quarterly analysis of invalid Social Security Numbers • Compare all SSNs to permissible Area and Group numbers • Search for ascending/descending SSNs • Search for serial numbers with all zeroes • Look for SSNs used in marketing • Consider SSNs Employee Verification Service (EVS)

13. Automated Tools Developed – Human Resources/Payroll • Analysis of unusual vacation/paid-time-off taken & available • Limited or no PTO hours • Terminated employees with remaining PTO balance • PTO banks in excess of corporate limits • Analysis of unusual hourly rates, regular and OT hours, and/or gross earnings • Active employees without YTD earnings • Full time employees averaging less than 32 hours/wk • Incomplete or inconsistent key dates (e.g. DOB > DOH)

14. Automated Tools Developed – Patient Account Service Centers • Trending graphs & analysis of: • “Promise to Pay” codes aged greater than 60 days • Average days to bill • Final bill alert exceptions • Insurance greater than 90 days • Daily analysis of selected master file settings • Comparison of credit balances – subsidiary system vs. management reporting system

15. First month results communicated to management Automated Tools Developed – Patient Account Service Centers

16. Automated Tools Developed – Assets/EBDITA Analyses • Changes to goodwill and related amortization accounts • Reviewfor non-performing assets &/or dormant entities • Analysis of unusual general ledger/financial reporting activity • Review entities with significant asset/EBDITA changes • Review entities having assets but without earnings & vice versa

17. Automated Tools Developed – Vendors/Accounts Payable • Bio-Med & Diagnostic Imaging equipment servicing inventory and billing • Duplicate records • Trend charges • Erroneous/illogical data elements • Duplicate payments: • Trend and report problematic vendors, facilities, employees, etc. • $17 million prevented or recovered to date – reduces/ eliminates need for review by 3rd party vendor

18. Automated Tools Developed – Other • Daily analysis of changes in consolidation indicators including any consolidating “test” entities • Monthly analysis of daily cash transfers from facilities to corporate treasury function

19. Next Steps • Dedicate FTE(s) to audit information generated from our automated tools • Develop an expedient management reporting process • Continue development of new automated tools and audit procedures for areas such as: • Adherence to system master file standards • Employee benefits • Purchasing/Inventory (inventory quantities, warehousing metrics, SKU usage, billing of high-cost supplies, etc.) • Cash disbursements • Laundry/linen expenses

21. Contact Information Chase Whitaker Audit Director HCA, Inc. Internal Audit & Consulting Services (615) 344-5973 Chase.Whitaker@HCAHealthcare.com