Get a Handle on Internal Controls

2. Get a Handle on Internal Controls William D. Miller Johnson County Auditor

3. Why? Internal Control = Common Sense Fiscal Officers are guardians of taxpayers’ money Think of it as YOUR money, not the government’s, would you spend the same way

4. It’s All About Risk • If money is involved there is risk • If it can be converted to money, there is risk • If it can be used for personal gain there is risk • If it can be misused there is risk

5. Common Problems • Organization attitude • Internal controls not documented • Internal control policies not followed • Failure to review controls for adequacy • Too much trust in entrusted employees • Top management oversight is lacking • Staffing levels impinge on ability to control

6. Organization Attitude • Critical Element • Does top management pay attention? • Is the internal control system proactively employed or reactive to problems (horse out of the barn)? • Do managers and staff think about internal controls? • Are there systematic reviews of IC systems?

7. Documentation and Execution • Have organization risks been assessed, prioritized and targeted for controls? • Can employees find the policies and procedures needed to implement internal controls? • Do employees have a working knowledge of the system? • Are IC procedures available and do they specifically define responsibilities? • If documented, are they followed?

8. Who do you Trust-Johnny Carson? • Internal Controls = Trust • Trust is the archenemy of internal controls • Trust is bestowed automatically • Trust is challenged after the fact • There are always footprints when internal controls are breached—Gee, I should have known!

9. Top Management Oversight Top managers need to make presence known Use reporting systems to ensure controls are working Spot check controls in action Review controls to ensure they are working and to identify changes over time

10. Staffing Requirements Not enough staff is not good enough Compensating controls can be implemented Remote locations require oversight for internal control—Use and verify reporting systems and spot checks If contracted out, require independent audit

11. Consequences Waste—taxpayer funds spent unwisely Abuse—taxpayer funded programs improperly managed sometimes with harmful consequences Fraud—Perpetrators find weaknesses and exploit them for ill-gotten gains

12. Contract Change Orders Identification of cause for change order Assessment of liability for change Independent estimate of cost for change Comparison of independent estimate to estimate provided by contractor Development of negotiation strategy

13. Change Orders Documentation of negotiations Review, approval and documentation of agreed upon costs Verification of accuracy of invoices submitted for payment

14. INVOICE Labor 10 hours @ $48.10 $491.00 Materials 151.36 657.59 10% Markup on Materials 15.23 3% Small Tools 59.18 ________ Amount Due $716.77 WRONG 3% of 657.59 = $19.73 The internal control was to add up the 4 figures!

15. Purchase Cards Highly vulnerable for misuse Speed of transactions and after the fact review and approval Good for small purchases and cost saver Requires diligence in managing use Poor controls lead to big problems

16. P-Card Internal Controls Establish who needs them-& review regularly Limits, review authorities & chain of review Establish appropriate/inappropriate charges clearly Review invoices—don’t rubber stamp Cancel the account as well as the card

17. Inventory Controls Inventory records were poor Process was faulty—allowed self reporting and not at time of purchase Not enough information collected Falsified dates of purchase (2011, 2012) RESULT: Missing assets

18. DFS Hotline System • Cited Unable to Investigate When Could • 18 cases received subsequent call and action was taken—not so for 313 • 25% of all calls received were treated as unable to investigate

19. Quality Control Issues—Failure to Respond • Unable to Investigate Calls • Many calls could/should have been referred to field offices for some type of action • Out in the cold • Cage boy • Hockey stick • Excrement in home • Breast feeding

20. DFS Reasons • Call taker cited did not meet a lock out law—a law that does not exist • 38 degrees never killed anyone • Did not attempt to locate or identify individual when could have gone to school • Could not locate address—audit found it in DFS’ own system

21. Can Fraud Be Far Behind? Lack of internal controls can lead to fraud Failure to apply established internal controls can lead to fraud Failure to oversee internal controls can lead to fraud

22. VA Loan Guaranty Program Guarantees up to $56,000 The purpose of the program is to allow veterans to get into homes with no down payment and to induce lenders to accept VA loans The program is a benefit program, supported by Congress, Veterans Groups, and is viewed as an entitlement by the veterans

23. VA Loan Guaranty Program • In the event of foreclosure, the VA will either pay the lender the guaranty or take the property and try to sell it. • VA's foreclosure rate is about 10%. VA took possession of most homes • The loan program had never been audited by outside auditors.

24. CONDITIONS FOR PROGRAMSource: William D. Miller • All Favorable • Houses Sold Well • Few Complaints • Foreclosures were Low Compared to Total Program • Everyone was Satisfied with Program Management Situation 3

25. AUDIT APPROACH • Target bad loans with low number of payments • Compare foreclosure rates to other housing programs • Determine if occupants were veterans • Determine patterns in foreclosures • Occurring in same general area • Specific Regional Offices or Lenders Situation 3

26. Audit Procedure • Key on the loan application • Verify everything on it, income, expenses, number of children, savings accounts • Drive by job locations • Interview applicants • Interview employers

27. What we found • Poor underwriting of loans (ties into Mgt Philosophy-benefit program) • Patterns showed suspicious activity in Colorado • Major fraud against 3 govt agencies discovered

28. What was happening • Condo mgt company was recruiting soldiers and spouses to buy their condos • Condos went into foreclosure when soldiers were reassigned • VA stuck with the guaranty payment

29. What was happening • The condo operation was an elaborate scam to get the guaranty money from the government (VA, HUD, FHA) • 5 companies were involved—2 loan processing companies-1 condo mgt company, 1 financial lending company, 1 builder

30. How did we prove it • Developed corporate matrix and tracked players (some were silent partners) • Determined that the 3 key officers in all the companies were the same people although the companies were in 4 states

31. How did we prove it Verification of loan app included: • Bank inquiries re: amounts in accts • Interviews with applicants at their homes (could see evidence of false info on apps-pictures of kids they didn’t declare) • Tracked defaulters to Europe and Okinawa

32. How did we prove it • Reviewed lender files and compared to VA files—very interesting notes in those files (required subpoenas) • Interviewed loan processors and with some criminal investigation work cracked a loan processor

33. Outcome • Attorney for the firms was disbarred • Owners and officers plea bargained • Settled on cases for $13 million dollars • Shut down the operation • Thwarted an attempt to establish same operation in Pensacola Fla

34. MEDICAID PRESCRIPTIONS • State offers prescription drug services under the MEDICAID program. (Optional) • 420,000 residents obtained $681.4 million through the MEDICAID program in 2001 • Funding is split at 60% and 40% between federal and state • State performs drug utilization reviews

35. NARCOTICS AND CONTROLLED SUBSTANCES • Two major therapeutic drug classes (anti-anxiety and analgesics/narcotics) have addictive qualities that increase potential for inappropriate use by recipients • Oxycodone/Oxycontin products are highly addictive and are abused in epidemic proportions

36. ABUSE OF MEDICAID PROGRAM • 3,900 recipients visited 5 or more physicians to obtain multiple quantities of controlled substances. • $8.7 million was spent on these drugs • Not all prescriptions were for legitimate purposes

37. OXYCODONE/OXYCONTIN • Legitimate use for intractable pain • Legitimate doses can be high • Illegitimate use, euphoric highs similar to cocaine • Lethal

38. OXCONTIN ABUSE • Oxycontin is a 24-hour time-release capsule version of the single dosage oxycodone • Abusers found that if crush capsule and ingest contents it will give cocaine level highs • Because this is a 24-hour time-release, the act of crushing and consuming can have fatal results

39. USAGE TREND-OXYCONTIN

40. RECIPIENTS’ OXYCONTIN ACTIVITY

41. HOW THEY DID IT • Recipients : • Visited multiple doctors • Obtained multiple prescriptions • Visited multiple pharmacies • The top 5 potential abusers in 2001 visited between 27 and 53 doctors

42. ABUSE OF MEDICAID PROGRAM

43. ABUSE EXAMPLE • Drug-Oxycontin • Recipient visited 10 pharmacies in 90 days • On 1 day obtained 26 prescriptions • This activity triggered alerts that showed therapeutic duplication

44. AUDIT METHODOLOGY • Analyzed State’s Medicaid paid prescription drug claims for 2 fiscal years • Matched pharmacies’ data to paid claims data and sorted on dates of issue & interviewed pharmacy and state staff • Identified controlled substances subject to high abuse (contacted DEA)

45. Take Them Serious As the examples show, missteps will occur Whether innocently or intentionally, failed controls lead to extra costs and CRIME Management levels HAVE to stay involved Use oversight techniques such as trending analysis, invoice reviews, reporting and verifying systems Take immediate action