Governance, Compliance and Internal Controls
This domain tests the oversight, compliance, and control environment around healthcare finances: board duties, the seven compliance program elements, fraud and abuse statutes, 501(r) obligations, and the internal controls that prevent misstatement and misappropriation.
Governance
Board members owe duties of care, loyalty, and obedience. Audit and compliance committees oversee external audit, internal controls, and the compliance program. Conflicts of interest are disclosed annually, and Form 990 is publicly available.
Compliance program elements
Written policies and procedures, designation of a compliance officer and committee, effective training and education, a communication line such as a hotline, screening and exclusion checks, auditing and monitoring, and consistent enforcement and corrective action.
Fraud and abuse and 501(r)
The Anti-Kickback Statute is intent-based and criminal. Stark is strict liability, civil, and limited to designated health services with enumerated exceptions. The False Claims Act imposes treble damages. Section 501(r) requires a community health needs assessment every three years, a financial assistance policy, limits on amounts charged to assistance-eligible individuals, and restrictions on billing and collection before screening.
Internal control
COSO comprises control environment, risk assessment, control activities, information and communication, and monitoring. Segregate custody of assets, authorization, and recordkeeping.
Worked example
A clinic cashier opens the mail, posts payments, and performs the bank reconciliation. This is a segregation-of-duties deficiency because one person controls custody, recordkeeping, and verification, creating lapping and write-off risk. Remediation: a lockbox or two-person mail opening, payment posting by a different clerk, reconciliation performed in finance with documented controller review, and exception reports on adjustments, refunds, and write-offs reviewed monthly by the CFO.
Traps that cost marks
- Believing not-for-profits are exempt from internal control expectations.
- Confusing Stark (no intent required) with the Anti-Kickback Statute (intent required).
- Adopting policies without monitoring, testing, or documentation.
- Missing the amounts-charged and collection-timing requirements under 501(r).