Internal Controls, Compliance, and Ethics
This domain tests the control environment and the healthcare-specific legal framework. Expect COSO components and principles, segregation-of-duties design, fraud indicators, and the statutes that make healthcare billing a compliance risk.
COSO and control design
COSO's five components - control environment, risk assessment, control activities, information and communication, and monitoring - expand into 17 principles. The control environment (tone at the top, board oversight, competence) sets the ceiling for everything else. Control activities include authorization, segregation of duties, reconciliation, physical safeguards, and IT general controls. Separate custody of assets, authorization, and recordkeeping; where headcount prevents it, add detective controls such as independent reconciliation review.
Healthcare compliance framework
The OIG's seven elements: written policies and procedures; a compliance officer and committee; training and education; open lines of communication; internal monitoring and auditing; enforcement and discipline; and response and prevention. Key statutes: the Anti-Kickback Statute is intent-based and covers remuneration for referrals; the physician self-referral law (Stark) is strict liability, covers designated health services, and requires an applicable exception; the False Claims Act carries treble damages plus per-claim penalties and permits qui tam relators. HIPAA governs privacy, security, and breach notification; IRC 501(r) requires tax-exempt hospitals to adopt a financial assistance policy, limit charges, and regulate collection practices.
Worked example
A clinic manager can add vendors to the AP master, approve invoices, and reconcile the bank statement - authorization, custody, and recordkeeping concentrated in one person, the classic fraud opportunity. Redesign: move vendor master maintenance to corporate finance, require a second signature above $10,000, and assign reconciliation to an employee with no payment authority, reviewed monthly by the CFO. The preventive controls are the split of duties and dual approval; the reconciliation review is the detective layer that catches what prevention misses.
Traps
- Treating Stark as intent-based; it is strict liability, while the Anti-Kickback Statute requires intent.
- Assuming a compliance program works because a policy manual exists.
- Letting the CFO both approve disbursements and reconcile the bank account.
- Recording a whistleblower allegation without a documented investigation and response.