Program Integrity Frameworks and Governance
Provisional domain 1: Program Integrity Frameworks and Governance. The supplied EGATSU-PI outline is unavailable, so this section uses a provisional domain label; verify it against the current candidate handbook. The exam most likely tests whether you can place a control in the right accountability layer and distinguish prevention, detection, and correction.
Core rules
- Program integrity means funds or benefits reach eligible recipients for allowable purposes, in the right amount, with evidence.
- Use a three-lines model: operational management owns and operates controls; a compliance/risk function monitors and advises; internal audit provides independent assurance. Internal audit must not own the control it audits.
- Classify controls: preventive (before payment), detective (after the fact), corrective (recovery, sanction, process fix). A policy is not a control unless it operates and leaves evidence.
- Risk-rank processes by likelihood, impact, and data quality; sample where risk is highest, not where review is easiest.
Worked example
A reviewer finds that a clinic's claims are paid without checking the treating clinician's license status. The gap is a preventive control failure in the first line, not an audit failure. Post-payment review may detect the problem, but it does not stop the initial payment. The fix is an enrollment-time primary-source license check, a documented exception queue, and a monthly operating metric. Reasoning: identify control type, accountable line, evidence, and residual risk.
Traps
Calling internal audit a management control; treating a written policy as operating evidence; confusing detection with prevention; and recommending more audit when the real gap is an upfront edit.