Wilson: The internal and external auditors' roles are quite different. The external auditor focuses on financial statements rather than on the daily inner workings of the various hospital departments. That's the purview of the internal auditor.
LeMoine: Never. In Enron's case, Arthur Andersen served as both internal and external auditor.
Wilson: There are two: 1. Audit Committee members should be independent of management. No hospital employees should sit on the Audit Committee. In fact, when the Audit Committee meets with the internal and external auditors, management should be asked to leave the room. 2. Trustees who sit on the Audit Committee should be financially literate enough to interpret financial statements and engage in a meaningful discussion with the auditors.
Riley: I recommend that the board have an Audit Committee that's separate from its Finance Committee. At least one member of the Audit Committee should have substantial financial expertise. But the rest of the members should represent a cross section of your board members. Some of the best communication I've ever heard take place between an Audit Committee and an external auditor has come from board members with little financial background, who are willing to ask the proverbial dumb question.
LeFever: Members must be willing to ask questions. They need to ask the auditors point-blank to go beyond the numbers and say whether this is a company that is well run and as financially strong as the records seem to indicate.
Here's how David LeMoine says Ascension Health does it. The Audit Committee members adopted a multi-page "charter" detailing its roles and responsibilities. The document serves the function of bylaws for the committee, and outlines the group's responsibility, the work to be done, the timeline for the work and the procedures for doing the job.
Prepared by the system's internal auditor, Catholic Healthcare Audit Network of St. Louis, the charter lays down the law about which kinds of people should comprise the Audit Committee, what authority the group has for internal and external auditing and how often the committee will meet.
Network CEO David LeMoine says he reviews the document and the committee's responsibilities for at least an hour with the Audit Committee each year. He repeats the exercise for each of his clients.
"They need to understand what their roles and responsibilities are, and they need to understand what my roles and responsibilities are," he explains. The charter, he says, "assists them in fulfilling their responsibilities because it's all laid out there-what they have to do at each meeting."
LeMoine also prepares the agenda for each Ascension Health Audit Committee meeting. The group meets at least three times a year.
This question is discussed thoroughly in the May 2002 issue of the Great Boards newsletter. The next few questions and answers were cut from the article for space reasons; be sure to read the newsletter article along with these FAQs. Our sources include several experts in healthcare auditing:
Bob Wilson, an independent consultant who works with financially troubled companies, including hospitals. Wilson worked as an auditor and consultant for Arthur Andersen for 29 years until 2000. (robt_e_wilson@yahoo.com)
Mike Riley, president of transAction Associates in Baltimore, Md., a healthcare management consultant providing project management, capital financing and financial turnaround services to hospitals and health systems. (mriley@transactionassociates.com)
Bob LeFever, a financial and management consultant in Philadelphia for 25 years, and a member of the Temple University Health System board. LeFever also is a former member and chairman of the Jeanes Hospital board.
David LeMoine, CEO of Catholic Healthcare Audit Network in St. Louis, which conducts internal audits for Catholic healthcare systems. (dlemoine@chanllc.com)
To get started, here are a few basics: Virtually all hospitals and healthcare organizations hire an accounting firm to conduct an annual audit of their financial statements. Management prepares the financial statements and works closely with the external auditors, but the Board of Trustees, through its Audit Committee, is responsible for overseeing the relationship with the external auditor and approving its report.
"There's a common misconception that the external audit is a fraud audit to find every single accounting error," says Mike Riley. "External audit procedures are designed to test the fairness of the financial statements' presentation, taken as a whole-not the accuracy of every accounting transaction."
Nonetheless, the external auditor's first job is to evaluate the organization's accounting procedures to determine how much it can reply on management's data in conducting its own tests to certify the accuracy of the financial statements. In the course of its work, the external auditor may identify potential problems and areas to examine closely in the way the system keeps its books and reports on its financial operations. Is it classifying revenues or expenses in an overly aggressive way that doesn't conform to accounting standards? In addition, the auditor inspects any transactions that are not routine, and it spot checks the system's accounting and inventory systems.
Auditors make a note of any "material" discrepancies in the organization's financial statements. What is "material" varies depending on the system and the auditor, but usually falls in the range of a 5 percent to 10 percent deviation from what has been reported on financial statements.
Then the auditor gives the Audit Committee its opinion: Are the financial statements a true representation of the organization's financial statements? Is it at risk of failing in the next year? Are there particular concerns that management, and the board, should examine and address? These notes to the audit report may be the most important part of the document.
A second audit-one that's less common in healthcare-is the internal audit, during which a staff auditor or an outside auditing firm follow a similar process to determine whether internal accounting systems and departmental procedures are in order. The board's Audit Committee also oversees that relationship.
Our experts say Audit Committee members should ask auditors to clarify anything they don't understand. In addition, they suggest these tough questions: