Tests of Internal Control

60.3 – Tests of Internal Control (Rev. 127, Issued: 07-13-07, Effective: 10-01-07, Implementation: 10-01-07) A. Provider’s Internal Control Structure A provider’s internal control structure consists of the policies and procedures established to provide reasonable assurance that the provider’s objectives are achieved. The internal control structure consists of three elements: • Control Environment: The collective effect of various factors on establishing, enhancing, or mitigating the effectiveness of specific policies and procedures. • Accounting System: The methods and records established to identify, assemble, analyze, classify, record, and report an entity's transactions and to maintain accountability for the related assets and liabilities. • Control Procedures: The policies and procedures in addition to the control environment and accounting system that management has established to provide reasonable assurance that specific entity objectives will be achieved. A provider generally has internal control structure policies and procedures that are not relevant to a particular audit and therefore need not be considered for that audit. For example, policies and procedures concerning the effectiveness, economy, and efficiency of certain management decision-making processes, while important to the provider, do not ordinarily relate to a Medicare audit. B. Medicare’s Policy Regarding Review of Internal Controls In the Medicare audit environment, a review of and reporting on a provider’s system of internal control is generally not warranted or cost effective. The auditor may conclude that it would be inefficient to evaluate the effectiveness of internal control policies and procedures and that the audit can be conducted more efficiently by expanding substantive tests. You may wish to gain an understanding of the provider’s internal control structure when, in your professional judgment, this understanding and assessment of the internal controls would significantly affect the scoping of the Medicare audit. This does not mean or require that the internal controls need to be reviewed in every instance. Your understanding can be obtained through sources such as the previous period's completed internal control questionnaire (see Exhibit IV in §170 of this chapter), current year’s management letter prepared by the provider’s financial auditors (e.g., CPA firm), previous Medicare audit history, and empirical knowledge of the provider. It is not necessary to test the provider’s system of internal control for audits of specifically selected areas such as intern/resident counts or wage index reviews, or for reopenings. Furthermore, where CMS directs you to perform a special audit, CMS may limit, or require no work, in the area of internal control. If internal controls are not reviewed, the decision should be stated in the scope section of the audit report. In this situation, preparation of a report on internal controls (see §70.1 of this chapter) is not required. C. Obtaining an Understanding of the Internal Control Structure If you determine that it is necessary to review internal controls in a given situation (e.g., new providers, first audit by the contractor), complete the Internal Control Questionnaire (see Exhibit IV in §170 of this chapter). Since all the aspects of the provider’s internal control structure are not relevant to a Medicare audit, this questionnaire is designed to allow you to obtain an understanding of the provider's internal control structure as it applies to Medicare audits. Medicare auditors are concerned with the allowability, reasonableness, classification, and accumulation of cost report data that must be reported in accordance with Medicare principles of payment. Therefore, the Medicare auditor should obtain an understanding of those aspects of the provider's internal control structure that affect the reliability of the cost report data that is being audited within the parameters of the Medicare audit in accordance with CMS' audit instructions. This understanding is ordinarily obtained by: • Previous experience with the provider; • Inquiries of appropriate personnel; • Observation of the provider's activities and operations; and • Inspection of the provider's documents and records. Once the information required by the questionnaire has been obtained and in your professional judgment you need to test the internal control structure in subsequent years, you may review and update the questionnaire answers and documentation during subsequent audits. Obtain the provider's written concurrence to the answers and documentation as a whole or on a question-by-question basis, as appropriate. Maintain the internal control questionnaire with all related documentation in a separate section of the permanent file and cross reference to supporting audit working papers, if necessary.