Exploring the world of what an audit “finding” means versus only perhaps an “observation” can get really interesting in the healthcare compliance area.
Financial auditors historically have had categories of “findings” such as, for example, the following:
-
Internal controls – significant deficiency or material weakness
-
Material noncompliance
-
Known or likely questioned costs greater than $25,000
-
Known or likely fraud
-
Misrepresentation of status of prior year findings
Other financial auditors refer to, for instance, internal control deficiencies in areas of “design” deficiency or “operating” deficiency.
In a Sarbanes-Oxley Section 404 management assessment of internal controls audit, deficiency definitions may include levels of:
-
Control deficiency
-
Significant deficiency
-
Material weakness
In the compliance world, we often need to ask: Did we just violate our policy, did we violate the law, or both?
A “reportable event” in a corporate integrity agreement (CIA) is defined as:
-
“A substantial overpayment,
-
A matter a reasonable person would consider a probable violation of criminal, civil, or administrative laws applicable to any Federal health care program for which penalties or exclusion may be authorized,
-
The employment of or contracting with an ineligible person,”[1]
-
The filing of a bankruptcy petition.
A reportable event may result from an isolated event or a series of occurrences.
Compliance officers must ask if a medical record or billing error violates a condition of participation and/or a condition of payment and understand the potential differences.
So, in the world of audit and audit reports, it is helpful to discuss or decide upfront how the severity of a concern in what is being looked at is communicated. For example, how will those be defined upfront if there will be critical observations, major observations, moderate observations, and minor observations? Is this the type of audit where the frequency of a finding should be the focus so it might make more sense to say (1) frequent, (2) common, (3) infrequent, or (4) isolated?
Would you prefer to have the findings communicated as (1) substantial, (2) significant, or (3) technical? What about (1) major observation, (2) minor observation, and (3) opportunity for improvement or recommendation?
It is nice to explore with your compliance or internal auditors how particular audit results will be measured and communicated.