Risk Assessment Beginning an Analysis Date by Jim Bowman

Background Goals Definitions Planned Evolution Risk Assessment Overview Risks Assessments Scoring Background Goals Definitions Planned Evolution Date by Jim Bowman

Effective and efficient business operations Risk Assessment Overview Risks Assessments Scoring Background Corporate fraud in the 1990’s led to a recognized need for Boards of Directors to provide reasonable assurance in achieving 3 objectives: Effective and efficient business operations Reliable financial reporting Compliance with laws and regulations Date by Jim Bowman

Background (Continued) Risk Assessment Overview Risks Assessments Scoring Background (Continued) Controlling risks requires: A controlled environment/culture Risk Assessment Control Activities Information and Communication Monitoring Date by Jim Bowman

Improve Business Success Risk Assessment Overview Risks Assessments Scoring Goals Reduce Risks Increase Confidence Improve Business Success Date by Jim Bowman

Risk – The possibility that something will go wrong Risk Assessment Overview Risks Assessments Scoring Definitions Risk – The possibility that something will go wrong Assessment – The likelihood that the adverse event will happen and the impact it would have on the business Scoring – Prioritizing our attention to making improvements Date by Jim Bowman

Planned Evolution for Making a Risk Assessment: Overview Risks Assessments Scoring Planned Evolution for Making a Risk Assessment: Step 1 Identify the universe of risks Step 2 Evaluate the effectiveness of controls Step 3 Determine how to monitor the risks Date by Jim Bowman

Planned Evolution (Continued) Risk Assessment Overview Risks Assessments Scoring Planned Evolution (Continued) Assess the likelihood and potential negative impact if the adverse event occurred Step 4 Step 5 Prioritize needed improvements Step 6 Review and update the Risk Assessment monthly Date by Jim Bowman

1. Key Business Activities Risk Assessment Overview Risks Assessments Scoring Identify the Universe of Risks from: 1. Key Business Activities 2. Prior Audits 3. Regulatory Requirements Date by Jim Bowman

1. Key Business Activities Risk Assessment Overview Risks Assessments Scoring 1. Key Business Activities By Departments Department activities have risks Each job function has risks Clinical Risks Services, Products, Equipment, Personnel Research, Patient Privacy and Safety and Care Variances, Licenses, Accreditation Quality of Services, Performance Measures Proper Documentation Date by Jim Bowman

1. Key Business Activities, Continued Risk Assessment Overview Risks Assessments Scoring 1. Key Business Activities, Continued Business Risks Billing, Revenue Cycle and Cost Reports Contracts and Leasing Arrangements Insurance Human Resources Policies and Procedures Information Technology and Security Organizational Risks Unique Governmental Requirements Tax Status Date by Jim Bowman

2. Prior Audits Risk Assessment Recent External Audits Overview Risks Assessments Scoring 2. Prior Audits Recent External Audits Findings Management Responses Follow Up Corrective Actions Recent Internal Audits Findings and Corrective Actions “Hot Topics” Requiring Further Work Date by Jim Bowman

3. Regulatory Requirements Risk Assessment Overview Risks Assessments Scoring 3. Regulatory Requirements Governmental Obligations and Requirements Laws and Rules that Regulate the Business Governmental Investigations into Fraud and Abuse Regulatory and Accreditation Standards Governmental Alerts and Bulletins Relevant Court Cases (Prosecution and Litigation) Sentencing Guidelines National Database of Healthcare Practioner Fraud and Abuse Date by Jim Bowman

3. Regulatory Requirements, Continued Risk Assessment Overview Risks Assessments Scoring 3. Regulatory Requirements, Continued Other Resources OIG Work Plan OIG Compliance program Guidance OIG Supplemental Guidance Relevant Newspaper Headlines Information from Internet, Newsletters and Professional Organizations Date by Jim Bowman

Once the risk topics have been identified, Risk Assessment Overview Risks Assessments Scoring Once the risk topics have been identified, List them within broad categories, such as: Sales and Marketing Providing Clinical Services Environmental Health and Safety Confidentiality and Privacy Records Management Human Resources Licensing, Registration, Certification, Accreditation Clinical Research Vendor Relations…or others as needed Date by Jim Bowman

Risk Assessment Overview Risks Assessments Scoring Please refer to the sample Risk Assessment Spreadsheet for this section. This section will focus on assessing risks by using the six spreadsheet columns to the right of each risk topic. Date by Jim Bowman

1. Obligation 2. Policy and Guidelines 3. Internal Controls Risk Assessment Overview Risks Assessments Scoring 1. Obligation 2. Policy and Guidelines 3. Internal Controls 4. Control Adequacy 5. Audit/Monitoring 6. Follow Up Date by Jim Bowman

1. Obligation Risk Assessment Overview Risks Assessments Scoring 1. Obligation Identify the Regulatory Obligation or Compliance Risk that must be met for each risk topic. Enter it into the spreadsheet. The Obligation should be a “positive” statement. An example is “Accurately promote products consistent with FDA approval.” A negative statement would be “Don’t violate FDA approved promotions.” Date by Jim Bowman

Risk Assessment Overview Risks Assessments Scoring 2. Policy and Guidelines List all Company Policies and Guidelines that refer to each of the risk topics. Enter those items into the spreadsheet for each risk topic. Date by Jim Bowman

Risk Assessment Overview Risks Assessments Scoring 3. Internal Controls Identify all Internal Controls for each risk topic. Internal Controls are documentation that include training materials, signed training completion certifications, policies, procedures, completed checklists and forms, etc. Enter all Controls into the spreadsheet for each risk topic. Date by Jim Bowman

Risk Assessment Overview Risks Assessments Scoring 4. Control Adequacy Evaluate the Controls for their adequacy in preventing risks. At this point, the Controls are either Adequate or Needs Improvement. Enter either Adequate or Needs Improvement into the spreadsheet for each risk topic. Date by Jim Bowman

Risk Assessment Overview Risks Assessments Scoring 5. Audit/Monitoring List all documented forms of auditing and/or monitoring that tests the effectiveness of each Control in preventing risk. Enter all of the audits or monitors into the spreadsheet for each risk topic. Date by Jim Bowman

Risk Assessment Overview Risks Assessments Scoring 6. Follow Up Describe what Follow Up should be done for each risk topic whose Control was Needs Improvement. Enter the Follow Up work into the spreadsheet for each risk topic. Date by Jim Bowman

Risk Assessment Overview Risks Assessments Scoring At this point, there should be a number of risk topics that require Follow Up. The next step will be to prioritize Follow Up work to the topics with the most risk. In order to do this, Scoring each Risk that Needs Improvement must be done. Date by Jim Bowman

Scoring the Risk Topics is based on: Risk Assessment Overview Risks Assessments Scoring Scoring the Risk Topics is based on: 1. Likelihood 2. Impact The results of the Scoring will be used to prioritize Follow Up work based on the severity of risk to the business. Date by Jim Bowman

Risk Assessment Overview Risks Assessments Scoring Scoring involves quantifying the relative magnitude of risk based on past occurrences and the potential negative impact on the business. A particular risk topic may have either a high or low likelihood of occurring. Similarly, a risk may have either a high or low negative impact on the business. Date by Jim Bowman

Risk Assessment Overview Risks Assessments Scoring Obviously, a risk that has a high likelihood and a high impact should receive our foremost attention. Similarly, a risk that has a low likelihood and a low impact does not require such a high level of attention. Date by Jim Bowman

Risk Assessment Overview Risks Assessments Scoring Risk Scoring can yield results that can be displayed on a diagram such as this: A B C D E F G H 1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 8 9 10 Impact Likelihood HIGH, HIGH 3 1 HIGH, LOW 2 4 LOW, LOW LOW, HIGH Date by Jim Bowman

Risk Assessment Overview Risks Assessments Scoring Quadrant #1 shows risk topics that scored both High Likelihood and High Impact: A B C D E F G H 1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 8 9 10 Impact Likelihood HIGH, HIGH 3 1 HIGH, LOW 2 4 LOW, LOW LOW, HIGH Date by Jim Bowman

Risk Assessment Overview Risks Assessments Scoring Quadrant #2 shows risk topics that scored a Low Likelihood and High Impact: A B C D E F G H 1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 8 9 10 Impact Likelihood HIGH, HIGH 3 1 HIGH, LOW 2 4 LOW, LOW LOW, HIGH Date by Jim Bowman

Risk Assessment Overview Risks Assessments Scoring Quadrant #3 shows risk topics that scored a High Likelihood and Low Impact: A B C D E F G H 1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 8 9 10 Impact Likelihood HIGH, HIGH 3 1 HIGH, LOW 2 4 LOW, LOW LOW, HIGH Date by Jim Bowman

Risk Assessment Overview Risks Assessments Scoring Quadrant #4 shows risk topics that scored a Low Likelihood and Low Impact: A B C D E F G H 1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 8 9 10 Impact Likelihood HIGH, HIGH 3 1 HIGH, LOW 2 4 LOW, LOW LOW, HIGH Date by Jim Bowman

Risk Assessment Overview Risks Assessments Scoring The numerical sequence of quadrants guides our priority in addressing risks. A B C D E F G H 1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 8 9 10 Impact Likelihood HIGH, HIGH 3 1 HIGH, LOW 2 4 LOW, LOW LOW, HIGH Date by Jim Bowman

We will look at each scoring block. Risk Assessment Overview Risks Assessments Scoring Now, let us determine a Likelihood and an Impact score for each risk topic. In the accompanying sample spreadsheet, for each risk topic there are five Likelihood scoring blocks and four Impact scoring blocks. We will look at each scoring block. Date by Jim Bowman

Likelihood Risk Assessment Occurrence of past errors a. No = 0 Overview Risks Assessments Scoring Likelihood Occurrence of past errors a. No = 0 b. Yes (minor) = 2 c. Yes (many) = 4 Date by Jim Bowman

Likelihood Risk Assessment Degree of complexity of the process Overview Risks Assessments Scoring Likelihood Degree of complexity of the process a. Not complex = 0 b. Somewhat complex = 2 c. Very complex = 4 Date by Jim Bowman

Likelihood Risk Assessment Degree of Manual versus Automated Overview Risks Assessments Scoring Likelihood Degree of Manual versus Automated a. Automated = 0 b. Somewhat automated = 2 c. Manual = 4 Date by Jim Bowman

Likelihood Risk Assessment Overview Risks Assessments Scoring Likelihood Stability or degree of changes in people, systems and processes a. No changes, stable = 0 b. Some changes, somewhat unstable = 2 c. Many changes, very unstable, or new = 4 Date by Jim Bowman

Likelihood Risk Assessment Overview Risks Assessments Scoring Likelihood Effectiveness of controls, as demonstrated in past audits and monitors a. Good = 0 b. Not audited = 2 c. Needs Improvement = 4 Date by Jim Bowman

Risk Assessment Overview Risks Assessments Scoring Likelihood When you add the five Likelihood scores together, a sum greater than 7 is considered to be High Likelihood. Enter the Likelihood scores and total into the spreadsheet. Date by Jim Bowman

Impact Risk Assessment Frequency and volume of transaction Overview Risks Assessments Scoring Impact Frequency and volume of transaction a. Small = 0 b. Medium = 3 c. Large = 5 Date by Jim Bowman

Impact Risk Assessment Direct impact on regulatory requirements Overview Risks Assessments Scoring Impact Direct impact on regulatory requirements a. No regulatory requirement = 0 b. Regulatory requirement = 5 Date by Jim Bowman

Impact Risk Assessment Overview Risks Assessments Scoring Impact Range of possible loss of revenue (fines, lost business, litigation) a. No loss = 0 b. Minimal refund = 2 c. Systemic issue, large refund = 4 d. Large refund and penalties or fines = 6 Date by Jim Bowman

Impact Risk Assessment Reportable to the government a. No = 0 Overview Risks Assessments Scoring Impact Reportable to the government a. No = 0 b. Yes = 5 Date by Jim Bowman

Risk Assessment Overview Risks Assessments Scoring Impact When you add the four Impact scores together, a sum greater than 10 is considered to be High Impact. Enter the Impact scores and total into the spreadsheet. Date by Jim Bowman

Risk Assessment Overview Risks Assessments Scoring Next Steps The objective of a Risk Assessment is not to simply make an Audit Plan, but to make the business better by improving the weaknesses. A report of the Risk Assessment findings and a strategic plan to address the highest priorities should be made into a Compliance Work Plan. Date by Jim Bowman

Next Steps The Compliance Work Plan should include: Risk Assessment Overview Risks Assessments Scoring Next Steps The Compliance Work Plan should include: The results of the Risk Assessment A list of the highest priority risk topics A strategic plan for follow up work Monthly review of the Risk Assessment Add new risk topics as they arise Date by Jim Bowman