Most industries today are faced with a variety of obstacles in achieving or remaining profitable. The healthcare industry is no exception. Profitability is enough of a challenge under normal circumstances, but especially so during fragile economic times. Uncertain revenue streams and rising costs have many healthcare organizations understandably apprehensive.
Traditionally, hospitals were more focused on managing revenues rather than on costs to insure profitability. But this focus on revenues has become increasingly more difficult to plan, execute and manage due to confusing healthcare reform, complex insurance reimbursements, Rejections, community perception, government red tape and political concerns. Conversely, effective internal controls in the healthy industry in East Africa has been a challenge but has not been a priority due to limited administrative resources toward cost management:
In my previous article in the Today’s Accountant magazine of ICPAU last year, I clearly stated that without sound internal controls that are linked to cost management function; the health care sector cannot achieve its desired objectives. A hospital cannot set rates and charges which are realistic and related to costs unless the cost-finding system accurately allocates both direct and indirect costs to the appropriate cost centers.
Cost management defined:
Cost management can be defined as the process of collecting, analysing, evaluating and reporting of cost information that is used for budgeting, forecasting, pricing, profitability analysis and performance reporting. Accurate cost information affects both financial and non-financial decision making. Inaccurate decisions often result in unprofitable service offerings, incorrect pricing, inefficient allocation of personnel and low return on investment on equipment purchases.
In Uganda, unless Hospitals quickly realise that there is limited control over revenue sources, and the costs associated with increasing those revenues only result in incremental losses. In comparison, cost management often results in each cost shilling saved, contributing directly to net income. Technology and costing techniques have now greatly evolved; so there is a real motivation to shift the focus to cost management linked with sound internal controls.
In its simplest form, costs consist of direct and indirect (overhead) components. Direct costs are easily identified and assigned to products and services. Examples of healthcare direct costs include: physician and procedure specific staff services (labor), supplies used to deliver services and easily assignable service related equipment costs. Assigning the supporting overhead, or indirect, costs to these same services to arrive at the total cost is far more complex and at times may appear ambiguous. In Uganda little healthcare organization can afford the cost of the skilled labour to effectively design/monitor the internal controls because even the national budget allocated to the healthy sector is less than 5% if compared to other sectors in the country.
Costing example with needed sound internal control to be in place.
A typical service offered by a healthcare facility is heart surgery. The direct costs would include the cost of the surgeon and procedure specific staff, along with the supplies required for this particular operation. The indirect (overhead) costs would include, but not limited to, general support staff and related costs, insurance, taxes, utilities, facility and administration. It is estimated that these indirect costs can be as high as 60% of the total costs of a hospital service. This is a significant portion of the total cost; so it only takes a slight deviation in such a large component of the cost to paint a startlingly different financial picture. This subsequently leads to inaccurate or misguided decision making if controls are not in place.
Healthcare organisations can improve the quality of their cost information to dramatically reduce the risk of inaccurate financial decisions if senior management is fully engaged in internal control. This includes the ability to better measure efficiencies and capacity utilization. Better information for all of the key stakeholders, including hospital administrators, physicians, or policy makers, will result in a far more efficient and cost-effective industry. But few accountants/ policy makers ask themselves if, really, the Ugandan healthy sector is profitable and management effective: Questions like why healthcare organizations do not participant in the ICPAU FiRe Awards will soon come to stoplight.
The bottom line: need for increased effective internal controls.
Healthcare organisations are finding it increasingly more difficult to improve profitability by focusing on revenues with increasing stock losses due to weak control systems. Refocusing resources on cost management linked with internal control will allow these organizations to achieve increased performance without sacrificing existing service levels. Understanding the total costs of services will allow the redeployment of resources which provide a higher payback, or will facilitate the elimination of those resources altogether. The bottom line: increased profitability may be achieved.
How to Get Senior Management to Take Internal Control Seriously
Top managers in hospitals have many calls on their time and attention. Vying for their attention will be patients, suppliers, employees, consultants, and many others. Internal controls can easily be squeezed out of their agenda. The problem this can create is that if senior management does not take control seriously, the “tone from the top” will be wrong—and if the people in charge don’t care, then why should anyone else in the organization? Right or wrong, this is the message that will be perceived across the healthcare industry, and internal control will suffer.
So, as a professional auditor, how can you push internal control up the priority list? Showing clearly to management the benefits of strong internal control on the one hand, and the consequences of failure of internal control on the other, is one path to this goal. This can only be achieved if all Certified Public Accountants fully understand the needful to the development of the sector.
Benefits of Control to the healthcare industry
A key message to communicate to management is that, effective and active controls give positive benefits as well as avoiding negative outcomes. Having controls that are effective will ensure that the directions of the board and senior management are implemented as intended; that operations and activities are carried out efficiently and meet their objectives; and that the assets used in a hospital are not only properly accounted for, but also that they are used effectively and efficiently for the benefit of the hospital.
For example at St Francis Hospital Nsambya, Procedures which follow sound control principles have enabled people to carry out their work in an environment that is orderly and satisfying to work in. Good internal controls have protected the hospital and its staff against the temptations of dishonesty, fraud, and theft. In the end even our service delivery has significantly improved if compared with other health care organizations.
In a nut shell, hospitals that have sound internal controls will know where they are, and where they are going, because management information controls will tell the organization’s management what they need to know when they need to know it through the heads of departments and ward managers. If the first imperative of most organizations is survival, then good internal control can play a major role in achieving that objective.
The impact of control failure inside the healthcare industry:
All too often, internal control only becomes a concern to top management after it breaks down. Out of the blue comes the sudden discovery of a massive fraud or a major hole in the accounts, or a business segment that was thought to be profitable is dramatically discovered not to be. There is a myriad of such possibilities. Management discovers, painfully, that when there is such a breakdown of control, almost everything else has to be thrown out of the window while the breakdown is investigated particularly when it is on drug management. It has to engage with internal auditors, external auditors, consultants, and specialists to uncover the root causes of the problem, as there is no cure without first making a diagnosis. The managers responsible for the failure must immediately be identified and a conclusion reached on their degree of culpability. And if someone has to be fired, who is going to take on their responsibilities?
Then, senior managers have to make up their minds on what to do about the underlying problem. What changes have to be made to ensure that it can never happen again? Should they commission reviews in other similar parts of the hospital to gain assurance that the problem isn’t endemic elsewhere? Are major investments in systems or capital items needed to fix things? Should procedures be revised? Do staff need retraining or reorganizing? If so, who is going to implement the changes, and where is the money going to come from?
Control breakdown can have external implications to a health care industry:
Another vital aspect is the impact of a breakdown on external relations. Do investors and the owner’s have to be informed? Is a loss warning necessary? How will stakeholders react? What will the (inevitably negative) impact be on the directors, and therefore the value, of the organization? Often such an announcement will create a loss of shareholder value that is many times the original operating loss. At times like these, an executive director may be lucky to keep his job; at the very least, there is a major risk of loss of personal and corporate reputation. Let all healthcare operators be warned.
The opportunity cost is great
On top of this, in a serious case the opportunity cost of the time that management will lose in attending to the consequences of an internal control breakdown can be massive. Strategic issues, tactical issues, business development—all these and many more normal concerns of senior management will have to take a back seat until the problem is resolved. Add to this the loss of reputation and of confidence, inside and outside the organization, because news will inevitably leak out however carefully those involved try to prevent it.
Getting Management Backing: Where to Start
If the benefits of sound controls are so tangible, and the aftermath of a failure of internal control is so dreadful, how does the auditor make a start on obtaining top management’s backing for a regime of sound internal control? Corporate governance regulations in Uganda, and best practice, now require organizations formally to analyze and record the risks they face. The purpose of this requirement is, first, to ensure that organizations actually understand their risk profile, as only then can they seriously and properly consider whether they have the right mitigation arrangements in place. Often a management team, in making explicit the risks they face, will discover that initially they do not have a common view as to what the risks are. Only when they have a unified vision can they expect to come up with a coherent and balanced response. Only then can they hope to design and develop a comprehensive internal control system that meets the needs of the organization. The auditor can assist by becoming involved in the risk identification process, by emphasizing to senior management the immediate impact of failure to mitigate the risks for example, by pointing out that the accounts will be incorrect.
It is not least by confronting management with the consequences of control failure that it can be helped to take internal control seriously. The internal auditor can help to create an understanding and appreciation of the consequences of control failure by making presentations and having one-to-one meetings with influential people, such as the medical director, chief executive, chief financial officer, audit committee chair, other board members, and senior managers. The objective is to create an awareness of internal control in the organization and, through that awareness, to change the attitude to it.
While some risks may be external to the hospital and not susceptible to internal control, many can be mitigated by internal controls. In healthcare setting, management is reluctant to accept the need for internal controls, believing that staff should be trusted. Internal auditors should point out to such management that trust is not a substitute for internal control.
A proper system of internal controls should be considered a force for moral good, in that it effectively removes temptation from employees by ensuring that undesirable behaviors will be promptly detected and corrected; if employees understand this, they will be less likely to attempt to defraud their employer.
How you can Make It Happen in the healthcare industry
• Collect evidence about the state of internal controls and any opportunities that exist for improving them.
• Present the benefits of better controls in terms with which management can identify.
• Review the organization’s code of conduct or similar document; if none exists, it is worth raising the issue.
• Seek a meeting with the head of the hospital and influential members of the board. Have a clear but short agenda. Aim for some specific goals from your meeting. Go prepared with a succinct presentation and some practical recommendations.
• Use the opportunity to argue for the importance of tone from the top where internal control is concerned; if the top people in the company take internal control seriously, so will everybody else. Ask whether they like unwelcome surprises and what they are prepared to do to avoid them.
• Point up the risks facing the organization, and show how a well-designed control structure can help to avoid or mitigate the worst consequences.
• Don’t expect everything to be achieved with just one meeting. Be prepared to keep going back with the same messages until they are not only accepted, but also acted on.
Management’s role in ensuring effective internal control is vital. Management sets the tone from the top. Unless management engages and commits, the rest of the organization will not take internal control seriously. The internal auditor can help management to appreciate the importance of internal control by demonstrating its value—not least, the efficiency dividend to an organization if good, cost-effective internal control systems are in place—and by making management aware of the consequences of failures of internal control. The internal auditor can further assist management by highlighting the need to set tone from the top, to allocate sufficient resources for internal control, and to ensure that internal control processes are suitably designed for the needs of the business.