The LBJ Tropical Medical Center auditors, Moss Adams, identified many deficiencies in internal controls relating to financial reporting, compliance, and other matters.
• 2020-001 – Financial Statement Close and Reporting Process – Significant Deficiency in Internal Controls over Financial Reporting
There were several reconciliations that needed to be completed and entries that needed to be posted subsequent to the start of the audit process.
Some entries were identified as a result of the audit procedures and some entries were identified by the Medical Center after the audit procedures had begun. “In addition, we noted that the Medical Center’s related process, policy, and procedure documentation had not been updated and reviewed.”
While performing internal control testing, the auditors found that reviews of user account privileges, privileged access, or segregation of duties are not performed. Employees have been granted supervisor access, which gives them the capability to provide access to other employees without working through the information technology (IT) department. Also, it was noted that access for terminated employees is not removed timely.
• 2020-002 – Patient Service Revenue Process – Material Weakness in Internal Controls over Financial Reporting
The Medical Center has not been able to obtain sufficient patient revenue and accounts receivable reports from the system for financial reporting purposes and the related revenue process has not been documented.
• 2020-003 – Capitalization of Assets and Unrecorded Liabilities – Material Weakness in Internal Controls over Financial Reporting
The auditors identified obligations that were improperly excluded from the Medical Center’s liabilities as of the fiscal year end and capital assets that were improperly expensed. The net effect of the related corrections, which decreased expenses by approximately $1,300,000, increased capital assets by approximately $2,000,000, and increased related liabilities by approximately $700,000, were made to the financial statements as of September 30, 2020.
• 2020-004 – Allowable Cost, Payroll Segregation of Duties – Significant Deficiency in Internal Controls over Compliance
During the auditors’ internal control testing surrounding payroll it was found that the finance office has access to employee demographic information and pay rates in the system. Payroll costs represent the most significant type of Federal award expenditures for the Medical Center.
• 2020-005 – Equipment and Real Property Management – Significant Deficiency in Internal Controls over Compliance
The Medical Center does not have documentation for the required physical inventory of all applicable capital assets in the last two years. The Medical Center designed a process to track capital assets purchased with federal funds starting in fiscal year 2020.
• 2019-004 – Preparation of Financial Statements – Significant Deficiency in Internal Controls over Financial Reporting
There were several entries identified as a result of the audit procedures that needed to be posted in order for the financial statements to be presented in accordance with accounting principles generally accepted in the United States of America. The auditors noted improvement during the current audit; not as many entries were identified relative the prior audit.
• 2019-005 – Policies and Procedures – Significant Deficiency in Internal Controls over Financial Reporting
The auditors found that several of the Medical Center’s policies and procedures had not been updated for several years. The auditors understand that the Medical Center’s current priority is implementing the new revenue cycleprocess.
• 2019-006 – Information Technology, Patient Revenues, and Accounts Receivable Ledger – Material
The Medical Center was historically unable to obtain accurate patient-revenue and accounts receivable reports as of year-end.
• 2019-007 – Information Technology – Material Weakness in Internal Controls over Financial Reporting
While performing internal control testing, the auditors noted that the accounting system has not been fully integrated. This results in a large amount of manual entries, as well as some inaccurate and/or inaccessible reports. While that is the condition for most systems, it was observed that the Medical Center implemented a new procurement system during the fiscal year that is fully integrated with the accounting system.
• 2019-008 – Segregation of Duties and Other Internal Control Findings – Significant Deficiency in Internal Controls over Financial Reporting
While performing internal control testing surrounding payroll the auditors noted the finance office has access to employee demographic information and pay rates. A mitigating control was implemented for part of the fiscal year, but was not implemented for the entire fiscal year.
