2011-12-01
“With the ACL solution, we’ve integrated data analysis into our audit plan. We’re saving real time and money every day.”
Dan Shelly, Senior Auditor, Greater Baltimore Medical Center
Greater Baltimore Medical Center (GBMC) includes the Greater Baltimore Medical Associates (GBMA), Gilchrist Hospice Care, and the GBMC Foundation. Founded in Towson, Maryland in 1965, the 281-bed medical center handles more than 26,700 inpatient cases and 60,000 emergency room visits annually. GBMC is one of the largest private sector employers in Baltimore County, with over 3,500 staff, including 1,300 physicians and 1,200 nurses.
The GBMC Internal Audit team reviews large data files that represent critical control areas, including system access privileges and federal vendor regulations. The organisation had become proficient with automated data analysis and recently implemented an ACL managed analytics solution to enhance efficiency and reduce manual sampling. The solution includes scheduling capabilities that enable users to run data tests at pre-determined times. It’s a flexible, server-based function that minimises hands-on intervention.
After the solution was implemented, an ACL consultant spent a week on-site with the GBMC audit team to create several custom analytics. These tests target high-risk areas that benefit most dramatically from automated analysis. The consultant worked closely with the audit team to understand their needs and demonstrate the process of creating and running the analytics.
The first one analyses vendors, employees and medical staff against the U.S. Excluded Parties List System (EPLS). This monthly test quickly reveals individuals and organisations that must not be paid with federal funds. Before the ACL implementation, the audit team would manually compare the EPLS list against internal databases. The process inevitably produced a large number of false positives, which required further manual review. It was a time-consuming activity that took staff away from other key responsibilities. Now, the ACL solution automatically searches the two databases for potential matches – with very few false positives. The entire process is complete in less than 15 minutes.
Another quarterly test looks for terminated employees who still have access to internal computer systems. It matches several termination files against reports from 12 different computer systems to pinpoint unauthorised users. It’s a valuable check that ensures data security and confidentiality, and supports external audit reviews of system access controls. Without the ACL solution, manually comparing these files would require at least two days of full-time work. Now, the test is complete in four hours or less.
“With ACL we’ve automated complex data analysis. The solution saves time, money and manual intervention.”
Dan Shelly, Senior Auditor, Greater Baltimore Medical Center
The internal audit team also uses ACL analytics to uncover duplicate payments before they leave the company. After the Accounts Payable team load invoices into the system for next-day payment, an automated test works overnight to compare the data with prepared check files. The next morning, employees simply scan an ACL report and pull erroneous checks from the workflow, or use the data to support further investigation. The process runs weekly without manual intervention – providing an effective, hands-off control process for the audit team. AP staff hours are no longer spent tracking down vendors to collect overpayments or request credits; the automated review prevents duplicate checks from being created in the first place.
Greater Baltimore Medical Center has used ACL technology to:
Storing reliable, repeatable analytics in a secure repository helps the GBMC audit team stay organised and work more efficiently. Auditors can easily share content and build on previous efforts, saving time and reducing work duplication. Server-based data analysis is also much faster than performing desktop calculations. The system access terminations test, for example, used to require nearly two hours to complete. Now, it runs in less than 10 minutes without the need for complex data extractions.
Automated data analytics also provide a strong financial return on investment for GBMC. With complete population coverage and pre-payment analysis, the audit team expects to prevent more than £39,000 in annual duplicate payments from leaving corporate accounts.
The EPLS analysis is another efficient test that provides significant peace of mind for both internal and external auditors, and senior management. While other medical organisations might struggle to comply with EPLS regulations, GBMC has implemented an automated control to prevent transactions with barred individuals and vendors.
If the audit team hits a snag with the analytics, ACL support staff is just a phone call away. They answer questions, offer suggestions, and can provide solutions to tricky problems. With a solid foundation of ACL training, the GBMC auditors have the skills they need to effectively leverage the existing analytics and create new tests that meet strategic audit and business goals.
The GBMC internal audit team has created a wish list of future analytics that target high-risk control areas. From additional system access testing to financial reviews, the auditors will continue to implement automated routines that provide secure, scheduled analysis. GBMC is also eager to expand their ACL solution to provide a timely way to review, distribute and resolve the exceptions revealed during continuous analysis.
3 Appleton Court, Calder Park
Wakefield, WF2 7AR
+44 (0) 1924 254 101
Subscribe to our newsletter.
Please fill out the details below and a member of our team will be in-touch shortly with next available date(s). Typically this workshop runs quarterly.
