Part 4 - Iowa Medicaid Enterprise

RFP MED-12-001 | Technical ProposalIowa Medicaid Enterprise System Service Procurement | MMIS and Core MMIS OperationsA periodic review occurs for each operational area, along with any subcontractors working within theoperational area. The selection of the areas for review is prioritized based on risk assessments. The riskassessment identifies business functions associated with the contract and evaluates each business functionbased on a series of risk factors. These weighted risk factors identify areas at greatest risk of failing tomeet contractual performance requirements. Operational areas identified as higher risk are audited earlierand more frequently than areas identified as lower risk.The annual audit plan is presented to the Audit, Compliance, & Governance Committee of our board ofdirectors. The plan is provided to the committee members for their review and a presentation is given at acommittee meeting. The annual audit plan is also distributed to executive and management staff. The planidentifies the operational areas to be audited during the upcoming fiscal year and provides a briefdescription of each planned audit.The audit process consists of the following:• Planning. The audit process begins with the planning stage. Auditors develop an audit program basedon management discussions and risk assessment results. Before the audit, the internal auditor givesnotice to the operational area being evaluated that an audit will be taking place. Typically, this noticeis sent one to two weeks in advance of the entrance conference. The notice is sent to managers andexecutive management of the areas being examined. The chief executive officer, chief operationsofficer, and compliance officer receive copies of each notice. The auditor holds a formal entranceconference to communicate the purpose and objective of the audit.• Audit Fieldwork. Fieldwork for the audit begins shortly after the entrance conference. Fieldworkconsists of testing and verifying the audit objective. Testing may include interviewing, observation,data analysis, reviewing documentation, recalculation, and sampling from a larger population. Astandard work paper format is used to document the auditor’s examination in detail. If the auditordiscovers areas where the operation is not meeting a certain condition or criteria, the finding isdiscussed with the appropriate management staff during the fieldwork so they can correct thecondition as soon as possible.• Final Audit Report. Once audit objectives have been tested, a final audit report is issued and workpapers are organized into an audit file. The manager of operations review examines the audit filefor quality.• Review of Audit Findings. The auditor provides the audit findings to the account manager. If thereare defects or deficiencies noted, the account manager is required to submit a CAP to the operationsreview team and the Department unit manager. The operations review team also requires the rootcause of the audit finding be documented on the tentative finding and recommendation form. AllCAPs that result from any operational audit will follow the same processes, monitoring, and reportingas CAPs from the reviews discussed previously.• Formal Exit Conference. A formal exit conference is held, communicating the results of the audit toCore contractor managers and Team Noridian executive management. If audit findings exist, CAPsare developed. The audit findings, recommendations, CAPs, and detailed audit information areentered into a database to track findings from issuance to closure.• Post Audit Activities. At the completion of the audit, a customer service survey is issued to thesubject of the audit to provide feedback on the auditor’s performance during the audit. Internally,shortly after the exit conference, the final audit report is distributed to the management staff of thearea audited, executive staff, the Audit, Compliance & Governance Committee of the board ofdirectors, and the compliance department.7 | 24