Internal audit tools in action: Taking on today’s biggest risks

Case study 1: SSI rates

The risk

While performing an annual risk assessment at a health system, internal auditors noticed surgical site infection (SSI) rates were higher at one medical center than at others within the system. A deeper review using data analytics revealed a spike in SSI rates at Medical Center A during November and December. By analyzing the data, auditors found the medical center’s infection rates were higher than others within the health system even though it did not perform the most surgeries. This alarming trend led internal auditors and health system leadership to add a surgical safety audit of Medical Center A to the health system’s upcoming audit plan.

How internal audit tools helped

By using Audivate, a healthcare-specific internal audit workflow tool, the internal auditors could gather and review detailed background information about surgical safety. The audit team was then ready to perform on-site observations of multiple surgical areas and conduct interviews with staff in several departments. After reviewing and observing surgery site prep in pre-op and in the operating room, the audit team could not find any anomalies and decided further investigation was needed to determine why Medical Center A had a high SSI rate.

Additional discussions between the audit team and medical center executives revealed new information: The medical center’s supply team recently had worked on a product cost reduction project. The auditors again used analytics found within Audivate on all product changes made at Medical Center A in the last quarter. They discovered that the skin prep agent used on patient surgical sites had been changed to a cost-saving alternative during that time.

Interviews with additional staff members revealed that the medical center’s supply chain team had not informed surgical leadership about the product change. As a result, clinicians were unaware that the new product had a longer dry time than the one previously used. The skin prep needed to remain wet longer than the previous product – three minutes versus two minutes – or it would not work properly to kill bacteria. Not adhering to the longer dry time had resulted in surgical site infections. Without the ability to conduct a deeper audit using analytics, that mistake might not have been uncovered, putting more patients at risk and costing the medical center even more due to the costs associated with treating SSIs.

The risk

After discovering a former employee still had access to several software systems despite leaving the organization, Hospital C wanted to gain an understanding of which internal users had access to technology systems and what level of access they were granted.

How internal audit tools helped

While planning their approach, internal auditors collected background information on the topic from Audivate, professional organizations that specialize in healthcare IT, and other industry groups. The background document from Audivate included common IT risks and example controls. Auditors also met with stakeholders to discuss processes and procedures in place for system access and user provisioning. These data points helped guide the internal auditors toward developing the audit scope.

The background information revealed to auditors several areas that would be beneficial to test, such as fraud due to inappropriate access (for example, data confidentiality breaches). The team also considered performance standards (for example, the speed at which user access is granted or removed after initial request and the controls in place to limit modification, destruction, or disclosure of data), the ability to identify separation-of-duties violations, and policies in place for password configuration requirements.

These examples were just some among a list of many areas identified for potential testing. With so many risks, it can sometimes be overwhelming to determine the testing plan and how best to test each item. The internal audit team received help from Audivate, which used RACMs to generate a lengthy list of risks and controls and provided information to auditors about how best to test them.

To streamline this audit, the auditors used another feature of Audivate: an accelerator that allows testing several areas at once. Auditors could cover more ground while still testing the full population of data (not just a sample). As a result, they were able to conduct this audit more quickly and had time to fit in additional risk coverage during their workdays.