Risk Management Advisory & Consulting

Healthcare Industry

Riskpro, India

1
Who is Riskpro… Why us?

ABOUT US MISSION
 Riskpro is an organisation of member firms
around India devoted to client service  Provide integrated risk management
excellence. Member firms offer wide range consulting services to mid-large sized
of services in the field of risk management. corporate /financial institutions in India
 Currently it has offices in three major cities  Be the preferred service provider for
Mumbai, Delhi and Bangalore and alliances complete Governance, Risk and Compliance
in other cities. (GRC) solutions.
 Managed by experienced professionals with
experiences spanning various industries.

VALUE PROPOSITION DIFFERENTIATORS

 You get quality advisory, normally delivered
by large consulting firms, at fee levels  Risk Management is our main focus
charged by independent & small firms
 Over 200 years of cumulative experience
 High quality deliverables
 Hybrid Delivery model
 Multi-skilled & multi-disciplined organisation.
 Ability to take on large and complex projects
 Timely completion of any task due to delivery capabilities
 Affordable alternative to large firms  We Hold hands, not shake hands.

2
 Risk Management Advisory Services

Basel II/III Advisory Corporate Risks Information Security

 Market Risk  Enterprise Risk Assessment  IS Audit
 Credit Risk  Fraud Risk  Information Security
 Operational Risk  Risk based Internal Audit  IT Assurance
 ICAAP  Operations Risk  IT Governance
 Forensic services
SERVICES

Operational Risk Governance Other Risks

 Process reviews  Corporate Governance  Business/Strategic Risk
 Policy/ Process Review  Business Strategic risk  Reputation Risk
 Process Improvement  Fraud Risk  Outsourcing Risk
 Compliance Risk  Forensic Accounting  Contractual Risk

Training Recruitment
 Banking – E Learning  Virtual Risk Managers
 Corporate Training  Full Time Risk Professionals
 Regular Risk Management Training  Part time Risk Professionals
 Online Training material  Risk Managers on call – free
 Workshops / Events

3
Our Delivery Methodology

FREE USP
“No Cost – Know Risk” Diagnostic Assessment
(To determine your pain points, industry benchmarking etc)

GAP ANALYSIS & PROJECT DEFINITION

(Riskpro and clients brainstorm define project)

USP
PROJECT TEAM DEFINITION
Client gets to select Riskpro team members, subject matter experts.
Riskpro uses a mix of client staff / own staff for maximum value add

PROJECT EXECUTION
Constant project updates, timely project completion and project
outcomes that are practical and easy to maintain

4
Business Model – Hospital (Illustrative)
Corporate Governance Business Planning
Stakeholder
perspective
Mergers & Acquisitions/ Projects Marketing & Sales

Service Medical Strategy Patient discharge

Patient reception Diagnosis & Medical Record
Delivery & Service and Rehabilitation
& admission Patient Treatment Maintenance
Excellence Services

Medical Audit

Cost Procurement - Medical HR & Payroll Procurement - Capex

Perspective

Operating Systems & IT Housekeeping Inventory Management

Other
Insurance including TPA Finance & Accounts MIS & FR
Enablers
Administration & Facility
Customer Service Legal & Taxation
Management
Misc.
Blood Bank Management Waste & Energy Management F&B
Important

Quality Assurance

Strategic Operational Support

5
 Key Issues noticed in Hospitals

• • Frequent changes in the Project Plan

Short Healthcare Personnel
• • Lack of investment in research and development to
Stock Out of Life Saving Drugs
• Improper maintenance of medical records identify opportunities for new specialty services.
• Improper monitoring of cost and quality against the plan/
• Long pending from TPA’s/ Corporate
• Loss of star doctor/team budgets

• • Lack of focus on Medical Programs

Issue of expired blood/medicine to patients
• • Incorrect diagnosis/ treatment provided to patients
Not maintaining adequate transparency with
• Regulatory non compliances
patients with regard to treatment provided
• • Unhygienic conditions in hospital kitchen
Improper waste management
• • Improper segregation and disposal of waste
Customer service not in sync with customer
• Incomplete medical records
expectations
• • Incorrect provisioning for accounts receivables
Incorrect billing to patients
• • Inappropriate data used for reporting to management
Insufficient use of IT in daily operations
• • Weak processes to ensure compliance to JCI/ NABH
Threat of information theft from external & internal
sources
• Continuous dependence to drive revenue through
ECHS/CGHS

6
Risk Based Internal Audit How we Do

Internal Auditing helps an organization

accomplish its objectives by bringing a Enterprise Risk
systematic, disciplined approach to evaluate Assessment
and improve the effectiveness of risk
management, control and governance
processes. Risk
Need of Organizations

Source: The Institute of Internal Auditors 1999 (IIA) Assessment

Process
Reviews

Fraud Benefits of Risk based Audit

Mitigation
• Traditional audit view value added
Control techniques
Reviews •Risk profile of Businesses
•Internal Controls & Ops Risk reviews
Transaction •Cost reductions recommendations
Audit •Review of Fraud Risk Controls

Increasing Enterprise Risk Focus

7
 Internal Audit Universe

Internal Audit may be performed in the following domains for hospitals:

Major focus area Objective

Ensuring management’s vision , business objectives are incorporated in
i Hospital Governance the governing principles of the hospitals.

Ensuring robust procedures supporting clinicians to provide best quality

ii Medical & Quality Audit medical care to patients.

Ensuring robust business processes to support effective and efficient

iii Operations Support Audit operation of units.

Ensuring processes to recruit, develop and retain workers and leaders to

iv People Audit support achievement of business objectives

Ensuring processes and controls for accurate and effective financial

v Finance & Accounts accounting and reporting.

Ensuring processes to help units and HO comply with internal policy and
vi Compliance Management procedures, legal requirements, JCI, NABH and other requirements.

8
Internal Audit methodology for Hospitals

Audit planning Audit execution Reporting

• Gaining detailed understanding of your • Detailed scoping for each audit in discussion • Providing detailed audit issues and supporting
organisation. with process leaders, unit heads, FCs and evidence (including discussions) to process leaders
• Identification of key business processes HO to identify key focus areas. at unit and management for management comments.
supporting patient service. • Conducting detailed process walkthroughs, • Organising audit closure workshop at unit with
• Importance mapping of business processes documentation , risk & controls identification process leaders, unit head and medical director to
with patient journey. and testing. discuss audit issues, rating and recommendations
Key Activities

• Identification of business risks at unit and • Continuous discussion with management at and attain common understanding.
organisation wide level. unit and HO. • Submit final audit report to unit, HO and audit
• Organising workshops at unit and HO level • Identification of issues, risks, implications, committee.
to discuss key business processes and risk recommendations and discussion with • Formation of recommendations implementation
rating to attain common understanding. process leaders. roadmap in consultation with unit and HO.
• Identification of operational and clinical • Audit issue/ process gap impact analysis on • Summary reporting to audit committee and
processes to be audited (audit wish list). clinical and support processes. presentation.
• Discussion with unit heads and HO to • Benchmarking of processes with leading • Obtain feedback.
prioritise audits. hospital practices.

• Findings and recommendations report for management

comments
Deliverabl

• Final internal audit plan • Engagement scoping document and timelines • Final report for management and audit committee
• • • Practical recommendations and implementation
es

Engagement letters Regular audit updates

• Audit workpapers and audit issues roadmap
• Audit committee report and presentation
Assurance

•
Quality

Team of professionals with extensive experience in healthcare audits.

• Continuous project reviews by partners and directors of the firm to ensure quality and client satisfaction.

9
 Patient Journey View - Illustrative

Standard steps/ stages in a patient journey in an hospital

List of departments supporting service delivery

Business importance assigned to departments on basis of

degree of involvement in providing patient care/ service

10
 Other factors to be considered for Scoping

 Multi-specialty Vs. Super Specialty hospital. More intense IA’s in case hospital is multi & super specialty.

 Business Objectives – have to be kept in mind for each hospital/ unit and IA scope should be fine tweaked
accordingly

 Age of the hospital – for new hospitals, key focus is effective implementation of SOP’s, clarity in roles &
responsibilities, service delivery monitoring. Stable/ Mature hospitals focus more on operational excellence,
introducing industry best practices.

 Integrated Compliance Risk Management – Most hospitals review same controls more than once, for eg.
Billing process may be reviewed in NABH/ JCI and/ or in Internal Audit and or in ISO and or in Internal Controls
over financial reporting review. Management should consider developing an integrated compliance risk
management framework whereby risk is assessed/ tested once and reported in multiple places as required.

 Past IA scope – key issues/ challenges play important role in direction setting. Audit Charter should cover key
processes/ controls monitoring regularly. Non key processes/ controls can be tested/ reviewed once in 2/3 years.

 Fraud vulnerabilities should be reviewed while ascertaining IA scope

 Maturity of IT/ ERP system is crucial factor for scoping

11
Riskpro Clients Our Clients

Any trademarks or logos used throughout this presentation are the property of their
respective owners

12
Team Experiences Our Experiences

Our team members have worked at world class Companies

Any trademarks or logos used throughout this presentation are the property of their
respective owners
13
RESUMES – Our team Credentials

 Founder - Riskpro
 CA, CPA, MBA-Finance (USA), FRM (GARP)
Manoj Jain

 Over 10 years international experience – 6 years in Bahrain and 4 years USA

 15 years exp in risk consulting and internal audits
 Sox Compliance project for Fannie Mae, USA ( $900+ Billion Mortgage Company)
 Specialization in Operational Risk, Basel II, Sox and Control design
 Led medium to large engagement teams

 Co- Founder - Riskpro

 CA (India), MBA (Netherlands), CIA (USA)
Rahul Bhan

 Over 15 years of extensive internal and external audit experience in India and
abroad.
 Worked with KPMG United Arab Emirates, PKF South Africa, Ernst and Young
Kuwait, Deloitte Netherlands and KPMG India.
 Worked with clients in a wide variety of industries and countries including trading,
retail and consumer goods, NGO, manufacturing and banking and finance. Major
clients include banks, investment companies, manufacturing organizations,
aviation etc.

14
RESUMES - Our team Credentials

 Co-Founder - Riskpro
Casper Abraham

 PGD (Electrical & Electronics & Computer Programming)

 30 years of experience in Information & Communications Technology (ICT) Solutions
for Retail, Garments, Manufacturing, Services Industries.
 Has created Companies, Divisions, Products, Brands, Teams & Markets.
 Consulting in Business, Technology, Marketing & Sales & Strategic Planning.
 Advisory, Training, Workshops & Implementation in Systems Thinking, Systems
Modeling & Balanced Scorecard
 Worked with TIFR, Mahindra, Ambience, Communico-Graphique & Ionidea Inc, USA,
Kumar Bhukhanwala

 Co-Founder - Riskpro
 B.Com, CA
 30 years of accounting, finance and risk management experience
 Most recent employment with Emerson, a USA Fortune 500
 Worked for Hinduja, Pidilite, Excel Industries and internationally
 Strong Financial Process and internal controls experience

15
RESUMES - PARTNERSHIPS
 Specialist Risk Consultant – Business Continuity
Andrew Hiles

 Founder and 15-year Chairman of Survive, the first international user group for Business
Continuity professionals
 Founding director and first Fellow of the Business Continuity Institute
 Over 25 years international consulting expertise in Risk, Crisis, Emergency, Incident, and
Business Continuity and ICT Disaster Recovery Management
 Multi-sector experience including Banking, Insurance, Finance, Oil, Gas, Energy,
Manufacturing, Retail, Hi-Tech & Telecom
 Western Press Award for services to business, 1994; BCI/CIR nomination for
lifetime achievement in BC, 1999, London; inducted into BC Hall of Fame by CPM magazine,
2004, Washington DC.

 Specialist Risk Consultant – Internal Audits

Mr. V K Gupta

 Chartered Accountant and CISA, with over 12 years of experience in business risk services.

 He has advised leading national and international clients.

 He was working with Ernst and Young (NZ). He has extensive experience in conducting
internal audits, risk assessment, drafting standard operating procedures, sarbanes oxley etc.
 He has helped organisations to improve business processes leading to increased efficiency
and effectiveness. He specializes in industries like healthcare, manufacturing, IT/ITES,
financial services.

16
Contacts

MUMBAI DELHI BANGALORE

Manoj Jain, Director Rahul Bhan, Director Casper Abraham, Director
B-44 Glaxo Building, Near C-561, Defence Colony, No. 62/B Modi Residency
Mt. Mary’s Steps, Bandra New Delhi-110 024 Millers Road, Benson Town
(W), Mumbai 400050 Bangalore 560 046

M- 98337 67114 M- 99680 05042 M- 98450 61870

E- manoj.jain@riskpro.in E- rahul.bhan@riskpro.in E- casper.abraham@riskpro.in

Email : info@riskpro.in

Web: www.riskpro.in

THANKS

17
Detailed Coverage - Hospital Audits

18
 Detailed Coverage – Hospital Governance

(i) Hospital Governance

Business Whether IA
Sub Areas
Criticality recommended

Mergers & Acquisition – Internal Control

H Yes
DDR

Medical Strategy & Quality H Yes

Capacity Management H Yes

Quality Compliance Management –

H Yes
NABH/ JCI

New Projects H Yes

Corporate Governance Matters H Yes

Marketing H Yes

19
 Detailed Coverage – Hospital Governance
(ii) Medical & Quality Audit
Whether IA
Sub Areas Business Criticality
recommended
Allied Health operations M Yes

Stress Care Centres H Yes

Medical Psyh Units M Yes

Operation Theatre’s H Yes

ICU, MICU, ICCU & PICU H Yes

Imaging Centres & Laboratory’s H Yes

Progressive Care Unit M Yes

Vascular Rooms H Yes

Cardiac Recovery rooms H Yes

Prep room H Yes

Recovery room H Yes

Ambulance services H Yes

Surgical Services H Yes

Blood bank management H Yes

Nurse/ Doctors bay M Yes

Pediatrics/ Orthro/ Neuro Unit M Yes

20
 Detailed Coverage – Hospital Governance
(iii) Operations Support Audit
Business Whether IA
Sub Areas
Criticality recommended
Parking, Reception & Front Office L Yes

Admissions H Yes

Procurement including CPC H Yes

Inventory Management H Yes

Foods & Beverages M Yes

Laundry & Housekeeping M Yes

Centre for Community Service M Yes

Discharge & Billing H Yes

Autopsy & Mortuary management M Yes

Patient Safety – Incident Management H Yes

Pharmacy M Yes

ATM, Café, Spiritual ministry L No

Insurance including TPA H Yes

Bio / Non Bio Medical equipment H Yes

Energy & Water consumption M Yes

IT Support – FOS, ITGC, ERP, Business

H Yes
Continuity & DRP
21
 Detailed Coverage – Hospital Governance
(iv) People Audit

Whether IA
Sub Areas Business Criticality
recommended

HR Planning & Recruitment H Yes

Employee training H Yes

Hospital and clinician relationship management M Yes

Roster management H Yes

Employee Records M Yes

Leadership Development Initiatives H Yes

Payroll end to end M Yes

Salary benchmarking M Yes

Performance Appraisal process H Yes

Employee Satisfaction Survey H Yes

22
 Detailed Coverage – Hospital Governance
(v) Finance & Accounts
Whether IA
Sub Areas Business Criticality
recommended
Budgeting H Yes

Accounts Receivable H Yes

Accounts Payable H Yes

Fixed Assets Management H Yes

Cash & Bank Management M Yes

Capital Expenditure H Yes

Treasury M Yes

Stock Options M Yes

Taxation H Yes

Financial Reporting H Yes

Foreign Exchange M Yes

Investments M Yes

Share Capital And Funds Utilization M Yes

23
 Detailed Coverage – Hospital Governance
(vi) Compliance

Whether IA
Sub Areas Business Criticality
recommended

Medical Records H Yes

Secretarial H Yes

EHS H Yes

Other enactments H Yes

Yes
JCI standards compliance H

NABH standards compliance H Yes

24
Examples of our Services

Risk

25
Governance, Risk and Compliance Offering Our GRC Approach

Company level

•Define Risk Appetite • Reputation Risk Scorecards • Scan of Emerging Risks

•Risk Scorecard • IT Governance
•Risk Heap maps • New Product Approval Policy

Governance Risk management Compliance

• Align Corporate Governance to • Risk assessment • Compliance Risk Policy &
global practices • Process and Control Review Framework
• Board Committee reviews • Insurance & Loss Alignment • Regulatory reviews and audits
• Review and enhance Risk • Incident Reporting Process & • Global regulation compliance
Governance Tool • Compliance Reporting
• Policy and Process Framework • Implementation of 20-30 top • Contractual Risk
• IT Governance Key Risk Indicators (KRI) • 3rd party audits of units
• Whistle Blowing Framework • Fraud Risk Management • Internal Control testing Tools
Services

Support Processes

• GRC Technology Implementation – Provide recommendations and select vendor for GRC Tool
•HR Policies and Processes to minimize people risk, frauds and strengthen succession planning
•Training and Awareness build up – Targeted and Ongoing training in areas of concern.
•E Learning Courses in Risk Management, Fraud Risk Management, Governance etc
26
Governance, Risk and Compliance (GRC) Our GRC Approach
Risk management software implementation

• Riskpro helps organisations adapt to change,

manage risk, and effectively comply with the risks
Govern risk & and regulations which effect their businesses.
compliance with • Helps in successfully managing risk and achieving
business benefits compliance in an ever-changing environment while
reducing costs and improving corporate performance
every day.

• Riskpro has several partnerships with world leaders

in implementation of GRC software solutions.
• (BPS Resolver, Methodware, Bwise, Odondo,
Rocsys)
Riskpro Partnerships
• Riskpro is also actively interacting with other Leading
with GRC Vendors vendors for GRC Technology rollout (Bwise, Oracle)
• Riskpro can review the company’s circumstances
and provide an unbiased opinion n the best product
for the circumstances.

27
 Enterprise Risk Management (ERM) - Methodology How we Do

You select the level and size

of ERM efforts to suit your 3 BASIC ERM 4 ENHANCED ERM
needs and budget.
Risk Identification Risk Identification

1 Foundation 2 RISK IDENTIFICATION Foundation Foundation

•FOUNDATION TASKS •Foundation Tasks

•ERM vision •Risk Assessment •RISK ASSESSMENT TASKS •RISK Identification
•Goals and objectives •Gap Analysis •Risk Mgmt for 2-3 critical risks •Enhanced Framework
•Policies •Risk Mapping •Evaluate existing RM structures
•Organization structure •Enhanced management reports
•Alignment to strategies •Dashboards
•Monitoring tools
•Risk based Communication

28
IT Governance How we Do

IS AUDIT
• Operating Systems Audit
• Database Audit
• Networking Audit IT GOVERNANCE
• Firewall Audit • COBIT
• IDS Audit • ValIT
• Web Application, Data Center Audit • Balanced Scorecard
• Internet Banking, Core Banking Audit • IT & Business Maturity Models
• Performance & Forensic Auditing
•Application Systems - Functional review
• Compliance with IS Policies & Procedures
IT ASSURANCE
• Business Continuity Planning
• Computer Crime Investigations
INFORMATION SECURITY • Training in IT
• Penetration Testing • Compliance with IS Policies &
• Application Systems - Security review Procedures
• Review of IS Controls
• BS 7799 / (ISO 27001) Implémentation
• Formation of IS Security Policy
• Compliance with IS Policies & Procedures

29
Forensic and investigation services How we Do

Based on our understanding of your requirements, we have customized a package of our solution
offerings to meet your needs, which is detailed in the ensuing slides.
Based on our understanding of your requirements, we have customized a package of our solution
To detect and prevent fraud
offerings to meet your needs, which is detailed in the ensuing slides.
and evaluate Code Of Conduct Our Solution for you Benefits To You
Compliance on following Our Solution For you
parameters :-

 Fraud Detection  Protects you from any

Resolve
 Fraudulent Vendor Monterey or Reputational
Investigate Prioritize damage
 Recruiting new dealers, solutions and
remedial
suppliers, franchisees or Analyze Source Root measures
 Code Of compliance
distributors cause of
Problem establishment
 Anti-Fraud Measures Understanding
Your Supply Quantify Loss

 Monitoring Compliance and Auth

Chain and Suggest
possible Actions
 Enables you to identify
orization
Obtaining And risks / control gaps
securing
Evidence
 Workplace Practice To Monitor Your  Helps you identify any
Solve
 Background check for employees
Process
Compliances undisclosed production
Issues
Confidential
 Background check for customers Interviews
 Risk Mitigation
with vendors
 Prevent default of high value Evaluating your
bills need

30