Feel Good Hospital: A Case Study In Employee Information Systems Fraud

FEEL GOOD HOSPITAL: CASE SUMMARY Feel Good Hospital (FGH) is affiliated with a prominent university and medical school, and is a large hospital with a national reputation. FGH has 340 in-patient beds, 420 attending physicians and over 3,000 employees. Most of FGHs key software systems were installed in the early 1990s and have undergone significant upgrades and customizations since that time. Recent regulatory changes, market factors and macroeconomic conditions have resulted in falling annual profits which declined from over $3M in 2000 to just over $1M in 2005. After much downsizing and re-engineering, vendors have complained about slow payments from the accounts payable department. Therefore, the accounts payable department was allowed hire one temporary clerk.Eventually, this clerk was hired as a permanent full-time employee. A few months later, suspicious large cash disbursements were uncovered by the accounts payable manager. INTRODUCTION Feel Good Hospital (FGH) is large hospital located in New York. Founded in 1912, FGHis affiliated with a prominent university and medical school, and has developed a national reputation for excellence in women and childrens health services. The company has 340 in-patient beds with 420 physicians on its medical staff. In 2005, with budgeted revenue of $250M and total assets of approximately $300M, the hospital is able to offer a wide range of medical services to the greater New York community. Feel Good Hospital is organized on a traditional functional level (see Exhibit 1). It maintains a small internal audit department with two Certified Information Systems Auditors. The hospital has long been the market leader in a number of service lines, such as critical care, ambulatory care, and home health care. However, in recent years, with regulatory changes, increasing competition in the local market, and restrictions on referral services imposed by health maintenance organizations (HMOs), traditional modest annual profits of $3M have deteriorated to just over $1M, from 200 to 2005 respectively. FGHs significant information systems are based on mid-range systemssuch as AS/400 and TANDEM hardware and client/server technology; most of its key software systems were installedin the early 1990s and have undergone significant upgrades and customizations since that time. In the spring of 2003, FGH embarked on a dramatic business process re-engineering (BPR) effort. Withcompetitive pressures increasing on healthcare providers, FGH sought to reduce its annual operating costs by $25M or10 percent of its total operating expenditures. This major initiative was started by FGHs chief executive officer[CEO], Bill Thomas, who sought to change the way the organization viewed its patients, employees, and otherstakeholder groups. To begin this large project, fifteen working groups were formed to review operations in all of FGHs businesssegments. The major working groups included: finance, information systems, nursing and ancillary services (e.g.laboratory, nuclear medicine, pharmacy, and radiology) and physician services. A variety of employees at differentstaff levels were selected to serve on the working groups and a three-day orientation and training session wasorganized by the management consulting firm hired to assist FGH in this project. After these working groups wereorganized, each group identified specific opportunities to reduce on-going operating costs while simultaneouslyimproving patient care and overall customer service. The administrative work group initiated a study of the accounts payable department, which had ten employees(see Exhibit 2). At the completion of its study, the administrative work group proposed eliminating two A/P Clerkpositions that were no longer necessary due to a decrease in the overall number

of medical supply vendors.AlthoughSteve Jones, CPA, controller and Tracy Downs, accounts payable manager opposed the staff reduction, all otherstakeholder groups approved the proposal. Jones and Downs objected to reducing accounts payable staff because ofgeneral performance concerns and a continuous high turnover rate in the accounts payable department. Ultimately,two full-time accounts payable clerks were eliminated from the finance divisions operating budget, resulting in anannual savings of $96,000. Six months later in November 2002, James Smith, chief financial officer (CFO) began receiving complaintsfrom the hospitals main supply vendors. Vendors were upset that they were not being paid on a timely basis, and as aresult, were threatening to stop shipping FGH critical patient care supplies. Smith was already aware of this situationbased on periodic reports by Jones indicating that the accounts payable department was unable to process all vendorinvoices in accordance with the specified terms of trade (e.g. 2/10, n/30) due to a lack of clerical personnel. This alsocost FGH money since the attractive purchase discounts were not taken. This vendor situation left Smith with very few choices about what type of action to take; unilaterally decidedto allow the accounts payable department to hire one temporary clerk.When Tracy Downs, A/P Manager, shared thisnews with her staff, Sharon Harris, Senior A/P Clerk suggested her son, Matt Harris, who was recently laid off from asimilar position at a manufacturing company, would be interested in this position. INTERNAL CONTROLS AND RED FLAGS OF FRAUD IN INFORMATION SYSTEMS When Downs interviewed Matt Harris, she found him to be personable, curious, and very eager to work at thehospital. Immediately, she hired him as a temporary accounts payable clerk without interviewing any other candidates.Since Harris was being hired as a temporary employee, he wasnt required to go through a background investigation;which was one of FGHs standard operating procedures for employees in sensitive positions (i.e. IT, Finance etc.).During a routine audit of the finance division, AlanWalters, Internal Audit Manager casually introduced himself to theMatt Harris. When he discovered that Matt was Sharon Harriss son, he immediately researched the companyspolicies regarding nepotism. His research found that FGHs general administrative policies prohibited members ofthe same family from working in a sensitive department that would potentially impact the integrity or safekeeping ofcorporate assets or documents. The situation in the accounts payable department appeared to conflict with FGHspolicies and was considered a red flag, indicating a situational environment which is conducive to a potentialfraudulent act. Mr. Walters, therefore, decided to call this important issue to the attention of FGHs seniormanagement. Mr. Walters requested a meeting with James Smith, CFO to discuss the apparent nepotism issue in theaccounts payable department. While Smith indicated that he was aware of the companys policy; he explained why hethought it was in the best interest of the hospital to keep Matt in this job. Walters explained this potential fraudenvironment to Smith who agreed that the situation was not ideal, but disagreed that Matt Harris be re-assigned toanother department. Mr. Smith also felt this would not be acceptable since Sharon Harris, Matts mother, had longbeen one of the most dedicated members of the accounts payable department, and had even won numerous Employeeof the Month awards during her fifteen years of employment FGH treated Matt Harris like it did any other independent contractor. Feel Good Hospital paid all of itscontractors and suppliers through the accounts payable module of its financial information system. When a new vendorwas identified it was set-up by either Tracy Downs, accounts payable manager, or Elinor Linz, assistant accountspayable manager, by updating the accounts payable master file with the necessary data to ensure timely and accurate processing. Exhibit 1 details the system flowchart for this process. Tracy Downs was responsible for reviewingthis data file each month for obsolete and inactive vendors, as well as overall data integrity issues (i.e. accuracy,completeness etc.) During September 2002, within two months of working as an independent contractor, a vacancy developed inthe department and Matt Harris was given the opportunity to apply for this permanent, full-

time position. AlthoughMatt was no longer an independent contractor, his accounts payable vendor file was not deleted by Tracy Downs orElinor Linz. With the support of Steven Jones, Controller who commented about Matts pleasant demeanor andcooperative attitude, Tracy Downs hired Matt again without interviewinganyone else or requesting a backgroundinvestigation. At this time, Matt began to receive all fringe benefits (e.g. health insurance, vacation pay, disabilityinsurance, etc.) and regular weekly paychecks; which were processed with all other employees using the PeopleSoftsystem. FRAUD DISCOVERY In January 2003, Tracy Downs returned from her annual Christmas holiday in Jamaica to discover some veryunsettling information. As part of catching up on her work, Downs scanned the system generated Check RegisterReports for the three weeks that she was on vacation. This review identified six cash disbursements totaling $80,000that had been made to Matt Harris. Ms. Downs thought that these disbursements looked suspicious and immediatelycontacted Alan Walters, the companys Internal Audit Manager. At a meeting later that same day, Downs detailed theprimary job responsibilities of Mr. Harris and his employment relationship. Alan Walters began planning an information systems fraud investigation. Copies of relevant informationsystem reports, cancelled checks from the hospitals bank, supporting cash disbursement authorization forms (see Exhibit 3 for sample form) were analyzed, and a thorough review of the accounts payable departments operatingprocedures was initiated. Consistent with FGHs policies, members of the information systems, human resources and security departments were notified by the Internal Audit Manager that a possible fraud had occurred. This was toinform all management personnel of about the potential disciplinary and legal ramifications. Walters discovered that Matt Harris appeared to have forged six cash disbursement authorization forms (seeExhibit 3 for sample copy); which contained vendor invoice data (e.g. vendor name, vendor address, invoice number,and invoice amount). Harris then input the data contained on the fraudulent accounting forms into the accountspayable accounting module under his own vendor account. Input controls help ensure that all data is captured in anaccurate and efficient manner. Furthermore, while Harris supervisor was away on vacation, he was assignedresponsibility for performing the semi-weekly cash disbursement run. Another key aspect of this fraud involved theprinting and mailing of the physical checks to FGHs vendors. In order to accomplish this task, Matt was allowedaccess to the main safe where pre-signed checks were stored. It was FGHs standard operating procedure to require asecond signature on all checks over $15,000. Matt was very savvy. In order to avoid creating suspicion bymanagement, each of the individual checks he processed was for less than $15,000. At the conclusion of the fraudinvestigation, the preliminary results were discussed with the accounts payable manager, security director, vicepresidentfor human resources and chief executive officer. Matt Harris was now to be interrogated. Although all facts seemed clear, FGH desired to obtain a confessionfrom Mr. Harris in addition to identifying a motive for the fraud. Mr. Harris was called at his desk and requested to goto a conference room for a meeting to discuss his employee benefits. Alan Walters, internal audit manager, andTheodore Block, security director, conducted the interrogation and presented Matt with the specific facts uncoveredduring the fraud investigation. Matt was visibly nervous when he entered the conference room. The following is anexcerpt of this discussion: Walters: Matt we called you to this meeting to discuss a very serious matter. I have conducted a fraudinvestigation surrounding six cash disbursements in your name. Harris: I dont know what you mean. Walters: It seems that when your supervisor, Ms. Downs was away on vacation you forged six accountingdocuments that generated checks to yourself. <Long Pause> Block: This is a serious matter and a fraudulent act like this is considered a felony crime in New York.

Walters: Our goal here is to confirm the facts and understand your reasons for perpetrating this fraud. <Long Pause> Harris: I want you to know..I did this by myselfI am very ill and have over $50,000 in credit card bills that I incurred to pay for experimental drugs that may possibly cure me. After a short period of silence Harris began to cry, and later confessed to the crime and explainedthat he was forced to steal from FGH because he was diagnosed with a terminal illness and had no personal assets or health insurance with which to pay for the treatments. Standard medical treatments had not been successful and experimentaltreatments, which were not Food and Drug Administration approved, were not available in the United States. Matt hadto obtain treatments and medications in Mexico. When questioned, once again, about the involvement of any other parties, and, in particular, his mother, Mr.Harris reiterated this fraud was solely his doing. He explained to Mr. Walter and Mr. Block how he had already spentthe funds he had stolen and did not have a means to make repayment. Matt then signed a written confession, and wasimmediately suspended without pay. DISCUSSION QUESTIONS What factors contributed to this opportunity to commit fraud? What breakdowns in internal control could have been improved so that this fraud could have been prevented? Other than Matt Harris, who bears some responsibility for this fraud? Did the Alan Walters, Internal Audit Manager do the right thing? Explain how general computer controls and application level controls could have helped prevent and detect this fraud?

Exhibit 1: FGH Organizational Chart

Exhibit 2: Finance Department Organizational Chart

Exhibit 3:Authorization for Cash Disbursement Form

FEEL GOOD HOSPITAL, INC. AUTHORIZATION FOR CASH DISBURSEMENT Date: ________________________ Pay to the Order of: __________________________________________________ Street Address: __________________________________________________ City: __________________________________________________ State: __________________________________________________ Zip Code: __________________________________________________ Dollar Amount: __________________________________________________

__________________________________ Authorized Signature Invoice Number: ____________________ Invoice Date: _______________________ G/L Account Number: _______________ Three Digit Department Number: _______ Input By: _________________________ A/P Voucher Reference: _______________ Form No. FGH314 Last Revised: 2/13/03