When time is money: Reviewing your planning and development service fees

Benchmarking doesn’t need to be time and resource consuming. Read on for four simple steps you can take to improve efficiency and maximize resources.

Stop us if you’ve heard this one before (from your Board of Trustees or Finance Committee): “I wish there was a way we could benchmark ourselves against our competitors.”

Have you ever wrestled with how to benchmark? Or struggled to identify what the Board wants to measure? Organizations can fall short on implementing effective methods to benchmark accurately. The good news? With a planned approach, you can overcome traditional obstacles and create tools to increase efficiency, improve operations and reporting, and maintain and monitor a comfortable risk level. All of this can help create a competitive advantage — and it  isn’t as hard as you might think.

Even with a structured process, remember that benchmarking data has pitfalls, including:

• Peer data can be difficult to find. Some industries are better than others at tracking this information. Some collect too much data that isn’t relevant, making it hard to find the data that is.
   
• The data can be dated. By the time you close your books for the year and data is available, you’re at least six months into the next fiscal year. Knowing this, you can still build year-over-year trending models that you can measure consistently.
   
• The underlying data may be tainted. As much as we’d like to rely on financial data from other organization and industry surveys, there’s no guarantee that all participants have applied accounting principles consistently, or calculated inputs (e.g., full-time equivalents) in the same way, making comparisons inaccurate.

Despite these pitfalls, benchmarking is a useful tool for your organization. Benchmarking lets you take stock of your current financial condition and risk profile, identify areas for improvement and find a realistic and measurable plan to strengthen your organization.

Here are four steps to take to start a successful benchmarking program and overcome these pitfalls:

1. Benchmark against yourself. Use year-over-year and month-to-month data to identify trends, inconsistencies and unexplained changes. Once you have the information, you can see where you want to direct improvement efforts.
2. Look to industry/peer data. We’d love to tell you that all financial statements and survey inputs are created equally, but we can’t. By understanding the source of your information, and the potential strengths and weaknesses in the data (e.g., too few peers, different size organizations and markets, etc.), you will better know how to use it. Understanding the data source allows you to weigh metrics that are more susceptible to inconsistencies.

3. Identify what is important to your organization and focus on it. Remove data points that have little relevance for your organization. Trying to address too many measures is one of the primary reasons benchmarking fails. Identify key metrics you will target, and watch them over time. Remember, keeping it simple allows you to put resources where you need them most.

4. Use the data as a tool to guide decisions. Identify aspects of the organization that lie beyond your risk tolerance and then define specific steps for improvement.

Once you take these steps, you can add other measurement strategies, including stress testing, monthly reporting, and use in budgeting and forecasting. By taking the time to create and use an effective methodology, this competitive advantage can be yours. Want to learn more? Check out our resources for not-for-profit organizations here.

The COVID-19 emergency has caused CMS (Centers for Medicare & Medicaid Services) to expand eligibility for expedited payments to Medicare providers and suppliers for the duration of the public health emergency.

Accelerated payments have been available to providers/suppliers in the past due to a disruption in claims submission or claims processing, mainly due to natural disasters. Because of the COVID-19 public health emergency, CMS has expanded the accelerated payment program to provide necessary funds to eligible providers/suppliers who submit a request to their Medicare Administrative Contractor (MAC) and meet the required qualifications.

Eligibility requirements―Providers/suppliers who:

1. Have billed Medicare for claims within 180 days immediately prior to the date of signature on the provider’s/supplier’s request form,
2. Are not in bankruptcy,
3. Are not under active medical review or program integrity investigation, and
4. Do not have any outstanding delinquent Medicare overpayments.

Amount of payment:
Eligible providers/suppliers will request a specific amount for an accelerated payment. Most providers can request up to 100% of the Medicare payment amount for a three-month period. Inpatient acute care hospitals and certain other hospitals can request up to 100% of the Medicare payment amount for a six-month period. Critical access hospitals (CAHs) can request up to 125% of the Medicare payment for a six-month period.

Processing time:
CMS has indicated that MACs will work to review and issue payment within seven calendar days of receiving the request.

Repayment, recoupment, and reconciliation:
The December 2020 Bipartisan-Bicameral Omnibus COVID Relief Deal revised the repayment, recoupment and reconciliation timeline on the Medicare Advanced and Accelerated Payment Program as identified below. 

Application:
Applications for accelerated payments can be found on each MACs' website. CMS has established COVID-19 hotlines at each MAC that are operational Monday through Friday to assist providers with accelerated or advance payment concerns. Access your designated MACs' website here.

The MAC will review the application to ensure the eligibility requirements are met. The provider/supplier will be notified of approval or denial by mail or email. If the request is approved, the MAC will issue the accelerated payment within seven calendar days from the request.

When funding is approved, the requested amount is compared to a database with amounts calculated by Medicare and provides funding at the lessor of the two amounts. The current form allows the provider to request the maximum payment amount as calculated by CMS or a lesser specified amount.

We are here to help
If you have questions or need more information about your specific situation, please contact the healthcare consulting team. We’re here to help.

The BerryDunn Recovery Advisory Team has compiled this guide to COVID-19 consulting resources for state and local government agencies and higher education institutions.

We have provided a list of our consulting services related to data analysis, CARES Act funding and procurement, and legislation and policy implementation. Many of these services can be procured via the NASPO ValuePoint Procurement Acquisition Support Services contract.

READ THE GUIDE NOW

We're here to help.
If you have any questions, please contact us at info@berrydunn.com

Read this if your organization, business, or institution has leases and you’ve been eagerly awaiting and planning for the implementation of the new lease standards.

Ready? Set? Not yet. As we have prepared for and experienced delays related to Financial Accounting Standards Board (FASB) Accounting Standards Codification Topic 842, Leases, we thought the time had finally come for implementation. With the challenges that COVID-19 has brought to everyone, the FASB recognizes the significant impact COVID-19 has brought to commercial businesses and not-for-profits and is proposing a one-year delay in implementation, as described in this article posted to the Journal of Accountancy: FASB effective date delay proposals to include private company lease accounting.

But what about lease concessions? We all recognize many lessors are making concessions due to the pandemic. Under current guidance in Topics 840 and 842, changes to lease contracts that were not included in the original lease are generally accounted for as lease modifications and, therefore, a separate contract. This would require remeasurement of the new lease contract and related right-of-use asset. FASB recognized this issue and has published a FASB Staff Questions and Answers (Q&A) Document,  Topic 842 and Topic 840: Accounting for Lease Concessions Related to the Effects of the COVID-19 Pandemic. Under this new guidance, if lease concessions are made relating to COVID-19, entities do not need to analyze each contract to determine if a new contract has been entered into, and will have the option to apply, or not to apply, the lease modification provisions of Topics 840 and 842.

Implementation of the lease accounting standard will most likely be delayed for Governmental Accounting Standards Board (GASB) entities as well. On April 15, 2020, the GASB issued an exposure draft that would delay most GASB statements and implementation guides due to be implemented for fiscal years 2019 and later. Most notably, this includes Statement 84, Fiduciary Activities, and Statement 87, Leases. Comments on the proposal will be accepted through April 30, and the board plans to consider a final statement for issuance on May 8. More information may be found in this article from the Journal of Accountancy: GASB proposes postponing effective dates due to pandemic.

More information

Whether you are a FASB or GASB entity, you can expect a delay in the implementation of the lease standard. If you have questions, please contact a member of our financial statement audit team. For other COVID-19 related resources, please refer to BerryDunn’s COVID-19 Resources Page.

More and more emphasis is being put on cybersecurity by companies of all sizes. Whether it’s the news headlines of notable IT incidents, greater emphasis on the value of data, or the monetization of certain types of attacks, an increasing amount of energy and money is going towards security. Security has the attention of leadership and the board and it is not going away. One of the biggest risks to and vulnerabilities of any organization’s security continues to be its people. Innovative approaches and new technology can reduce risk but they still don’t prevent the damage that can be inflicted by an employee simply opening an attachment or following a link. This is more likely to happen than you may think.

Technology also doesn’t prepare a management team for how to handle the IT response, communication effort, and workforce management required during and after an event. Technology doesn’t lessen the operational impact that your organization will feel when, not if, you experience an event.

So let’s examine the human and operational side of cybersecurity. Below are three factors you should address to reduce risk and prepare your organization for an event:

1. People: Create and maintain a vigilant workforce
   Ask yourself, “How prepared is our workforce when it comes to security threats and protecting our data? How likely would it be for one of our team members to click on a link or open an attachment that appear to be from our CFO? Would our team members look closely enough at the email address and notice that the organization name is different by one letter?”
    

   According to the 2016 Verizon Data Breach Report, 30% of phishing messages were opened by the target across all campaigns and 12% went on to click on the attachment or link.

   Phishing email attacks directed at your company through your team range from very obvious to extremely believable. Some attempts are sent widely and are looking for just one person to click, while others are extremely targeted and deliberate. In either case, it is vital that each employee takes enough time to realize that the email request is unusual. Perhaps there are strange typos in the request or it is odd the CFO is emailing while on vacation. That moment your employees take to pause and decide whether to click on the link/attachment could mean the difference between experiencing an event or not.
   
   So how do you create and cultivate this type of thought process in your workforce? Lots of education and awareness efforts. This goes beyond just an annual in-service training on HIPAA. It may include education sessions, emails with tips and tricks, posters describing the risk, and also exercises to test your workforce against phishing and security exploits. It also takes leadership embracing security as a strategic imperative and leading the organization to take it seriously. Once you have these efforts in place, you can create culture change to build and maintain an environment where an employee is not embarrassed to check with the CFO’s office to see if they really did send an email from Bora Bora.

2. Plan: Implement a disaster recovery and incident response plan 
   Through the years, disaster recovery plans have been the usual response. Mostly, the emphasis has been on recovering data after a non-security IT event, often discussed in context of a fire, power loss, or hardware failure. Increasingly, cyber-attacks are creeping into the forefront of planning efforts. The challenge with cyber-events is that they are murkier to understand – and harder for leadership – to assist with.
   
   It’s easier to understand the concept of a fire destroying your server room and the plan entailing acquiring new equipment, recovering data from backup, restoring operations, having good downtime procedures, and communicating the restoration efforts along the way. What is much more challenging is if the event begins with a suspicion by employees, customers, or vendors who believe their data has been stolen without any conclusive information that your company is the originating point of the data loss. How do you take action if you know very little about the situation? What do you communicate if you are not sure what to say? It is this level of uncertainty that makes it so difficult. Do you have a plan in place for how to respond to an incident? Here are some questions to consider:
    
   1. How will we communicate internally with our staff about the incident?
   2. How will we communicate with our clients? Our patients? Our community?
   3. When should we call our insurance company? Our attorney?
   4. Is reception prepared to describe what is going on if someone visits our office?
   5. Do we have the technical expertise to diagnose the issue?
   6. Do we have set protocols in place for when to bring our systems off-line and are our downtime procedures ready to use?
   7. When the press gets wind of the situation, who will communicate with them and what will we share?
   8. If our telephone system and network is taken offline, how we will we communicate with our leadership team and workforce?

By starting to ask these questions, you can ascertain how ready you may, or may not be, for a cyber-attack when it comes.

3. Practice: Prepare your team with table top exercises  
   Given the complexity and diversity of the threats people are encountering today, no single written plan can account for all of the possible combinations of cyber-attacks. A plan can give guidance, set communication protocols, and structure your approach to your response. But by conducting exercises against hypothetical situations, you can test your plan, identify weaknesses in the plan, and also provide your leadership team with insight and experience – before it counts.
   
   A table top exercise entails one team member (perhaps from IT or from an outside firm) coming up with a hypothetical situation and a series of facts and clues about the situation that are given to your leadership team over time. Your team then implements the existing plans to respond to the incident and make decisions. There are no right or wrong answers in this scenario. Rather, the goal is to practice the decision-making and response process to determine where improvements are needed.
   
   Maybe you run an exercise and realize that you have not communicated to your staff that no mention of the event should be shared by employees on social media. Maybe the exercise makes you realize that the network administrator who is on vacation at the time is the only one who knows how to log onto the firewall. You might identify specific gaps that are lacking in your cybersecurity coverage. There is much to learn that can help you prepare for the real thing.

As you know, there are many different threats and risks facing organizations. Some are from inside an organization while others come from outside. Simply throwing additional technology at the problem will not sufficiently address the risks. While your people continue to be one of the biggest threats, they can also be one of your biggest assets, in both preventing issues from occurring and then responding quickly and appropriately when they do. Remember focus on your People, Your Plan, and Your Practice.

CARES Act update:

As anticipated, the House of Representatives approved the CARES Act on March 27, 2020, and the President has signed the measure. The provisions highlighted in our prior summary remain intact in the final measure. 

So…how are the emergency relief funds in the legislation accessed by healthcare providers?

• Public Health & Social Services Emergency Fund (PHSSEF): The guidance on how hospitals will access the $100 billion in PHSSEF funds to offset “COVID-19 related expenses and lost revenue” is expected to be released shortly. Keep an eye on this space for further updates as information becomes available.
• Medicare Advanced Lump Sum or Periodic Interim Payments: Application is made through the Fiscal Intermediary (FI). It should be noted that healthcare organizations do not qualify if they are in bankruptcy, under active medical review or program integrity investigation, or have outstanding, delinquent Medicare overpayments.
• SBA Paycheck Protection Program (PPP): This application process begins with your local lender. Do not hesitate—contact your lender immediately as it is anticipated that application volume will be tremendous. For more specifics on this program compiled by BerryDunn experts, visit our blog.

We will continue to provide updates as more information becomes available. In the meantime, please feel free to contact the hospital consulting team. Despite the current circumstances we remain available to support your needs. 

On March 25, 2020 the US Senate unanimously approved the $2 trillion Coronavirus Aid, Relief, and Economic Security (CARES) Act (The “Act”). The White House has signaled that it will sign the measure as approved by the Senate. 

Major provisions of the proposed legislation include:

• $100 billion for hospital “COVID-19 related expenses and lost revenue”
• $275 million for rural hospitals, telehealth, poison control centers, and HIV/AIDS programs
• $250 million for hospital capacity expansion and response
• $150 million for modifications of existing hospital, nursing home, and “domiciliary facilities” undertaken as part of COVID-19 response

The CARES Act also includes the following targeted relief and payment modifications under the Medicare and Medicaid programs:

• The Medicare 2% sequester will be suspended from May 1, 2020 through December 31, 2020. 
• “Through the duration of the COVID-19 emergency period”, the Act will increase by 20% hospital payments for the treatment of patients admitted with COVID-19. The add-on applies to hospitals paid through the Inpatient Prospective Payment System.
• $4 billion in scheduled cuts to Medicaid Disproportionate Share Hospital payments will be further delayed from May 22, 2020 to November 30, 2020.
• Certain hospitals, including those designated as rural or frontier, have the option to request up to a six month advanced lump sum or periodic interim payments from Medicare. The payments will:
  1. Be based upon net payments represented by unbilled discharges or unpaid bills,
  2. Equal up to 100% of prior period payments, 125% for Critical Access Hospitals
  3. In terms of paying down the “no interest loans”, hospitals will be given a four month grace period to begin making payments and at least 12 months to fully liquidate the obligation.

Non-financing provisions contained in the Act that will impact hospital operations include:

• Providing acute care hospitals the option to transfer patients out of their facilities and into alternative care settings to "prioritize resources needed to treat COVID-19 cases." That flexibility will come through the waiver of the Inpatient Rehabilitation Facility (IRF) three-hour rule, which requires patients to need at least three hours of intensive rehabilitation at least five days per week to be admitted to an IRF.
• Allowing Long-Term Care Hospitals (LTCH) to maintain their designation even if more than 50% of their cases are less intensive and would temporarily pause LTCH site-neutral payments.
• Suspending scheduled Medicare payment cuts for durable medical equipment during the length of the COVID-19 emergency period, to help patients transition from hospital to home.
• Disallow Medicare beneficiary cost-sharing payments for any COVID-19 vaccine.
• Ensuring that uninsured individuals could receive free COVID-19 tests "and related service" through any state Medicaid program that elects to enroll them.

Other emergency-period provisions that directly affect other entities but have implications for hospitals:

• Affording $150 billion to states, territories, and tribal governments to cover their costs for responding to the coronavirus public health emergency.
• Physician assistants, nurse practitioners, and other professionals will be allowed to order home health services for Medicare beneficiaries, to increase "beneficiary access to care in the safety of their home."
• Requiring HHS to clarify guidance encouraging the use of telecommunications systems, including remote patient monitoring, for home health services.
• Allowing qualified providers to use telehealth technologies to fulfill the hospice face-to-face recertification requirement.
• Eliminating the requirement that a nephrologist conduct some of the required periodic evaluations of a home-dialysis patient face-to-face.
• Allowing federally qualified health centers and rural health clinics to serve as a distant site for telehealth consultations.
• Eliminating the telehealth requirement that physicians or other professionals have treated a patient in the past three years.
• Allowing high-deductible health plans with a health savings account (HSA) to cover telehealth services before a patient reaches the deductible.
• Allowing patients to use HSA and flexible spending accounts to buy over-the-counter medical products without a prescription.

For more information
If you have questions or need more information about your specific situation, please contact the hospital consulting team. We’re here to help. 
 

Editor’s note: Please read this if you are a not-for-profit board member, CFO, or any other decision maker within a not-for-profit.

In a time where not-for-profit (NFP) organizations struggle with limited resources and a small back office, it is important not to overlook internal audit procedures. Over the years, internal audit departments have been one of the first to be cut when budgets are tight. However, limited resources make these procedures all the more important in safeguarding the organization’s assets. Taking the time to perform strategic internal audit procedures can identify fraud, promote ethical behavior, help to monitor compliance, and identify inefficiencies. All of these lead to a more sustainable, ethical, and efficient organization. 

Internal audit approaches

The internal audit function can take on many different forms, depending on the size of the organization. There are options between the dedicated internal audit department and doing nothing whatsoever. For example:

• A hybrid approach, where specific procedures are performed by an internal team, with other procedures outsourced. 
• An ad hoc approach, where the board or management directs the work of a staff member.

The hybrid approach will allow the organization to hire specialists for more technical tasks, such as an in-depth financial analysis or IT risk assessment. It also recognizes internal staff may be best suited to handle certain internal audit functions within their scope of work or breadth of knowledge. This may add costs but allows you to perform these functions otherwise outside of your capacity without adding significant burden to staff. 

The ad hoc approach allows you to begin the work of internal audit, even on a small scale, without the startup time required in outsourcing the work. This approach utilizes internal staff for all functions directed by the board or management. This leads to the ad-hoc approach being more budget friendly as external consultants don’t need to be hired, though you will have to be wary of over burdening your staff.

With proper objectivity and oversight, you can perform these functions internally. To bring the process to your organization, first find a champion for the project (CFO, controller, compliance officer, etc.) to free up staff time and resources in order to perform these tasks and to see the work through to the end. Other steps to take include:

1. Get the audit/finance committee on board to help communicate the value of the internal audit and review results of the work
2. Identify specific times of year when these processes are less intrusive and won’t tax staff 
3. Get involved in the risk management process to help identify where internal audit can best address the most significant risks at the organization
4. Leverage others who have had success with these processes to improve process and implementation
5. Create a timeline and maintain accountability for reporting and follow up of corrective actions

Once you have taken these steps, the next thing to look at (for your internal audit process) is a thoughtful and thorough risk assessment. This is key, as the risk assessment will help guide and focus the internal audit work of the organization in regard to what functions to prioritize. Even a targeted risk assessment can help, and an organization of any size can walk through a few transaction cycles (gift receipts or payroll, for example) and identify a step or two in the process that can be strengthened to prevent fraud, waste, and abuse.  

Here are a few examples of internal audit projects we have helped clients with:

• Payroll analysis—in-depth process mapping of the payroll cycle to identify areas for improvement
• Health and education facilities performance audit—analysis of various program policies and procedures to optimize for compliance
• Agreed upon procedures engagement—contract and invoice/timesheet information review to ensure proper contractor selection and compliant billing and invoicing procedures 

Internal audits for companies of all sizes

Regardless of size, your organization can benefit from internal audit functions. Embracing internal audit will help increase organizational resilience and the ability to adapt to change, whether your organization performs internal audit functions internally, outsources them, or a combination of the two. For more information about how your company can benefit from an internal audit, or if you have questions, contact us.