by Lloyd Froelich

Smaller clinics are especially vulnerable to office embezzlement.  The reality is that smaller clinics just don’t have the available tools to set up more than limited internal control measures.  They are limited by a lack of personnel, management expertise, or required management time.

Unfortunately, it has often been discovered when reviewing business operations of smaller clinics that little to no attention has been placed on even the rudimentary, easy-to-implement office practices that can help mitigate (but not eliminate) this vulnerability.  Many office embezzlements could be avoided if some simple internal controls were implemented and monitored. 

Perform background checks

Even before hiring someone, a very simple but effective internal control measure should be performed.  Talking with former employer references, even if they are known, can provide information you can’t obtain in any other manner.

A doctor may not report theft to the police or confront the suspected employee, even if he has proof.  He might, however, give a potential employer some type of signal to beware of the job applicant.

Also perform bonding insurance investigations on final job candidates.  Just knowing they will be investigated for bonding coverage can scare away people with a history of illegal activity.

Automate financial summary reports 

Preparing income tax returns or dividing income among the doctors isn’t the only reason for summarizing financial and management information for the practice.  Timely and proper analysis of clinic data can help uncover possible embezzlement situations.

Because it noticed a low accounts receivable (A/R) balance compared to both historical and benchmark data, one clinic discovered a bookkeeper had been building up a large credit balance on a fictitious patient to cover up the theft of over $10,000. 

Providing some important key performance indicator summary information on a daily and weekly basis gives the message that management is overseeing operations, a meaningful deterrent to theft.

Segregate A/R duties

Segregation of duties is a primary method of providing proper internal controls.  This means no one person should be allowed to carry out an office function completely alone.

Someone once said it takes at least three people to allow for a good segregation of duties within a clinic.  In the smallest of clinics, there might only be a doctor and his “right hand,” which means the doctor must be involved in execution of internal systems.  In such cases, the third person might be an outsider such as an accounting firm or business consultant. 

A disorganized office supplies the confusion and lack of accountability needed to hide embezzlement.  Implementing office policies and procedures that take little or no additional time to accomplish helps standardize both effective office functions and meaningful internal controls.

It is just as easy to make daily bank deposit slips mirror patient receipt batches that are entered into the A/R system as it is not to do such a matching. The matching provides a paper trail where each bank deposit can be matched against each batch of patient receipts. 

Any difference needs to be reconciled.  It may seem easier and logical for the person who enters payments into the A/R system to also make out the patient receipt bank deposit slips, instead of having one person make out the deposit slip while another enters the A/R payments.

The only extra time this two-step process takes is for the person making out the bank deposit to give it to the A/R entry person.  However, it breaks up or segregates the steps, making it more difficult to steal patient payments.

Many internal control measures serve double duty.  Using pre-numbered charge tickets offers a revenue capture mechanism in addition to internal control.  Requiring each office visit to be assigned a sequentially numbered charge slip and comparing these charge slips against daily appointment records and patient sign-in sheets ensure each patient is charged something for the visit, capturing revenue while also making sure each charge gets entered into the A/R system.

Keep an eye on cash disbursements

Theft can occur not only from incoming cash and checks for A/R, but also from cash disbursements.

• Has every vendor invoice been signed off, noting all items were received, by someone other than the person who writes the checks?
• Is a vendor invoice attached to every vendor check so charges can be verified before the check is signed?
• Are vendors periodically reviewed to make sure the clinic is being charged competitive rates?
• If credit cards are used for purchases, is each and every charge identified and proved before payment?
• Is the checkbook left in an unsecured file drawer when not in use? 
• Concerning payroll, are periodic reviews done to make sure no “bogus employees” are paid or no “unauthorized raises” have been paid?
• For bank reconciliations, has someone independent of the check writer periodically reviewed the cancelled checks for endorsements on the back of the checks?

An answer of NO to any of these questions identifies an opening for office embezzlement to occur.

Avoid the"family" trap

In smaller clinics, the doctors come to think of employees as “family” and trust and rely on these employees implicitly.  Unfortunately, sometimes personal needs or motivations can rationalize improper behavior and, given an opportunity, result in office theft.

Even the most elaborate system of internal controls can’t guarantee against this.  However, internal controls provide deterrence, making the opportunity for undetected theft slim. 

Doctors need to “buy into” the internal control process and support the implementation and monitoring of these measures as normal, effective business functions.

About the author

Lloyd Froelich is a partner in the Wipfli Health Care practice.  He can be reached at our St. Paul office at 651.636.6468 or lfroelich@wipfli.com.