Embezzle-proofing your practice
Episode 8: Embezzleproofing Your Practice
In our last episode, we heard from Tiffany Couch, national expert on insider fraud and embezzlers. I’m hoping you all got a lot out of that interview, and that you’re now focused on what you can do to safeguard your practice.
We learned that physicians are trusting individuals, and since we haven’t given you any business training, you’re also easy targets for embezzlers. In my thirty years in the industry, I’ve seen some embezzlers who move from practice to practice, continuing their crimes.
There are some simple steps you can take as a business owner to safeguard your assets – businesspeople call them “internal controls.” Tiffany mentioned several during our conversation: if you are a sole proprietor, or part of a small practice, we recommend that on a monthly basis, you have a financial summit with your office manager and your bookkeeper. Take some time to look over the bank statements and the credit card statements. Ask questions about any transactions or vendors you don’t recognize. Ask about any large amounts. Review all large orders and returns – one embezzler at a pediatric practice returned unused vaccines and credited her own credit card for the return. She did this for many years before she was caught. Meanwhile, she had stolen thousands of dollars from the practice.
As a part of that monthly summit, review the bank reconciliation too. It should always balance, or there should be a reasonable explanation for any discrepancy. During your summit, login to your online banking system and review any online banking transactions, and any new vendors that were added in the past month. Many business owners will set up their online banking so that they are the only ones with the ability to add a new vendor. If you do have new vendors, take a look at their service contract and understand what they are providing for you. Read the fine print and the termination clauses too. We’ll have more on service contracts in an upcoming episode.
Please don’t be worried about offending anyone. The honest people will welcome the review and your increased interest in the business. The dishonest ones will push back, and that is a huge red flag. Time for some tougher conversations. Don’t shy away from this…it’s your money, not theirs to steal.
We always recommend that our clients utilize a Decision Matrix to outline financial responsibility and authorization levels. Who is allowed to spend how much money without a “Mother May I?” Where and when do they come to you for authorization? We have examples of this template on the Medical Money Matters Toolkit that you can download.
When you think about responsibilities that you’ve assigned to your staff, don’t put too many eggs in one basket. This leaves you and your staff person open to risk. They can take advantage of you, and as Tiffany mentioned, even if they’re innocent, if they hold all the keys, all paths lead to them if money goes missing. It’s important to safeguard your assets AND your employees.
When implementing any changes like these, talk with your employees about the internal controls you’re setting up and why. I always say to our team, if we’ve done our set up correctly, and have the right systems in place, no one can be suspected of embezzling. It is simply good business, and it keeps everyone safe.
Internal controls are good, even if your spouse is involved. Over the years, I’ve seen some terrible theft perpetrated by spouses of physicians. Which was then followed by divorce. Keep everyone happy with good business practices. And my friendly advice to you, unless your spouse is a bookkeeper or insurance biller by profession, do not ask him or her to take on this role in your clinic. In the vast majority of situations I’ve seen over 30 years, this results in stress, lost money, lost opportunity, and did I mention, stress? Hire someone who already does this for a living – don’t fall into the trap of “Oh, my husband or wife can just take care of that.”
Now, let’s talk about money coming into the practice. We recommend that you get all payments from insurance companies via EFT or Electronic Funds Transfer. All of the major payers have forms you can fill out to receive payment that way if they are still mailing you a check. Having the money come in electronically makes payments faster, and safer.
Next, check to be sure that your billing team is sending patient statements via text or email and assure that all patient payments go directly to your bank as well. Again, this is faster and safer, and will save a lot of staff time.
As our world becomes more automated, and given the rise of check fraud, we are encouraging our clients to move their bill pay function to online systems. We also strongly recommend that you or one of the business owners approve all online banking transactions. This is the equivalent of signing the checks in a paper world and should be performed by a business owner or in the case of a larger group, a Chief Financial Officer or Controller who is vested with that authority.
If your practice takes in cash payments over the front counter for copays, outstanding balances or products, daily balancing for EVERY cash drawer is a must. We also recommend balancing petty cash funds and change funds – anywhere there is cash. Your accountant can help you to set up a basic cash balancing system if you do not have one. Another best practice is to use locking bank bags for each of your cash drawers and a receipt system that can be used to balance each day to assure that patient payments are recorded properly.
Two other ideas to assure that employees are honest – first is to perform spot checks of employee’s posting and deposits, which will help you to spot “kiting.” Kiting is a form of theft which involves confusing patient payments by posting part of one payment on the wrong patient, and then another part of it on another patient until the whole thing becomes so convoluted that it cannot be unraveled. The thieves are clever. The second simple protocol is to require all employees to utilize all or most of their vacation time each year. This ensures that everyone takes time off. Many times, embezzlers won’t take time off, because if someone else is covering their work, their scheme might be uncovered. We’ve met several employees who came off as dedicated because they would NEVER take time off, when in reality, they were busy stealing money every day they went to work!
With regard to your practice management or billing system, a more sophisticated internal control is to conduct a daily or weekly reconciliation from your practice management system to your bank deposit to your accounting system, whether its QuickBooks or another system. Each day, the amount of money your billers post into your practice management system should match the amount of money deposited into your bank account. This should in turn, match the amount that got entered into your accounting system as revenue. Any discrepancies should be handled immediately.
Additionally, within your practice management system, you should work with your office manager and review all Adjustments made by billing team. This allows you to become familiar with what is begin written off. Be sure you’re getting paid according to your insurance contracts, and that your team knows to follow up on denials, and not just write them off at the first sign of trouble. You did that work for those patients, and you deserve to get paid.
If your group is large enough to have a Finance Committee, that group should set and approve a budget for each year, and they should also set a scope for review. This is business speak for “how much do I care about?” and it differs for each group. As we reviewed in our Episode on budgets, you will have an amount that requires review if your actual expenditure exceeds your budget by a certain dollar amount AND a certain percentage. Be sure to review those variances carefully – they can be a sign of trouble.
Any time you receive ANY pushback, ask lots more questions! As we learned from the interview with Tiffany, beware the one you trust the most, especially if other employees don’t like him or her.
This may all be feeling a bit overwhelming, but my encouragement is to start small, and add one or two controls each month until you feel comfortable. As things smooth out, and you get more familiar with everything, your financial summit should take an hour or less each month and should leave you with a clear understanding of what’s happening with the money in your practice. Above all: ask questions, ask questions, ask questions. Don’t take “no” or “let’s talk about that later” as an answer. It’s your money. Keep educating yourself – you are the owner, and the one to whom everyone is accountable. No exceptions.
That’s it for this episode about Internal Controls and how to embezzle-proof your practice. Join me for our next episode where we’ll demystify those Financial Statements even further.
