Moosewood Hospital
(a)    Ethical and professional issues
Compliance with laws and regulations
It appears that Moosewood Hospital is storing and maybe using medicines that have passed their recommended use by date. This may be illegal, and it may breach the terms of agreement with their suppliers and, most significantly, this may lead to patient harm or ineffective treatment.
ISA 250 Consideration of Law and Regulations in an Audit of Financial Statements requires that in the event of a suspected non-compliance with law and regulations, the auditor should document the findings and discuss them with management. The audit team should attempt to obtain more information about the suspected non-compliance, though this will be difficult given the actions of the financial controller, who is denying access to the relevant source of information and the attempt to intimidate the audit team by the finance director.
The audit team should seek appropriate legal advice in relation to the use of out of date medicines. If this is a breach of regulations then the auditor may have a statutory duty to report this incident to the relevant regulator.
Reporting non-compliance to those charged with governance
If Fern & Co believes that non-compliance with relevant law and regulation is taking place, then according to ISA 250, the matter should be reported to those charged with governance of Moosewood Hospital. This communication should happen without delay given that it appears to be deliberate and owing to the potential seriousness of the use of expired medical inventory. At present it is unclear whether those charged with governance are aware of these practices. The auditor should request that those charged with governance make any necessary disclosure to the relevant authorities, clearly state the reasons why Moosewood Hospital should make the disclosure and that if the board fails to comply, that Fern & Co will be compelled to make the disclosure themselves.
If the auditor suspects that members of senior management including the board of directors are involved with the non-compliance, then the auditor should report the matter to the next higher level of authority, such as the audit committee.
Confidentiality
Reporting the incident to a regulator would require the auditor to report information about a client to a third party, which is a breach of client confidentiality. In these circumstances, however, legal/regulatory responsibilities would be considered to outweigh the confidentiality requirement.
Given the potential conflict with the IESBA Code of Ethics for Professional Accountants, Fern & Co should seek legal advice before they act to minimise the risk of legal dispute with their client or legal action from the regulator due to inaction.
If Fern & Co concludes that the matter should be reported to a regulator they should first communicate this belief to the board of Moosewood Hospital and request that they make a disclosure. At present it is unclear whether those charged with governance are aware of these practices. They should clearly state the reasons why Moosewood Hospital should make the disclosure and that if the board fails to comply, that Fern & Co will be compelled to make the disclosure themselves.
Impact on the financial statements
It is not correct for management to assert that the issue with out of date inventory is not relevant to the audit, because if any of the inventory is obsolete, then it should be written off in the financial statements.
By restricting the audit team’s ability to audit inventory management has imposed a limitation on the scope of the audit. If the auditor is unable to obtain satisfactory evidence relating to inventories then this may lead to a modification of the auditor’s report.
Fern & Co should report this matter to those charged with governance and request that they provide access to the necessary evidence. They should also explain what repercussions this will have on the auditor’s report if they fail to comply.
If Moosewood Hospital has failed to comply with any legal, regulatory or contractual requirements they may incur fines or other financial penalties. The audit approach should now be modified to include additional procedures aimed at investigating the potential implications of the use of out of date medicines and the potential value of fines and penalties.
Intimidation threat
The aggressive actions of the finance director amount to an intimidation threat to objectivity. The finance director has tried to influence the conduct of the audit with threatening behaviour.
Fern & Co should inform those charged with governance, explaining the significance of the matter and that it cannot be tolerated. Fern & Co should explain the reasons for the enquiries made by the audit team and the significance of being allowed to complete these procedures.
Management integrity
While the intentions of management are not clear it does appear that they are trying to conceal a matter of some significance from the auditor
The audit team must increase their scepticism of all evidence provided by management, particularly written representations obtained from management as they may be subject to bias and evidence which they could potentially manipulate, such as internal spreadsheets. In particular, if the audit team are given access to the inventory valuation spreadsheet they must remain vigilant for any indication that this has been subsequently altered.
Withdrawal from engagement
If the audit team believes that management is complicit in any significant illegal activity and/or attempt to manipulate the financial statements they may reconsider their position as auditor. If permitted by local regulations they may wish to resign from the engagement to protect their reputation and to protect themselves from being implicated in any ensuing legal case.
Before taking any action the matter should be discussed with the senior partners of the firm and an appropriate legal advisor
(b)    Difference between ‘performance audit’ and ‘audit of performance information’
Performance audi
A performance audit refers to when the practitioner provides assurance to management with regard to the effective functioning of operational activity or an agreed component of operations.
Audit of performance information
In contrast, an audit of performance information refers to when the practitioner provides assurance with regard to specific performance measures published by the reporting entity. The specific assurance objectives may differ between engagements but will normally be in relation to the accuracy of the reported measures.
(c)    Procedures
General
Document the systems that are in place for recording the information relevant to the performance measures, noting the key controls that should operate to ensure the accuracy of the information that is captured, recorded and reported. Evidence of the operating effectiveness of these controls throughout the period should be obtained.
In particular, the auditor should obtain an understanding of the level of scrutiny of the performance measures by senior management, including: the frequency of their reviews; the level of detail that is provided; and their responses should the reported performance measures differ from their expectations.
Each of the calculations of the performance measures should be obtained. Using the figures supplied by management these should be recalculated by the audit team to ensure mathematical accuracy.
The performance measures should be analytically reviewed against historic performance levels, on a monthly basis if such information is available, to identify any significant fluctuations in reported performance levels. Where fluctuations occur reasons should be sought through management enquiry, which should then be corroborated with evidence wherever possible.
Tutorial note: Other, relevant general procedures will also be awarded credit but will only be awarded credit once, i.e. candidates will not be given credit for repeating the same general procedure for each performance measure.
Patient/nurse ratio
Obtain copies of the original document in which the basis for calculating the performance measures were agreed; this may be in the form of a strategic document agreed with national health service agencies or it may even be the minutes of the executive board. From this, identify whether any specific definition is provided of the term ‘average’ or whether a specific formula is provided. In particular, it is important to ascertain over what period the average must be calculated.
From the same document ascertain which patients must be included in the calculation, i.e. should this include emergency patients or just patients admitted for treatment by appointment.
Confirm the calculation of the number of patients treated through inspection of underlying treatment and appointment records.
Confirm the calculation of the number of nurses through inspection of underlying staff rotas and records of hours worked supplied to human resources and payroll departments.
Surgical room usage
Enquire of the manager responsible for planning and co-ordinating surgical operations what the ‘normal’ period of time (i.e. excluding emergencies) is during which surgical procedures may be performed, i.e. which hours during the day and whether there are any days where scheduled procedures would not be performed.
Obtain and inspect the hospital plans to identify the total number of surgical rooms available
Using the information above calculate the total number of surgical hours available to the hospital. Compare the figure calculated to the figure used in management’s calculation to identify any significant variances.
Obtain a schedule of the total hours of surgery performed during the year. Confirm a sample of the times recorded to underlying hospital records to confirm the accuracy of the figures used in this calculation.
Admissions for previously treated conditions
Enquire of management how they define a ‘previously treated condition’. For example, does this depend upon the underlying symptoms or the diagnosis of the medical practitioner?
Obtain a copy of the patient admissions records. Use computer assisted audit techniques (CAATs) to identify patients admitted to the hospital within 28 days of a previous admission. If possible, inspect the underlying patient records to identify whether the patient was treated for either the same or a similar condition. If not enquire of the medical practitioners responsible for their care during their admission.
Where the above procedure identifies patients admitted for the same condition ensure that these patients are recorded in management’s calculation of the performance measure to ensure the completeness of the information used in the calculation.