49 Steps to Implement Sarbanes-Oxley Best Practices in Private and Nonprofit Health Care Entities

Table of Contents

Chapter 1. Overview of Sarbanes-Oxley Act

• Background to the Passage of the Act
• Evolution of Corporate Accountability Laws and Regulations

Chapter 2. Relevance of Sarbanes-Oxley to Private and Nonprofit Entities

• Sarbanes-Oxley Standards: Good for Business
• Best Practice Standards for Business Entities
• Reduction in Liability Exposure for Officers and Board Members
• Directors and Officers Insurance
• Bondholder Ratings
• OIG and Sentencing Commission Guidance
• Similar State Measures
• Third Parties and Business Partners May Demand Higher Standards
• Investors or Purchasers of Businesses May Expect Adherence
• Changing GAAP and FASB Accounting Principles
• Accountants Are Likely to Adopt the Same Principles and Standards for All Sectors
• Avoiding Litigation
• Potential Initial Public Offerings
• Impact of Sarbanes-Oxley on Accountants and Lawyers

Chapter 3. Getting Started

• Step 1. Conduct a gap analysis.
• Step 2. Gain "top-down" written agreement on the process, form and format for policy development and implementation.

Chapter 4. Corporate Governance

• Step 3. Establish an executive Compliance or Governance Committee to oversee implementation of compliance efforts.
• Step 4. Establish a compliance or governance officer function.
• Step 5. Define the position of the individual who will be responsible for the compliance office function.

Chapter 5. Board of Directors — Structure

• Step 6. Develop a job description for members of the Board that defines their roles and responsibilities.
• Step 7. Develop a policy regarding orientation and education of Board directors on their fiduciary duties and responsibilities.
• Step 8. Create a Board Governance Committee.

Chapter 6. Board of Directors — Independence

• Step 9. Define Board of Directors independence.
• Step 10. Prohibit the company from extending or maintaining credit arrangements for any director or executive officer.

Chapter 7. Board Audit Committee

• Step 11. Establish and charter an Audit Committee of the Board of Directors with defined responsibilities for compliance oversight
• Step 12. Develop operating policies and procedures for carrying out the Audit Committee's chartered mission.
• Step 13. Consider melding the Audit Committee oversight responsibilities of the Act with general compliance oversight.
• Step 14. Establish composition of and meetings for the committee.
• Step 15. Establish and define the relationship between the Audit Committee and management.
• Step 16. Mandate that a member of the Audit Committee is a financial expert, and define what constitutes financial expertise.
• Step 17. Establish the process for addressing the oversight and qualifications of auditors.
• Step 18. Define how the Audit Committee should go about providing oversight of the auditors and accountants.
• Step 19. Require preapproval by the committee of all services provided by an audit firm, with a review and verification process.

Chapter 8. Auditor Independence

• Step 20. Prohibit a public accounting firm performing audit services from performing contemporaneously non-audit services.
• Step 21. Prohibit the financial auditor from providing audit services for more than five consecutive fiscal years, under certain circumstances.
• Step 22. Require those performing audits to report: accounting policies and practices; alternative treatments of financial information within GAAP; other written communications between the financial audit organization and the organization's management.

Chapter 9. Conflicts of Interest

• Step 23. Prohibit any officer or director of the organization to fraudulently influence, coerce, manipulate, or mislead any auditor.
• Step 24. Establish a companywide conflicts-of-interest policy.
• Step 25. Ensure that accountants and auditors do not receive additional compensation related to the engagement.
• Step 26. Prohibit a financial audit organization from performing audit services if key officers of the company were employed by it and participated in the audit during the prior year.

Chapter 10. Code of Business Ethics and Conduct

• Step 27. Establish a policy to approve a written Code for guidance on expectations for workplace conduct.
• Step 28. Develop a Code of Business Ethics.
• Step 29. Include a message in the Code of Business Ethics by the CEO reinforcing commitment to compliance.
• Step 30. Establish a training program for all covered employees on the content of the Code of Business Ethics and Conduct.

Chapter 11. Ethical Conduct: Reporting & Investigations

• Step 31. Establish a Hotline and/or other communication channels between employees and a designee of the Audit Committee without going through management.
• Step 32. Create an affirmative duty for employees to report any potential violations of federal, state, or local laws or regulations.
• Step 33. Permit employees and agents to report or seek guidance regarding potential or actual criminal conduct.
• Step 34. Prohibit retaliation against anyone for reporting potential violations of law, regulations, or code of conduct.
• Step 35. Develop and implement written guidelines for the investigation of whistleblower complaints and allegations.
• Step 36. Establish a records management, retention, and destruction policy for compliance Hotline-related documents.

Chapter 12. Financial Reporting and Disclosures

• Step 37. Mandate certifications for annual reports.
• Step 38. Develop financial report certification forms to be signed by the CFO and CEO.
• Step 39. Establish a disclosure committee to ensure that financial reporting contains all identified material correcting adjustments.
• Step 40. Define the policy for when disclosures are required and how this will be done.
• Step 41. Develop a financial records management program.
• Step 42. Ensure accurate retention of records.
• Step 43. Establish a process by which the internal controls of the company are tested on an ongoing basis.
• Step 44. Establish a process and requirement for annual internal control reports certified by senior management.
• Step 45. Define the affirmative duties of attorneys for reporting potential material violations of laws.

Chapter 13. Auditing and Monitoring

• Step 46. Establish an effective risk assessment process and work plan.
• Step 47. Establish an ongoing auditing & monitoring program.
• Step 48. Develop a general fraud and abuse policy for compliance with all applicable laws and regulations.
• Step 49. Establish an audit follow-up and resolution process.

Appendix 1: Glossary

Appendix 2: Sarbanes-Oxley Act of 2002: Titles and Sections of the Act

Appendix 3: Summary of Sarbanes-Oxley Act of 2002 by Section

Appendix 4: Securities and Exchange Commission Sarbanes-Oxley Press Releases, Final Rules, Proposed Rules, and Special Studies

Templates (available in the book and on CD):

1: Initial Gap Analysis - Getting Started With Implementation Steps

2: Policy Development and Implementation Policy

3: Compliance Committee Policy

4: Compliance Officer Policy

5: Chief Compliance Officer (CCO) Position Description

6: Job Description for Board Members (Directors)

7: Director Orientation and Education Policy

8: Board Governance Committee Policy

9: Board of Directors Independence Policy

10: Policy Against Extending Loans or Credit to Any Executive Officer or Board

11: Charter of the Audit Committee of the Board of Directors

12: Audit Committee Duties and Responsibilities Policy

13: Board Audit and Compliance Committee Policy

14: Audit Committee Composition and Meeting Policy

15: Audit Committee and Management Relationship Policy

16: Audit Committee Financial Experts Policy

17: Evaluation of Independent Auditor's Qualifications Policy

18: Auditor and Accountant Oversight Policy

19: Audit and Non-Audit Services Preapproval Policy

20: Services Outside the Scope of Practice of Auditors Policy

21: Auditor and Accountant Rotation Policy

22: Auditor and Accountant Oversight Policy

23: Policy Against Coercing or Influencing Auditors or Accountants

24: Employee Conflicts-of-Interest Policy

25: Auditor Compensation Policy

26: Auditor and Accountant Conflicts-of-Interest Policy

27: Audit Committee Oversight Responsibilities for the Code of Business Ethics and Conduct Policy

28: Code of Business Ethics and Conduct

29: Code of Business Ethics and Conduct Cover Letter - Message from the CEO

30: Compliance Education and Training Policy

31: Sarbanes-Oxley Hotline Policy

32: Employee Duty to Report Policy

33: Confidentiality/Anonymity Policy

34: Non-Retribution/Non-Retaliation Policy

35: Investigating Whistleblower Complaints Policy

36: Hotline Records Management Policy

37: Financial Certification Policy

38A: Certification of the Chief Financial Officer Pursuant to Section 302 of the Sarbanes-Oxley Act

38B: Certification of the Administrator or CFO Pursuant to CMS Regulations, Section 413.24(F)(4)(iv), Adequate Cost Data and Cost Finding

39: Disclosure Committee Policy

40: Financial Disclosure Policy

41: Records Management Policy

42: Certification of Internal and External Auditor's Commitment to Retain All Necessary Work Papers Related to a Financial Audit or Review

43: Internal Controls Review Policy

44: Management Report on Financial Internal Controls and Identification of Material Weaknesses

45: Attorneys' Duty to Report Policy

46: Risk Assessment and Work Plan Policy

47: Auditing and Monitoring Policy

48: Audit Follow-Up and Resolution Policy

49: Fraud and Abuse Compliance Policy

Written By

49 Steps to Implement Sarbanes-Oxley Best Practices is written by Richard P. Kusserow, president of Strategic Management Systems, Inc. (SMSInc), an industry-leading health care compliance consulting firm in Alexandria, Va., and Rita Kuyumcuoglu, Esq., MPA, an associate at SMSInc. Prior to founding SMSInc in 1992, Mr. Kusserow was the Inspector General of HHS for 11 years. He is among the top compliance consultants in the nation, well-known both for his ability to see the big picture and his intimate first-hand knowledge of the federal government's compliance initiatives. His extraordinary understanding of compliance requirements, and the ways in which health care organizations have responded, will help you understand today's Sarbanes-Oxley challenges and respond to them with effective tools that can be adapted for your organization. Ms. Kuyumcuoglu is responsible for researching and analyzing regulatory and industry information to serve the specialized needs of SMSInc's clients.

Written For

• Compliance officers
• Internal auditors
• Corporate executives
• Risk managers
• Officers and Board members
• Accountants
• Consultants
• Lawyers

Shipping Information

This item is shipped via UPS. Please give us your street address when you order (UPS does not deliver to PO boxes.) You should receive your order within 5-7 business days. Shipping cost is $12 per item.

Rush orders: Please call us at 800-521-4323 to place a rush order. We will overnight your order for an additional charge of $45, or you can give us your FedEx or UPS account number and we will charge the shipping to your account. Rush orders placed after 3:00pm EST will not be shipped out until the next business day.