Public Hospitals: Results of the 2012–13 Audits

Conclusion

Parliament can have confidence in the 2012–13 financial reports of public hospitals and their associated entities. Clear audit opinions were issued on all financial reports for 2012–13, meaning that the financial reports of the audited entities can be relied on by Parliament and the public in relation to the results of the entities' operations and their assets and liabilities as at 30 June 2013.

Public hospital sustainability

Approximately 88 per cent of public hospital revenue comes from Commonwealth and state funding tied to the delivery of health care. The remaining revenue is self-generated and is typically derived from additional services such as pharmacy sales, cafeteria sales, diagnostic imaging, private practice fees, car park fees and income on investments.

The Department of Health does not provide public hospitals with direct funding to cover the depreciation of their assets and so the funding model continues to have a direct and significant impact on the financial sustainability of hospitals. The ability of governing bodies and management to make decisions to renew and replace assets is limited because they do not generate sufficient revenue from their own operations to fund such decisions.

Public hospitals built and delivered through public private partnership (PPP) arrangements have maintenance requirements and asset quality standards written into contracts with the private sector providers. As a result the maintenance of the assets is managed throughout the operating period of the PPP and the asset is required to be returned to the state at the end of the period, in an agreed condition.

Across the sector, the average self-financing ratio was assessed as low in 2012–13, highlighting the sector's ongoing reliance on government funding to maintain service levels and to maintain and replace assets. Consequently, more spending may be required over the long term to replace ageing public hospital assets. This poses a risk to the sector's ability to keep up with the increasing demand for health services while maintaining assets.

Under the current funding model, public hospitals hold very low cash reserves and have limited ability to fund long-term debt and capital replacement. The cash holdings at 23 public hospitals was less than seven days at 30 June 2013. This means that these hospitals could only continue to operate for a week if there was a delay in providing their next funding instalment. These cash levels risk the ability of these hospitals to respond in the event of unexpected costs.

As at 30 June 2013, 28 public hospitals (31 in 2011–12) relied on a 'letter of support' from the Department of Health committing to provide sufficient cash flows to them to meet their obligations if required.

Private patient revenue

Private patients provide a source of revenue for public hospitals independent of government funding. Eighty-two of the 87 public hospitals generated revenue from this source in 2012–13. Private patient revenue collected in 2012–13 amounted to more than $719 million, up from $611 million collected in 2011–12.

Most public hospitals had private patient revenue policies or revenue policies covering the generation, collection and recording of these fees. We observed that practices employed by public hospitals generally aligned with their policies and were supported by strong monitoring controls. Half of the public hospitals that collected private patient revenue had engaged internal auditors to review the activity within the past three years.

Risk management at public hospitals

To effectively manage risk, management and governing boards should identify risks, then design and implement mitigation strategies. All public hospitals had risk management frameworks, however, they could be improved by:

• reviewing risk management policies annually so that they are current
• embedding risk into the business and strategic plans of public hospitals
• explicitly providing a role for the audit committee in the oversight of risk management, by articulating responsibilities in the audit committee charter.

Many public hospitals relied on outsourced providers for critical financial functions, including payroll, information technology services and accounts payable functions. However, not all had sought and obtained assurance about their providers' risk management practices in order to act to mitigate any related risk exposure.

The public hospitals could also improve their risk management by regularly engaging their governing boards and audit committees in reviewing risk policies and documents and by reporting critical or extreme risks to them, as well as engaging internal auditors to review practices.

Recommendations

Recommendations have been made throughout this report. These recommendations are outlined below.

That public hospitals:

1. adjust all errors identified during audits so that their financial statements are of the highest possible quality
2. review their financial reporting processes to address the better practice report preparation elements, including the timely preparation of shell financial statements
3. review their risk management frameworks and policies, at least annually
4. report on 'critical' or 'extreme' risks and associated mitigation strategies to their board or audit committee, at least quarterly
5. use internal audit to review practices in relation to private patient revenue and compliance with established policies.

Submissions and comments received

In addition to progressive engagement during the course of the audit, in accordance with section 16(3) of the Audit Act 1994 a copy of this report, or relevant extracts from the report, was provided to the Department of Health and named agencies with a request for submissions or comments.

Agency views have been considered in reaching our audit conclusions and are represented to the extent relevant and warranted in preparing this report. Their full section 16(3) submissions and comments are included in Appendix F.

1.1 Introduction

Public hospitals provide a range of services across metropolitan, regional and rural areas. Metropolitan and regional public hospitals typically provide acute health services, as well as a mix of mental health, subacute, community health and aged care services. Rural public hospitals generally offer a higher proportion of aged care and community health services.

This report provides the results of the financial audits of 112 entities, comprising 87 public hospitals and their 25 associated entities, and is one of a suite of Parliamentary reports on the results of the 2012–13 financial audits conducted by VAGO. The full list of reports can be found in Appendix A of this report.

A breakdown of the 112 entities commented on in this report is set out in Figure 1A.

Figure 1A

Public hospitals and controlled entities

(a) Entities controlled by public hospitals generally comprise foundations and trusts. Subsequent to the 2011–12 audits, the control arrangements for one entity were reassessed and it was determined that the entity was no longer controlled by the related public hospital. The entity has therefore been excluded from the 2012–13 report.

(b) Other associated entities are not directly controlled by a public hospital and generally comprise joint ventures or unrelated not-for-profit entities.

Source: Victorian Auditor-General's Office.

The names of all the entities, within the public hospital sector, audited by VAGO appear in Appendix B.

1.2 Structure of this report

This report informs Parliament about issues arising from the audits of the Victorian public hospital sector, and adds to the assurance provided through audit opinions on the financial statements included in the respective entities' annual reports.

The structure of this report and details covered in each Part are set out in Figure 1B.

Figure 1B

Report structure

1.3 Audit of financial reports

An annual financial audit has two aims:

• to give an opinion consistent with section 9 of the Audit Act 1994, on whether the financial report is fairly stated
• to consider whether there has been wastage of public resources or a lack of probity or financial prudence in the management or application of public resources, consistent with section 3A(2) of the Audit Act 1994.

The framework applied in conducting our financial audits is set out in Figure 1C.

Figure 1C

Financial framework

Source: Victorian Auditor-General's Office.

1.3.1 Audit of internal controls relevant to the preparation of the financial report

Integral to the annual financial audit is an assessment of the adequacy of the internal control framework, and the governance processes, related to an entity's financial reporting. In making this assessment, consideration is given to the internal controls relevant to the entity's preparation and fair presentation of the financial report, but this assessment is not used for the purpose of expressing an opinion on the effectiveness of the entity's internal control.

Internal controls are systems, policies and procedures that help an entity reliably and cost effectively meet its objectives. Sound internal controls enable the delivery of reliable, accurate and timely internal and external reporting.

An explanation of the internal control framework, and its main components, is set out in Appendix C. An entity's governing body is responsible for developing and maintaining its internal control framework.

Internal control weaknesses we identify during an audit do not usually result in a 'qualified' audit opinion because often an entity will have compensating controls in place that mitigate the risk of a material error in the financial report. A qualification is warranted only if weaknesses cause significant uncertainty about the accuracy, completeness and reliability of the financial information being reported.

Weaknesses in internal controls found during the audit of an entity are reported to its chief executive officer and audit committee in a management letter.

Our reports to Parliament raise systemic or common weaknesses identified during our assessments of internal controls over financial reporting, across a sector.

1.4 Public hospital funding framework

During 2012–13, reforms to National Health funding arrangements came into operation. The National Health Reform Agreement was introduced to give greater control for funding of public hospitals to the Commonwealth Government. The implementation of a nationally consistent approach to funding acute admitted services, emergency department services and non-admitted patient services began on 1 July 2012, and for the remaining non-admitted services, mental health and subacute services, on 1 July 2013. The funding basis is referred to as Activity Based Funding (ABF).

ABF involves the setting of a unit price for each type of medical or clinical activity, and agreeing on the quantity of units to be provided by the hospital. This forms the basis for calculating the funding to be provided under the health services agreement between the hospital and Minister for Health.

Block funding continues to be provided where appropriate, and is also set out in an annual health services agreement. Block funding is provided to public hospitals when it is not technically possible to use ABF, or where there is an absence of economies of scale that mean some services would not be financially viable under ABF.

The National Health Funding Pool

Under the new arrangements, state and territory governments remain responsible for the performance of public hospitals in their jurisdictions. However, Commonwealth and state ABF monies as well as Commonwealth block funding are now paid into a pool bank account established for each state or territory. The Victorian bank account is known as the National Health Funding Pool—Victorian State Pool Account. Each state's pool account is to be managed by an independent administrator. An administrator is required for the Commonwealth, and for each of the states and territories.

At the time of preparing this report an administrator for Victoria had not been appointed. The Victorian Minister for Health has temporarily granted authority to the Chief Finance Officer of the Department of Health (DH) to make payments out of the Victorian pool account to Victorian hospitals.

ABF payments are made directly from the Pool to hospitals, circumventing the previous role of state and territory health departments. Payments can only be made from the Pool following instruction from the relevant state or territory health minister.

Commonwealth block funding is paid from the Victorian pool account to the State Managed Fund (managed by DH) and then passed on to hospitals. State block funding is paid by DH directly to hospitals and therefore does not go through the Pool.

The Commonwealth administrator oversees the payments, maintains the associated records and prepares annual financial statements for each state and territory pool, for auditing and reporting to the Parliament of the related jurisdiction.

The Victorian Auditor-General is responsible for the audit of the financial statements of the National Health Funding Pool—Victorian State Pool Account. However, as the Pool does not form part of the operations of the public hospital sector its financial results are not included in this report.

1.5 Conduct of public hospital financial audits

The audits of the 87 Victorian public hospitals and their 25 associated entities were undertaken in accordance with Australian Auditing Standards.

Pursuant to section 20(3) of the Audit Act 1994, unless otherwise indicated, any persons named in this report are not the subject of adverse comment or opinion.

The total cost of preparing and printing this report was $205 000.

2.1 Introduction

This Part covers the results of the audits of the 2012–13 financial statements of public hospitals and their associated entities.

2.2 Audit opinions issued

Independent audit opinions add credibility to financial reports by providing reasonable assurance that the information reported is reliable and accurate. An 'unqualified' or 'clear' audit opinion confirms that the financial statements present fairly the transactions and balances for the reporting period, in accordance with the requirements of relevant accounting standards and legislation.

A 'qualified' audit opinion means that the financial report is materially different to the requirements of the relevant reporting framework or accounting standards, and is less reliable and useful as an accountability document.

For 2012–13, unqualified audit opinions were issued on the financial statements of all 112 public hospitals and associated entities. This positive result is consistent with 2011–12 when all 113 public hospitals and associated entities received unqualified audit opinions.

In certain circumstances an audit opinion may draw attention to, or emphasise, a matter relevant to the users of an entity's financial report but does not warrant a qualification. No public hospitals' audit opinion included an emphasis of matter paragraph for 2012–13. One associated entity's opinion contained an emphasis of matter paragraph in relation to the winding up of the business. This was adequately disclosed within the financial statements.

2.3 Quality of individual hospital financial reporting

The quality of an entity's financial reporting can be measured in part by the timeliness and accuracy of the preparation and finalisation of its financial report, as well as against better practice criteria.

2.3.1 Accuracy

The frequency and value of errors in financial statements are direct measures of the quality of the draft financial statements submitted for audit. Ideally, there should be no errors or adjustments required as a result of an audit.

Our expectation is that all entities will adjust any errors identified during an audit, other than those errors that are clearly trivial or clearly inconsequential to the financial report, as defined under the auditing standards.

The public is entitled to expect that any financial statements that bear the Auditor‑General's opinion are accurate and of the highest possible quality. Therefore all errors identified during an audit should be adjusted, other than those that are clearly trivial.

Material adjustments

Material errors need to be corrected before an unqualified audit opinion can be issued and while all material errors were adjusted prior to the completion of the financial reports, 81 material adjustments were made during the 2012–13 audits. This compares to 129 in 2011–12. Rural hospitals continue to account for half (53 per cent) of the material adjustments each year.

The nature of material adjustments identified during the 2012–13 audits were:

• financial instrument disclosures—incomplete or incorrect adjustments to financial instrument disclosures
• financial statement and accounting policy disclosures—adjustments to financial statements to bring disclosures into line with the sector's model financial report, and adjustments to accounting policy disclosures to reflect the individual public hospital's actual situation
• revenue/receivables—adjustments to the revenue recognised where entities had either incorrectly classified revenue items or had accounted for revenue in the wrong year
• cash and investments—reclassification of cash balances to investments for deposits held with maturity terms in excess of 90 days.

Adjustment of other misstatements

Other errors should also be corrected before the audit opinion is signed. While some errors may appear immaterial in isolation, in aggregate, a series of small errors may have a significant impact on an entity's financial statements or an entity's operating result.

During the 2012–13 audits, a number of misstatements clearly above trivial thresholds were identified. Most were subsequently adjusted in entities' financial statements. However, some were not adjusted because either they were identified too late in the audit, or could not be processed in a timely manner without raising the risk of creating further errors. In these instances the misstatement was raised with management and will be rectified during 2013–14.

2.3.2 Timeliness

Timely financial reporting is key to providing accountability to stakeholders and enables informed decision-making. The later reports are produced and published after year end, the less useful they are.

Public hospitals are required to finalise their audited financial reports within 12 weeks of the end of the financial year, and they are to be tabled in Parliament within four months of the end of the financial year. The need to consolidate the results of controlled entities into their parent entity's financial report means that the financial statements of associated entities that operate under the Corporations Act 2001 are also required to report within 12 weeks of the end of financial year.

All public hospitals met the legislated time frame in 2012–13, as was the case in 2011–12. The audits of two associated entities were, however, not completed within the legislated time lines, but were completed by 31 October 2013.

The average time to finalise financial statements increased to 9.1 weeks in 2012–13 from 8.5 weeks in 2011–12. Some delays arose directly from the need to complete the audit of the National Health Funding Pool—Victorian State Pool Account prior to finalising audits of individual hospitals, to ensure that funds distributed from the pool account were accurately reflected in hospital financial statements.

2.3.3 Better practice

An assessment of the quality of financial reporting processes was conducted against better practice criteria, detailed in Appendix C, using the following scale:

• no existence—process not conducted by the entity
• developing—partially encompassed in the entity's financial reporting preparation processes
• developed—entity has implemented the process, however, it is not fully effective
• better practice—entity has implemented effective and efficient processes.

The results are summarised in Figure 2A.

Figure 2A

Results of assessment of report preparation processes against better practice elements

Source:Victorian Auditor-General's Office.

While most elements were developing or developed, with some public hospitals having achieved better practice, the most significant element to be addressed across the sector is the preparation of shell financial statements. Providing these to auditors well before year end enables format, presentation and disclosure issues within the financial statements to be identified and resolved early. Conversely, not providing shell financial statements to the auditors in advance of year end can cause significant delays and additional costs in the finalisation of the audit—potentially jeopardising the hospital's ability to meet legislated time lines and causing unnecessary cost increases.

Recommendations

That public hospitals:

1. adjust all errors identified during audits so that their financial statements are of the highest possible quality
2. review their financial reporting processes to address the better practice report preparation elements, including the timely preparation of shell financial statements.

3.1 Introduction

To be financially sustainable, entities need to be able to meet their current and future expenditure as it falls due. They also need to absorb foreseeable changes and financial risks that materialise, without significantly changing their revenue and expenditure policies. The assessment of financial sustainability assists in identifying trends that either warrant attention or highlight positive results.

Financial sustainability should be viewed from both short-term and long-term perspectives. Short-term indicators show the ability of an entity to maintain positive operating cash flows in the near future, or to generate an operating surplus in the next financial year. Long-term indicators focus on strategic issues, such as the ability to fund ongoing asset maintenance programs or reduce long-term debt.

In this Part, insight is provided into the financial sustainability of public hospitals through analysis of five key financial sustainability indicators as at 30 June 2013, and the trends of these indicators over the last five years. Appendix D describes the sustainability indicators and their significance, as well as the risk assessment criteria and rating scales used in this Part.

The analysis addresses the financial position of the sector as a whole, of the three categories of hospitals (metropolitan, regional and rural), and of individual public hospitals.

To form a definitive view of an entity's financial sustainability, a holistic analysis would be required, going beyond financial indicators and including an assessment of the entity's operations and environment. However, non-financial factors are not considered in this Part.

3.2 Financial results of public hospitals

3.2.1 Operating result

Public hospitals, as an essential public service, should manage their finances so that they break even or report a small profit. The sector's net result for 2012–13 was a deficit of $4 million—which against the total revenue of $12 billion for all entities in the sector is tantamount to a break even position.

Total public hospital revenue increased by 3 per cent in 2012–13, and expenditure increased by a corresponding 3 per cent. The composition of what makes up revenue and expenditure for public hospitals has remained unchanged over the past five years. Government funding contributes 88 per cent of public hospital revenue, and salaries and wages are the biggest expense, representing 65 per cent of expenditure.

Public hospitals derive and report revenue as either:

• revenue arising from health services agreements (HSA income)—which is largely made up of government funding
• revenue from hospital and community initiatives (non-HSA income).

Non-HSA income is self-generated and is typically derived from additional services provided such as pharmacy sales, cafeteria sales, diagnostic imaging, private practice fees, car park fees and income on investments.

Rural and regional public hospitals derive 92 per cent and 91 per cent, respectively, of their revenue from health service agreements. This means rural and regional hospitals have little self-generated revenue over which they have discretion to spend. In contrast, metropolitan public hospitals generate 87 per cent of their revenue from health services agreements and therefore have more capacity to fund initiatives and absorb unexpected cost fluctuations.

3.2.2 Financial position

An entity's financial position is generally measured with reference to its net assets—the difference between its total assets and total liabilities. However, this measure is less appropriate for public hospitals as they largely do not hold assets to generate revenue.

The strategic objectives for public hospitals are more aligned to providing key health services to the public. Maintaining assets and managing debt levels are lesser priorities for public hospitals, but are still important as the value of buildings, medical equipment and infrastructure assets is significant.

The total assets of the sector were $12.0 billion at 30 June 2013. Net assets at 30 June 2013 were $7.5 billion. This positive net asset position improved during 2012–13 as large scale capital projects progressed, such as the new Victorian Comprehensive Cancer Centre, and smaller capital projects were completed. Corresponding liabilities for some of these capital projects were recognised.

3.2.3 Going concern

Despite the financial results achieved by the sector in 2012–13, 28 public hospitals (31 in 2011–12) showed signs of financial stress, with a material uncertainty about their ability to continue as a going concern.

The Department of Health (DH) provided letters of financial support to these 28 hospitals, undertaking to provide adequate cash flows to enable them to meet their current and future obligations, as and when they fall due, for a period of 12 months up to September 2014, should it be required.

The letter of financial support mitigates the risk that the 28 hospitals will cease to operate during 2013–14. Accordingly, these hospitals are able to continue to report as a going concern, in accordance with Australian Accounting Standards.

Figure 3A shows the hospitals that relied upon 'letters of support' at the date of signing their 2012–13 financial reports.

Figure 3A

Public hospitals relying upon 'letters of support', 2012–13

Source: Victorian Auditor-General's Office.

3.3 Financial sustainability of public hospitals

3.3.1 Overall assessment

The overall financial sustainability risk for the public hospital sector for 2012–13 was assessed as medium, consistent with the 2011–12 result. This assessment means there are concerns relating to the longer-term financial sustainability of public hospitals.

Figure 3B presents the indicators by hospital category for 2012–13.

Figure 3B

Financial sustainability risk, 2012–13

Note: Red signifies a high risk, while amber indicates longer-term sustainability issues and green indicates no issues.

Source: Victorian Auditor-General's Office.

Detailed results of our sustainability risk assessments for each category and each public hospital can be found in Appendix D. Detailed comments on the results for each of the five indicators follow in this Part.

3.3.2 Net result

Net result is calculated by subtracting an entity's total expenses from its total revenue, to show what was earned or lost in a given period of time. A positive result is known as a surplus, a negative result indicates a deficit.

Figure 3C shows the average net result for each public hospital category from 2008–09 to 2012–13.

Figure 3C

Net result, by hospital category

Source: Victorian Auditor-General's Office.

The net results by category have fluctuated significantly over the five year period, although most have remained in deficit. All categories have achieved some recovery since the large losses delivered in 2009–10. The losses in 2009–10 were largely due to significantly increased depreciation costs resulting from the sector wide asset revaluations performed in 2008–09. Under the funding model, DH does not fund public hospitals directly for depreciation, and it is expected that public hospitals will record operating deficits as they incur increased depreciation charges.

The overall improvement since 2009–10 has been driven by hospital cost containment measures and increased government funding.

Regional hospitals have achieved sustained average surpluses in recent times. These averages are buoyed by consistently strong results from a number of hospitals which increase the average result of the category as a whole.

In 2012–13, the number of public hospitals with an underlying deficit decreased to 60 (62 in 2011–12). This continues an overall improvement in the number of public hospitals with operating deficits since 2009–10.

3.3.3 Liquidity

Liquidity is a measure of current assets against current liabilities. This measures the ability of an entity to pay existing liabilities in the next 12 months. A ratio of one or more means there are more current assets than short-term liabilities.

At 30 June 2013, 33 of 87 public hospitals had lower balances of current assets than current liabilities (33 in 2011–12). This means they face liquidity challenges of not being able to pay liabilities as and when they fall due. Low liquidity highlights the pressure on public hospitals to meet short-term debts and contributed to the need for some public hospitals to seek a 'letter of support'.

Figure 3D shows that the average liquidity ratio by hospital category has remained relatively stable over the past five years.

Figure 3D

Average liquidity ratio, by hospital category

Source: Victorian Auditor-General's Office.

While average liquidity ratios have remained stable, the number of public hospitals with significant liquidity risks is slowly growing each year. The risk profile over the past five years in Figure 3E shows a greater number of public hospitals moving to the high‑ and medium-risk categories.

Figure 3E

Public hospital liquidity risk

Source: Victorian Auditor-General's Office.

3.3.4 Average number of days cash available

The average number of days cash available indicator measures the number of days of operating expenses that a hospital could pay with its current, unrestricted, cash.

This indicator is calculated using the cash and cash equivalents items disclosed within the financial reports of individual hospitals. This approach is consistent with the definition of cash and cash equivalents, within the Australian Accounting Standards. According to this definition certain assets, such as term deposits with original maturities of more than 90 days, are specifically excluded from cash. For the purposes of completeness and consistency across all hospitals, this indicator therefore excludes these particular assets.

The calculation of unrestricted cash also excludes amounts held by a public hospital, where the use of these amounts has been restricted–such as patient money held in trust or cash set aside for capital purposes. These amounts are excluded from this indicator, as they cannot be used by the public hospital to cover their day to day operating costs.

At 30 June 2013, 57 of 87 public hospitals (49 of 87 at 30 June 2012), including most major metropolitan and regional hospitals, had cash holdings equivalent to less than 30 days of their operating cash outflows.

Figure 3F shows that the average number of days of cash available at year end decreased at the whole of sector level, but remained greater than one month's operating cash flows as at 30 June 2013.

Figure 3F

Average number of days cash available, by hospital category

Note: Funds held in trust, unspent capital grants and restricted special purpose funds are excluded from this analysis as their use is restricted.

Note: Holdings in short term investments, such as such as term deposits, are also excluded from this analysis.

Source: Victorian Auditor-General's Office.

The cash holdings at 23 public hospitals were less than seven days at 30 June 2013. This means that these hospitals could only continue to operate for a week if there was some delay in providing them with their next funding instalment. The low level of cash held also puts at risk the ability of these hospitals to respond in the event of unexpected costs. The 23 hospitals are listed in Figure 3G, and include several large metropolitan public hospitals.

Figure 3G

Public hospitals with cash holdings of less than seven days' worth of operating cash outflow, 30 June 2013

Note: Where a hospital's unrestricted cash balance is less than zero, it has been rounded to zero days cover.

Note: Funds held in trust, unspent capital grants, restricted special purpose funds and holdings in short term investments, such as such as term deposits, are excluded from this analysis.

Source: Victorian Auditor-General's Office.

3.3.5 Self-financing

The self-financing indicator measures the ability of an entity to replace assets using cash generated by its own operations. The higher the percentage the more effectively this can be done.

Across the sector, the average self-financing ratio remained low, highlighting the sector's ongoing reliance on government funding to maintain service levels and to maintain and replace assets. In 2012–13, metropolitan hospitals continued the trend of the past four years, with lower self-financing ratios than regional and rural hospitals.

Figure 3H shows the movement in the average self-financing ratio for each of the three hospital categories over the past five years.

Figure 3H

Average self-financing indicator, by hospital category

Source: Victorian Auditor-General's Office.

Figure 3I shows that the self-financing risk for 80 per cent of public hospitals was high for 2012–13. This is consistent with results since 2008–09, and is largely due to the funding model.

Figure 3I

Public hospital self-financing risk

Source: Victorian Auditor-General's Office.

3.3.6 Capital replacement

The capital replacement indicator compares the rate of spending on infrastructure with an entity's depreciation. Ratios higher than 1:1 indicate that spending on new infrastructure is greater than depreciation for the year. This is a long-term indicator, as capital expenditure can be deferred in the short term if there are insufficient funds available from operations, and borrowing is not an option.

Figure 3J shows that after a sharp decline in 2009–10, the sector's overall capital replacement ratio has remained relatively stable. On average only regional hospitals are replacing assets at a rate greater than they are being consumed.

Figure 3J

Average capital replacement indicator, by hospital category

Source: Victorian Auditor-General's Office.

The data used for this indicator includes spending on replacing or improving facilities but does not capture ongoing repairs and maintenance. It also excludes expenditure on hospital assets procured through public private partnerships (PPP) and maintained by the private sector provider. Typically, PPP arrangements require the private sector provider to maintain the asset throughout the agreement's operating phase and return the asset to the state at the end of the partnership. When the asset is returned to the state, it must be returned in an agreed condition.

As a result of the above exclusions, the true level of spending on assets and their maintenance may be misstated. The results, nevertheless, remain indicative and identify challenges for DH and public hospitals to fund capital replacement into the future.

The data suggests that for assets not subject to PPP arrangements, more spending may be required over the long term to replace ageing public hospital assets. Current spending will not be sufficient for public hospitals to continue maintaining and upgrading existing infrastructure and equipment. This poses a risk to the sector's ability to keep up with the increasing demand for health services and to maintain assets.

Figure 3K highlights a declining annual spend on replacing and improving fixed assets compared with increasing annual depreciation expenditure.

Figure 3K

Cash spent on fixed assets compared to annual depreciation expenditure

Source: Victorian Auditor-General's Office.

Annual capital spending was less than depreciation in both the metropolitan and rural sectors in each of the past four years. This indicates that assets are being used faster than they are being replaced.

The impact of the funding model, on the revenue side, is clearly evident in Figure 3L. In 2012–13, 37 per cent of public hospitals (32 hospitals) received capital grants from DH equal to less than 20 per cent of their depreciation expense for the financial year (38 hospitals in 2011–12). This was most pronounced in rural hospitals.

Figure 3L

Percentage of public hospitals receiving capital grants of less than 20 per cent of depreciation expense

Source: Victorian Auditor-General's Office.

Figure 3M shows that the number of public hospitals with a high capital replacement risk has reduced since 2009–10, with more hospitals assessed as medium and high risk.

Figure 3M

Public hospital capital replacement risk

Source: Victorian Auditor-General's Office.

The value of assets across the sector increased in 2008–09, increasing the depreciation charged annually and affecting the capital replacement indicator.

The 2012–13 results show that the proportion of public hospitals in the low-risk category has improved slightly, however, it remains well below 2008–09 levels. The next revaluation cycle will occur in 2013–14, at which time it is likely that the value of assets across the sector will increase and affect the annual depreciation charge.

3.3.7 Impacts of the funding model on sustainability

Public hospital funding arrangements directly impact the financial sustainability of public hospitals. For hospitals to maintain an adequate level of service, their assets need to be maintained and replaced when necessary. However, they are almost entirely dependent on obtaining additional government funding to meet their asset maintenance, upgrade and replacement needs.

The funding model does not progressively provide funding to public hospitals to match the depreciation of their assets. Capital grants, which may be provided for asset renewal and replacement, are allocated by DH strategically across the sector.

The impact on public hospitals is demonstrated as follows:

• Seventy public hospitals (80 per cent) had a high self-financing risk in 2012–13 (66 in 2011–12).
• In 2012–13, 32 public hospitals received capital grants of less than 20 per cent of their depreciation expense for the year, that is, the funding received for replacing their assets was significantly less than the value of assets they consumed.

Under section 33 of the Health Services Act 1988, the functions of a public hospital's board are to oversee and manage the hospital, and to ensure that services provided comply with the requirements of the Act and the hospital's objectives. Despite this, under the funding model, management and hospital boards have limited control over capital funding while remaining accountable for the impacts of ageing infrastructure and associated expenditure. The mismatch between the governance and funding models blurs accountability for the financial performance of individual hospitals.

4.1 Introduction

Poor internal controls diminish management's ability to achieve an entity's objectives, deliver upon agreed service levels and comply with relevant legislation. Poor internal controls also increase the risk of fraud, error and irregularities.

Reliable internal controls are a prerequisite for accurate and timely reporting. In our financial audits, we focus on the internal controls over financial reporting and assess whether entities have mitigated risks to the completeness and accuracy of their financial statements.

The board and management of each public hospital are responsible for developing and maintaining adequate systems of internal control to enable:

• the preparation of accurate financial records and other information
• timely and reliable external and internal reporting
• the appropriate safeguarding of public assets
• the prevention or detection of fraud, errors and other irregularities.

Integral to the annual financial audit is an assessment of the adequacy of the internal control framework, and the governance processes, related to an entity's financial reporting. In making this assessment, consideration is given to the internal controls relevant to the entity's preparation and fair presentation of the financial report, but this assessment is not used for the purpose of expressing an opinion on the effectiveness of the entity's internal control.

In this Part we report on aspects of the internal controls of Victoria's 87 public hospitals. We specifically address:

• general internal controls
• risk management frameworks, including a review of fraud risk management
• private patient revenue.

4.2 General internal controls

Internal controls at public hospitals and their associated entities were adequate for maintaining the reliability of external financial reporting. Nevertheless, the following areas were commonly identified as requiring improvement:

• preparing and reviewing key account reconciliations
• review of masterfile standing data changes.

Both of these issues were reported last year and while there has been some improvement in the number of hospitals at which these weaknesses were observed, further improvement is required particularly in rural hospitals.

Weaknesses were brought to the attention of management and audit committees by way of management letters.

4.2.1 Preparing and reviewing key account reconciliations

A financial report is prepared from information captured in an entity's general ledger, with key general ledger balances supported by information in subsidiary ledgers such as accounts payable, fixed assets and payroll. Periodic reconciliation of the general ledger with subsidiary ledger balances confirms the completeness and accuracy of data.

Timely preparation and independent review of reconciliations decreases the risk that errors may go undetected or may not be resolved in a timely manner. Poor controls can adversely affect the accuracy of financial reporting.

Twelve of the 87 public hospitals (23 in 2011–12) had deficiencies in the preparation and review of key reconciliations. While these 12 hospitals are preparing reconciliations regularly, independent reviews of these reconciliations either did not occur, or were not documented, in a timely manner. Nine of the 12 were rural hospitals.

4.2.2 Review of masterfile standing data changes

Financial systems such as accounts payable and payroll systems, rely on the maintenance of masterfiles holding standing data to enable reliable processing of individual payments. The standing data can include details such as names, addresses, pay rates and bank account details.

It is important that all changes to masterfile standing data are checked for completeness, accuracy and legitimacy. Without checks, processing errors can be repeated many times over, reducing data integrity. An independent review of masterfile standing data changes is important for the detection and timely correction of unintentional or fraudulent changes, and to guard against payments to fictitious parties.

Eleven of the 87 public hospitals (14 in 2011–12) had weaknesses in maintaining key system masterfiles, including a lack of an independent review of changes made, and inadequate documentation to support the changes made. These issues were identified at metropolitan and rural hospitals.

4.3 Risk management

Risk management is an important component of public sector governance. For public hospitals, risk management involves identifying and mitigating risks to the delivery of quality health services to the public, the timely and effective development of new infrastructure projects, and optimal resource allocation.

Risk management is a combination of organisational systems, processes and procedures that identify, assess, evaluate and mitigate risks in order to protect the organisation, its strategies and performance objectives. An effective risk management framework plays a significant role in reducing exposure to potentially unfavourable events.

For public hospitals, the potential consequences of ineffective risk management can be significant in terms of community health and wellbeing.

4.3.1 Risk management frameworks

Public hospitals are required to develop, implement and maintain a risk management framework. Primary responsibility for doing so rests with a hospital's board. Boards should ensure the hospital has a risk management policy and framework that clearly describes its overall approach and intention with respect to risk management.

Figure 4A outlines the key elements of an effective risk management framework. It draws on the requirements of the Financial Management Act 1994, the Department of Treasury and Finance's 2011 Victorian Government Risk Management Framework and the Australian/New Zealand Risk Management Standard AS/NZS ISO 31000:2009.

Figure 4A

Key elements of an effective risk management framework

Source: Victorian Auditor-General's Office based on the Victorian Government Risk Management Frameworkand Risk Management Standard AS/NZS ISO 31000:2009.

We assessed the risk management framework of the 87 public hospitals against the above elements. All public hospitals had some form of risk management framework in place generally addressing most aspects of the better practice framework. Attention should be given to the regular review of overarching policies, the use of risk registers and the implementation of fraud incident logs.

4.3.2 Risk management policies

During 2012–13, 86 of 87 public hospitals had a risk management policy in place. Of the 86, many had better practice elements included in their policy. The following areas were typically well covered at public hospitals:

• the overall objectives of the risk management framework—100 per cent
• reference to the Department of Treasury and Finance's 2011 Victorian Government Risk Management Framework and the Australian/New Zealand Risk Management Standard AS/NZS ISO 31000:2009—91 percent
• the responsibility for risk management within the hospital—94 per cent
• reporting obligations for monitoring and managing identified risks—95 per cent
• the requirement for the approval of risk management policies by the board or relevant committee—93 per cent.

The following elements were not well incorporated into risk management policies:

• a requirement for risk management to be included in business and strategic plans—missing for 22 percent of hospitals
• a requirement for the audit or risk committee to include their risk oversight function in the committee's charter—missing for 19 per cent of hospitals
• a requirement for an annual review of the policy—missing at 24 per cent of hospitals.

These elements, if not properly addressed, can impact the overall effectiveness of risk management activities.

The one hospital that did not have a risk management policy in place, had a risk management plan and a regularly updated risk register. The hospital is a small rural hospital, and the responsibility for oversight of its risk framework falls directly with the Chief Executive Officer and audit committee. While establishing a risk management policy may seem cumbersome, documentation of key approaches and business rules enables the better transfer of knowledge in the event of changes to management personnel.

4.3.3 Management practices

The following elements of an effective risk management framework were in place, at public hospitals:

• systems and processes exist for considering new and emerging risks and the revision of existing risks—97 per cent
• risks identified, categorised and rated with appropriate consideration of likelihood of occurrence—98 per cent
• executive management involved in identifying and assessing risks—98 per cent
• appropriate training enabling risk principles to be appreciated and understood by all relevant staff—87 per cent
• adequate staff resources allocated to the risk management function—100 percent
• management review of existing risks, and consideration of new and emerging risks at least annually—100 per cent.

Generally, public hospitals did not review the risk management practices of their outsourced providers. Providers typically deliver key functions such as payroll, information technology services and accounts payable services. The delivery of these functions has important risk management, security and accountability implications for hospitals.

When outsourcing key functions, hospital management does not forego its duty to ensure that controls are adequate, that outputs are accurate or that sensitive information is protected.

Assurance over the effectiveness of a provider's control environment, including their risk management practices, is considered part of an entity's overall internal control framework. With no assurance about the adequacy of outsourced providers risk management, public hospitals may be exposed to risks of which they are not aware and cannot manage.

Maintaining risk registers

Ninety-five per cent of public hospitals (83 of 87) maintained a risk register. This is compared to 97 per cent of public hospitals with policies that required a risk register to be developed. The four hospitals that did not have a risk register were in the process of developing one. All 83 risk registers recorded the likelihood and consequence of each identified risk. Eighty‑one of the 83 hospitals also documented strategies to mitigate the identified risks.

Reporting

Risks identified in the risk registers as 'critical' or 'extreme' were reported to the board, or relevant risk committee, at least quarterly at 70 public hospitals.

Fourteen of the remaining 17 hospitals reported these risks to the board biannually, annually or on request. Better practice suggests that such risks should be reported to the board at least quarterly.

The remaining three hospitals had not identified any 'critical' or 'extreme' risks. Benchmarking against the industry can provide an opportunity to better inform risk identification and management, and encourage better performance. Benchmarking of the hospital's risk profile against industry data was not performed at 60 hospitals (69 per cent).

4.3.4 Governance and oversight

The board is ultimately accountable for a hospital's operations, and is a crucial part of effective risk management. Boards exercise governance and oversight by undertaking high-level reviews of identified risks and subsequent mitigation strategies, as well as developing and signing off the overall risk management framework.

The regularity of review of risk management policies and procedures was inconsistent across the sector. Despite the policies of 76 public hospitals requiring an annual review, 31 hospitals (36 per cent) had not reviewed their policy or framework in the past twelve months. These hospitals would therefore have no assurance about the currency of their risk management activities.

An internal audit can provide independent oversight and recommendations to improve a public hospital's risk management policies and practises. Across the sector, 68 per cent of hospitals included consideration of their most critical risks in the internal audit plan and had scheduled an internal audit review in the short or medium term. In 63 per cent of the hospitals, an internal audit had been conducted in the past three years.

Risk attestation

The Victorian Government Risk Management Framework requires public sector agency heads to attest that their risk identification and management plan is consistent with the requirements of AS/NZS ISO 31000:2009. A responsible body or audit committee is required to verify this attestation.

The 2012–13 annual reports of all 87 public hospitals carried a risk attestation, and in all cases it was supported by verification by the audit committee.

4.3.5 Managing the risk of fraud

The risk of fraud exists across all industries and sectors. Sound internal control and risk management frameworks assist to prevent and detect fraudulent activities. Seventy-seven of the 87 public hospitals had separate, and specific, policies and procedures in place to address fraud risk. Thirty-four of the 87 public hospitals maintained a separate fraud risk framework.

The Standing Directions of the Minister for Finance suggest that agencies maintain a register of all cases of suspected or actual theft, arson, irregularity or fraud to allow for appropriate reporting to the Minister for Finance and the Auditor-General. Thirty-seven public hospitals did not maintain a register, however each of the 37 had procedures in place to report identified frauds to the board and relevant committee.

Across the sector 14 instances of fraud were identified during 2012–13, with the single largest instance amounting to around $200 000. In each of the 14 cases the hospital reported the incident appropriately and has amended procedures to mitigate the risk of recurrence. Insurance policies covered losses at each of the affected hospitals.

4.4 Private patient revenue

In tight economic times, public hospitals are under increasing pressure to fund their operations from sources other than government funding. Private patient fees provide a stream of income over and above that provided under annual hospital service agreements with government, and give public hospitals greater flexibility in delivering services.

Private patient services typically generate higher fees for service than public patient services. In 2012–13, private patient services across Victorian public hospitals generated revenue of more than $719 million ($611 million in 2011–12). Eighty-two of the 87 public hospitals generated private patient revenue in 2012–13.

4.4.1 Private patient revenue framework

Figure 4B outlines the key components of an effective revenue framework. It draws on the Standing Directions of the Minister for Finance under the Financial Management Act 1994.

Figure 4B

Key elements of an effective revenue framework

Source: Victorian Auditor-General's Office.

We considered these elements when assessing the private patient revenue processes at the 87 public hospitals. Overall, frameworks for generating and collecting private patient revenue across the sector were adequate. While not all public hospitals had specific private patient revenue policies, appropriate procedures were typically included in the hospital's general revenue and patient admission policies. Management, governance and oversight of private patient revenue was generally appropriate for the scale of private patient revenue generated by the hospital.

4.4.2 Policies

Existence and approval of policies

Fifty-eight of the 82 public hospitals (71 per cent) that generated private patient revenue had policies or procedures specifically related to private patient revenue. The policies and procedures covered the generation, collection and recording of private patient fees.

Of the remaining 24 hospitals, 14 relied on their generic policies addressing patient admission and cash handling procedures. Eleven of the 24 (46 per cent) did not intend to develop or implement a specific private patient revenue policy.

The policies or procedures in place typically covered the key elements expected, including:

• procedures for admitting private patients—97 per cent
• requirements to comply with the national health care agreement arrangements—78 per cent
• requirements to obtain insurance or payment details in advance of admission—78 per cent of hospitals
• procedures for debt collection—91 per cent
• the level of authorisation required to write-off debt—100 per cent of hospitals.

The governing body had approved the policy in 95 per cent of the 82 hospitals. Eighty‑nine per cent of those approved by the governing body had been approved or reviewed in the past three years.

4.4.3 Management practices

Monitoring

Monitoring of private patient revenue was effective across the 82 public hospitals that generated private patient revenue. Seventy-six of the hospitals (93 per cent) had a designated officer or committee directly responsible for overseeing the income, while the remaining six relied on their general revenue monitoring processes.

Monitoring processes included annual (or more frequent) reviews of procedures in 55 per cent of the hospitals that generated private patient revenue.

Examinations of actual practice revealed that public hospitals operated in line with their policies. Policy areas addressed well included:

• systems being in place to record, follow up and monitor private patient revenue—100 per cent
• all relevant hospital staff being provided with training for the admission of private patients—99 per cent
• verification of insurance or payment details occurring before admission, or as soon as practicable afterwards—89 per cent
• regular reporting being provided to the governing body—100 per cent.

Reporting

Reporting of private patient revenue was appropriate across the sector. Most of the 82 public hospitals provided monthly information to the board and relevant committee. Figure 4C shows the lines of reporting for each of the hospital sectors.

Figure 4C

Lines of reporting, by hospital category

Source: Victorian Auditor-General's Office.

4.4.4 Governance and oversight

Monitoring at the board or committee level was adequate at 78 of the 82 public hospitals (95 per cent). Monitoring included regular reviews and updates of policy and procedure documents, revenue amounts, debt levels and debt write-offs.

An internal audit can be an effective tool for assessing compliance with established policies. However, an internal audit had not been engaged to review private patient revenue in most (55 per cent) of the public hospitals who collected this revenue.

In the eleven public hospitals that did have an internal audit review of their private patient revenue systems in the last three years, the reviews identified high- and moderate‑risk issues. In each instance, issues were appropriately dealt with by management in a timely manner.

Recommendations

That public hospitals:

1. review their risk management frameworks and policies, at least annually
2. report on 'critical' or 'extreme' risks and associated mitigation strategies to their board or audit committee, at least quarterly
3. use internal audit to review practices in relation to private patient revenue and compliance with established policies.