Back to All Case Studies
Healthcare & Multi-Specialty Hospital Network Duration: 12 Weeks Section 134(5)(e) & Section 143(3)(i) of Companies Act 2013 read with Guidance Note on IFC (ICAI)

Internal Financial Controls (IFC) Architecture & Revenue Leakage Audit — Multi-Specialty Hospital Network

NRSR & Co designed and deployed a full-scale Internal Financial Controls over Financial Reporting (ICFR) framework for a 350-bed healthcare network, plugging ₹1.65 Cr in annual billing leakages and establishing automated audit trails.

350 Beds / 2 Locations
Hospital Capacity
₹1.65 Cr Annualized
Revenue Leakage Plugged
142 Key Controls (RCM)
Control Points Mapped
Clean Board Attestation
IFC Certification

Client Background & Operational Context

The client operates a tertiary healthcare network encompassing multi-specialty inpatient care, diagnostic imaging centers, and automated pharmacy chains. With daily cash flows, insurance Third-Party Administrator (TPA) claim settlements, doctor fee splits, and high-value surgical consumables, the hospital's operational accounting was susceptible to manual reconciliation errors and unbilled consumables.

The Challenge & Risk Exposure

Key vulnerabilities identified during the diagnostic phase: 1) Significant discrepancies between surgical implants logged in Operation Theatre (OT) sheets and patient billing records, 2) Extended delays in TPA insurance claim submissions resulting in write-offs of disallowed claims, 3) Weak physical control and expiry tracking over high-value oncology and surgical pharmaceuticals, and 4) Lack of formal Risk Control Matrices (RCM) mandated for corporate boards under Section 134(5)(e) of the Companies Act, 2013.

The NRSR & Co Advisory Approach & Methodology

NRSR & Co executed an exhaustive Internal Financial Controls Review adhering to the ICAI Guidance Note on Audit of Internal Financial Controls Over Financial Reporting. We built customized Risk Control Matrices across 8 core process cycles and deployed automated reconciliations.

Phased Implementation Framework

1

Phase 1: Process Flow Mapping & Walkthroughs

Documented end-to-end standard operating procedures across Patient Registration, IP/OP Billing, TPA Pre-Authorization & Claims, Pharmacy Dispensing, Procurement, Fixed Assets, and Payroll.

2

Phase 2: Risk Control Matrix (RCM) Design & Segregation of Duties

Formulated comprehensive RCMs mapping financial statement assertions (Completeness, Existence, Accuracy, Valuation) to 142 distinct entity-level and process-level controls. Reconfigured Hospital Information System (HIS) user permission matrices to prevent conflicting roles.

3

Phase 3: Design & Operating Effectiveness Testing (TOD & TOE)

Sample-tested 600+ patient discharge files, OT registers, and pharmacy consumption batches to test control operation. Identified control design gaps and instituted mandatory barcode scanning for surgical implants prior to OT closure.

4

Phase 4: Remediation, SOP Manual & Management Reporting

Established standard SOP manuals, trained clinical and billing administrative staff, and presented the final IFC Attestation Report and Remediation Matrix to the Audit Committee and Board of Directors.

Impact, Governance & Measurable Outcomes

The engagement eradicated unbilled surgical consumables, saving ₹1.65 Crores annually. TPA claim turnaround dropped from 65 days to 24 days, drastically reducing bad debt provisions. The statutory auditors issued an unqualified opinion on IFC under Section 143(3)(i) of the Companies Act, 2013.

"In high-volume service environments like healthcare, strong internal financial controls do not slow down operations — they provide the clinical transparency and financial safeguards necessary for high-stakes expansion."

— CA Shrinidhi Rao, Managing Partner

Process Cycle Breakdown & Key Controls Instituted

Operational CycleFinancial Risk IdentifiedKey IFC Control Deployed
OT & Surgical Consumables

Implants consumed but missing in final invoice | Mandatory barcode scan during surgery directly linked to HIS patient invoice ledger. |
| TPA / Insurance Claims | Disallowances due to late submission or missing docs | Pre-discharge digital claim pack verification with automated SLA alert triggers. |
| Pharmacy & Central Store | Shrinkage & stock write-offs due to near-expiry meds | First-Expiry-First-Out (FEFO) automated lot tracking in inventory management system. |
| Doctor Retainerships & Splits | Miscalculation of complex IP/OP revenue sharing | Automated calculation engine tied to verified discharge settlements. |

Board Governance & Statutory Mandates

  • Section 134(5)(e): Certified directors' responsibility statement regarding adequate internal financial controls and orderly conduct of business.
  • Section 177: Presented quarterly internal control dashboards directly to the Audit Committee.
  • Statutory Audit Harmonization: Standardized evidentiary audit trails, slashing year-end statutory audit testing timelines by 40%.
← All Case Studies Discuss Your Advisory Engagement →