**U.S. Office of Personnel Management**

**Office of the Inspector General and Retirement and Insurance Service**

**July 2001**

**FEHBP EXPERIENCED-RATED CARRIER**

**AND**

**SERVICE ORGANIZATION AUDIT GUIDE**

**TOPICS**

***Financial Statement Audits***

***Reporting on Internal Controls and Compliance with Laws and
Regulations***

***Attestation Reports***

***Agreed-Upon Procedures***

***Reporting on Internal Controls of Third Party Servicing
Organizations***

**CONTENTS**

Page

**CHAPTER I \~ REPORTING REQUIREMENTS AND OTHER CONSIDERATIONS**

**Purpose of the Audit Guide** I-1

Objectives I-1

**Use of the Guide** I-1

**Authorization** I-2

Accounting Requirements I-2

**ERC Reporting Requirements** I-3

**Corrective Action Plan** I-6

Carrier Reporting Responsibilities Defined I-6

Practitioner Reporting Responsibilities I-6

Deficiencies in Carrier's Internal Controls I-6

**Carrier Responsibilities and Assertions** I-7

**Practitioner Qualifications and Responsibilities** I-8

**Future Revisions** I-11

**CHAPTER II \~ SSAE NO. 10 CARRIER REPORTING**

**Carrier Assertions for Compliance Attestation in Accordance with SSAE
No. 10** II-1

**CHAPTER III \~ AGREED-UPON PROCEDURES FOR SPECIFIED ELEMENTS, ACCOUNTS
OR ITEMS OF THE FINANCIAL STATEMENT FOR PROGRAM REPORTING (SAS 75)**

**Program Procedures** III-1

Health Benefits Charges III-1

*Accuracy of Claim Payments* III-1

*Timeliness of Claim Payments* III-2

Letter of Credit Authorizations III-3

Cash and Equivalents .III-3

Administrative Expenses III-3

Revenue III-4

Refunds III-5

Provider Charges III-5

**Roll Forward Procedures** III-6

**Status of Prior Year Findings** III-7

## 

**CHAPTER IV \~ SAS NO. 70 REVIEWS FOR SERVICE ORGANIZATIONS**

**Service Organization Requirements** IV-1

**Practitioner (Service Auditor) Engagement Requirements** IV-1

**CHAPTER V \~ CONTRIBUTORS TO THIS GUIDE** V-1

**APPENDICES**

#### Appendix A

Carrier Annual Accounting Statement Format A-1

Illustrative Financial Statements and Disclosures A-2

#### Appendix B

Sample Practitioner Reports B-1

*Illustrative Report on Carrier Assertions About An Entity's*

*Compliance with FEHBP Contract Requirements* B-1

*Illustrative Report on Agreed-Upon Procedures* B-2

*Illustrative Schedule of Findings and Questioned Amounts* B-3

*Illustrative Comments on Resolution of Prior Year\'s Examination
Findings* B-3

*Illustrative SAS No. 70 Report Regarding Service Organization
Management\'s Assertions* B-4

*Illustrative Corrective Action Plan for Material Weaknesses or
Findings* B-5

#### Appendix C

Definitions and Acronyms C-1

Authoritative References C-1

#### Appendix D

Laws and Regulations and Contract Terms to be Tested for Compliance D-1

#### Appendix E

Freedom of Information Requests E-1

**CHAPTER I**

**REPORTING REQUIREMENTS AND OTHER**

**CONSIDERATIONS**

**PURPOSE OF THE AUDIT GUIDE**

**Objectives**

Overall objectives of OPM in implementing these financial audit,
internal control and compliance review and agreed-upon procedure (AUP)
requirements are to gain the following assurances:

A. Carrier's calendar or fiscal year Federal Health Benefits Program
(FEHBP) Annual Accounting Statements (AAS) are fairly stated in all
material respects in accordance with the Office of Personnel
Management's (OPM) prescribed accounting practices.

B. Carrier management's assertions, supported by an independent public
accountant's (IPA) report, on the effectiveness of the entity's internal
controls over compliance with the FEHBP contract is fairly stated.

C. Carrier reported fiscal year activity is reasonably complete and
accurate, and processed in accordance with the FEHBP contract
requirements.

D. Service organization(s) has suitably designed and effectively
operating internal control systems over FEHBP processed activity.

## USE OF THIS GUIDE

This guide must be used by experienced-rated carriers (ERCs)
participating in the FEHBP.

This guide is divided into five sections.

***Chapter I*** provides general information about engagement
requirements and addresses the purpose of the Guide, the scope of
required engagements, management and practitioner responsibilities,
reporting, effective dates, examination periods and due dates.

***Chapter II*** describes assertions to be made by management regarding
the effectiveness of internal controls over, and management's compliance
with, the FEHBP contract, and provides suggested examination procedures
for selected assertions.

***Chapter III*** provides FEHBP program-related procedures and FEHBP
financial information roll forward procedures and related reporting
requirements and other matters.

***Chapter IV*** provides guidance over reviews of internal controls at
service organizations.

## AUTHORIZATION

The FEHBP contracts, as amended, require each participating ERC to
prepare an AAS and supplemen­tal information at specified times, and
subject this information to audit and other audit related procedures.

These contracts also require that the audits and audit related
procedures be performed by a qualified, independent certified public
accountant.

**Accounting Requirements** - See Appendix A.

## ERC REPORTING REQUIREMENTS

The Guide requires, depending upon the reporting option chosen by the
carrier, that:

**A. Carriers with claims greater than \$40 million select from the
following options:**

+---------------+-------+-------+---------+-------+-------+---------+
|               | *     |       |         | **Dec |       |         |
|               | *Sept |       |         | ember |       |         |
|               | ember |       |         | 31**  |       |         |
|               | 30**  |       |         |       |       |         |
+===============+=======+=======+=========+=======+=======+=========+
|               | **O   | **O   |         | **O   | **O   |         |
|               | ption | ption |         | ption | ption |         |
|               | 1**   | 2**   |         | 3**   | 4**   |         |
+---------------+-------+-------+---------+-------+-------+---------+
|               | **G   | **GA  | # DU    | **G   | **GA  | **DUE   |
|               | AAS** | GAS** | E DATES | AAS** | GAS** | DATES** |
+---------------+-------+-------+---------+-------+-------+---------+
| Reports       |       |       |         |       |       |         |
| Prepared by   |       |       |         |       |       |         |
| IPA:          |       |       |         |       |       |         |
+---------------+-------+-------+---------+-------+-------+---------+
| **1.          | X     | X     | D       | X     | X     | March   |
| Financial     |       |       | ecember |       |       | 30      |
| audit of      |       |       | 14      |       |       |         |
| AAS**         |       |       |         |       |       |         |
+---------------+-------+-------+---------+-------+-------+---------+
| **2. SSAE 3** | X     | \-    | D       | X     | \-    | March   |
|               |       |       | ecember |       |       | 30      |
|               |       |       | 14      |       |       |         |
+---------------+-------+-------+---------+-------+-------+---------+
| **3.          |       |       |         |       |       |         |
| Agreed-upon   |       |       |         |       |       |         |
| procedures**: |       |       |         |       |       |         |
+---------------+-------+-------+---------+-------+-------+---------+
| **a.          | X     | X     | D       | X     | X     | D       |
| Program**     |       |       | ecember |       |       | ecember |
|               |       |       | 14      |       |       | 14      |
+---------------+-------+-------+---------+-------+-------+---------+
| **b. Roll     | \-    | \-    |         | X     | X     | D       |
| forward**     |       |       |         |       |       | ecember |
|               |       |       |         |       |       | 14      |
+---------------+-------+-------+---------+-------+-------+---------+
| **4.          |       |       |         |       |       |         |
| Unaudited AAS |       |       |         |       |       |         |
| for:**        |       |       |         |       |       |         |
+---------------+-------+-------+---------+-------+-------+---------+
| **a. Fiscal   | \-    | \-    | \-      | X     | X     | D       |
| year ending   |       |       |         |       |       | ecember |
| 9/30**        |       |       |         |       |       | 14      |
+---------------+-------+-------+---------+-------+-------+---------+
| **b. Fiscal   | X     | X     | March   | \-    | \-    | \-      |
| year ending   |       |       | 30      |       |       |         |
| 12/31**       |       |       |         |       |       |         |
+---------------+-------+-------+---------+-------+-------+---------+
| **5. Third    | For   |       |         | For   |       |         |
| party         | gui   |       |         | gui   |       |         |
| service**     | dance |       |         | dance |       |         |
|               |       |       |         |       |       |         |
| **o           | SAS   |       |         | SAS   |       |         |
| rganization** | No.70 |       |         | No.70 |       |         |
|               | is    |       |         | is    |       |         |
| **control     | refer |       |         | refer |       |         |
| test**        | enced |       |         | enced |       |         |
+---------------+-------+-------+---------+-------+-------+---------+
| Reports       |       |       |         |       |       |         |
| Prepared by   |       |       |         |       |       |         |
| Carrier:      |       |       |         |       |       |         |
+---------------+-------+-------+---------+-------+-------+---------+
| **6.          | X     | X     | March   | X     | X     | June 29 |
| Corrective    |       |       | 30      |       |       |         |
| action plan** |       |       |         |       |       |         |
+---------------+-------+-------+---------+-------+-------+---------+

B. Carriers with claims less than \$40 million must only do lines No. 1
above for FEHBP activity and No. 4 unless otherwise notified by OPM.

Generally, in addition to performing the engagement at either September
30 or December 31, the engagements may be performed in conformity with
either Generally Accepted Auditing Standards (GAAS), including
Attestation Standards where applicable, or Generally Accepted Government
Auditing Standards (GAGAS).

## Option 1

This engagement would be performed on the September 30 AAS in accordance
with GAAS. The AAS and all audit reports must be received by OPM no
later than **December 14.** Additionally, this engagement requires:

A. Statements on Standards for Attestation Engagements (SSAE) No. 10, AT
Sections 101 and 601 (Attest Engagements and Compliance Attestation
Engagements) related to specified responsible party assertions about the
carrier's compliance with the FEHBP contract for the period ending
September 30.

B. The application of specified agreed-upon procedures as of September
30.

C. The procedures necessary to assess service organization controls
related to FEHBP activity, if applicable. The IPA may consider the use
of a service organization auditor's report.

D. Unaudited AAS as of December 31.

## Option 2

This engagement would be performed at September 30 in accordance with
GAGAS. The AAS and all audit reports must be received by OPM no later
than **December 14.** Additionally, this engage­ment requires:

A. The application of specified agreed-upon procedures as of September
30.

B. The procedures necessary to assess service organization controls
related to the FEHBP if applicable. The IPA may consider the use of a
service organization auditor's report.

C. A report on compliance with laws, regulations and internal controls.

D. Unaudited AAS as of December 31.

## Option 3

This engagement would be performed at December 31 in accordance with
GAAS. The AAS and all audit reports must be received by OPM no later
than **March 30**. Additionally, this engagement requires:

A. Statements on Standards for Attestation Engagements (SSAE) No. 10, AT
Sections 101 and 601 (Attest Engagements and Compliance Attestation
Engagements) related to specified responsible party assertions about the
carrier's compliance with the FEHBP contract for the period ending
December 31.

B.  The application of two sets of specified agreed-upon procedures;
    one, as of

September 30, and the second, as of December 31.

C. The procedures necessary to assess service organization controls
related to health benefits program activity, if applicable. The IPA may
consider the use of a service organization auditor's report.

D. Unaudited AAS as of September 30.

## Option 4

This engagement would be performed at December 31 in accordance with
GAGAS. The AAS and all reports must be received by OPM no later than
**March 30**. Additionally, this engagement requires:

A.  The application of two sets of specified agreed-upon procedures;
    one, as of

September 30, and the second, as of December 31.

B. The procedures necessary to assess service organization controls
related to FEHBP activity, if applic­able. The IPA may consider the use
of a service organization auditor's report.

C. A report on compliance with laws, regulations and internal controls.

D. Unaudited AAS as of September 30.

Where applicable, we encourage the performance of any of the work
described in the options above to be performed throughout the year or at
interim periods. In addition, the carrier should consider having their
internal auditors to perform some of the AUP work. The role of the
internal auditors should be coordinated with the IPA responsible for the
overall Guide testwork and should be in accordance with SAS No. 65, The
Auditor's Consideration of the Internal Audit Function in an Audit of
Financial Statements, and with this Guide.

## CORRECTIVE ACTION PLAN

**Carrier Reporting Responsibilities Defined**

*Responsible Party Assertions* (if GAGAS is not applied). The carrier is
required to make written assertions about the carrier's compliance with
specified FEHBP contract requirements and the effective­ness of the
carrier\'s internal control over compliance with those requirements.

*Corrective Action Plan.* To assist OPM to resolve deficiencies in
financial statements, internal con­trols and contract compliance, a
carrier or service organization must develop and submit a corrective
action plan directly to OPM within 90 days of report issuance. The
corrective action plan, an essential part of the report requirement for
the FEHBP, is prepared by the carrier or service organization
management, and is pre­sented on the entity\'s letterhead and includes
the name, title, and telephone number of the responsible carrier or
service organization official. In the plan, management:

A. Describes the corrective action taken or planned in response to
findings identified in the practi­tioner\'s report.

B. Comments on the status of corrective action taken on the findings
included in the practitioner's two prior reports.

See Appendix B, Example 6, for a suggested plan format.

## Practitioner Reporting Responsibilities For Other Than Financial Statement Audits

*Attestation Reports.* SSAE No. 10[^1], AT Section 601 provides overall
guidance on reports. See Appendix B for pro forma reports.

*Agreed-Upon Procedures Reports.* SAS No. 75 provides overall guidance
on reports. See Appendix B for pro forma reports.

## Deficiencies in Carrier's Internal Controls

*For carriers:* For carriers electing reporting Options 1 and 3,
paragraphs 44 through 47 of SSAE No. 10, AT Section 601 describe the
practitioner's responsibility to communicate internal control structure
deficien­cies identi­fied during the attestation engagement. In addition,
paragraphs 53 and 36 of SSAE No. 10, AT Section 601 provide the
practitioner with guidance regarding reportable conditions and material
weaknesses. For carriers electing reporting Options 2 or 4 (GAGAS
options), refer to the GAO's Government Auditing Standards, as amended
July 1999 (Yellow Book).

*For service organizations:* Service organization management is
encouraged to engage a practitioner to perform a SAS No. 70[^2] (Service
Organizations) review that reports on the internal control policies and
procedures placed in operation and tests of operating effectiveness, or
the carrier's IPA may perform procedures to determine the effectiveness
of the service organization's controls. Practitioners should consider
the testing and reporting requirements contained in the Codification of
Statements on Auditing Standards, AU sec. 324, Reporting on an Entity's
Internal Control Structure over Financial Reporting.

*Follow-up on Audit Resolution Matters:* Paragraph 4.10 of Government
Auditing Standards require practitioners to:

A. Follow up on known material findings and recommendations from
previous audits to deter­mine whether timely and appropriate corrective
action has been taken.

B. Report the status of uncorrected material findings and
recommendations from prior audits.

Practitioners must report on the status of material findings and related
recommendations contained in prior reports by the practitioner or by
other practitioners that are related to the carrier\'s or service
organization\'s participation in the FEHBP.

Practitioners do not have to report on the specific status of findings
or recommendations from OPM program reviews or other engagements, which
were not OPM required examinations or audits (opinion-level
engagements). An illustrative report is shown in Appendix B, Example 1,
of this guide.

We anticipate requirements of this guide will serve as the basis for
establishing certain perform­ance measures, which will be used to
evaluate carriers and service organizations.

## CARRIER RESPONSIBILITIES AND ASSERTIONS

Among other carrier responsibilities discussed in this guide, the
carrier is responsible for:

A.  Preparing the Annual Accounting Statements as of and for the period
    ending

September 30 and December 31.

B. Complying with FEHBP contract requirements.

C. Establishing and maintaining effective internal controls.

D. Evaluating and monitoring the effectiveness of internal controls.

E. Providing the audit practitioner with written representations (See
Chapter II), in a separate report, about all matters in paragraph 67 of
SSAE No. 10, AT Section 601 (not required if audit is performed in
accordance with GAGAS).

F. Maintaining accounting records for 5 years after contract year-end.

The carrier must comply with the above requirements to avoid being in
default of its FEHBP contract.

## PRACTITIONER QUALIFICATIONS AND RESPONSIBILITIES

Following is a discussion of the standards audit practitioners must
follow and guidance on apply­ing those standards in the engagements
required by this guide.

*Qualifications and General Standards.* The FEHBP contract requires a
combination of annual financial audits, reports on internal controls and
compliance with laws and regulations, attestation reports, reports on
agreed-upon procedures and reviews of service organization activities to
be conducted by a qualified, independent public accountant in accordance
with GAGAS or GAAS. Therefore the engagements must be performed by a
licensed certified public accountant (\"practitioner\") who meets the
general standards of qualification, independence, due professional care
and quality control. For GAGAS audits, refer to Chapter 3 of the Yellow
Book for continu­ing professional education requirements. In part, those
standards require practitioners and audit firms to comply with the
appli­cable provisions of the public accountancy laws and rules of the
juris­dictions in which they are licensed and where the engagement is
being conducted. If the carrier or service organization is located in a
state outside the home state of the practitioner, and the practitioner
performs substantial field work in the carrier's or service
organization\'s state, the practitioner must document his or her
compliance with the licensing require­ments of the public accountancy
laws of that state. This guide does not impose addi­tional licensing
requirements beyond those estab­lished by the individual State Boards of
Accountancy.

Internal auditors of a carrier or service organization are not
independent of the entity while auditing within it and, therefore, their
work and reports cannot directly satisfy the reporting requirements of
this guide. However, where audit standards allow, internal auditors and
their work should be considered by the practitioner. For example, while
performing the examination of internal controls discussed in Chapter II
of this guide, a practitioner should consider the guidance in SAS No. 65
for use of internal auditors.

*Field work and Reporting Standards.* The practitioner must follow the
fieldwork and reporting standards for financially related audits in
accordance with those standards contained in GAAS or Chapters 4 and 5,
respectively, of GAGAS. If the audit is performed in accordance with
GAAS, the practitioner must perform a review of and report on the
carrier's internal controls and com­pliance with laws and regulations in
accordance with SSAE No. 10.

*Engagement Scope.* The nature of the carrier or service organization
management\'s written assertions and the scope of the practitioner\'s
engagement may vary depending on whether the carrier contracts with
service organizations. All applicable assertions required of management
by this guide must be addressed by the practitioner's report.

*Engagement Letter*. The practitioner must prepare a letter of
engagement to communicate to the carrier or service organization the
nature of the engagement. The letter must include, at a minimum, the
following:

A. A statement that the engagement is to be performed in accordance with
GAGAS, GAAS and AICPA Attestation Standards as applicable.

B. A statement that both parties understand that the U.S. Office of
Personnel Management intends to use the practitioner's report to help
carry out its responsibilities for oversight of the FEHBP.

C. A statement that the practitioner is required to provide OPM's
contracting officer and Inspector General, as well as the U.S. General
Accounting Office (GAO), or their representatives, access to working
papers or related documents to review the engagement. Access to working
papers includes making necessary photocopies. Practitioners can refer to
Interpretation No. 1 of SAS No. 41, titled \"Providing Access to or
Photocopies of Working Papers to a Regulator,\" or attesta­tion standards
AT 9100 paragraphs 56 to 59, for guidance. Information regarding
con­fidential commercial information that may be contained in working
papers and Freedom of Information Act (FOIA) disclosure is provided in
the \"Working Papers\" subsection on page I-10 of this guide.

*Obtaining Carrier Representations.* Carrier representations are
required for essentially all of the engagements in this Guide.
Specifically, paragraphs 9 and 10 of SSAE No. 10, AT Section 601 states,
in part, a practitioner may perform an examination engagement if the
carrier a) accepts responsibility for the entity's compliance with
specified requirements and the effectiveness of the entity's internal
control over compliance and b) evaluates the entity's compliance with
specified requirements or the effectiveness of the entity's internal
control over compliance. Also, sufficient evidential matter must exist
or could be developed to support the carrier's evaluation. The carrier's
written assertions are the basis for the practitioner\'s testing and,
therefore, are an integral part of the engagement. In addition to the
spe­cific assertions identified in the Guide, management must also
provide written repre­sentations about the matters in paragraph 67 of
SSAE No. 10, AT Section 601 to the practitioner. The carrier must
provide all written assertions and representations required by the Guide
to the IPA. If the carrier omits any of the required assertions or
representations, the practitioner should consider the guidance of
paragraph 68 of SSAE No. 10, AT Section 601 about limitations on the
scope of the engagement.

*Matters Requiring Immediate Action.* Practitioners must plan and
perform the audit to obtain reasonable assurance about whether financial
statements are free of material misstatements, whether caused by error,
illegal acts or fraud, in accordance with AICPA SAS No. 82.

As described in paragraph 2, Appendix B of SAS No. 82, the practitioner
is required to plan and perform his or her work with due professional
care. Due professional care imposes a responsibili­ty upon each
professional within an independent auditor\'s organization to observe
the standards on fieldwork and reporting.

As described in Paragraph 38 of SAS 82, whenever the auditor has
determined that there is evi­dence that fraud may exist, that matter must
be brought to the attention of an appropriate level of management. This
is generally appropriate even if the matter might be considered
inconsequential; such as a minor defalcation by an employee at a low
level in the entity's organization. Fraud or illegal acts involving
senior management and fraud (whether caused by senior management or
other employees) that causes a material misstatement of the AAS should
be reported to the audit committee. Further, consistent with paragraph
40 (a) and (d) of SAS 82, the auditor must dis­close possible fraud and
illegal acts and management's response to the OPM Inspector General
within 30 days from the time disclosure is made to management or the
audit committee as appro­priate. The practitioner shall submit these
reports to the Assistant Inspector General for Audits at the address
shown at the end of this section.

For supplemental guidance, consult SAS No. 82, Consideration of Fraud in
a Financial Statement Audit, and SAS No. 54, Illegal Acts by Clients.

*Due Care and Professional Skepticism.* Paragraph 3.26 of GAGAS states
due professional care should be used in conducting the audit and in
preparing related reports. Practitioners are cautioned against ignoring
basic weaknesses in internal controls, performing audit steps
mechanically (auditing form over substance), and accepting explanation
for audit exceptions without question.

*Obtaining an Understanding of Internal Control Structure.* SAS No. 78,
SSAE No. 10, and Chapter 5 of the Government Auditing Standards provide
guidance on understanding, evaluating and testing internal control
policies and procedures.

*Obtaining Sufficient Evidence and Sampling*. The examination procedures
suggested in this guide are not intended to be all inclusive. The
practitioner is responsible for determining the procedures necessary to
form an opinion regarding the financial statements and whether
management's asser­tion regarding the effectiveness of internal controls
is fairly stated. The procedures are not intended to supplant the
practitioner's judgment of the work required. Suggested procedures
described may not cover all circumstances or conditions encountered.
Practitioners should consider Evidential Matter, Codification of
Statements on Auditing Standards, AU sec. 326.

The Guide requires samples to be selected in such a way to be
representative of the population and period under audit (in the case of
service organizations, representative of the carrier clients serviced)
and have certain confidence levels and tolerable error rates.
Practitioners are encouraged to use guidance contained in the AICPA\'s
Professional Standards, Vol. 1, AU sec. 350, Audit Sampling, and the GAO
Financial Audit Manual.

*Working Papers.* SAS No. 41 and Paragraphs 4.34 through 4.38 of GAGAS
address working papers. SAS No. 41, paragraph 5 states working papers
ordinarily should include documentation showing (a) the work was
adequately planned and supervised; (b) sufficient understanding of the
internal control structure was obtained to plan the audit and determine
nature, timing and extent of audit tests; and (c) the audit evidence
obtained, the auditing procedures applied, and the testing performed
have provided sufficient competent evidential matter to afford a
reasonable basis for an opinion.

Further, Paragraph 4.35 of GAGAS states the practitioner\'s working
papers should \"contain suf­ficient information to enable an experienced
auditor having no previous connection with the audit to ascertain from
them the evidence that supports the auditor\'s significant conclusions
and judgments.\"

Carriers, service organizations or practitioners who deem any of the
working paper information to be \"confidential commercial information\"
should take appropriate steps to so designate each working paper
containing confidential commercial information.

Such designation may protect its confidentiality if, at a future point
of time, a request is made for disclosure of this information under the
Freedom of Information Act. \"Confidential commercial information\"
means records that may contain material exempt from release under
Exemption 4 of the FOIA (pertaining to trade secrets and commercial or
financial information that is privileged or confidential) because
disclosure could reasonably be expected to cause substantial competitive
harm. Further information regarding the designation of such documents
and OPM's Office of Inspector General (OIG) procedures upon receipt of a
FOIA request are contained in Appendix E.

*Engagement Quality.* The OPM OIG has implemented procedures for
evaluating work performed by non-federal practitioners. As part of this
evaluation, the practitioner shall make working papers available upon
request to the Assistant Inspector General for Audits or other
representa­tives of the OIG. To facilitate these requests, management\'s
reporting package should include an information sheet identifying the
name, address, and telephone number of the partner on the engage­ment
(see Appendix A). Working paper reviews will normally take place at the
carrier\'s office.

Whenever an evaluation of a report or working papers discloses
inadequacies, the practitioner may be asked to take corrective action.
If OPM determines the report and working papers are substan­dard or
contain significant inadequacies, referral to the AICPA and the
cognizant State Board of Accountancy will be considered. OPM may also
initiate action to debar the practitioner from further participation in
federal programs.

## FUTURE REVISIONS

It is the practitioner\'s responsibility to ensure he/she is using the
most current version of this guide. OPM periodically revises the FEBHP
reporting requirements and the OPM OIG plans to issue revisions to this
Guide to reflect these changes. Until the Guide is revised,
inconsistencies may exist between the Guide and FEBHP laws or
regulations. Practitioners should follow the FEBHP laws or regulations
in effect for the period being examined and modify their procedures to
test the FEBHP compliance requirements accordingly.

The practitioner is also responsible for monitoring relevant changes in
GAGAS and GAAS, including AICPA SASs and SSAEs, and for considering the
implications of changes on the engagement.

Technical questions about applying the Guide and suggestions for
improving future guides should be sent to:

Assistant IG for Audits

Office of the Inspector General

U.S. Office of Personnel Management

1900 E Street NW., Room 6400

Washington, D.C. 20415-1100

Fax: (202) 606-4823

Email: dlfletch@opm.gov

**CHAPTER II**

**SSAE NO. 10 CARRIER REPORTING**

**CARRIER ASSERTIONS FOR COMPLIANCE ATTESTATION IN ACCORDANCE WITH SSAE
NO. 10**

These assertions are made by the experienced-rated carrier participating
in the Federal Employees Health Benefits Program (FEHBP). They relate to
the effectiveness of the car­rier\'s internal controls over compliance
with specified laws and regulations and with the carrier\'s contract
with the Office of Personnel Management (OPM) (See Appendix D). The
independent public accountant (IPA), engaged by that carrier, will
perform the procedures necessary to express an opinion about whether the
assertions are fairly stated in all material respects.

*Preamble:* The Federal Employees Health Benefits Program is authorized
and operates under statute (Title 5, U.S. Code, Chapter 89) and
regulation (Title 5, Code of Federal Regulations, Part 890). Carriers
participate under the terms of a contract with OPM; the contracts
conform with the Federal Acquisition Regulation (FAR), 48 CFR Ch. 1, and
the Federal Employees Health Benefits Acquisition Regulations (FEHBAR),
48 CFR Ch. 16.

**Assertion 1: The carrier asserts that controls were in place during
the current federal fiscal year to ensure compliance with the
contractual requirements for accu­rate and timely claim payments and
coordination of benefits as described in the contract.**

*Examination considerations:* Using the sample test results from the
agreed upon procedures for "Accuracy of Claim Payments" and "Timeliness
of Claim Payments" from Chapter III, evaluate the errors and determine
whether the controls over the accuracy and timeliness of claims payments
are adequate.

**Assertion 2: The carrier asserts that controls were in place during
the current fiscal year to ensure compliance with the requirements for
investing FEHBP funds as specified in section 3.4 of the contract.**

**Assertion 3: The carrier asserts that controls were in place during
the current fiscal year to ensure that FEHBP funds were not commingled
with funds obtained from other sources in accordance with the
requirements in Section 3.5 of the contract.**

**Assertion 4: The carrier asserts that controls were in place during
the current federal fiscal year to ensure compliance with the
requirements at 48 CFR 1632.170 (2) and (3) for withdrawing funds from
the letter of credit account maintained by OPM for the plan.**

*Examination considerations:* Using the sample test results from the
agreed upon procedures for "Letter of Credit (LOC) authorizations" in
Chapter III, evaluate the findings reported and deter­mine whether the
controls over LOC withdrawals are adequate.

**Assertion 5: The carrier asserts that controls were in place during
the current federal fiscal year to ensure that uncashed checks issued to
pay for or reimburse the payment of benefits, services or supplies are
credited and handled in accor­dance with Section 3.6 of the contract.**

*Examination considerations:* Using the sample test results from the
agreed upon procedures for "Cash and Equivalents" in Chapter III,
evaluate the reported findings and determine whether controls over
uncashed checks are adequate.

**Assertion 6: The carrier asserts that controls were in place during
the current fiscal year to ensure that the requirements for diligent
collection of overpaid claims in section 2.3 (g) of the contract are
adhered to.**

**Assertion 7: The carrier asserts that controls were in place during
the current federal fiscal year to ensure that costs charged to the
contract were allowable, actual, necessary, and reasonable and were
properly justified and supported in accordance with section 3.2 of the
contract.**

*Examination considerations:* Using the sample test results from the
agreed upon procedures for "Administrative Expenses" in Chapter III,
evaluate the reported findings and determine whether controls over
administrative expenses are adequate.

**Assertion 8: The carrier asserts that controls were in place during
the current federal fiscal year to ensure that enrollment was reconciled
with information pro­vided by employers in the form of a quarterly health
benefits reconciliation report.**

*Examination considerations:* Using the results of the inspection
performed from the agreed upon procedures for "Revenue" in Chapter III,
evaluate the reported findings and determine whether controls over
subscriber enrollment reconciliations are adequate.

**Assertion 9: The carrier asserts that controls were in place during
the current federal fiscal year to ensure that, in accordance with FAR
31.201-5, the applicable portion of any income, rebate, allowance or
other credit relating to any allowable cost and received by or accruing
to the carrier was credited to the FEHBP either as a cost reduction or
by refund. FEHBP credits/refunds result from benefit payments that
include, but are not limited to, coordination of benefits, hospital
year-end settlements, uncashed and returned checks, utilization reviews,
litigation with subscribers or providers of services, and erroneous
benefit payments.**

*Examination considerations:* Using the sample test results from the
agreed upon procedures for "Refunds" in Chapter III, evaluate the
reported findings and determine whether controls over refunds are
adequate.

**Assertion 10: The carrier asserts that controls were in place during
the current federal fiscal year to ensure that, in accordance with 5
U.S.C. 8909(f)(1), no taxes, fees, or other mone­tary payment, directly
or indirectly, were imposed on FEHBP premiums by any state, the District
of Columbia, the Commonwealth of Puerto Rico, or any other political
subdivision \[48 CFR 1631.205-41\].**

**Assertion 11: The carrier asserts that controls were in place during
the current fiscal year to ensure that, in accordance with FEHBAR
1631.205-73, no interest costs incurred in the administration of the
contract were charged to the contract.**

**Assertion 12: The carrier asserts that controls were in place during
the current fiscal year to ensure that, in accordance with FEHBAR
1631.205-73, no selling costs related to sales promotion or paid to
outside entities for enrolling federal subscribers in the plan were
charged to the contract.**

**Assertion 13: The carrier asserts that controls were in place to
ensure that known mater­ial findings and recommendations from prior
audits were incorporated into a corrective action plan and subsequently
forwarded to the Office of Personnel Management.**

**CHAPTER III**

**AGREED-UPON PROCEDURES FOR SPECIFIED**

**ELEMENTS, ACCOUNTS, OR ITEMS OF THE FINANCIAL STATEMENT FOR PROGRAM
REPORTING (SAS 75)**

**PROGRAM PROCEDURES**

This section of Chapter III contains specific procedures for seven
requisite elements to be followed during the audit. Should the carrier's
system of accounts and records make the use of these specific procedures
inappropriate, the carrier may request OPM to consider alternative
procedures designed to produce similar results. For all samples selected
in the procedures below, the samples **[must be representative of the
population]{.underline}**. The seven requisite elements include the
following:

Health Benefits Charges

Letter of Credit (LOC) Authorizations

Cash and Equivalents

Administrative Expenses

Revenue

Refunds

Provider Charges

## Health Benefits Charges

*Accuracy of Claim Payments.* Stratify the claims-paid universe into
five payee subgroups: (1) physician, (2) hospital, (3)
pharmacy/prescriptions, (4) subscriber under age 65, and (5) subscriber
age 65 or over. Select a judgmental sample of each claim population. The
compliance test sample size for Groups 1, 2, 3 and 5 is 157; for Group 4
the test sample size is 93.

Sample sizes may be reduced under the following circumstances:

o Items that meet multiple subgroup criteria can be used as a sample
item for several categories; e.g. if a claim was selected as a physician
claim, but also was for a subscriber under age 65, then this item could
be counted as one sample item for both subgroups. Or

o If a carrier can assert that all claims are processed through the same
processing system at the same location by the same employees and are
subject to the same control procedures then stratify the claims-paid
universe into two payee subgroups, (1) subscriber age 65 and over and
(2) all other claims. The sample size for each subgroup would consist of
157 claims.

For each claim selected, perform the following:

A. Compare the claimant's name and other identifying information to the
carrier's subscriber eligibility files and determine eligibility.

B. Inspect documentation evidencing accuracy of claim amount.

C. Inspect documentation evidencing allowability of claim and compare
with the terms of the contract.

D. Compare evidence of claim amount with claim amount recorded in the
general ledger or claim amount to check register and then to the general
ledger.

E. Inspect documentation supporting proper application of coinsurance.

F. Inspect documentation supporting proper application of coordination
of benefits (COB).

For claim population of subscriber age 65 or over, also perform the
following:

G. Obtain the subscriber history file (for up to 6 months) of subsequent
information.

H. Inspect documentation that identifies other insurance coverages
(Medicare B, etc.) impacting COB.

I. Recalculate COB amounts due OPM for retroactive application of
coverage.

J. Determine whether the amount of the claim and the amount charged to
the FEHBP agrees with the amount on the remittance advice to provider,
or amount of the check.

K. Select judgmental sample of COB refunds and determine that they were
properly applied to the contract.

> ***Evaluation:*** Compile the number of errors including monetary
> amounts found for each subgroup sample and report the claim amounts
> and error rate as a finding.

*Timeliness of Claim Payments.* Using the sample derived above,
calculate the average number of working days from the date a claim was
received to the date it is adjudicated (paid, denied, or a request for
further information is sent out), for the given time period, expressed
as a cumulative percentage.

> ***Evaluation:*** If the cumulative percentage of average days for all
> 5 subgroups exceed the standards expressed in Section 1.9(a)(2)(I), of
> the standard contract, report the results as a finding.

## Letter of Credit Authorizations

Select a sample of 25 withdrawals from the carrier's FEHBP LOC account
and using the sample:

A. Examine the withdrawals and confirm that the amounts withdrawn are
supported by claims invoices, administrative expense vouchers or other
documentation, and compare the total dollar value of the supporting
documentation with the amounts withdrawn.

B. Inspect withdrawals. Compare the date the checks issued for FEHBP
disbursements were actually presented to the carrier's bank with the
date of the withdrawals.

> ***Evaluation:*** Compile the number of times that the dollar value of
> the LOC withdrawal exceeds the dollar value of the supporting
> documentation. In each case identified, report the amount of the
> excess. In addition, compile the number of times that LOC withdrawals
> occur before checks issued for FEHBP Program disbursements are
> presented to the carrier's bank.

## Cash and Equivalents

A. Inspect a sample of uncashed FEHBP checks. Identify and tally all
checks outstanding for two years. Compare the amounts represented by
these checks with the corresponding amounts credited to the FEHBP, and
identify those checks that were credited later than the 25th month after
issuance or not credited at all.

B. Inspect a sample of uncashed checks where the FEHBP is a related
party. Identify and tally all checks outstanding for two years. Compare
the date that amounts representing the FEHBP's allocable share of these
checks were credited to the FEHBP with the date of the uncashed checks.
Identify those amounts representing FEHBP's allocable share of the
checks credited later than the 25th month after issuance or not credited
at all.

> ***Evaluation:*** Compile the number of instances that the FEHBP or
> FEHBP-related uncashed checks outstanding for two years have not been
> credited to the FEHBP later than the 25th month after issuance and
> report the results as a finding.

## Administrative Expenses

A. Stratify the administrative expenses into five subgroups: (1)
salaries, (2) fringe benefits, (3) pension costs, (4) post retirement
benefits, and (5) all other. Select a judgmental sample of each expense
population. The compliance test sample size is 42, sample unit is
general ledger transactions, for each subgroup.

> For each sample item:
>
> 1\. Inspect documentation evidencing that each transaction was
> supported by invoices or other documentation.
>
> 2\. Compare charges to the criteria prescribed for allowability of
> charges as defined in the contract cost principles procedures found in
> 48 CFR, Part 31 and 1631.
>
> 3\. Inspect documentation evidencing the charges were allocable to the
> contract, as defined in 48 CFR 31-201-4.
>
> 4\. Compare charges to the definition of reasonable charges as
> described in 48 CFR 31.201-3.
>
> ***Evaluation:*** Report as a finding all instances where
> administrative charges made to the FEHBP were not in accordance with
> the contractual terms or the charges were not supported by appropriate
> documentation.

B. Inspect all manual adjustments to administrative expenses made after
period-end closing and compare the adjustments with the corresponding
supporting documentation.

C. Inspect all manual adjustments to administrative expenses made after
period-end closing and compare the adjusted administrative costs with
the charges allowable by 48 CFR, Part 31 and 1631.

> ***Evaluation:*** Report as a finding all instances where supporting
> documentation did not exist for manual adjustments and instances where
> adjusted administrative costs were not allowable charges under the
> terms 48 CFR, Part 31 and 1631.

D. Review any nonrecurring items such as gain or loss on sale of assets
to insure that the FEHBP was allocated according to 48 CFR 31.205-16.

E. Review rental charges for five transactions (involving five different
properties) according to 48 CFR 31.205-36. Note any items with rental
costs; treatment under a sale and leaseback agreement; and charges for
rent between any divisions, subsidiaries, or organization under common
control.

***Evaluation:*** Report as a finding all instances where amount charged
exceeds allowable

amounts by more than 3 percent.

## Revenue

The carrier is required to maintain records of subscriber enrollment
reconciliations with federal payroll offices and to make the information
available for inspection by OPM's Inspector General and by the U.S.
General Accounting Office.

The federal payroll offices initiate the enrollment reconciliation cycle
by producing and sending to the carriers the quarterly reports of
enrollment. These reports are sent on 4/1, 7/1, 10/1 and 1/1 of a given
year. Within 60 days after receiving the enrollment reports, the
carriers must reconcile these reports to their enrollment information
and report to the federal payroll offices any discrepancies. In return,
the payroll offices must respond within 31 days to the discrepancies
reported by the carriers. The reconciliation is complete when all
enrollees have been confirmed.

Inspect the records of subscriber enrollment reconciliations with
federal payroll offices and affirm that: (1) all reconciliations were
completed quarterly, and (2) all actions were taken to reconcile
identified differences within 91 days of the end of the quarter.

> ***Evaluation:*** Report all instances where enrollment
> reconciliations are not completed quarterly. Also, report all
> instances where action to reconcile differences have not occurred
> within 91 days of the end of the quarter. Identify instances where
> federal payroll offices fail to respond to carrier efforts to
> reconcile, including the identification of the payroll offices.

## Refunds

A. Inspect the carrier's accounting policies and procedures used to
account for solicited and unsolicited refunds and determine whether the
policies and procedures are in accordance with the contract.

B. Compare the outstanding refunds report to the total refunds reported
in the general ledger.

C. Select a sample of 25 refund transactions (resulting from direct and
indirect charges) and perform the following:

> 1\. Compare refunds allocable to the FEHBP with requirement that
> refunds be credited to it within 30 days of receipt.
>
> 2\. For refunds that were indirectly charged to the FEHBP, but where
> the proportionate share of the charge or associated refund cannot be
> identified, compare the FEHBP refund with an amount derived from the
> application of a percentage (FEHBP's share of the carrier's business
> proportionate to the carrier's total business) to the total refund
> amount.
>
> ***Evaluation:*** Report as a finding all instances where: the carrier
> lacks policies and procedures to account for refunds, the outstanding
> refunds report does not agree with the general ledger; and refunds
> directly or indirectly associated with the FEHBP are not credited to
> the program within 30 days of receipt.

## Provider Charges

Obtain agreements detailing arrangements the carrier has established
with its providers for discounts and settlements.

A. Inspect payment/pricing methodology and determine if the methodology
allows for retroactive settlements to occur.

B. Inspect a sample of 25 carrier settlements and document and determine
whether they are in compliance with provider agreements. Compare the
settlement received by the FEHBP with the terms of the agreements.

C. Tally the number of transactions where amounts resulting from
provider discounts/settlements were returned to the FEHBP after 30 days
of receipt by the carrier.

> ***Evaluation:*** Compile the number of instances where the carrier:
> (1) cannot identify discounts and settlements. (2) does not comply
> with provider agreements, (3) does not credit the FEHBP in accordance
> with the terms of the agreements, and (4) does not return funds
> benefited from the discounts/settlement arrangements within 30 days of
> receipt by the carrier. Report the results as a finding.

## ROLL FORWARD PROCEDURES

Roll forward procedures are to be completed when a carrier chooses
either option 3 or 4. These procedures are performed on the September 30
unaudited AAS supporting documentation.

Obtain reconciliations and supporting detailed schedules for all amounts
reported in the financial statements.

**Review the carrier's financial records for the following:**

A. Review the carrier's general ledger record of cash (LOC) receipts to
verify that the carrier received OPM premium payments and that they are
recording the receipts properly. Reconcile any differences.

B. Payments from the carrier to providers. Review the carrier's general
ledger records of claim payments to verify that the carrier reimbursed
providers and subscribers for the amounts received from OPM. Reconcile
any differences.

C. Charges for administrative expenses. Determine that the
administrative expenses reported in the FEHBP financial statements
reconcile to the carrier's general ledger.

For all schedules (i.e., cash reconciliations or property, plant, and
equipment listings) with amounts representing 10 percent or more of the
total assets for the balance sheet or 10 percent or more of the total
claims on the statement, verify that they agree with the general ledger
balances or can be reconciled to the general ledger. The auditor should
agree the detailed information contained in the schedules and
reconciliations to supporting documentation. Tests should also analyze
the next month's transactions for activity relating to the prior period
as is done with standard cut-off testing.

## STATUS OF PRIOR YEAR FINDINGS

If the carrier was subject to the Guide in the prior year, update the
status of prior year findings. Obtain the carrier's corrective action
plan from the prior year. Obtain an update on the status of each finding
from the prior year. Verify that the actions indicated were completed by
the plan by viewing evidence from the plan. See Appendix B, number 6 for
an illustrative corrective action plan.

**CHAPTER IV**

**SAS No. 70 REVIEWS FOR SERVICE ORGANIZATIONS**

This chapter sets forth the suggested federal fiscal year reporting for
carriers who use service organization entities to process FEHBP-related
transactions. It also provides guidance on the general approach the
practitioner should consider in designing and carrying out procedures
necessary to report on the controls placed in operation and tests of
operating effectiveness.

## SERVICE ORGANIZATION REQUIREMENTS

The service organization is encouraged to provide a written
representation, which includes all elements of AICPA Professional
Standards, Vol. 1, AU sec. 324, paragraph 57. Service organizations have
responsibility for designing and implementing sufficient internal
controls to ensure FEHBP claims are accurately processed in accordance
with the terms of the service contract.

If a service organization does not perform for its carrier client all of
the functions addressed by a single assertion, that assertion may be
modified, but must clearly distinguish responsibilities of the carrier
and the service organization, so that their respective written
assertions address only the functions each performs.

## PRACTITIONER (SERVICE AUDITOR) ENGAGEMENT REQUIREMENTS

The service auditor is responsible for performing the procedures
necessary to provide reasonable assurance that during the current
federal fiscal year service organization management has:

A. Designed controls to ensure FEHBP claims are accurately processed in
accordance with the terms of the service contract; and

B. Controls are operating with sufficient effectiveness to provide
reasonable assurance FEHBP claims are accurately processed in accordance
with the terms of the service contract.

Responsibilities of the service auditors are contained in AICPA
Professional Standards, Vol. 1, AU sec. 324, paragraphs 22-24. In
addition service auditors should consult paragraphs 41-56 for
information on reports on controls placed in operation and tests of
operating effectiveness.

**CHAPTER V**

**CONTRIBUTORS TO THIS GUIDE**

The Office of Inspector General wishes to express our appreciation for
the contributions of time, effort and expertise so generously given by
the members of the following government and private entities.

OPM Retirement and Insurance Service

KPMG Peat Marwick, LLP

Baird, Kurtz and Dobson, LLP

Government Employees Hospital Association (GEHA)

CareFirst BlueCross BlueShield

BlueCross BlueShield Association

American Postal Workers Union, Health Plan Department

OPM and the Office of the Inspector General also gratefully acknowledge
the assistance provided by all other FEHBP carriers and the public
accounting community.

**APPENDIX A**

**CARRIER ANNUAL ACCOUNTING STATEMENT FORMAT**

Carrier financial statements should be presented in conformity with the
following OPM prescribed statements, which are representative of
Generally Accepted Accounting Principles (GAAP) for Health and Welfare
Plans (SOP 92-06). The following statements presentation and are for
information purposes only. We acknowledge changes may be necessary for
each carrier's individual situation and it is the carrier's
responsibility to prepare full disclosure financial statements. All
supplemental schedules must be completed as detailed.

This guide requires federal fiscal year-end and calendar year-end
carrier financial state­ments and disclosures. However, the following
illustrative financial statements and disclosures (pages A-2 through
A-13), except for the Supplemental Schedule of Monthly Cash Flows
(fiscal year schedule only), are calendar year only.

**FEDERAL EMPLOYEES HEALTH BENEFITS PROGRAM**

**ANNUAL ACCOUNTING STATEMENTS**

**FOR**

**CALENDAR YEAR 200X**

**Carrier
Name:\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
Code\_\_\_\_\_**

**TABLE OF CONTENTS**

**Executive Summary**

A. Financial statements and required supplementary schedules of the
FEHBP as of and for the years ended December 31, 200X and 200Y and
independent auditors' report.

> Required supplementary schedules include:

-   Supplemental Schedule of Monthly Cash Flows (fiscal year only)

-   Supplemental Schedule of Administrative Expenses

-   Supplemental Schedule of Status of Reserves

-   Supplemental Schedule of Health Charges Paid

-   Supplemental Schedule of Audit Findings

B. Other reports based on reporting option chosen.

C. Corrective action plan.

**BALANCE SHEET**

**DECEMBER 31, 200X AND 200Y**

**[200X]{.underline} [200Y]{.underline}**

**ASSETS**

> Cash and Cash Equivalents \$ \$

Balance in Letter of Credit (LOC) Account

Interest Income Receivable

Program Income Receivable

Prepaid Expenses

**TOTAL ASSETS** \$ \$

## LIABILITIES

Health Benefits Accrued but Unpaid \$ \$

Accrued Administrative Expenses and Retentions

Special Reserve

**TOTAL LIABILITIES WITH SPECIAL RESERVE** \$ \$

***See accompanying notes to financial statements.***

**STATEMENT OF OPERATIONS**

**FOR THE**

**YEARS ENDED DECEMBER 31, 200X AND 200Y**

**[200X]{.underline} [200Y]{.underline}**

**REVENUE:** \$ \$

Letter of Credit (LOC) Authorizations

Net Investment Income

Total Revenue

## BENEFITS AND EXPENSES

Health Benefit Charges

Administrative Expenses

State Statutory Reserve

Reinsurance Expenses

Service Charges

Other

Total Benefits and Expenses

**GAIN (LOSS) FROM OPERATIONS** \$ \$

Special Reserve Beginning of Year \$ \$

Gain (Loss) from Operations

Return of Excess Reserves

Contingency Reserve Payments

Other

Special Reserve at End of Year \$ \$

***See accompanying notes to financial statements.***

**STATEMENT OF CASH FLOWS**

**FOR THE**

**YEARS ENDED DECEMBER 31, 200X AND 200Y**

**[200X]{.underline} [200Y]{.underline}**

**CASH FLOWS FROM OPERATIONS ACTIVITIES** \$ \$

Net Gain

Adjustments to Reconcile Net Gain to Net Cash Provided

by (used in) Operating Activities:

(Increase) Decrease in Assets:

Benefits Receivable

Accrued Investment Income

xxx

xxx

Other Assets

Increase (Decrease) in Liabilities:

Accrued Benefits Payable

Special Reserve

xxx

xxx

xxx

Other Liabilities

## TOTAL ADJUSTMENTS 

Net cash provided by operating activities \$ \$

**(Continued Next Page)**

**STATEMENT OF CASH FLOW** (Continued from previous page)

## CASH FLOWS FROM INVESTMENT ACTIVITIES

Proceeds from Sale of Investments \$ \$

xxx

Net Cash Provided by Investing Activities \$ \$

## NET INCREASE IN CASH AND CASH EQUIVALENTS

Cash and Cash Equivalents at the Beginning of Year

Cash and Cash Equivalents at the End of Year \$ \$

***See accompanying notes to financial statements.***

**NOTES TO FINANCIAL STATEMENTS**

**FOR THE**

**YEARS ENDED DECEMBER 31, 200X AND 200Y**

**SUPPLEMENTAL SCHEDULE OF MONTHLY CASH FLOWS**

**FOR THE PERIOD ENDING SEPTEMBER 30, 2001 (FISCAL YEAR REPORTING
ONLY)**

SOURCES OF CASH APPLICATIONS OF CASH

**(1) (2) (3) (4) (5) (6) (7) (8)**

#  Cash and Cash

**Month LOC Interest Other Claims Admin. Other Net Inflow Equivalents**

**[Drawdowns]{.underline} [Income]{.underline} [(explain)]{.underline}
[Paid]{.underline} [Exp.]{.underline} [(explain)]{.underline}
[Outflow]{.underline} [Monthly ]{.underline}**

# Balance -- 09/30/2000

Oct. 2000

Nov. 2000

Dec. 2000

Jan. 2001

Feb. 2001

Mar. 2001

Apr. 2001

May 2001

Jun. 2001

Jul. 2001

Aug. 2001

Sep. 2001

**SUPPLEMENTAL SCHEDULE OF ADMINISTRATIVE EXPENSES**

**FOR THE**

**YEARS ENDED DECEMBER 31, 200X AND 200Y**

**[200X]{.underline} [200Y]{.underline}**

**ADMINISTRATIVE EXPENSES**

> Rent \$ \$
>
> Salaries
>
> Employee Benefits
>
> Furniture and Equipment
>
> Maintenance
>
> Equipment Rental
>
> Printing, Stationery and Supplies
>
> Travel
>
> Postage
>
> Telephone & Telegraph
>
> Private Wire System
>
> Auditing Services
>
> Legal Services
>
> Consulting & Professional
>
> Payroll Taxes
>
> Utilities
>
> Insurance
>
> LOC Bank Charges
>
> Cost Containment
>
> Other

**TOTAL** \$ \$

***See accompanying independent auditors' report.***

**SUPPLEMENTAL SCHEDULE OF STATUS OF RESERVES**

**AS OF DECEMBER 31, 200Y**

1\. **Reserves Held by Carrier**

a\. Ending Special Reserve Balance \$

b\. Ending Accrued but Unpaid Health Benefits Charges

c\. Total. *(line l.a. plus line l.b.)* \$

2\. **One Month\'s Average Expenses**

a\. One Month\'s Average Claims Paid:

Claims paid-last six months of 200Y:

July \$

August

September

October

November

December

Total \$ x 1/6 \$

b\. One Month\'s Average Administrative Expenses and Retentions

(Statement of Operations = Administrative Expenses plus all

other Expenses and Retentions x 1/12) \$

c\. Total One Month\'s Average Expenses. *(line 2.a. plus line 2.b.)* \$

3\. **Target Level of Carrier-Held Reserves.** *(line 2.c. x 3.5)* \$

4\. **Status of Reserves:**

a\. Excess Reserve *(If the amount on line 1.c. is greater than the
amount in line 3., enter the*

*difference here.)* \$

b\. Deficiency of Reserves *(If the amount on line 3. is greater than
line 1.c., enter the difference* \$

*here.)*

***See accompanying independent auditors' report.***

**High Option**

**Low Option**

**SUPPLEMENTAL SCHEDULE OF HEALTH BENEFIT CHARGES PAID**

**FOR THE YEAR ENDED DECEMBER 31, 200Y**

**PART A - Monthly Claims Paid**

+--------------+-----------+-----------+---------------+-------------+
|              |           |           | YEAR INCURRED |             |
+--------------+-----------+-----------+---------------+-------------+
| MONTH        | AMOUNT    | 200Y      | 200X          | 199X -      |
|              |           |           |               | PRIOR       |
|              | PAID      |           |               |             |
+--------------+-----------+-----------+---------------+-------------+
| January      | \$        | \$        | \$            | \$          |
|              |           |           |               |             |
| February     | \$        | \$        | \$            | \$          |
|              |           |           |               |             |
| March        |           |           |               |             |
|              |           |           |               |             |
| April        |           |           |               |             |
|              |           |           |               |             |
| May          |           |           |               |             |
|              |           |           |               |             |
| June         |           |           |               |             |
|              |           |           |               |             |
| July         |           |           |               |             |
|              |           |           |               |             |
| August       |           |           |               |             |
|              |           |           |               |             |
| September    |           |           |               |             |
|              |           |           |               |             |
| October      |           |           |               |             |
|              |           |           |               |             |
| November     |           |           |               |             |
|              |           |           |               |             |
| December     |           |           |               |             |
|              |           |           |               |             |
| Total        |           |           |               |             |
+--------------+-----------+-----------+---------------+-------------+

Prior year\'s accrual from line *Summary Statement* \$

Difference \$

## PART B - Number of Claims Paid

  ----------------- ----------------- ----------------- -----------------
                                      YEAR INCURRED     

  TOTAL             200Y              200X              199X - PRIOR

                                                        
  ----------------- ----------------- ----------------- -----------------

**(Continued Next Page)**

**SUPPLEMENTAL SCHEDULE OF HEALTH BENEFIT CHARGES PAID**

**FOR THE YEAR ENDED DECEMBER 31, 200Y (Continued from previous page)**

**PART C - Types of Claim Paid**

  ----------------- ------------------ ----------------- -----------------
  TOTAL             HOSPITALIZATION    PHYSICIANS        OTHER

                                                         
  ----------------- ------------------ ----------------- -----------------

**PART D - Reconciliation of Health Benefit Charges Paid**

Total Claims Paid from Part A *(above)* \$

Less: Reinsurance Recovery

Other Adjustments *(explain)*

**TOTAL** (Summary Statement) \$

***See accompanying independent auditors' report.***

**SUPPLEMENTAL SCHEDULE OF AUDIT FINDINGS**

**FOR THE**

**YEAR ENDED DECEMBER 31, 200Y**

**AUDIT NUMBER AND ASSOCIATED YEAR:**

XXXX \$

XXXX

**TOTAL** \$

**APPENDIX B**

**SAMPLE PRACTITIONER REPORTS - For Selected Requirements**

1\. ILLUSTRATIVE REPORT ON CARRIER ASSERTIONS ABOUT AN ENTITY'S
COMPLIANCE FEHBP CONTRACT REQUIREMENTS

Independent Accountants' Report

Office of Personnel Management

Carrier Audit Committee

Carrier X

City, State ZIP Code

We have examined \[*name of carrier*\]'s compliance with the specified
representations included in Chapter II of the FEHBP Experience-Rated
Carrier and Service Organization Audit Guide and its contract with the
Office of Personnel Management, during the year ended \[*September 30 or
December 31*\]. Management is responsible for \[*name of carrier*\]'s
compliance with those requirements. Our responsibility is to express an
opinion on \[*name of carrier*\]'s compliance based on our examination.

Our examination was conducted in accordance with attestation standards
established by the American Institute of Certified Public Accountants,
and, accordingly, included examining, on a test basis, evidence about
\[*name of carrier*\]'s compliance with those requirements and
performing other such proce­dures we considered necessary in the
circumstances. We believe that our examination provides a reasonable
basis for our opinion. Our examination does not provide a legal
determination on \[*name of carrier*\]'s compliance with specified
requirements.

\[Unqualified\]

In our opinion, \[*name of carrier*\] complied, in all material
respects, with the aforemen­tioned requirements for the year ended
\[*September 30 or December 31*\].

> \[Qualified -- requires changes to the introductory paragraph that are
> not shown here. Refer to SSAE No. 10, AT Section 601\]

Our examination disclosed the following material noncompliance *with
\[compliance requirement*\] applicable to \[*name of carrier*\] during
the year ended \[*September 30 or December 31*\]. \[*Describe
noncompliance*\].

In our opinion, except for the material noncompliance described in the
third paragraph, man­agement's assertions that the \[*name of carrier*\]
complied with the aforementioned requirements for the year ended
\[*September 30 or December 31*\] is fairly stated, in all material
respects.

> \[Adverse -- requires changes to the introductory paragraph that are
> not shown here. Refer to SSAE No. 10\]

Our examination disclosed the following material noncompliance *with
\[compliance requirement*\] applicable to \[*name of carrier*\] during
the year ended \[*September 30 or December 31*\]. \[*Describe
noncompliance*\].

In our opinion, because of the effect of the noncompliance described in
the third paragraph, the \[*name of carrier*\] has not complied with the
aforementioned requirements for the year ended \[*September 30 or
December 31*\] is not fairly stated.

This report is intended solely for the information and use of the Office
of Personnel Management and is not intended to be and should not be used
by anyone other than this specified party.

(Signature)

(Date)

2\. ILLUSTRATIVE REPORT ON AGREED-UPON PROCEDURES **(AU Section
622.34)**

Office of Personnel Management

We have performed the procedures enumerated below, which were agreed to
by the audit com­mittees and management of OPM and carrier x, solely to
assist you in evaluating the accompany­ing Annual Accounting Statement
for the period ending September 30, 200X. This agreed-upon procedure
engagement was performed in accordance with standards established by the
American Institute of Certified Public Accountants. The sufficiency of
these procedures is solely the responsibility of the specified users of
the report. Consequently, we make no representation regarding the
sufficiency of the procedures described below either for the purpose for
which this report has been requested or for any other purpose.

The procedures we performed are enumerated in the listing of engagement
procedures accom-pany­ing this report. Findings obtained from performing
these procedures are presented in the accompanying schedule of findings
and questioned amounts.

We were not engaged to, and did not, perform an examination, the
objective of which would be the expression of an opinion on the
accompanying Annual Accounting Statement of carrier X. Accordingly, we
do not express such an opinion. Had we performed additional procedures,
other matters might have come to our attention that would have been
reported to you.

This report is intended solely for the use of OPM and the audit
committee and management of carrier X, and should not be used by those
who have not agreed to the procedures and taken responsibility for the
sufficiency of the procedures for their purposes. This restriction is
not intend­ed to limit the distribution of this report, which is a matter
of public record.

3\. ILLUSTRATIVE SCHEDULE OF FINDINGS AND QUESTIONED AMOUNTS

+----------------+--------------------+--------------+----------------+
| Schedule of    |                    |              |                |
| Findings for   |                    |              |                |
| Agreed-Upon    |                    |              |                |
| Procedures     |                    |              |                |
+----------------+--------------------+--------------+----------------+
| Area           | Description of     | \$           | Status of      |
|                | Findings           | Questioned   | Finding        |
+----------------+--------------------+--------------+----------------+
| Claims         | Describe in detail | \$10,000     | 1.  Amount     |
| Enrollment     | the noted finding  |              |     Reimbursed |
| Records        |                    | Unknown      |     to FEHBP,  |
|                |                    |              |     or         |
|                |                    |              |                |
|                |                    |              | 2.  Amount Not |
|                |                    |              |     Reimbursed |
|                |                    |              |     to FEHBP,  |
|                |                    |              |     or         |
|                |                    |              |                |
|                |                    |              | 3.  Resolved   |
|                |                    |              |     -- No      |
|                |                    |              |     Money Due  |
|                |                    |              |     the FEHBP  |
|                |                    |              |                |
|                |                    |              | 4.  Unresolved |
|                |                    |              |     -- No      |
|                |                    |              |     Money Due  |
|                |                    |              |     the FEHBP  |
+----------------+--------------------+--------------+----------------+

4\. ILLUSTRATIVE COMMENTS ON RESOLUTION OF PRIOR YEAR'S EXAMINATION
FINDINGS

Finding No 1: In an examination performed by the \[name of audit
entity\] dated \[mm/dd/yy\] and titled \[name of report\], in tests of
claims paid, the carrier did not properly coordinate payment of
benefits. The FEHBP was overcharged by \$xx.

Status: As of \[mm/dd/yy\] the carrier has not reimbursed the FEHBP for
these claims or recorded proper accounting entries to record payable to
the FEHBP.

NOTE: The chart in No.3 could be modified to incorporate these two
items, and thereby minimize duplication of efforts.

5\. ILLUSTRATIVE SAS No. 70 REPORT REGARDING SERVICE ORGANIZATION
MANAGEMENT'S ASSERTIONS **(AU 324.39)**

We have examined the accompanying description of controls related to the
claims processing and payment applications of ABC service organization.
Our examination included procedures to obtain reasonable assurance about
whether: (1) the accompanying description presents fairly, in all
respects, the aspects of ABC service organization's controls that may be
relevant to a user organization's internal control as it relates to an
audit of financial statements, (2) the controls included in the
description were suitably designed to achieve the control objectives
specified in the description, if those controls were complied with
satisfactorily, and (3) such controls had been placed in operation as of
September 30, 200X. The control objectives were specified by ABC service
organization.

In our opinion, the accompanying description of the aforementioned
application presents fairly, in all respects, the relevant aspects of
ABC service organization's controls that had been placed in operation as
of September 30, 200X. Also, in our opinion, the controls, as described
are suit­ably designed to provide reasonable assurance that the specified
control objectives would be achieved if the described controls were
complied with satisfactorily.

In addition to the procedures we considered necessary to render our
opinion as expressed in the previous paragraph, we applied tests to
specific controls, listed in Schedule X, to obtain evidence about their
effectiveness in meeting the control objectives, described in Schedule
X, during the period from October 1, 200X to September 30, 200Y. The
specific controls and the nature, timing, extent, and results of the
tests are listed in Schedule X. This information has been pro-vided to
user organizations of ABC service organization and to their auditors to
be taken into consideration, along with information about the internal
control at user organizations, when making assessments of control risk
for user organizations. In our opinion the controls that were tested, as
described in Schedule X, were operating with sufficient effectiveness to
provide reasonable, but not absolute, assurance that the control
objectiveness specified in Schedule X were achieved during the period
from October 1, 200X to September 30, 200Y.

The relative effectiveness and significance of specific controls at ABC
service organization and their effect on assessments of control risk at
user organizations are dependent on their interaction with the controls
and other factors present at individual user organizations. We have
performed no procedures to evaluate the effectiveness of controls at
individual user organizations.

The description of controls at ABC service organization as of September
30, 200X, and information about tests of the operating effectiveness of
specified controls covers the period from October 1, 200X to September
30, 200Y. A projection of such information to the future is subject to
the risk that, because of change, the description may no longer portray
the system in existence. The potential effectiveness of specified
controls at the service organization is subject to inherent limitations
and, accordingly, errors or irregularities may occur and not be
detected. Furthermore, the projection of any conclusions, based on our
findings, to future periods is subject to the risk that changes may
alter the validity of such conclusions.

This report is intended solely for use by the management of the ABC
service organization, its customers, and the independent auditors of its
customers.

6\. ILLUSTRATIVE CORRECTIVE ACTION PLAN FOR MATERIAL WEAKNESSES OR
FINDINGS

Corrective Action Plan

(Prepared by carrier or service organization)

Name of carrier or service organization and plan code:

Official responsible for plan:

Phone number:

Audit Period:

Practitioner/Audit firm:

> A. Comments on findings and recommendations
>
> The carrier should provide a statement of concurrence or
> nonconcurrence with each finding and recommendation. For instances of
> nonconcurrence, the carrier should provide documentation to support
> their position.
>
> B. Actions taken or planned
>
> The carrier should develop a detail action plan to correct or resolve
> all practitioner findings. The plan should include expected correction
> date(s) and name of official responsible for corrective actions.
>
> C. Status of corrective actions for prior year findings
>
> The carrier, should document status of all prior year findings and the
> related corrective actions including changes in corrective action, and
> expected dates of completion.

**APPENDIX C**

**DEFINITIONS AND ACRONYMS**

*Carrier:* a voluntary association, corporation, partnership, or other
non-governmental organi­zation which is lawfully engaged in providing,
paying for, or reimbursing the cost of health ser­vices under group
insurance polices or contracts, medical or hospital services agreements,
mem­bership or subscription contracts, or similar group arrangements, in
consideration of prem­iums or other periodic charges payable to the
carrier, including a health benefits plan duly sponsored or underwritten
by an employee organization.

*Service organization:* any organization that provides claims processing
or claims related service(s) to a FEBHP carrier as defined above.

*AICPA* American Institute of Certified Public Accountants

*AIGA* Assistant Inspector General for Audits

BCBS Blue Cross Blue Shield

*CFR* Code of Federal Regulations

*CFO Act* Chief Financial Officers Act of 1990

*CPA* Certified Public Accountant

*ERC* Experienced‑rated Carriers

*FOIA* Freedom of Information Act

*GAAS* Generally Accepted Auditing Standards

*GAGAS* Generally Accepted Government Auditing Standards

*GAO* U.S. General Accounting Office

*GLS* General Ledger System

*IC* Internal Control

*LOC* Letter of Credit

*MOU* Memorandum of Understanding

*OFCM* Office of Financial Control and Management

*OIG* Office of the Inspector General

*OMB* Office of Management and Budget

*OPM* Office of Personnel Management

*QIT* Quality Improvement Team

*SAS* AICPA's Statement on Auditing Standards

*SSAE* AICPA's Statements on Standards for Attestation Engagements

##### AUTHORITATIVE REFERENCES

Generally Accepted Accounting Principles (GAAP)

GAO's Government Auditing Standards (Yellow Book)/Generally

Accepted Government Auditing Standards (GAGAS)

Generally Accepted Auditing Standards (GAAS)

SAS No. 41, Working Papers

Interpretation No. 2 of SAS No. 41, Providing Access to or

> Photocopies of Working Papers to a Regulator

SAS No. 54, Illegal Acts by Clients

SAS No. 65, The Auditor's Consideration of the Internal Audit

Function in an Audit of Financial Statements

SAS No. 70, Service Organizations

SAS No. 75, Engagements to Apply Agreed-Upon Procedures

to Specified Elements, Accounts, or Items of a Financial Statement

SAS No. 78, Consideration of Internal Control in a Financial

> Statement Audit: An Amendment to SAS No. 55

SAS No. 82, Consideration of Fraud in a Financial Statement Audit

SSAE No. 10 Attestation Standards: Revision and Recodification

SSAE No. 4, Agreed-Upon Procedures Engagements

**APPENDIX D**

**LAWS AND REGULATIONS, AND CONTRACT TERMS TO BE TESTED FOR COMPLIANCE**

1\. *Enrollment reconciliations.*

2\. *Claims benefit payments.*

3\. *Coordination of benefits.* OPM expects all Federal Health Benefits
Program plans to coordinate benefits. (48 CFR- 1604.70.)

4\. *Carrier investment of FEHBP funds.* The carrier is required to
invest and reinvest all funds on hand, including any attributable to the
special reserve or the reserve for incurred but unpaid claims, exceeding
the funds needed to discharge promptly the obligations incurred under
the contract. Also, the carrier is required to credit income earned from
its investment of FEHBP funds to the special reserve on behalf of the
FEHBP. If a carrier fails to invest excess FEHBP funds or to credit any
income due the contract, for whatever reason, it shall return or credit
any investment income lost to OPM or the special reserve. Investment
income is the net amount earned by the carrier after deducting
investment expenses. (48 CFR - 1615.805-70b, c and d).

5\. *FEHBP credits.* FAR 31.201-5 provides that the applicable portion
of any income, rebate, allowance, or other credit relating to any
allowable cost and received by or accruing to the contractor shall be
credited to the government either as a cost reduction or by cash refund.
FEHBP credits result from benefit payments that include, but are not
limited to:

> a\. Coordination of benefit refunds

b\. Hospital year-end settlements

c\. Uncashed and returned checks

d\. Utilization review refunds

e\. Refunds attributable to litigation with subscribers or providers of
health services

f\. Erroneous benefit payment, overpayment, and duplicate payment
recoveries. (48 CFR - 1631.201-70).

6\. *Taxes.* 5 U.S.C. 8909(f)(1) prohibits the imposition of taxes,
fees, or other monetary payment, directly or indirectly, on FEHBP
premiums by any state, the District of Columbia, or the Commonwealth of
Puerto Rico or by any political subdivision or other governmental
authority of those entities. (48 CFR - 1631.205-41).

7\. *Interest expense.* Interest charges incurred in the administration
of FEHBP contracts are not allowable in accordance with FAR 31.205.20.
However, interest charges that are associated with the carrier\'s
investment of FEHBP account funds are not considered administrative
costs and may be allowable under very limited circumstances \[See
criteria (1) through (5)\]. (48 CFR - 1631.205-73).

8\. *Selling costs.* FAR 31.205-38 is modified to eliminate from
allowable costs those costs related to sales promotion and the payment
of sales commissions fees or salaries to em­ployees or outside commercial
or selling agencies for enrolling Federal subscribers in a par­ticular
FEHBP plan. Selling costs are allowable costs to FEHBP contacts to the
extent that they are necessary for conducting annual contract
negotiations with the government and for liaison activities necessary
for ongoing contract administration. (48 CFR 1631.205-75).

9\. *Non-commingling of FEHBP funds.* Carrier or underwriter commingling
of FEHBP funds with those from other sources makes it difficult to
precisely determine FEHBP cash balances at any given time or to
precisely determine investment income attributable to FEHBP invest­ed
assets. FEHBP funds shall be maintained separately from other cash and
investments of the carrier or underwriter. (48 CFR 1632.771).

10\. Carriers must comply with the provisions negotiated and as reported
in the contract and

any addendums thereto between the carrier and the Office of Personnel
Management.

11\. *Exclusion of unallowable costs per FAR.*

**APPENDIX E**

**FREEDOM OF INFORMATION REQUESTS**

**NOTIFICATION TO SUBMITTERS OF CONFIDENTIAL COMMERCIAL INFORMATION**

You have been or may be asked to submit to the Office of Inspector
General, U.S. Office of Personnel Management, information in connection
with these procedures, audit, inspection or other inquiry pursuant to
the Inspector General Act of 978, as amended, 5 U.S.C. app. 3, sec. 1 et
seq. This is to notify you that if you deem any of this information to
be "confidential commercial information," you may take steps to so
designate that information to protect its confidentiality if at a future
point in time a request is made for disclosure of this information under
the Freedom of Information Act (FOIA).

"Confidential commercial information" means records that may contain
material exempt from release under Exemption 4 of FOIA (pertaining to
trade secrets and commercial or financial information that is privileged
or confidential), because disclosure could reasonably be expected to
cause substantial competitive harm.

You may use any reasonable method you believe appropriate and which is
acceptable to the OIG to indicate which documents and information you
deem to fall into the category of "confidential commercial information."
Please be as specific as possible in segregating the information that
you consider to be "confidential commercial information" from any other
information you are providing to the OIG. This may be done before such
information is provided to the OIG if feasi­ble, but only if it will not
delay or interfere with production of the information or delay or
interfere with the OIG's investigation, audit, inspection or other
inquiry. Otherwise, you may so desig­nate this information within a
reasonable period of time after the information is provided to the OIG.

If a FOIA request is received by the OIG for information you have
designated as "confidential commercial information," the OIG is
nevertheless required by law to make its own independent determination
of whether the FOIA requires disclosure of the information or whether it
should be withheld pursuant to Exemption (b)(4) or any other exemption
of FOIA. If the OIG determines that it may be required to disclose
pursuant to FOIA that information you have designated or other
information that the OIG has reason to believe could be expected to
cause substantial competitive harm, to the extent permitted by law, we
will make a good faith effort to notify you and provide you with a
reasonable opportunity to object to such disclosure and to state all
grounds upon which you oppose disclosure. We will give careful
consideration to all specified grounds for nondisclosure prior to making
our final decision.

If we nonetheless believe that disclosure is required, we will provide
you with a statement explaining why your objections were not sustained
and specifying a disclosure date. To the extent permitted by law, this
statement will be provided to you in a reasonable number of days prior
to the specified disclosure date. Furthermore, if disclosure of the
designated information is denied pursuant to an exemption under FOIA and
an administrative or judicial appeal is taken by the FOIA requester, we
will make a good faith effort to notify you promptly.

The procedures outlined in this notice are intended only to improve the
internal management of the OIG and are not intended to create any right
or benefit, substantive or procedural, enforce­able at law by a party
against the United States, its agencies, officers, or any person.

[^1]: SSAE No. 10 became effective on June 1, 2001 and supersedes all
    previously issued SSAEs. In the past, this Audit Guide referenced
    SSAE No. 3, as amended by SSAE No. 9 in 1999. We have revised all
    references to SSAE No. 3, as amended by SSAE No. 9, to reference and
    reflect the changes in SSAE No. 10. IPAs should review and consider
    the changes in SSAE No. 10 when performing their work under this
    Audit Guide.

[^2]: Statement of Auditing Standard (SAS) No. 70 was amended by SAS No.
    88 in December 1999. SAS No. 88 replaced existing language in SAS
    No. 70 with language and concepts in SAS No. 55, *Consideration of
    Internal Control in a Financial Statement Audit*, as amended by SAS
    No. 78. Also, SAS No. 88 amended AU section 420, "Consistency of
    Applications of Generally Accepted Accounting Principles." Finally,
    SAS No. 88 changed the title of SAS No. 70 from *Reports on the
    Processing of Transactions by Service Organizations* to *Service
    Organizations*. IPAs should review and consider the changes included
    in SAS No. 88 when performing the work under this Audit Guide.