You are a staff auditor in the internal audit department of St. Mary's Hospital. Within the hospital there are many decentralized departments and units. One day you received a telephone call from a secretary at the radiology clinic. The secretary explained that he has recently started at the clinic and has some concerns regarding money that is collected for some of the services rendered. He explained that this clinic charges a fee for patients who do not wish to wait for extended periods of time for their x-rays. He was advised that the only acceptable form of payment was by credit card. The other employee, Marlene, who is usually responsible for collecting payments from patients, has been on sick leave for the past three weeks. The secretary explained his concerns stemmed from four patients who in the past few weeks have tried to pay cash for their services. When told that cash was not accepted they seemed surprised and claimed to have paid cash in the past. In fact, two patients specifically stated that Marlene had insisted on cash payments.

In addition, the secretary advised you that Marlene was responsible for depositing the credit card slips and issuing the receipts to patients. The receipts are manually prepared and are not sequentially numbered.

Marlene usually performs the reconciliation of patient x-rays to fees collected on a weekly basis. Also, the secretary had recently checked the petty cash and was surprised to find it was over by $500. The usual petty cash was $100, which again was the responsibility of Marlene.

The secretary explained that he had not informed his superiors and instead reported his concerns to you. When you report this to your chief audit executive (CAE), she immediately contacts the director of the radiology clinic. The director expressed his gratitude for any help you can offer and agrees to cooperate fully. However, the director requests that you advise him about how you will proceed with your investigation and what role the internal audit department will play. In addition, the CAE has asked you to conduct a risk assessment on the clinic's procedures and provide recommendations to be included in the memo to the director. This will help the clinic to avoid situations such as this from occurring in the future.

Required

In the spirit of cooperation, the CAE has asked you to make a memo to the director to address his requests.