Duke University Health System Internal Controls Over Financial Reporting February 2010

1. Duke University Health SystemInternal Controls Over Financial Reporting February 2010

2. Agenda • DUHS Financial Update and Current Plans • DUHS Control Environment • Service Level Agreements (SLA’s) with DU • Expenditure and Investment Transaction Cycles • Revenue Cycle

3. DUHS Financial Update and Current Plans

4. Financial Profile • DUHS is coming off two of its most successful operating financial years • Despite significant investment losses and liquidity challenges, DUHS maintained its Aa2/AA credit ratings in FY 09 ($ millions)

5. Five Year Capital Plan • DUHS plans to invest $1.2 billion in capital projects over the next 5 years • DUH Ambulatory Cancer Center $220 million • DUH Duke Medicine Pavilion $559 million • Other projects $421 million • Major projects are now committed

6. Five Year Plan of Finance ($ billions)

7. What Does It Take to Support this Five Year Plan of Finance? • Annual Operating Margins of $150+ million for 5 years • Annual Cash Flow From Operations of $200+ million for 5 years • DUHS’ balance sheet “buffer” is current balance of $1.3 billion in cash and investments • DUHS will borrow $300 million in tax-exempt debt financing • Potential development campaign

8. Margin Improvement Initiative Update *When fully implemented projected savings are $84 million annually. ($ thousands)

9. Healthcare Industry Challenges • Healthcare reform • Uninsured population • Healthcare spending cuts • Transparency/Tax Exemption • Federal Government budget deficits (Medicare) • State budget deficits (Medicaid)

10. Divergent Near-Term Plans? • DUHS – adding major facilities and clinical capacity • DMP and Cancer Center result in: • Approximately 850,000 additional square feet of space • Approximately 300 additional physicians • Approximately 2,100 additional FTE’s (16% increase) • 126 additional beds and 16 additional operating rooms at DUH • Major expansion in cancer exam rooms, infusion treatment spaces, radiology equipment • University – working to manage revenue challenges (including unavoidable implications on staffing) while maintaining or enhancing mission-critical services to all Duke constituencies

11. DUHS Internal Control Environment

12. DUHS Control Environment • April 1999 Operating Agreement between DUHS and DU governs organizational relationships • DUHS purchases from the University core processing support for many major transaction cycles • Disclosed fully in Note 15 – Related Parties in the June 30, 2009 DUHS financial statements

13. DUHS Control Environment • DUHS is solely responsible for only two major transaction cycles in the Health System: • Revenue Cycle • Medical Professional Liability Insurance • All other transaction cycles, most of which are high volume and process-oriented in nature, are managed by the University with DUHS as a “customer”: • Procurement and A/P Sub-Ledger • Payroll and HR • Fixed Asset Accounting Sub-Ledger • Commercial Banking Relationships • Investment Management through DUMAC • Capital Acquisition and Repayment

14. DUHS Control Environment • Service Level Agreements (SLA’s) have been developed with the University to better define each entity’s operating responsibilities to the other for shared services • Each SLA provides for: • Review of proposed annual DU budget for each service area by DUHS budgetary officials • Duties and responsibilities of each entity, including expectation of adequate internal controls

15. DUHS Control Environment • Multiple Information Technology organizations impact the DUHS control environment • Administrative Systems Management (ASM) operates SAP from within University Financial Services • Duke Health Technology Solutions (DHTS) is managed by the Duke Medicine CIO • DU Office of Information Technology (OIT) is managed by the University CIO (Duke-corporate technology strategies)

16. DUHS Control Environment • DUHS, as a not-for-profit entity, is not subject to Sarbanes-Oxley (SOX) requirements • While many SOX “best practices” have been adopted by DUHS, including risk assessments by multiple parties, Section 404 requirements for assessing, testing, and monitoring internal controls over financial reporting with annual certifications and reporting have not been implemented across the organization • For DUHS to be “SOX compliant”, DU would also need to be SOX compliant

17. DUHS Control Activities Expenditure and Investment Transaction Cycles • Essentially all are shared with DU • DUHS Authorization (from DUHS Board): • Annual Corporate Operating Budget • Corporate Capital Plan • Specific expenditures/investments require specific approvals by Health System Management • Once approved, much of the remaining back-office detailed processing takes place in DU systems • Ultimately recorded in the DUHS general ledger for financial reporting

18. University/DUHS Transaction Relationships Cash-In Cash-Out Operating DUHS Budget University Decisions Transactional Processing DUHS Revenue Cycle DUHS Funds Available Capital DUHS Capital University Decisions Transactional Processing DUHS External Borrowing DUHS Investing DUMAC Decisions Long Term Pool (LTP) DCC Pool

19. DUHS Control Activities Revenue Cycle • DUHS has sole responsibility for its revenue cycle • Revenue cycle accounting is primarily the responsibility of three functions within DUHS Finance: • Patient Revenue Management Organization (PRMO) • Reimbursement and Revenue Accounting • General Accounting and Financial Reporting

20. DUHS – Revenue Cycle Accounting PRMO Etc. Credit Balances Write-Offs Collecting Billing General Ledger Reporting General Accounting and Financial Reporting Net Patient A/R and Net Patient Revenue Valuation Estimates Reimbursement & Revenue Accounting DUHS A/R Sub-Ledger PDC A/R Sub-Ledger

21. DUHS - PRMO • Building a control environment in the PRMO over time • 10-member Quality Control group was formed and staffed • Deloitte was engaged to conduct a SOX “404-Like” review of all control activities that either were, or should have been, in the PRMO • Quality Control eventually moved from documentation to monitoring responsibility • Today - - a SOX “404-Like” model exists within the PRMO • Detailed control activity documentation is up-to-date for approximately 1,400 controls • Operating managers provide quarterly certifications of compliance levels with controls • Quality Control group tests both certifications and compliance with control activities and formally reports each quarter

22. DUHS – Reimbursement and Revenue Accounting • Internal Revenue Accounting • Valuation of patient accounts receivable at net realizable value • KPMG assisted with the development of a modelling process 10 years ago / DUHS has refined and improved over the years • External Revenue Accounting • Cost reporting and other third-party payments • Engaged outside expertise in 2008 to review policies and procedures over cost reporting, perform a GAP analysis, and help design a policy format to address weaknesses • Initial five processes are documented and being communicated

23. DUHS – General Accounting and Financial Reporting • KPMG Consulting assisted DUHS with the creation of a “world-class finance function” 10 years ago • Core to this was the creation of a strong, centralized general accounting, financial reporting and consolidation group • This group is responsible for closing the books each accounting period and preparing all consolidated financial reporting

24. DUHS Internal Controls - Summary • DUHS is not SOX compliant • DUHS has utilized appropriate external resources and expertise to advance its internal controls structure over financial reporting over time • DUHS Overall Goal – adequate system of internal controls to minimize the likelihood of a “financial surprise”