Third Party Administrators (TPAs) design internal controls to process claims for self-insured plans. But it is not feasible for a TPA to solely rely on its own internal control structure to ensure complete, accurate, and timely claims processing. Therefore, a plan sponsor must have certain controls in place to ensure its system is working properly. The controls required by the plan sponsor, otherwise known as User Entity Controls (UECs), vary depending on the design of the TPA’s claims processes and procedures. Although, there is no universal list of UECs for a plan sponsor to follow, there is a list of common controls that are generally expected., and aA plan sponsor should obtain and read its TPA’s SOC 2 Report on an annual basis to understand the UECs that are required.
The following list contains examples of generally expected controls the user organization must have in place:
- Controls are established so new plan details, or changes to existing plans, are authorized and reviewed. This plan information should be submitted to the TPA accurately and on a timely basis.
- Controls are established to review the benefit administration source document for completeness and accuracy and to ensure that exceptions are investigated and resolved with the TPA.
- Controls are established so erroneous plan or enrollment data (both sent to, and received from, the TPA) is corrected and resubmitted on a timely basis.
- Controls are established to determine if enrollment information and claims pricing services provided by the TPA are complete and accurate.
- Controls are established so enrollment changes are authorized and reviewed. The enrollment information should be submitted to the TPA in a complete, timely, and accurate manner.
- Controls are established to ensure that member accumulators are shared with the TPA in a complete, timely, and accurate manner.
- Controls are established to monitor and review claims detail, fund requests and receipts, and funds summary reports for completeness, accuracy, and duplicate payments, as well as ensure that exceptions are investigated and resolved in a timely manner with the TPA.
- Controls are in place to ensure exception reporting is authorized and responses are provided to the TPA in a timely, accurate, and complete manner.
- Controls are in place to ensure TPA contracts are executed completely to ensure changes in terms and conditions are loaded in a timely manner.
If the plan sponsor’s TPA does not have a SOC 2 or similar report, it should consult with the TPA to gain an understanding of its control environment and the UECs that are required to ensure claims are paid in a complete, accurate, and timely manner. Without properly designed and operating UECs, the plan sponsor risks TPA failures even if its controls are designed properly and working effectively.
If you have questions, we are happy to help. Contact us by email or call us directly at (410) 971-7910.
About the Authors:
Timothy A. Heller, CPA | Partner
Tim leads the assurance group and provides compliance-oriented services to large and jumbo self-funded health and welfare plans. A national thought leader, he has exceptional expertise in accounting and financial reporting, as well ERISA-related compliance matters. He has successfully handled many complex multiple and multi-employer engagements for collectively-bargained union plans and often assists trustees with various fiduciary matters.
Jamie Bartynski, CPA, MBA | Manager
Jamie provides assurance and compliance services to large and jumbo self-funded health and welfare plans. As a Certified Public Accountant, she has vast knowledge in the areas of GAAP, GAAS, and ERISA matters for single, multiple, and multi-employer plan sponsors. She often shares her expertise in these areas in nationwide publications.