Audit of the State Office of Pharmacy Services Objectives, Scope, and Methodology

An overview of the purpose and process of auditing the State Office of Pharmacy Services.

Overview

In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of certain activities of the State Office of Pharmacy Services (SOPS) for the period July 1, 2021 through June 30, 2023.

We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Below is a list of our audit objectives, indicating each question we intended our audit to answer; the conclusion we reached regarding each objective; and, if applicable, where each objective is discussed in the audit findings.

Objective	Conclusion
Did SOPS have policies and procedures in place to standardize operations and monitor all prescription functions at facilities across the Commonwealth?	Yes
Did SOPS comply with its internal Policy 2.08 Vendor Contract Overhead Fees?	Yes
Did SOPS comply with General Chapter 797 from the United States Pharmacopeia safety standards and its own Policies 3.01 through 3.04?	Yes
In response to our previous recommendation (from Audit No. 2012-0293-3S) did SOPS establish and implement necessary policies, procedures, and related internal controls to ensure that SOPS appropriately sent required reports to the House and Senate Committees on Ways and Means and that the reports were signed by the executive director, as required in Chapter 24 of the Acts of 2021 and Chapter 126 of the Acts of 2022?	No; see Finding 1

To accomplish our audit objectives, we gained an understanding of the aspects of SOPS’s internal control environment relevant to our objectives by reviewing applicable agency policies and procedures and by interviewing SOPS management. We evaluated the design and implementation and tested the operating effectiveness of internal controls related to the annual review of compounding safety standard policies and the monthly reconciliation of vendor overhead fees. In addition, to obtain sufficient, appropriate evidence to address our audit objectives, we performed the procedures described below.

Standardization and Monitoring of Prescription Functions

To determine whether SOPS has standardized operations for all prescription functions, we performed an audit review of the processing, filling, and delivery of prescriptions by verifying that the practices used by Cardinal Health employees were in compliance with the Pharmacy Distribution Center policies approved by SOPS.

To determine whether SOPS ensured that Cardinal Health met its medication error rate goal, outlined in its vendor contract, at facilities across the Commonwealth, we obtained all Medication Event Reports from Cardinal Health from the audit period and completed the following actions.

• We recalculated the medication error rate by dividing the medical events by the total number of orders processed each month.
• We calculated the average medication error rate for each fiscal year.
• For Medication Event Reports with a monthly percentage greater than 0.15%, we verified that assessment and action plans were documented on the Medication Event Reports.

To determine whether SOPS’s policies over the monitoring of all prescription functions were operating effectively, we reviewed email documentation and annual reports to determine whether SOPS held both annual meetings with its vendor, Cardinal Health, during the audit period regarding the plans for the clinical pharmacy program. Additionally, we selected a random, nonstatistical sample¹ of 35 out of 104 weekly scorecard reports and reviewed the correspondence between SOPS and Cardinal Health to ensure that SOPS provided the oversight needed to ensure effective operations.

Based on the results of our testing, we determined that, during the audit period, SOPS had policies and procedures in place to standardize operations and monitor all prescription functions at facilities across the Commonwealth.

Vendor Contract Overhead Fees

To determine whether SOPS complied with its internal Policy 2.08 Vendor Contract Overhead Fees, we obtained a list of all 371 overhead fee transactions from the audit period, totaling $442,236 ($210,648 in fiscal year 2022 and $231,588 in fiscal year 2023), and selected a random, nonstatistical sample of 40 transactions, totaling $45,484, and completed the following actions for each sampled transaction.

• We examined supporting documentation (including emails, invoices, and contracts) to determine whether a proposal for each overhead fee was made.
• We reviewed the contract overhead fee proposals to determine whether each selected fee was used within the scope of its proposed use.
• We reviewed each contract overhead fee for approval by SOPS’s chief of pharmacy before its purchase.

Based on the results of our testing, we determined that, during the audit period, SOPS complied with its internal Policy 2.08 Vendor Contract Overhead Fees.

Compounding Safety Standard

To determine whether SOPS complied with its internal Policies 3.01 through 3.04 and General Chapter 797 from the United States Pharmacopeia safety standards, we completed the following actions.

• We requested and reviewed all 10 surface tests conducted during the audit period to determine whether SOPS passed each review and whether SOPS conducted surface testing reviews quarterly from July 2021 through December 2021 and biannually from January 2022 to June 2023.
• We requested and reviewed all seven air tests conducted during the audit period to determine whether SOPS passed each review and whether SOPS conducted biannual air testing reviews.
• We compared SOPS’s internal policies to General Chapter 797 from the United States Pharmacopeia safety standards to determine whether SOPS met the United States Pharmacopeia’s safety standards.

Additionally, from the list of 41 compounding employees who prepared compounded pharmaceuticals during the audit period, we selected a random, nonstatistical sample of 10 employees and reviewed continuing professional education completion data and both initial and annual evaluations to determine whether each employee completed the following:

• five compounded pharmaceutical continuing professional education hours annually;
• initial and annual garbing and gloving evaluations;
• initial and annual cleaning and disinfecting evaluations; and
• initial and annual media fill evaluations.

Based on the results of our testing, we determined that, during the audit period, SOPS complied with General Chapter 797 from the United States Pharmacopeia safety standards and its own Policies 3.01 through 3.04.

Chapter 24 of the Acts of 2021 Reporting

To determine whether, in response to our previous recommendation (from Audit No. 2012-0293-3S), SOPS established and implemented necessary policies, procedures, and related internal controls to ensure that SOPS appropriately sent required reports to the House and Senate Committees on Ways and Means by April 15, 2022 and April 14, 2023, respectively, and that the reports were signed by the executive director, as required in Chapter 24 of the Acts of 2021 and Chapter 126 of the Acts of 2022, we interviewed SOPS’s chief of pharmacy and reviewed SOPS’s policies and procedures that were in effect during the audit period.

See Finding 1 for more information regarding the results of our testing related to SOPS’s updating its policies, procedures, and related internal controls in response to our previous recommendation.

We used nonstatistical sampling methods for testing and therefore did not project the results of our testing to the population.

Data Reliability Assessment

Weekly Scorecard Reports

To determine the reliability of the weekly scorecard reports that Cardinal Health submitted to SOPS during the audit period, we obtained all 104 reports from SOPS and reviewed them to ensure that there were no missing reports.

Vendor Contract Overhead Fees

To determine the reliability of the list of 371 overhead fees paid during the audit period, provided by SOPS, we interviewed SOPS officials who were knowledgeable about the data. We reviewed the data to ensure that there were no blank fields or duplicates and that all of the data was from within the audit period. Further, we selected a random sample of 20 overhead fee transactions from the dataset and matched the amounts, invoice numbers, and dates to the original invoices.

Compounding Safety Standard

To determine the reliability of the list of 41 employees with access to the compounding room provided by Cardinal Health, we interviewed SOPS officials who were knowledgeable about the list. We reviewed the employee list to ensure that there were no duplicate employees. Further, we reconciled the vendor’s employee list to an independent list provided by SOPS of employees who were granted badge access by SOPS to the compounding room to ensure that all employees who were granted badge access were on the vendor list.

Based on the results of the data reliability assessment procedures described above, we determined that the information we obtained was sufficiently reliable for the purposes of our audit.

1.    Auditors use nonstatistical sampling to select items for audit testing when a population is very small, the population items are not similar enough, or there are specific items in the population that the auditors want to review.

Date published:	March 20, 2025