Compliance in the Field of Procurement and Human Resources in Social Insurance Institutions

All of the three audited social insurance institutions – the General Accident Insurance Institution (AUVA), the Austrian Insurance Fund for Civil or Public Servants (BVA) and the Pension Insurance Authority (PVA) – lacked systematic compliance management that would take into account special financial and organizational risk factors. The regulations adopted for coordinating the tasks of the self-administration and the so-called Office, for avoiding partiality of the members of the self-administration and for discharging the management board by the control assembly were insufficient. The internal audit unit lacked sufficient resources and independence. The social insurance institutions also failed to designate a compliance officer and to establish a system for dealing with whistle-blowers. Room for improvement was also detected for the IT area.

The organization of convalescent leaves and rehabilitation needed improvement in terms of the legal foundations, planning, design of contracts, determining rates, selecting contractual partners and compliance. A significant part of the services relating to rehabilitation (in particular for pensioners) was based on a legal basis prepared for preventive health care. This had negative implications both for the legal status of individuals as well as the management possibilities for the public sector. The PVA took decisions on applications based on short application forms and, if applicable, on attached medical reports, although the social insurance institutions had comprehensive data at hand. Significant compliance-relevant process elements (fixed allocation of tasks, documentation by the decision-makers) were insufficiently established at the BVA and the PVA. Due to a lack of instructions taking into account statistics, no reliable statistical information was available regarding the approval practices of the individual social insurance institutions. In line with internal provisions, the PVA denied significantly more applications for convalescent leaves than the BVA. The regulations for preventing the excessive use of convalescent leaves were not uniform.

The planning of rehabilitation services was not binding and deficient; a concept to bridge regional imbalances was lacking. The contracts with the service providers failed to regulate the consequences of deficient performances. The rates were determined without price competition and without cost calculation. As regards the selection of contractual partners, the social insurance institutions failed to actively take measures to meet the identified needs, leaving it up to the contenders to bring forward their ideas. The process for identifying the needs was divided into two parts: the assessment of needs in the provinces and the contract negotiations with the social insurance institutions. The instruments for coordinating the tasks of the provinces and the social insurance institutions were largely not binding and were hardly used. The selection of candidates was not based on quality or the price but on the chronological order of the applications (first-come-first-served principle). The PVA failed to collect all documents related to the award of contracts. Furthermore, the assignment of documents to the individual cases was not clear. Decisions were partly not justified. The tasks related to planning, calculating the rates, selecting the contractual partners and setting up the contracts were partly fragmented.

In the course of the audit, the PVA fundamentally overhauled the award of contracts for rehabilitation-related services. However, it still had to take corrective measures regarding the coordination of the processes carried out by the provincial authorities with the call for tenders to be issued by the social insurance institutions, as well as the internal reorganization and the process instructions for a complete internal documentation.

The three audited social insurance institutions did not have an overview of the overall procurement volume, although it totalled some EUR 423.55 million in 2014 (convalescent leaves and rehabilitation excluded). Procurement-related matters were allocated to 73 organizational units. The institutions lacked strategic goals with operational targets, the management board as the managing body restricted itself mostly to taking decisions on individual procurement processes. The internal provisions for obtaining comparing offers were insufficient as regards the audited period. Systematic ex-post examinations were carried out in an inadequate way. Furthermore, the institutions failed to establish a risk-management system.

The post tables of the three social insurance institutions were not binding, and a systematic cross-institutional controlling was lacking or remained largely ineffective. Binding regulations regarding job advertisements and staff recruitment were not complied with. The regulations to prevent internal conflicts of interest or partiality were not sufficiently clear.