Internal controls for NEMT billing and cash: separating who edits trips, who bills, and who banks the money

Why a small transportation office is exposed

Small organizations had the highest median loss per fraud case in the ACFE’s Occupational Fraud 2026 report, which studied 2,402 cases investigated between January 2024 and September 2025. Organizations with fewer than 100 employees lost a median of $126,000. The report notes that a loss that size usually hurts a small organization more, because it is a larger share of revenue.

The ACFE found the biggest differences between small and larger organizations in billing schemes, skimming, and check and payment tampering. Expense and payroll schemes were also more common in small organizations. Each one runs through money a transportation office handles every week:

These are frauds against the company. In the ACFE’s terms, a billing scheme means getting the company to pay fake, inflated, or personal invoices. It does not mean claims sent to payers. Skimming means taking incoming money before it reaches the books. Among the 140 cases at health care organizations, 32 percent involved a billing scheme.

A NEMT company carries a second risk on top: claims for rides that did not happen the way they were billed. That one creates repayment duties toward Medicaid, plans, and brokers, so the controls below protect against both. The fraud prevention guide covers schemes against payers in detail.

The report also names the root causes. A lack of internal controls was the main weakness in 33 percent of cases, an override of existing controls in 19 percent, and a lack of management review in 18 percent. Small organizations had the fewest controls in place: 41 percent had management review against 79 percent of larger ones, and 16 percent ran surprise audits against 52 percent.

Four jobs that belong to different people

The core control is simple: no one person should be able to create or change a trip, bill it, receive the money, and check the books. Split those four jobs.

• Changing trip records. Dispatchers and drivers create trips and correct times, miles, riders, and levels of service. Nobody in this role posts payments or touches the bank.
• Billing. The biller turns completed trips into claims and invoices. The biller can flag a trip that looks wrong but should not edit the trip record that supports the claim.
• Receiving money. One person opens the mail, logs each check, and makes the deposit. Federal Medicaid rules pay the provider itself and let a billing agent receive payments in the provider’s name only under strict fee limits (42 CFR 447.10), so payer deposits should land in a company account only the owner controls.
• Reconciling. Someone who neither bills nor deposits matches deposits to remittances and to the bank statement. In most small companies that is the owner.

COSO’s Internal Control, Integrated Framework, refreshed in 2013, sorts controls into five components: the control environment, risk assessment, control activities, information and communication, and monitoring. Splitting duties is a control activity. The owner’s reviews in the sections below are monitoring.

When the office is two or three people

Few small companies can staff four separate roles. When one person must hold two jobs, add a review by someone else on a fixed schedule. COSO’s 2013 framework allows for this: where splitting duties is not practical, management picks other controls to take its place.

For example, in a three-person office, the dispatcher corrects trips, the office manager bills and deposits checks, and the owner reconciles the bank and reviews edited trips. The office manager’s two jobs are covered because the owner pulls the bank statement straight from the bank and matches every deposit to a payment record. A second safeguard is time away: when the office manager takes a week off, someone else runs billing and deposits. The ACFE found job rotation or mandatory vacation in just 8 percent of small organizations.

OIG’s General Compliance Program Guidance (November 2023) has advice built for small entities. It suggests that a company that cannot support a compliance officer name a compliance contact who, whenever possible, is not involved in billing, coding, or claim submission. That contact reports to the owner at least quarterly, and the owner remains ultimately responsible. The compliance program guide walks through the rest of OIG’s seven elements.

Review every trip edited after the ride

A trip changed after it was completed deserves a second look before anyone bills it, whether the change fixed a mistake or created one. Pull a list of those trips every week, before billing.

For each one, check what changed: miles, pickup or drop-off times, the level of service, the rider, an added stop, or a no-show changed to a completed trip. Then compare the new values with what was recorded during the ride, such as GPS miles, timestamps, and the signature captured on the spot. Approve the edit, reverse it, or send it back with a question. Patterns matter more than any single edit: the same editor every week, the same rider, or miles that keep landing on round numbers.

This is one form of the management review the ACFE measured. Cases at organizations with management review in place had a median loss of $84,000, against $186,000 where it was missing. A trip audit checklist turns the review into a monthly sample as well.

Checks, deposits, and electronic payments

Incoming money needs a paper trail that starts before anyone posts it.

• Paper checks. Whoever opens the mail writes each check on a log (payer, check number, amount, date) and endorses it for deposit only on the spot. Deposit within a business day. The log goes to the person who reconciles, and the biller posts payments from the remittance, never from memory.
• Electronic payments. The riskiest moment is a change to the bank account a payer pays into. Make the owner the only person who signs EFT and ERA enrollment forms, and confirm any change by calling the payer at a number you already have. Payer forms ask for this kind of authority; TMHP’s ERA agreement, for example, must be signed by someone authorized to start, change, or end the enrollment. The EFT enrollment entry covers the setup.
• Card payments and cash from riders. Issue a numbered receipt for every payment, and let refunds go out only with a second person’s approval.

Approvals for refunds, payroll changes, and new payees

Money going out needs a second set of eyes in four places.

1. Refunds and repayments. A refund to a rider or facility, or a repayment to a payer, needs the owner’s sign-off and a written reason. A repayment to Medicaid follows the 60-day overpayment rule.
2. Payroll changes. New hires, pay rate changes, and changes to an employee’s direct deposit account need the owner’s approval. Each pay period, compare the payroll list with the drivers who actually worked. The ACFE’s own example of a payroll scheme is a ghost employee added to the payroll.
3. New vendors and changed bank details. Confirm any request to change where a vendor gets paid by calling a number already on file. The ACFE lists rerouting an electronic vendor payment into an employee’s account as a payment tampering scheme.
4. Fuel cards. GSA’s fleet card program uses limits per transaction and per month, limits on how many transactions a card can make, and product restrictions. Ask your fuel card company for the same settings, and match each month’s fuel charges to the miles each van drove. A key and fuel card log shows who held each card.

The monthly bank reconciliation

The reconciliation is the control that catches what the others miss, so it belongs to someone who does not deposit money or post payments.

1. Download the statement directly from the bank, not from a copy someone hands you.
2. Match every deposit to a remittance, a broker payment statement, a card payout, or a line on the check log.
3. Match every withdrawal to an approved bill, a payroll run, or a tax payment.
4. Chase every deposit that matches no posted payment and every payment posted with no deposit.
5. Sign and date the reconciliation and keep it with the month’s records.

Then reconcile the trips themselves: completed trips against trips billed, and trips billed against trips paid. A completed trip that was never billed is lost revenue, and a billed trip with no completed record is a compliance problem. The bookkeeping guide covers the books side.

A way to report a problem

Tips catch more fraud than any other method. In the ACFE’s 2026 study, 43 percent of cases were detected by a tip, and 55 percent of those tips came from employees. Yet only 24 percent of organizations with fewer than 100 employees had a hotline, against 85 percent of larger ones. OIG’s guidance for small entities fills the gap without a vendor: a written policy that requires good-faith reporting and bans retaliation for it, a simple way to report such as an anonymous drop box, and, where anonymity is not possible, posted instructions for reaching the HHS OIG Hotline. The compliance program guide covers the reporting element in more depth.

Logins and access

Every person who touches trips, claims, or money should have a login of their own. The HIPAA Security Rule makes unique user identification a required safeguard for systems that hold electronic health information, and shared logins also make any edit impossible to trace. Give each role only what it needs: the biller does not need to edit trips, and dispatchers do not need payment screens. Turn off every login, including payer portals and the bank, on the day someone leaves.

Controls on one calendar

A control works only if it happens on schedule, so put each one on a calendar with a named owner.

1. Weekly. Review trips edited after the ride, before billing.
2. Monthly. Bank reconciliation, trip-to-claim reconciliation, fuel card review, and exclusion screening of staff.
3. Quarterly. The compliance contact reports to the owner, as OIG suggests for small entities.
4. Yearly. A compliance risk assessment and at least one audit, which OIG’s guidance asks small entities to do at least once a year, plus a review of who has access to what.

The compliance calendar template has room for all of it.

Running these checks in HealthRide

HealthRide records every change and limits each person to what their role allows. Every ride keeps its GPS-recorded miles, timestamps, and on-screen signature to hold an edit up against. On the money side, payments are tracked against their invoices in one ledger, which gives whoever reconciles the bank one place to match deposits.