Internal Audit Newswire - October 11, 2026

Heal 360 Clinics and Owner Agree to Pay $20M to Resolve False Claims Act Allegations of Billing False Claims to the COVID-19 Uninsured Program for Services Not Rendered

Source: United States Department of Justice (Office of Public Affairs)

Summary: The DOJ announced a $20 million civil settlement with Heal 360 Urgent Care PLLC, Heal 360 Primary Care PLLC, and owner Dr. Mohammed Amer Mohiuddin to resolve allegations they billed the HRSA COVID-19 Uninsured Program for evaluation and management services not performed between Jan. 1, 2021 and March 23, 2022. Liability was not determined. For internal audit, this is a case study in revenue-cycle risk: coding accuracy, encounter documentation, uninsured eligibility checks, and claim submission validation. It also underscores whistleblower exposure when billing controls fail during emergency funding programs.

Internal Audit Implications: This settlement, even without an admission of liability, is a blueprint for where revenue-cycle controls break. Internal audit should immediately test: encounter documentation and coding controls for evaluation and management services; uninsured eligibility verification and retention of proof; charge capture and claim submission validation to HRSA programs; and post-payment monitoring for services not rendered during Jan 2021–Mar 2022. Use data analytics to identify claims without supporting encounters, repeated E/M codes on the same day, or billings submitted after visit cancellations. Validate segregation of duties between providers, coders, and billers. Assess governance: does a revenue integrity committee review coding audit results and corrective actions? Are E/M audits independent of operations and performed with defined sampling and escalation thresholds? Review system edits that prevent submission without required documentation and confirm override logging and approvals. Evaluate whether HRSA program-specific policies exist, including attestation requirements for providers and documented uninsured determinations. Whistleblower exposure is explicit in FCA matters. Test hotline intake, triage, and investigation protocols, including retaliation monitoring and reporting up to the audit committee. Confirm that substantiated billing issues trigger root-cause analysis, clawback/repayment workflows, and control remediation tracking. Expect audit committee questions: Where are our control deficiencies in coding and claims validation? How are we detecting and preventing billing for services not performed? What monitoring exists over emergency program billing? How many exceptions have required repayment, and how quickly were they escalated? Is our risk register updated to reflect this exposure and owners assigned to remediation?

Owner of Florida Ransomware Remediation Company Charged with Defrauding Clients

Source: U.S. Attorney's Office, Eastern District of New York (press release hosted on justice.gov)

Summary: The U.S. Attorney’s Office for the Eastern District of New York announced that Zohar Pinhasi, owner of MonsterCloud LLC, was arraigned on an indictment charging conspiracy to commit wire fraud and two counts of wire fraud. The indictment alleges MonsterCloud marketed ransomware data recovery without paying attackers but secretly paid cybercriminals, charging clients more than $19 million while paying attackers over $8 million; one example cites ~$150,000 billed vs ~$8,200 paid. Pinhasi pleaded not guilty. The case spotlights vendor transparency risk around ransomware remediation.

Internal Audit Implications: Allegations that a remediation vendor secretly paid attackers while marketing no‑payment recoveries go to the heart of third‑party oversight. Internal audit should evaluate: vendor due diligence for incident-response providers (corporate background checks, alias screening, references), contract clauses requiring full disclosure of tactics and any payments to threat actors, and approval matrices for any engagement that may involve contact with criminals. Test that incident response playbooks define decision rights, documentation requirements, and escalations to legal and risk leadership. Treat this as core IT risk and third‑party risk. Review billing and transparency controls: do invoices itemize vendor services versus pass‑through fees, and are they reconciled to work performed and client approvals? Sample recent ransomware engagements to trace from procurement to close‑out, confirming retention of communications, evidence of management authorization, and post‑incident reviews capturing lessons learned into the risk register. Assess governance: does the CISO report vendor performance and exceptions to the risk committee? Are there right‑to‑audit provisions and monitoring of vendor representations? Validate segregation between those negotiating outcomes and those approving payments or fees. The audit committee will ask: Which vendors can engage attackers on our behalf, and under what conditions? How do we verify vendor claims about their methods? What controls prevent undisclosed payments or misrepresented services? Are we performing independent post‑mortems and adjusting operational risk tolerances? What gaps did control testing reveal, and what control remediation is underway with timelines and owners?

United States: DOJ's New Fraud Division Corporate Enforcement Directive

Source: Baker McKenzie (Insight)

Summary: Baker McKenzie reported that on Oct. 1, 2026 the DOJ’s newly created National Fraud Enforcement Division issued Directive 26‑12, 'Corporate Enforcement in the Fight Against Fraud.' The Directive outlines enforcement priorities and corporate enforcement approaches, and underscores coordination with other agencies and whistleblower channels. The analysis highlights the objective to investigate and prosecute misuse of taxpayer dollars and characterizes the Directive as reiterating existing emphases and channels, including corporate disclosures and relators. For internal audit, this signals increased attention to fraud governance and escalation.

Internal Audit Implications: The Directive signals sustained DOJ attention to corporate fraud, coordinated with whistleblower channels and other agencies. Internal audit should use this quarter to refresh the enterprise fraud risk assessment, emphasizing areas involving taxpayer funds and reimbursement programs. Update the risk register with clear owners, metrics, and monitoring cadence. Test governance over disclosures: are potential fraud allegations rapidly escalated through documented disclosure controls and procedures, with handoffs to legal/compliance and timely briefings to the audit committee? Review investigation protocols for intake, scoping, preservation, and reporting; confirm case management systems track milestones, substantiation rates, and remediation. Hotline effectiveness will matter. Evaluate hotline availability, anonymity options, triage service levels, independence of investigators, retaliation safeguards, and board reporting. Sample cases to verify root-cause analysis and that control remediation is tracked to closure. Strengthen preventive and detective internal controls in high‑risk processes: approval hierarchies, maker‑checker segregation, exception reporting, and analytics for unusual patterns. Verify training coverage for managers on recognizing and escalating fraud indicators and on how corporate disclosures to authorities are authorized and documented. Expect audit committee questions: When was our last fraud risk assessment update, and what emerging risks were added? How quickly can we evaluate and disclose credible allegations? Are our whistleblower channels resourced and trusted? What KPIs demonstrate effective risk governance? Where have control deficiencies been identified, and what SOX program or ICFR impacts exist if issues intersect financial reporting?

Disclaimer: This content is provided for general informational purposes only and does not constitute legal, accounting, tax, investment, or other professional advice. Portions were generated using AI tools from public web sources and may contain errors or omissions — verify important details against the primary sources linked above before relying on them. Any example prompts, scripts, templates, or other artifacts are provided “as is” without warranty of any kind, express or implied; test them on non-production data and apply your own professional judgement before use. Cherry Hill Advisory disclaims all liability for any loss or damage arising from the use of, or reliance on, this content or any artifact it contains.