Building an Internal Audit Program: Sample Sizes, Frequency, and Corrective Action Plans for Providers

Medicare contractors, Medicaid agencies, and commercial payers all audit providers. The organizations that handle those audits best are usually the ones that audit themselves first. An internal audit program gives a provider a regular, structured way to test whether its documentation, coding, and billing meet payer requirements, to find problems while they are still small, and to fix them before an outside reviewer does.

The HHS Office of Inspector General (OIG) treats auditing and monitoring as a core part of an effective compliance program. In its General Compliance Program Guidance, published in November 2023, OIG describes risk assessment, auditing, and monitoring as one of the seven elements of an effective compliance program. OIG's guidance does not set one required sample size or audit schedule for every provider. Instead, it expects each organization to design a program that fits its size, services, and risks.

This article explains how to build an internal audit program from the ground up: how to assess risk, which types of audits to use, how many claims to review, how often to audit, how to write and track corrective action plans, how to handle overpayments that audits uncover, and how to report results. It is educational and does not replace legal or professional advice.

Why an Internal Audit Program Matters

An internal audit program does more than catch errors. It helps a provider:

• Identify documentation, coding, and billing weaknesses before contractors do.

• Reduce denials, overpayments, and the risk of extrapolation.

• Prepare staff for Additional Documentation Requests (ADRs) and other external reviews.

• Meet obligations to report and return overpayments under the 60-day rule.

• Show regulators, payers, and the governing body that the compliance program is working.

• Support decisions about training, staffing, and system changes with data.

OIG's guidance has long noted that an effective compliance program can be a factor when the government decides how to resolve a matter. A documented, functioning audit program is one of the clearest signs that a compliance program is real rather than a policy on a shelf.

Step 1: Establish Governance and Ownership

Before choosing what to audit, decide who owns the program.

The Compliance Officer

The compliance officer typically oversees the audit program, approves the annual audit plan, and reports results to the compliance committee and the governing body.

The Compliance Committee

The committee reviews the audit plan, monitors results, and makes sure corrective actions are carried out.

Auditors

Audits may be performed by internal staff, outside reviewers, or a mix of both. Internal auditors should be independent of the work they review where possible. For example, a coder should not audit his or her own claims. Outside reviewers can add objectivity and specialized expertise, and many organizations rotate between internal and external reviews.

Legal Counsel

When an audit may uncover potential fraud, significant overpayments, or other legal issues, counsel may direct the review to help protect attorney-client privilege and work product. Decide this before the audit begins, not after findings appear.

A Written Audit Policy

The program should be described in a written policy that covers:

• The purpose and scope of auditing and monitoring.

• Who approves the audit plan and who performs audits.

• How audit topics are selected.

• How samples are designed.

• Review standards and error definitions.

• How findings are reported and escalated.

• How corrective action plans are written, approved, and tracked.

• How potential overpayments are evaluated and handled.

• Record retention for audit work papers.

Step 2: Conduct a Risk Assessment

A good audit program starts with a risk assessment. OIG's General Compliance Program Guidance encourages organizations to assess risk regularly and to use the results to focus auditing and monitoring.

Sources of Risk Information

• Government priorities. OIG audit and evaluation reports, work planning materials, and enforcement actions show where OIG sees risk.

• Contractor review topics. MAC medical review and Targeted Probe and Educate (TPE) topics, approved Recovery Audit Contractor (RAC) topics, and Supplemental Medical Review Contractor (SMRC) projects show where contractors are looking.

• Improper payment data. The Comprehensive Error Rate Testing (CERT) program publishes error rates by service type.

• Data reports. The Program for Evaluating Payment Patterns Electronic Report (PEPPER) and CMS Comparative Billing Reports (CBRs) show where a provider differs from peers.

• Internal data. Denial trends, appeal outcomes, ADR results, high-volume or high-dollar services, new services, new providers, staff turnover, and system changes.

• Hotline reports and complaints.

• Prior audit findings.

Ranking Risks

For each potential risk area, consider:

• Likelihood that errors occur.

• Financial impact if errors occur.

• Regulatory and enforcement attention.

• Volume of claims affected.

• Results of prior reviews.

Rank risks as high, medium, or low, and use the ranking to build the annual audit plan.

Step 3: Choose Audit Types

An internal audit program usually combines several types of reviews.

Baseline Audits

A baseline audit measures current performance in a risk area. It is often the first audit of a new service, provider, or process and sets a starting point for future comparison.

Focused or Targeted Audits

A focused audit reviews a specific risk area, such as a high-risk code, service line, or provider.

New Provider and New Service Audits

New clinicians and new services carry higher risk. Many organizations review a set number of claims for each new provider within the first few months.

Follow-Up Audits

A follow-up audit checks whether corrective actions worked.

Prospective and Retrospective Audits

Prospective, or prebill, audits review claims before they are submitted. They allow errors to be corrected before billing and avoid overpayments. Retrospective audits review claims after payment. They can identify overpayments that must be returned and measure real-world performance.

Process Audits

Process audits test workflows rather than claims, such as ADR intake, signature tracking, order management, and charge capture.

Monitoring

Monitoring is ongoing review of data, such as denial rates, coding distributions, and PEPPER results, to spot trends between formal audits.

Step 4: Decide How Many Claims to Review

Sample size is one of the most common questions in building an audit program. There is no single sample size required for every internal audit. The right number depends on the audit's purpose.

Probe Samples for Discovery

When the goal is to find out whether a problem exists, a probe sample is often enough. Many organizations use small samples for routine reviews, such as a set number of encounters per clinician or a set number of claims per service. CMS's own Targeted Probe and Educate program reviews a limited number of claims per round, generally 20 to 40, to identify errors and provide education. A probe sample is useful for spotting issues and directing education, but it is not designed to estimate the total amount of overpayment in a population.

Statistically Valid Random Samples for Estimation

When the goal is to estimate the financial impact of errors across a group of claims, a statistically valid random sample is needed. CMS's Medicare Program Integrity Manual, Chapter 8, describes the steps Medicare contractors follow when using statistical sampling to estimate overpayments, including defining the universe and sampling frame, selecting a random sample, and calculating the estimate. OIG makes its RAT-STATS software available for selecting random samples and analyzing results.

If audit results might support a self-disclosure to OIG, note that OIG's Health Care Fraud Self-Disclosure Protocol requires a damages estimate based on either a review of all affected claims or a statistically valid random sample of at least 100 claims, using the mean point estimate.

Full Reviews

In some cases, especially when the universe of claims is small or a serious problem has been identified, reviewing all affected claims may be appropriate.

Factors That Affect Sample Size

• The purpose of the audit: discovery, measurement, or estimation.

• The size of the universe.

• How much claim values vary.

• The expected error rate.

• The level of precision needed.

• Available resources.

Practical Sampling Tips

• Define the universe clearly, such as all paid claims for a service during a specific period.

• Use random selection and document the method, random number source, and seed so the sample can be replicated.

• Consider stratification when claim values vary widely.

• Involve a qualified statistician when results will be used to estimate overpayments or may be shared with the government.

• Keep a record of the sample and the results in the audit work papers.

An Escalation Approach

Many organizations use a stepped approach:

• Start with a probe sample.

• If the error rate is low, document the results and continue routine monitoring.

• If the error rate is high or errors suggest a systemic problem, expand the review, often to a larger or statistically valid sample.

• If findings suggest potential overpayments beyond the sample, consult counsel about the 60-day rule and whether a full review or statistical estimate is needed.

Step 5: Set Audit Frequency

OIG does not prescribe a single audit schedule for all providers. Frequency should reflect risk.

Common Practices

• High-risk areas are often audited at least annually, and sometimes quarterly.

• New clinicians are often reviewed within their first few months, then on the regular schedule.

• New services are reviewed soon after launch.

• Areas with prior findings are reviewed again after corrective actions, often within three to six months.

• Monitoring of key data, such as denial rates and PEPPER, is often done monthly or quarterly.

• Lower-risk areas may be reviewed on a rotating basis over several years.

Triggers for Additional Audits

• New OIG reports or contractor review topics for your services.

• Outlier status in PEPPER or a CBR.

• Rising denial rates.

• Changes in coding or coverage rules.

• System changes, such as a new EHR or billing platform.

• Staff turnover in coding or billing.

• Hotline reports or complaints.

• An ADR or contractor review in a related area.

The Annual Audit Plan

Each year, the compliance officer should prepare an audit plan based on the risk assessment. The plan should list:

• Audit topics and objectives.

• Planned timing.

• Sample approach.

• Responsible auditors.

• Reporting expectations.

The compliance committee should approve the plan, and the plan should be updated during the year as new risks appear.

Step 6: Perform the Audit

Use the Right Standards

Auditors should apply the same standards payers apply:

• Medicare statutes and regulations.

• National and Local Coverage Determinations.

• Medicare manuals, including documentation and signature requirements.

• Coding guidelines.

• Payer contracts and policies for commercial and Medicaid claims.

• The rules in effect on the dates of service.

Use Qualified Reviewers

Certified coders should review coding. Clinicians should review medical necessity and level-of-care questions.

Define Errors Consistently

Use consistent error categories, such as:

• Insufficient documentation.

• Medical necessity not supported.

• Incorrect coding, including upcoding and downcoding.

• Missing orders, certifications, or plans of care.

• Missing or invalid signatures.

• Incorrect units or modifiers.

• Billing errors.

Track whether each error caused an overpayment, an underpayment, or no financial impact.

Document Work Papers

Keep records of the sample, the standards applied, claim-level findings, and the reviewer for each claim.

Step 7: Report Findings

An audit report should include:

• Objective and scope.

• Sample method and size.

• Standards applied.

• Error rates by category, provider, and service.

• Financial impact.

• Root cause analysis.

• Recommendations.

Report results to the compliance committee and, as appropriate, to the governing body. OIG's guidance emphasizes the board's role in overseeing the compliance program, so summaries of significant findings and corrective actions should reach the board.

Step 8: Write and Track Corrective Action Plans

A corrective action plan turns audit findings into change.

Elements of a Strong Corrective Action Plan

• A description of the problem and its root cause.

• Specific actions to fix the problem.

• The person responsible for each action.

• Deadlines.

• How success will be measured.

• A follow-up audit date.

Common Corrective Actions

• Targeted education for clinicians, coders, or billing staff.

• EHR template changes to prompt for required elements.

• Policy and procedure updates.

• Prebill review for high-risk services or individual providers until accuracy improves.

• Workflow changes for orders, certifications, and signatures.

• System edits to prevent billing errors.

• Changes in staffing or supervision.

• Disciplinary action when appropriate, applied consistently.

Tracking Corrective Actions

Use a log that lists each corrective action, its owner, its deadline, and its status. Review the log at each compliance committee meeting.

Measuring Effectiveness

A follow-up audit should test whether the corrective action fixed the problem. If errors remain, revise the plan.

Step 9: Handle Overpayments

Audits often identify claims that were paid in error. Under 42 CFR 401.305, Medicare providers must report and return identified overpayments within the required timeframe. The rule allows the deadline to be suspended while the provider conducts a timely, good-faith investigation to determine the existence and amount of related overpayments, subject to time limits. The lookback period is six years.

Practical Steps

• Escalate potential overpayments to the compliance officer promptly.

• Determine whether the issue may affect claims outside the sample.

• Work with counsel on whether a broader review is needed and how to quantify the overpayment.

• Document the investigation and its timing.

• Report and return overpayments through the appropriate process, such as the MAC's voluntary refund process, or, in more serious cases, OIG's Self-Disclosure Protocol or CMS's Self-Referral Disclosure Protocol.

• For Medicaid and commercial payers, follow state rules and contract requirements.

Underpayments

Audits may also find underpayments. Providers may be able to correct these within payer timelines, but the main focus of compliance auditing should remain accuracy, not revenue.

Step 10: Protect Privilege When Appropriate

When an audit may uncover legal issues, consider having counsel direct the work. Communications with counsel and work performed at counsel's direction to help provide legal advice may be protected, depending on the circumstances and applicable law. For routine reviews, privilege may be less important. Decide in advance.

Building the Program in a Small Practice

Smaller providers can build effective programs with limited resources:

• Focus on the highest-risk services.

• Review a small number of encounters per clinician on a regular schedule.

• Use outside reviewers for periodic independent audits.

• Use free CMS and OIG resources, including PEPPER, CBRs, MLN materials, and RAT-STATS.

• Keep a simple corrective action log.

• Report results to practice leadership regularly.

Building the Program in a Larger Organization

Larger organizations often need:

• A dedicated audit team or department.

• Audit software and data analytics.

• Statisticians for estimation work.

• Audit plans for each department or service line.

• Regular reporting to the compliance committee and board.

• Coordination with internal audit, legal, finance, and revenue cycle teams.

Metrics to Track

• Error rate by service, provider, and error type.

• Financial impact of errors.

• Number of audits completed against the plan.

• Corrective actions completed on time.

• Results of follow-up audits.

• Denial rates and ADR outcomes.

• Overpayments reported and returned.

• Training completion.

Common Mistakes

• Auditing without a risk assessment.

• Using probe samples to estimate overpayments.

• Failing to document the sampling method.

• Applying standards that differ from payer standards.

• Using reviewers without the right qualifications.

• Producing findings without root cause analysis.

• Writing corrective action plans without owners or deadlines.

• Never conducting follow-up audits.

• Ignoring potential overpayments identified by audits.

• Not reporting results to leadership and the board.

A Hypothetical Example

A multispecialty group reviews its PEPPER-like data and CBRs and finds that two of its physicians bill the highest level of established patient visits far more often than peers. The compliance officer adds evaluation and management coding to the annual audit plan as a high-risk area.

A probe sample of 10 encounters per physician shows a high rate of overcoding for both physicians. The compliance officer consults counsel, who directs a statistically valid random sample of the affected visits over the prior year. The results are used to estimate the overpayment, which the group reports and returns. The group provides one-on-one education, places both physicians on prebill review for three months, and updates its EHR template. A follow-up audit six months later shows significant improvement, and the physicians return to routine monitoring.

Frequently Asked Questions

How many claims should an internal audit review?

It depends on the purpose. Small probe samples help discover problems. Statistically valid random samples are needed to estimate overpayments. OIG's Self-Disclosure Protocol requires at least 100 claims when sampling is used to estimate damages for a disclosure.

How often should providers audit?

There is no single required schedule. High-risk areas are commonly audited at least annually, with follow-up audits after corrective actions and additional audits triggered by new risks.

What should a corrective action plan include?

The problem, its root cause, specific actions, owners, deadlines, measures of success, and a follow-up audit date.

What happens if an audit finds overpayments?

Providers must evaluate their obligations under the 60-day rule, conduct a timely, good-faith investigation if needed, and report and return overpayments as required.

Should internal audits be privileged?

When audits may uncover legal issues, counsel may direct the review to help protect privilege. Routine audits may not need privilege.

Conclusion

An internal audit program is one of the most effective tools providers have to reduce audit risk. By grounding the program in a risk assessment, using the right type of sample for each purpose, auditing high-risk areas on a regular schedule, writing corrective action plans with clear owners and deadlines, following up to confirm results, and handling overpayments promptly, providers can find and fix problems before contractors do and demonstrate that their compliance programs work.

How HealthBridge Can Help

HealthBridge is a healthcare management consulting firm that helps providers design and run internal audit programs, including risk assessments, annual audit plans, sampling design, documentation and coding reviews, corrective action plans, and follow-up audits. When privilege is important, we work under the direction of our clients' legal counsel. If you would like help building or strengthening your internal audit program, please get in touch with us. We will be happy to help you with this topic.

References

• U.S. Department of Health and Human Services, Office of Inspector General. General Compliance Program Guidance. https://oig.hhs.gov/compliance/general-compliance-program-guidance/

• U.S. Department of Health and Human Services, Office of Inspector General. Compliance Guidance. https://oig.hhs.gov/compliance/compliance-guidance/

• U.S. Department of Health and Human Services, Office of Inspector General. Health Care Fraud Self-Disclosure Protocol. https://oig.hhs.gov/compliance/self-disclosure-info/

• U.S. Department of Health and Human Services, Office of Inspector General. RAT-STATS Statistical Software. https://oig.hhs.gov/compliance/rat-stats/

• U.S. Department of Health and Human Services, Office of Inspector General. Reports and Publications. https://oig.hhs.gov/reports/all/

• Centers for Medicare & Medicaid Services. Targeted Probe and Educate. https://www.cms.gov/data-research/monitoring-programs/medicare-fee-service-compliance-programs/medical-review-and-education/targeted-probe-educate-tpe

• Centers for Medicare & Medicaid Services. Comprehensive Error Rate Testing (CERT). https://www.cms.gov/data-research/monitoring-programs/improper-payment-measurement-programs/comprehensive-error-rate-testing-cert

• Centers for Medicare & Medicaid Services. Medicare Program Integrity Manual, Chapter 8, Section 8.4, Statistical Sampling for Overpayment Estimation. https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/pim83c08.pdf

• Centers for Medicare & Medicaid Services. Self-Referral Disclosure Protocol. https://www.cms.gov/medicare/regulations-guidance/physician-self-referral/self-referral-disclosure-protocol

• Centers for Medicare & Medicaid Services. Medicare Fee-for-Service Compliance Programs. https://www.cms.gov/data-Research/monitoring-Programs/medicare-Fee-Service-Compliance-Programs

• Electronic Code of Federal Regulations. 42 CFR 401.305, Requirements for Reporting and Returning of Overpayments. https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-A/part-401/subpart-D/section-401.305