Nobody audits their billing for fun.

Practices order audits when something looks off: denials climbing, the A/R report stretching past 90 days, a new provider joining, or a payer letter landing on the desk with a records request. An audit is how you find out what is actually happening between the exam room and the bank account.

A medical billing audit is a structured review of a practice's coding, documentation, claims, and payments, checked against payer rules and federal compliance requirements. The auditor reads what went out the door and compares it with what should have gone out. The output is a report of what is wrong, how much it costs, and what to fix first.

When practices order one

Audits get ordered after a trigger, not on a calendar. The common triggers:

  • Denials are climbing, and one audit firm ranking for this service names a first-pass denial rate above 5% as its trigger point. You don't need their number. If your clean-claim rate is sliding, an audit finds the pattern behind it.
  • Your A/R is aging: claims sitting past 60 or 90 days are claims that may stop paying. Timely-filing windows close, and they close quietly: Medicare's is one calendar year from the date of service, and commercial contracts are often shorter.
  • A vendor just changed. Switching billing firms is the classic blind spot. The new firm inherits the old firm's mess, and nobody documented what "normal" looked like before the handoff.
  • Nothing has ever been checked. A practice that has never had an external audit doesn't know what it doesn't know. That is the whole point of the exercise.
  • A payer is asking questions. A records request from Medicare or a commercial payer is its own category. It gets its own section below.

If a vendor switch is part of the story, read when outsourcing makes sense first. The framework there covers choosing what comes next, not just who handles the billing.

What an audit examines

An audit moves through the revenue cycle layer by layer. Here is the standard stack, in the order most auditors work it.

Coding accuracy

The auditor samples claims and checks the codes against the clinical note: CPT codes for what was done, ICD-10 codes for why, modifiers for the circumstances. Upcoding, where the code pays more than the documentation supports, and downcoding, where the practice bills below what it did, both show up here. Modifier use gets its own pass. Modifiers like -25 and -59 change how a claim prices, and auditors flag them routinely.

Documentation and medical necessity

The note has to support the code. A level-4 visit code needs level-4 documentation: the history, exam, and decision-making recorded well enough that a stranger can see why the visit was billed at that level. "Medical necessity" is the payer's phrase for prove it mattered. Auditors look for copy-pasted notes, unsigned entries, and gaps between what was documented and what was billed.

Claim and denial data

The auditor pulls your claim history and reads the denials. Denial codes, grouped by cause, tell the story: eligibility misses, authorization gaps, coding errors, timely filing. One practice's denial problem is usually a handful of repeating patterns, not dozens of random ones. For the pattern catalog, start with claim denials: common causes and fixes.

Accounts receivable and write-offs

The aging report gets read bucket by bucket. What is sitting past 60, 90, 120 days. Which buckets are still recoverable and which are write-offs, and whether the write-offs are contractual, meaning the payer's rules took the money, or administrative, meaning someone gave up on it. A clear write-off policy is part of compliance. An unclear one is where money quietly dies.

Payer contract variance

One ranked vendor's audit page describes a contract-variance check: contracted rate against expected payment against actual payment, line by line. Comparing what arrived against what the contract promised turns up underpayments that a single remittance hides.

Credentialing and enrollment

Only one of the ranking audit pages (Resilient MBS's) includes this, and it belongs in all of them. If a provider is not enrolled with a payer, or the enrollment lapsed, the claims don't pay no matter how perfect the coding is. Audits check the roster against payer participation and catch lapsed enrollments and missed revalidations before they turn into a quarter of denials.

Compliance risk

This is the part that is not about money. Billing errors are also legal exposure. The Affordable Care Act's 60-day rule requires practices to report and return identified Medicare and Medicaid overpayments within 60 days. False Claims Act liability attaches to knowingly submitting false claims, and "knowingly" covers reckless disregard, not just intent. An audit finds the errors while they're still yours to fix. That is the reason the compliance section exists.

The audit types, compared

Internal self-audit External coding audit Pre-bill (prospective) Post-payment (retrospective) Payer / government audit
Who runs it Your own staff An outside firm Your staff or a vendor An outside firm The payer or a CMS contractor
What it checks Samples of recent claims Coding, documentation, the full revenue cycle Claims before they go out Claims after payment Your claims against their rules
Best for Ongoing hygiene Independent verification Catching errors before submission Finding underpayments and overpayments You do not choose this one
Weakness Your staff audits its own work Costs money and staff time Slows the claim flow The money already moved Adverse findings carry penalties

You will meet two of these: the external coding audit you commission, and the payer audit you do not.

How an audit runs

  1. Scope. You and the auditor agree on what is being checked, the date range, and which providers or payers are in scope. Everything after this follows from the agreement, so read it like a contract.
  2. Data pull. The auditor needs claim files, remittance advices, payer contracts or fee schedules, and access to a sample of clinical notes. Nothing leaves your control without a signed Business Associate Agreement. HIPAA treats the auditor as a business associate, full stop.
  3. Sampling. Auditors rarely read every claim. They pull a statistical sample, or they stratify: high-dollar claims, new providers, problem payers, your most-billed codes. Both methods are legitimate. Ask which one is being used and why.
  4. Review. Coders check codes against notes. Revenue-cycle reviewers check claims against payer rules. The two tracks run in parallel, which is why a real audit team pairs certified coders with revenue-cycle people instead of sending one generalist.
  5. Validation. A serious auditor walks the preliminary findings past your team before finalizing. Some of those "errors" are your workflow doing something unusual on purpose. The validation pass separates real findings from misunderstandings.
  6. Report and plan. The deliverable, covered next. Then a corrective action plan: what changes, who owns it, by when.

The audit runs on copies of your data, so daily billing keeps moving. The validation step is the one part that takes your staff's time.

What the report should contain

If the report is a summary and a handshake, you bought the wrong audit. A usable report has:

  • An executive summary a non-biller can read: what was checked, the headline findings, the dollar exposure, the priority fixes.
  • Claim-level findings, each tied to a specific claim, code, and note, with a severity rating. Severity is the auditor's call, so ask how they score findings before the audit starts: critical means fix now, compliance exposure; moderate means fix this quarter, revenue impact; minor means opportunity.
  • A denial root-cause analysis, grouped by cause with the count and dollar value attached to each.
  • An A/R recovery list: which aged claims are still collectible, and what stands in the way of each one.
  • Timely-filing exposure, sorted by days remaining. This section turns into a to-do list with real deadlines.
  • Payer performance: which payers pay cleanly, which underpay, which deny on pattern.
  • A corrective action plan with owners and dates, plus a follow-up check to confirm the fixes stuck.

The severity scoring is the part most audit pages skip. Without it, a report with forty findings reads as forty equal problems. Forty equal problems get fixed in whatever order is easiest, which is never the order that matters.

What an audit costs

Audit pricing is less transparent than it should be, which is strange for a service that sells transparency. The models in the market:

  • A free audit: two of the firms ranking for this keyword offer the audit itself free. The audit is the lead generator. The money is in the contract that follows, whether that's ongoing billing services or a remediation engagement. A free audit isn't a scam. It's a sales funnel. Read the scope carefully and ask what happens to your data if you don't sign.
  • A flat fee: at least one firm publishes a fixed price ($199 for an RCM audit, per its own site). Flat fees are predictable, and the scope is usually narrow, so check what is excluded.
  • Hourly or per-chart pricing, common for narrow coding audits. The price scales with sample size.
  • A percentage of recovered revenue: the auditor takes a cut of what the audit recovers. An auditor paid on recovery is paid to find underpayments. Overpayments, which you may have to return, are not what the fee rewards.

The more useful question is what the pricing model rewards the auditor to find. Ask that one directly.

Self-audit vs hiring an auditor

A practice can audit itself. Nobody will stop you. The question is whether the result is useful.

Self-audit works for hygiene. Pull your top five denial codes from the last quarter. Read the ten oldest claims in A/R. Check the timely-filing dates on anything past 90 days. Sample twenty notes against their codes. That's a real audit, just a small one, and doing it quarterly keeps the obvious problems from compounding.

Hire out for independence. An external auditor has two things your staff doesn't: distance and pattern memory. Distance, because your billers would be auditing their own work. Pattern memory, because an auditor who has reviewed fifty practices knows what a healthy denial mix looks like from the outside. Payers also weight an independent review differently from a self-check, which matters when findings get disputed.

A workable middle ground: self-audit quarterly, external audit annually or after a trigger. One firm ranking for this service recommends annual audits, which is a reasonable cadence for a stable practice.

When the payer audits you

Sometimes the audit letter comes to you. Medicare runs contractor audits through RACs, the Recovery Audit Contractors, and the CERT program, Comprehensive Error Rate Testing. The federal OIG, the Office of Inspector General, runs its own reviews. Commercial payers run theirs. The mechanics are the same each time: a records request, a deadline, and a findings letter.

Three rules. Respond on time. The deadline in the letter is real, and silence reads as agreement. Send what was asked for, nothing extra. A records request is scoped. Volunteering the next three years of claims isn't helpful. Get the findings reviewed before you accept them. Payer auditors make coding errors too, and their findings are appealable. If the letter alleges overpayments, remember the 60-day clock: once an overpayment is identified, it has to be reported and returned.

A clean internal audit history is your best defense here. A practice that can show it checks its own work gets a different conversation than one that can't.

How to pick an audit firm

This is the part no ranking page covers well, so here is the checklist:

  1. Certified coders on the team. Look for AAPC credentials: CPC for coding, CPMA for auditing specifically. An audit run by uncertified reviewers is an opinion, not a finding.
  2. A signed BAA before any data moves. Non-negotiable. If the firm is casual about this, end the conversation.
  3. Independence. The firm shouldn't be auditing claims it submitted. If your billing vendor offers to audit its own work, get a second firm.
  4. Written methodology. Ask how they sample, what standards they audit against (CMS guidance, payer policies), and how they score findings. Vague answers here predict vague reports.
  5. A report sample. Ask to see a redacted one. You will learn more from the sample than from the sales call.
  6. Specialty experience. Coding rules vary by specialty, and a firm without experience in yours will miss errors a specialist would catch.
  7. What happens after. Does the engagement include the corrective plan and the follow-up check, or does it end at the findings?

Our medical coding audit service page lists firms that offer this work, matched from the services they publish on their own sites. Our methodology explains how those listings are built, so you know what the match is based on before you start calling firms.