How to Build a Risk-Based Audit Plan: Choosing Where to Audit Next

A risk-based internal audit is a structured review of your highest-risk coding and billing areas. These are the areas where errors are most likely to happen and would cost the most to fix. A risk-based audit plan lists which providers, coders, and services you will audit, in what order, and how often. To build the plan, you use two types of information. The first is external enforcement data, such as the OIG Work Plan. The second is your own claims and audit data. This guide will walk you through which signals to watch for, how to score and rank risks, the steps to build your plan, and when to review and update it.

A risk-based audit plan focuses your audits on the areas where coding errors are most likely and would cost the most. These areas can be specific providers, codes, services, or billing practices. For example, you might audit a provider who bills more high-level E/M visits than similar providers, a service that uses codes that changed this year, or a modifier that payers are denying more often. Lower-risk areas, such as routine services that passed past audits, are still audited, but less often.

An audit plan is risk-based when it decides how much to audit each area based on two questions. First, how likely is it that this area has errors? Second, how much would those errors cost if no one caught and fixed them? Areas with a high score on both questions get audited first and more often.

This approach follows federal guidance. The HHS Office of Inspector General (OIG) issued its General Compliance Program Guidance (GCPG) in November 2023, and Element 6 of that guidance groups risk assessment, auditing, and monitoring together. OIG recommends conducting compliance risk assessments at least annually and using the results to decide where auditing and monitoring should focus.

For coding and billing teams, the risk-based audit plan puts that recommendation into practice as a written schedule. It also connects your audit work to the other six elements of an effective compliance program, since audit findings feed training, policy updates, and corrective action.

Rotation-based auditing reviews each provider, coder, or department on a fixed schedule, usually once a year, with the same number of encounters for each. The main limitation is that it treats every area the same, even though some areas carry more risk than others. For example, a surgeon billing high-dollar procedures under newly changed codes gets the same review as a provider with three clean audits. This leaves less auditor time for the areas most likely to have errors.

Risk-based auditing decides what to review, how often, and how many encounters to sample based on where errors are most likely and would cost the most. High-risk areas are reviewed first, more often, and with larger samples, so errors are found and fixed sooner. Low-risk areas are still reviewed, but less often. The plan also records why each area was or was not audited, which helps when your compliance committee or an outside reviewer asks.

Risk signals come from two sources: outside programs that show where federal reviewers are focusing, and your own data that shows where errors are occurring inside your organization.

External risk signals come from government agencies, Medicare contractors, and payers outside your organization. Here are some examples:

• OIG Work Plan. Lists the audits and evaluations OIG has underway or planned, and OIG adds items throughout the year. Topics that match your services are candidates for internal review.
• RAC approved issues. CMS publishes the topics Recovery Audit Contractors (RACs) are approved to review, sorted by provider type and review type. A topic on this list is one a contractor can request records for.
• CERT improper payment findings. The Comprehensive Error Rate Testing (CERT) program reviews a random sample of Medicare fee-for-service claims each year and reports error rates by claim and service type.
• MAC Targeted Probe and Educate topics. Medicare Administrative Contractors (MACs) select providers for Targeted Probe and Educate (TPE) review using billing data, and many publish the services under review.
• CMS Comparative Billing Reports. A Comparative Billing Report (CBR) compares one provider’s billing patterns with peers in the same state and nationwide.
• PEPPER, where applicable. The Program for Evaluating Payment Patterns Electronic Report (PEPPER) applies to facilities such as hospitals, skilled nursing facilities, hospices, and home health agencies, not to physician practices.

Internal data tells you where that risk exists in your organization. The most useful internal signals include:

• Denial trends. Rising denials for a code, modifier, or payer often point to a documentation or coding pattern.
• Previous audit error rates. Areas with high error rates in past audits are more likely to have errors now.
• E/M level distribution compared with peers. A provider who bills a much higher share of level 4 and level 5 visits than specialty peers warrants review.
• New providers or coders. People new to your organization have not yet learned your documentation standards or payer rules.
• New services. A new service line brings unfamiliar codes, coverage rules, and documentation requirements.
• Annual code-set changes. ICD-10-CM updates take effect October 1, and CPT updates take effect January 1, so services that use new or revised codes are good candidates for early review.
• Payer contract requirements. Some commercial contracts set their own coding, documentation, or audit terms.
• HCC and risk adjustment exposure. Organizations with Medicare Advantage or other risk-based contracts depend on accurate diagnosis coding for payment.
• CMS and payer newsletters. CMS’s MLN Matters and payer bulletins, such as UnitedHealthcare’s Network Bulletin and Aetna’s OfficeLink Updates, announce coding and billing changes.
• Specialty society publications. These track recurring billing issues in your specialty, but their guidance doesn’t always match payer rules.

The overlap between the two lists sets your starting priorities. An OIG topic for a service you never bill can stay low on the list. A topic you bill at high volume, with rising denials and a new coder, belongs near the top.

A coding audit risk assessment scores each candidate area on likelihood and impact, then multiplies the two scores to produce a priority ranking.

The formula is risk priority = likelihood × impact. Scoring each factor separately lets you show the compliance committee exactly why one area ranks above another.

Likelihood measures how probable it is that an area has errors. Past audit error rates and frequent denials are strong signs. High claim volume, new codes or services, and attention from OIG, RACs, or your MAC also raise the likelihood score.

Impact measures what an error would cost if no one caught it. Start with the dollar value of the claims and any repayment you might owe. Identified Medicare and Medicaid overpayments must be reported and returned within 60 days, so areas with large potential overpayments score higher.

A three-point scale works well for most teams. Rate likelihood and impact from 1 (low) to 3 (high), and multiply. Scores of 6 to 9 are high priority, 3 to 4 are medium, and 1 to 2 are low. The table below shows how this works with illustrative examples.

A weighting factor raises the score of areas that make up a larger part of your billing. Two common measures for setting the weight are:

• Share of dollars billed. The area’s billed dollars divided by your total billed dollars. Use this when financial exposure matters most.
• Share of claim volume. The area’s number of claims or codes divided by your total. Use this when an error would repeat across many claims.

Choose one measure and use it for every area. Then turn the share into a multiplier. For example, use 1.0 for under 5 percent, 1.25 for 5 to 15 percent, and 1.5 for over 15 percent. Multiply the base score by the multiplier to get the weighted score.

In this example, the revised CPT codes move from medium to high priority because they make up a large share of billed dollars. Write down the measure and multipliers you choose so the same rule applies to every area. Some teams also add weight for areas named in an active OIG or RAC topic..

The ranking tells you what to audit first, and the six steps below turn that ranking into a written workplan with scopes, methods, dates, and owners.

For each audit, write down what you are reviewing and the question the audit should answer. Keep the question narrow, such as “Does Provider A’s documentation support the level 5 visits billed?”

Focused audits review a known risk, while random audits check encounters without a set target. Prospective audits review claims before submission, and retrospective audits review claims that have already been paid.

Choose a sample large enough to answer your scope question and small enough to finish within your available hours. If you need to estimate an overpayment, use a statistically valid random sample. OIG’s free RAT-STATS software helps in three ways:

• Sample size. Enter the total number of claims, and it calculates how many to audit.
• Random selection. Number your claims, and it generates a random list of which ones to review.
• Overpayment estimate. Enter your audit results, and it projects the overpayment across all claims.

Higher-priority risks warrant more frequent review, such as monthly or quarterly. Medium-priority areas can be reviewed semiannually, and lower-priority areas annually. Where code-set changes drive the risk, schedule the first review shortly after the new codes take effect, while there is still time to correct a pattern before it repeats across many claims.

Each audit in the plan needs named individuals assigned to it. Assign four roles:

• Auditor. The person who performs the review and records findings.
• Compliance or coding owner. The person accountable for education and corrective action after the audit.
• Operational owner. The practice manager, department lead, or provider who makes process changes.
• Reviewer. The compliance committee member or leader who reviews results and confirms follow-up.

Present your annual coding audit plan, including the ranked list, scoring method, and schedule, to your compliance committee. Record its approval in the meeting minutes.

A risk-based plan should change throughout the year as new findings and risk signals emerge, with a formal review at least once a quarter.

A quarterly review gives you a fixed point to check whether the ranking still holds. At each review, look for changes in these areas:

• New external risk signals, such as added OIG Work Plan items or newly approved RAC topics
• New internal findings from denials, complaints, or compliance hotline reports
• Changes in error rates for providers, coders, or services already in the plan
• New services, providers, or coders added since the last review
• Changes in payer requirements or contract terms
• Results from audits completed during the quarter

Rescore any area affected by these changes. A provider that passes two focused audits in a row may shift from quarterly to semiannual review, freeing hours for a new risk

A re-audit threshold is the result that sends an area back to the top of your list. Before audits begin, your compliance committee should set the error rate that triggers a re-audit, the time between education and the re-audit, and the next step if results don’t improve.

For each change to the plan, record what changed, why, and the evidence behind it, such as an audit result or denial report. Date each revision so you can explain your decisions if an outside reviewer asks.

Use the table to narrow your list to two or three vendors, then run the side-by-side test below.

Ask each shortlisted vendor to load the same sample encounters from your highest-volume services. If any encounters contain PHI, sign a business associate agreement with the vendor first, or use de-identified records.

Next, have two of your auditors score the same encounters in each tool. Compare how closely their scores match, how long each audit takes, and how easily you can summarize the findings for leadership. Similar scores from both auditors show that the tool’s scoring rules are working as intended. Include your revenue cycle leader in the final review, so the person who funds the purchase sees the same results as the auditors.

The table below shows how a finished plan might look for a health system with an employed physician group and a hospital. Every row is illustrative. Your risk areas, scores, samples, and owners will depend on your services, payers, and audit history.

Use this as a starting template. Replace each row with your own ranked areas, then confirm that the total sample across all rows fits the auditor hours you have for the year.

Audit Manager+ helps healthcare auditing teams bring greater consistency and efficiency to that process. Configurable checklists, audit guidelines, and custom error categories help ensure auditors evaluate encounters against the same criteria, while the ability to review both provider and coder performance within a single encounter supports more comprehensive assessments.

By creating a more consistent auditing process and maintaining organized findings, teams can better understand where coding and documentation problems are occurring, evaluate corrective actions, and make more informed decisions about where to focus future audits.

Most coding audit teams have more areas to review than hours to review them. A risk-based audit plan gives you a consistent way to decide which areas come first, a written record of why, and a schedule your compliance committee has approved. Most of the effort comes in the first year, when you gather signals and agree on a scoring method.

To see how other audit teams make these decisions, watch the “Where Should You Audit Next?” webinar recording. In it, CJ Wolf, MD, walks through how to prioritize coding and billing risk when deciding what to audit next.

To see how Audit Manager+ organizes the audits in your plan, request a demo.

Request a Demo