Where Should You Audit Next? 8 Coding and Billing Risk Areas on OIG’s Radar

Many coding, billing, and compliance teams set next year’s audit plan in Q4. OIG audit priorities for 2026 are a useful starting point, because the HHS Office of Inspector General (OIG) publishes the areas it is reviewing through its Work Plan and audit reports.

Compliancy Group hosted a webinar with C.J. Wolf, MD, Senior Compliance & Auditing Educator, to discuss where to focus your next audits. In this article, we explore the eight coding and billing risk areas he covered, what recent OIG findings show about documentation, and how to prioritize and defend your audit plan.

An audit plan built from your current risk assessment covers the areas most likely to produce errors this year, including areas last year’s plan did not address.

Starting from last year’s schedule keeps known areas under review. It can also miss services that have grown in volume, codes your providers recently started billing, and topics that OIG or your Medicare Administrative Contractor (MAC) began reviewing after the last plan was set.

OIG’s General Compliance Program Guidance (GCPG), released in November 2023, says the compliance committee “should include in the compliance work plan a schedule of audits to be conducted based on risks identified by the annual risk assessment.” The committee should also make sure the compliance officer has capacity for additional audits when new risks appear during the year, such as an overpayment investigation that uncovers a possible systemic issue. The GCPG is voluntary, but it is OIG’s current reference for how a compliance program should be structured.

During the webinar, C.J. Wolf, MD, pointed out that dollar value is only one measure of risk. A small error repeated across many claims can add up to a large overpayment over several years, so high-volume, lower-dollar services also deserve review.

OIG’s audit activity shows where federal reviewers are testing claims, and it works best as one input to your risk assessment.

Projects in the OIG Work Plan 2026 describe audits and evaluations that OIG has announced or has underway. Published audit reports add the sample size, error rate, and documentation that failed review.

An OIG audit area does not require every provider to run the same audit. A hospital that does not implant neurostimulators can leave that area out, while a practice that bills a high volume of chronic care management probably should include it.

The eight areas below come from OIG Work Plan projects and audit reports that C.J. Wolf reviewed in the September 30 webinar.

Use the table to shortlist the areas that match your services.

In OIG’s recent home health and sacroiliac (SI) joint injection audits, claims failed when the medical record did not support what was billed.

The home health figures show how much is at stake. In 2023, Medicare paid home health agencies about $16 billion for services to about 2.8 million people in traditional Medicare, and the Comprehensive Error Rate Testing (CERT) program run by the Centers for Medicare & Medicaid Services (CMS) put the improper payment rate for home health claims at 7.7 percent, or about $1.2 billion, according to OIG’s audit of Deistic Home Health Care. The 2026 audits include these examples:

• Face-to-face (F2F) note unrelated to the primary diagnosis. The claim listed gastritis without bleeding as the primary reason for services, but the F2F note addressed the patient’s pain, mobility, and need for physical therapy.
• Unsupported primary diagnosis. The claim reported a pressure ulcer, but the documentation supported small bowel obstruction, and the corrected code resulted in an overpayment.
• Late plan of care. The physician signed and dated the plan of care after the claim was submitted, which made the related skilled services unallowable.
• Late Outcome and Assessment Information Set (OASIS) transmission. The agency transmitted OASIS data to CMS more than 30 days after completing the comprehensive assessment, which is a condition of payment.

The SI joint injection audit grouped its findings into five categories: indications of pain, imaging and pain assessments, diagnostic or therapeutic injection requirements, limitations of coverage, and therapeutic billing for sessions that should have been billed as diagnostic. You can turn each failure type into a checklist question, sample the services closest to the ones OIG reviewed, and record results in a format you can compare with the next audit cycle.

Attendees raised other topics during the Q&A that organizations are evaluating, although they are not necessarily formal OIG priorities.

• Clinical documentation improvement (CDI) queries. Whether queries avoid leading the provider toward a particular diagnosis.
• G2211. Whether the add-on code is billed only when the record shows an ongoing, longitudinal care relationship.
• High medical decision-making (MDM) evaluation and management (E/M) services. Whether documentation supports the visit level billed.
• Molecular pathology. Whether test selection and coding match the order and any applicable coverage policy.
• Device credits. Whether the hospital reports manufacturer credits for replaced devices.

An organization that outsources billing remains responsible for claims submitted under its name, so its audit plan should include access to the billing company’s claims data. Audits of SI joint injections and neurostimulator implants should also confirm the type, duration, and outcome of failed conservative therapy in the chart.

A risk-based plan should change throughout the year as new findings and risk signals emerge, with a formal review at least once a quarter.

Rank each area by how closely it applies to your organization and what errors in it could cost, then fit the schedule to your available audit hours.

Compare the eight areas with the results of your annual healthcare compliance risk assessment, then weigh each one against these factors:

• Claim volume. The number of claims you submit for the service each year.
• Financial exposure. The dollar value of those claims and the overpayment an error rate like OIG’s would produce.
• Regulatory scrutiny. Active OIG projects, MAC reviews, or recent enforcement in the area.
• Organizational relevance. Service lines that are growing, new to your organization, or handled by new staff.
• Audit history. Errors found in earlier audits and whether they recurred after corrective action.

Then set the scope and frequency of each audit to match your resources. C.J. Wolf gave the example of a team with 400 audit hours for the year, which should not schedule all 400 at the start because new issues will come up.

Use this as a starting template. Replace each row with your own ranked areas, then confirm that the total sample across all rows fits the auditor hours you have for the year.

A defensible audit plan shows a reviewer why you chose each area, how each audit was performed, and what your organization did with the findings.

1. Use consistent checklists. Build each checklist from the coverage requirements for the service and adjust it for the LCD that applies at each location, so two auditors reviewing the same chart apply the same criteria.
2. Document why each area was selected. Record the risk assessment results, claims data, and OIG activity behind each audit and its frequency.
3. Keep a complete audit trail. Store samples, findings, provider education, and corrective actions in one place, with dates.
4. Feed audit history into the next risk assessment. Review areas with recurring errors more often, and move areas with consistently clean results to a longer cycle.

C.J. Wolf described the goal as being able to show a reviewer three things: the risk assessment, the audit plan built from it, and a record of completed audits.

A well-kept spreadsheet can support a small program with one or two auditors. Keeping criteria consistent and records complete gets harder when several auditors work across locations with different LCDs.

Audit Manager+ by Compliancy Group is a web-based healthcare auditing platform for provider, coding, and documentation audits. Teams can turn each covered indication, limitation, and documentation requirement into a checklist item that auditors answer on every chart, customize audit guidelines, scoring logic, and workflows to their methodology, and keep a documented history of completed audits. To compare platforms, see the Audit Manager+ buyer’s guide.

Request a Demo

The full recording covers each audit area in more depth, along with the OIG reports behind it and the questions attendees asked.

C.J. Wolf, MD, Senior Compliance & Auditing Educator,  presented “Where Should You Audit Next? Prioritizing Coding & Billing Risk” on September 30, 2026. He covered what OIG expects an organizational audit plan to include, the eight audit areas in this article, and how auditing teams run and document the work once the plan is set.

Watch the Recording