Most practices think about coding compliance reactively — after a payer audit letter arrives, or after a denial pattern gets bad enough to notice. An internal coding audit flips that: it’s a structured, self-initiated review that catches problems before a payer, or the OIG, finds them for you. Done well, it’s also a revenue-integrity tool, not just a compliance chore — it catches undercoding (money left on the table) just as much as upcoding (money you shouldn’t have billed).
Why practices audit their own coding
The Office of Inspector General (OIG) has treated internal auditing as a core element of an effective compliance program since its original 2000 compliance guidance for physician practices, which lists “conducting internal monitoring and auditing” as the very first of seven recommended program elements. In 2023, OIG issued a broader, consolidated General Compliance Program Guidance covering all provider types, reaffirming the same underlying logic in more current language: organizations should “implement auditing and monitoring activities targeted to the specific risks” of their own operations. Worth knowing if you go looking for OIG’s guidance directly: the physician-practice-specific 2000 document is still the one OIG links to for practices, even though it’s now paired conceptually with the newer 2023 framework — so don’t be surprised to see both referenced in different places.
Beyond compliance risk (False Claims Act exposure, payer recoupment, RAC/UPIC audit risk), a well-run internal audit program is also a revenue-integrity check. It’s just as capable of finding undercoding — services billed at a lower level than the documentation actually supports — as it is of finding upcoding. Undercoding isn’t a safe default; it’s still a documentation/process failure, and in risk-adjustment contexts it also understates how sick your patient population actually is.
Audit types: pick the right tool for the question you’re asking
Prospective (pre-bill) vs. retrospective (post-bill): A prospective audit reviews claims before submission, catching errors before money moves — but it slows the billing cycle and is harder to scale across high volume. A retrospective audit reviews claims after submission or payment, which is easier to operationalize and allows a deeper look, but any errors found have already gone out the door, which can trigger repayment obligations (more on that below). Larger hospital-based coding operations sometimes add a third category, concurrent review, checked during the encounter or at discharge.
Random-sample vs. focused/targeted: A random sample gives a defensible, unbiased snapshot of overall accuracy — useful for an annual baseline compliance check, and the right approach if you might ever need to present the results externally. A focused or “judgmental” audit targets a specific suspected risk area: one provider, one CPT code family, one payer, a new coder still ramping up, or a code that’s been driving denials. Both have a place; most mature audit programs use focused audits for known risk areas and periodic random audits for the overall baseline.
Internal vs. external (third-party): Internal audits are cost-effective and use staff who already know the practice, but they only work if the person doing the audit has genuinely independent, qualified coding-audit expertise — an under-qualified internal reviewer can produce a false sense of security that’s arguably worse than not auditing at all. External audits cost more but carry more credibility with outside stakeholders (payers, regulators) precisely because they’re independent. Many compliance programs blend both: internal audits for ongoing monitoring, periodic external audits for validation.
A practical step-by-step method
1. Decide your sample
OIG’s original physician-practice guidance is refreshingly honest that there’s no universal formula here. Its literal language: “there is no set formula to how many medical records should be reviewed, [but] a basic guide is five or more medical records per Federal payor… or five to ten medical records per physician.” Treat that as a floor for routine internal monitoring, not a statistically rigorous standard — if you ever need to calculate or defend an extrapolated overpayment amount, that requires actual statistical sampling (OIG publishes a free tool for this, called RAT-STATS), not a fixed small chart count. In practice, many practice-management consultants recommend a wider working range of roughly 10-20 records per provider per audit cycle, which gives you more signal than the bare OIG minimum without requiring a full statistical sample.
2. Decide what you’re reviewing
A thorough audit checks four things, not just “is the code right”: documentation quality (does the note actually support the level and complexity billed — completeness, signature, date), code selection (diagnosis-to-procedure alignment, specificity, unbundling), modifier use (modifiers 25, 59, 51, 50, 24, and 57 are frequently-flagged error points industry-wide), and medical necessity (is the service itself reasonable and necessary for the diagnosis, independent of whether the code is technically correct).
3. Score it — and know that your scoring method changes the number
There’s no single universal accuracy benchmark, but a working range shows up repeatedly across sources: roughly 90% coding accuracy as a baseline acceptable threshold, with 95%+ treated as a maturity target once training and monitoring are established. Here’s the part that’s easy to miss: the grading method itself changes the reported score for identical errors. A “per-code” method gives partial credit line-by-line; an “all-right-all-wrong” (per-record) method fails an entire chart if any single reimbursement-impacting error exists. The same real-world audit can score 97% under a per-code method and 83% under a per-record method. If you’re comparing your practice’s audit score to an industry benchmark, make sure you know which method both numbers actually used — otherwise you’re comparing two different things that happen to share a percentage sign.
4. Build a corrective action plan
When an audit finds a real error pattern, the standard response is targeted, not punitive: retrain on the specific error found, update EHR documentation templates or internal coding cheat-sheets where the gap is structural, re-audit on a shorter interval until the error rate normalizes, and track the trend monthly rather than treating the audit as a one-time event. If the audit uncovers a genuine overpayment, OIG’s guidance is explicit that practices should promptly identify and repay the affected payer — this is where the federal 60-day overpayment rule, and in more serious cases OIG’s Self-Disclosure Protocol, become legally relevant. Those are healthcare-attorney territory, not a DIY step, so loop in counsel rather than trying to navigate disclosure obligations from a blog post.
How often should you audit?
OIG’s baseline recommendation is a first audit covering roughly the initial three months of claims after any new compliance or training initiative, then periodic audits at least once a year afterward — with frequency increasing whenever problems are found. Beyond that annual floor, real-world triggers for a more frequent or targeted audit include: a new provider or coder still ramping up, a noticeable spike in denials for a specific code or payer, a major coding-guideline change (the 2021 E/M documentation overhaul being a recent example), a new EHR or service line, or findings from a prior audit that haven’t fully resolved yet.
What audits actually find
The most detailed government breakdown of E/M coding errors remains a 2012 OIG report analyzing 2010 Medicare claims: it found $6.7 billion in improper E/M payments that year — 21% of all Medicare E/M payments — with 26% of E/M claims upcoded and 19% under-documented relative to the level billed. Worth flagging clearly in any use of this statistic: that data is now over a decade old and predates the 2021 E/M documentation and medical-decision-making overhaul that changed how office/outpatient E/M levels are determined, so treat it as evidence that E/M coding is a persistent risk area rather than as a current-year error rate.
For a genuinely current figure, CMS’s Comprehensive Error Rate Testing (CERT) program reported a Medicare fee-for-service improper payment rate of 6.55% (about $28.83 billion) for the period July 2023-June 2024, broken down by claim type (Part B claims ran highest among the major categories, at 8.44%). It’s important to use this correctly: CERT’s “improper payment” rate includes insufficient documentation and medical-necessity issues generally, not solely coding errors specifically, so it’s a broader indicator of billing-integrity risk rather than a pure coding-accuracy statistic.
Tools and resources
Most practices don’t need to buy anything to get started: a documentation-completeness checklist, a code-to-documentation crosswalk, and a standard modifier/medical-necessity review sheet cover the basics. From there, options scale up: EHR-integrated compliance/audit modules, standalone coding-audit software platforms, OIG’s own free RAT-STATS statistical sampling tool for anything approaching a formal extrapolation, and outsourced third-party audit firms for periodic independent validation. Which combination makes sense depends mostly on practice size and how much of this work you want to keep in-house versus validate externally.
Pingback: HCC Coding and Risk Adjustment: A Beginner’s Guide - medicalbillinginfo.com