CHAE cheat sheet

The IIA Global Internal Audit Standards (2024) became effective 9 January 2025 and organize requirements into five domains, 15 principles, and 52 standards.

Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations.

The chief audit executive (CAE) reports functionally to the audit committee or board and administratively to senior management; functional reporting includes charter approval, audit plan approval, budget, and CAE appointment or removal.

Independence is organizational status plus objectivity; assigning the CAE operational duties or having auditors design controls they later audit impairs independence.

Engagement planning requires documented objectives, scope, risk assessment, criteria, audit program, and resource allocation before fieldwork begins.

Audit evidence must be sufficient, reliable, relevant, and useful; workpapers must support conclusions and be reviewed and supervised.

Quality assurance includes continuous internal assessments, periodic internal assessments, and an external quality assessment at least every five years by a qualified independent reviewer.

Follow-up must monitor management corrective actions and escalate unresolved high-risk findings to the audit committee.

The IIA Three Lines Model (2020) assigns governance to the board, first-line ownership to management, second-line risk and compliance functions, and independent assurance to internal audit.

Risk is commonly scored as likelihood multiplied by impact; inherent risk exists before controls, and residual risk remains after controls operate.

COSO ERM 2017 has five components: governance and culture; strategy and objective-setting; performance; review and revision; information, communication, and reporting.

COSO Internal Control 2013 has five components: control environment, risk assessment, control activities, information and communication, and monitoring activities, supported by 17 principles.

Risk responses are avoid, reduce, share, and accept; acceptance must be within the board-approved risk appetite and documented with accountable ownership.

A HIPAA Security Rule risk analysis must assess risks to confidentiality, integrity, and availability of electronic protected health information and drive a risk management plan.

A risk register records risk description, owner, inherent and residual ratings, controls, treatment plan, and target date; key risk indicators provide early-warning thresholds.

Governance documents include bylaws, audit committee charter, delegation of authority, conflict-of-interest policy, and code of conduct.

The False Claims Act imposes treble damages plus per-claim civil penalties for knowingly presenting false claims; knowingly includes deliberate ignorance and reckless disregard.

Qui tam relators may receive 15% to 30% of recoveries; retaliation against whistleblowers is prohibited.

The Anti-Kickback Statute is criminal and intent-based; it prohibits remuneration to induce referrals for federally reimbursed items or services, subject to regulatory safe harbors.

The Stark Law is civil and strict-liability; it prohibits physician self-referral for designated health services payable by Medicare or Medicaid unless an exception applies.

The 60-day overpayment rule requires a provider to report and return identified Medicare or Medicaid overpayments within 60 days; retaining an identified overpayment can create FCA liability.

The OIG seven compliance elements are written policies and procedures, compliance officer and committee, training and education, communication lines, internal monitoring and auditing, discipline, and corrective action.

Screening the OIG List of Excluded Individuals/Entities before hiring and monthly thereafter prevents CMP exposure from employing or contracting with excluded persons.

EMTALA requires an appropriate medical screening examination, stabilizing treatment, and compliant transfer for emergency conditions without delay based on insurance or ability to pay.

The revenue cycle has front-end (scheduling, registration, eligibility, prior authorization), mid-cycle (charge capture, coding, clinical documentation integrity, claim editing), and back-end (denials, accounts receivable, collections) processes.

Net AR days = net accounts receivable divided by average daily net revenue; gross AR days uses gross receivables and gross revenue.

Clean claim rate = claims accepted on first submission divided by total claims submitted, multiplied by 100.

Denial rate = denied claims divided by total claims; denial write-off rate = denied amounts written off divided by denied amounts.

Charge lag = days from date of service to charge posting; high charge lag delays billing and increases write-offs.

Underpayment variance = contract expected allowed amount minus actual payer paid amount; auditors compare remittance advice to contracted fee schedules or case rates.

Collection rate = cash collected divided by net revenue; uncompensated care includes charity care and bad debt.

Coding audits validate CPT or HCPCS, ICD-10-CM or ICD-10-PCS, modifiers, medical necessity, and National Correct Coding Initiative edits against documentation.

Utilization review applies evidence-based criteria, such as InterQual or MCG, to assess medical necessity, appropriateness, and level of care.

The CMS two-midnight rule generally treats a hospital stay expected to span two midnights as inpatient; the physician order and admission status must be documented.

Case management coordinates discharge planning, transitions of care, and readmission prevention; delays in discharge planning increase length of stay.

Operating room efficiency metrics include first-case on-time starts, turnover time, utilization rate, cancellation rate, and case duration variance.

Credentialing verifies licensure, training, board certification, and sanctions through primary sources; privileging grants specific clinical privileges.

Focused professional practice evaluation (FPPE) assesses new or flagged practitioners, while ongoing professional practice evaluation (OPPE) monitors competency continuously.

Nurse staffing audits compare worked hours per patient day, overtime, agency use, and nurse-to-patient ratios against policy and benchmark data.

Clinical documentation integrity programs query physicians to clarify diagnoses, capture CC or MCC severity, and support accurate DRG assignment.

The Donabedian model evaluates quality through structure, process, and outcome measures; each measure type answers a different question.

Serious reportable events, often called never events, are unambiguous adverse events that should not occur; CMS may deny payment for hospital-acquired conditions.

A sentinel event is an unexpected occurrence involving death or serious physical or psychological injury, or the risk thereof; root cause analysis is required.

Failure mode and effects analysis (FMEA) is prospective and identifies ways a process can fail, whereas root cause analysis is retrospective.

PDSA (plan-do-study-act) cycles test small changes and are a core QAPI improvement method.

Just culture distinguishes human error, at-risk behavior, and reckless behavior when evaluating incident reports and accountability.

CMS Star Ratings, HCAHPS patient experience scores, and core measures are publicly reported quality metrics that affect reputation and payment.

Healthcare-associated infection audits track CLABSI, CAUTI, surgical site infections, and MRSA through standardized surveillance definitions.

The HIPAA Security Rule requires administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of electronic protected health information.

The HITECH Act strengthened breach notification, raised civil penalties, extended certain Privacy Rule requirements to business associates, and promoted electronic health record adoption.

Audit trails must record unique user identification, date and time, access, and activity; HIPAA documentation generally must be retained for six years.

Role-based access and the minimum necessary standard limit electronic protected health information access to job-related needs.

A contingency plan includes data backup, disaster recovery, emergency mode operations, and testing of restoration procedures.

Interoperability standards include HL7 version 2, FHIR, and C-CDA; the 21st Century Cures Act prohibits information blocking except for defined exceptions.

EHR audit techniques detect copy-paste documentation, late entries, template misuse, order-set errors, and inappropriate record edits or deletions.

Promoting Interoperability programs require certified EHR technology and measure electronic exchange, patient access, and public health reporting.

The HIPAA Privacy Rule permits treatment, payment, and health care operations without authorization; other uses generally require a valid authorization or de-identification.

Safe Harbor de-identification removes 18 specified identifiers; Expert Determination requires a qualified person to determine that re-identification risk is very small.

Breach notification to affected individuals is generally required within 60 days of discovery; HHS is notified, and media notice is required for breaches affecting more than 500 residents of a state or jurisdiction.

An accounting of disclosures covers the prior six years and excludes treatment, payment, operations, and authorized disclosures.

Sampling risk is the risk that the sample is not representative; confidence level and tolerable deviation rate drive sample size, and higher confidence requires a larger sample.

Attribute sampling estimates a deviation rate and is used for compliance testing; variable sampling estimates monetary amounts.

Benford's Law predicts first-digit frequency and helps detect fabricated amounts, duplicate payments, and outlier transactions.

Data analytics quality depends on completeness, accuracy, timeliness, and consistency; source-system validation is required before relying on dashboards or key performance indicators.