CHAE common mistakes
CHAE · Understand the traps and how to avoid them.
Accepting an assurance engagement over the same revenue-cycle or clinical process the auditor helped design or redesign a few months earlier, and completing the independence section with 'no known conflict' without any analysis.
Healthcare audit shops are small, so advisory work and assurance work frequently involve the same people. Candidates underestimate how fast a design-then-audit sequence creates a self-review and self-interest threat, and they read the independence standards as a signature requirement rather than a judgment requirement.
What to do instead
Before accepting the engagement, document the specific threats and the safeguards applied, per the IIA independence standards. If the auditor designed or installed the controls, decline the assurance role, reassign the engagement to a team that did not perform the advisory work, or scope the review strictly to processes the auditor never touched. Record the analysis, not just the conclusion.
Writing test procedures, selecting samples, and starting fieldwork before the engagement objectives, scope, and audit criteria are stated, so the workpapers end up describing what the system does rather than testing whether it meets a requirement.
Many candidates move into healthcare auditing from operational or financial roles where 'poke around and see' is normal practice. The planning standards then look like boilerplate to be recited at the end rather than the step that determines what evidence is even relevant.
What to do instead
Build the engagement plan in fixed order: objectives, then risks, then criteria, then procedures, then evidence. Every workpaper step should trace to a stated objective and an identified risk. At review, delete any procedure that traces to nothing, and add criteria for any objective that has no defined standard to test against.
Answering governance and risk questions by listing the organization's top enterprise risks, without connecting them to a stated risk appetite, tolerance thresholds, risk owners, or the committee that receives the reporting.
Candidates memorize the component names of enterprise risk frameworks but not the mechanics that make them operate: how appetite becomes an escalation trigger, and how oversight flows from management to the audit or compliance committee and the board.
What to do instead
For every risk cited, state five things: the appetite or tolerance, the accountable owner, the committee that receives monitoring, the metric or threshold that triggers escalation, and where that is evidenced (charter, committee minutes, dashboard). Place each item against the three lines model so the audit's own position is explicit.
Treating every coding error or overpayment as fraud, or analyzing an Anti-Kickback question with the Stark framework, blurring strict-liability, intent-based, and knowing-intent legal standards together.
The statutes overlap heavily on the facts - same physician, same hospital, same claim - but differ in what must be proven. Candidates answer from general 'fraud is fraud' intuition instead of separating the elements, and exam items are built specifically on that separation.
What to do instead
Run the analyses as separate tests. Stark: is there a financial relationship, a referral of a designated health service, and no applicable exception - intent is irrelevant. Anti-Kickback: was remuneration offered with intent to induce referrals, applying the one-purpose test. False Claims Act: was the claim knowingly false. State in the workpaper which lens is being applied and why.
Auditing charge capture or code assignment by comparing charges to the charge master, or current claims to prior claims, rather than to the clinical documentation in the medical record.
Charge master and claims extracts are easy to pull at scale, and internal consistency between two system outputs feels like corroboration. The chart is slower to review and often requires clinical training the auditor may not have.
What to do instead
Re-perform code assignment from the source documentation using current coding rules, then compare to what was billed. Validate modifier use (for example, modifier 25 and the X-modifiers that replaced modifier 59) and test medical necessity against the order, the plan of care, and the note. Report coding accuracy and documentation sufficiency separately.
Quantifying an overpayment as the full charge or as charges times an error rate, without reconciling the figure to what the payer actually paid and what the beneficiary owes.
The charge amount is often the number the auditor has already validated during the charge-capture phase, so it feels like the audited figure. The exposure, however, runs through reimbursement and contractual allowances, which require a separate reconciliation.
What to do instead
Build the refund calculation from the paid claim: gross charge, contractual allowance, payer payment, and beneficiary cost-share, with the methodology documented. Where results are extrapolated, define the sampling frame and the projection method up front and have the statistician and legal counsel review before the finding is issued.
Deciding whether documentation supports a level of care, a diagnosis, or a continued stay by relying on personal clinical judgment, without criteria fixed in advance from policy, protocol, or recognized guidance.
Clinically trained auditors reasonably trust their own expertise, and reaching for a conclusion feels faster than locating the standard. The result is an opinion that can be challenged on appeal and that does not meet the definition of audit evidence.
What to do instead
Set criteria before fieldwork: order sets, protocol thresholds, admission and continued-stay criteria where licensed, medical staff bylaws, or payer policy. Where criteria are silent, escalate to a clinical subject-matter expert, document the rationale, and record any disagreement rather than resolving it silently in the workpaper.
Measuring patient safety by counting incident reports, then concluding a unit or service line is safe because the report volume is low, without ever testing for underreporting.
Reporting systems are voluntary and capture only a fraction of events. A declining count can signal a punitive or fatigued reporting culture just as easily as improved care, and candidates read the trend in whichever direction is convenient.
What to do instead
Triangulate sources: apply trigger tools or focused chart review, compare against patient-safety indicator or claims data, and classify reports as near-miss versus harm. Present reporting-rate change alongside event rates, and explicitly assess whether the reporting culture encourages or suppresses disclosure.
Extracting a population from the EHR or billing system and accepting the report output - record counts, date ranges, exclusions - as the audit population, without validating the query logic against source records.
Reports are built by analysts who are not auditors, and filters, joins, and de-duplication can silently drop or double-count patients. The output looks authoritative because it came from the system of record, so candidates treat extraction as data collection rather than as a testable control.
What to do instead
Re-perform the query logic, reconcile record counts at each filter step, and trace a sample back to the source screens or scanned documents. Archive the query text, parameters, run date, and analyst name as audit evidence so the population can be regenerated and defended later.
Copying full record extracts containing protected health information onto shared drives and into audit workpapers without applying minimum necessary, de-identifying where feasible, or putting a data use agreement in place.
Linkage across records requires identifiers, so auditors pull complete extracts as the path of least resistance. Privacy review is seen as a downstream formality rather than a condition of using the data at all.
What to do instead
Apply minimum necessary and substitute study identifiers where direct linkage is not needed. Use a limited data set under a data use agreement, or de-identify by safe harbor or expert determination, for analytics and dashboards. Document the legal basis, storage location, access list, and retention or destruction schedule before the data leaves the source system.