CHAE key terms

The international framework issued by the Institute of Internal Auditors that sets principles, requirements, and guidance for internal auditing, covering purpose, ethics, governance, managing the audit function, and performing engagements.

A formal document approved by the board that defines the internal audit function's purpose, authority, responsibility, and scope, and establishes the chief audit executive's reporting lines and unrestricted access to records and personnel.

A schedule of audit engagements selected by ranking auditable areas on likelihood and impact of risk, so limited audit resources concentrate on the processes and controls that matter most.

A structured set of internal and external assessments that measure whether the audit function conforms with professional standards, improves its processes, and communicates results to the board.

The quantity and quality of information an auditor gathers to support conclusions: enough in amount and reliable in source, so findings withstand challenge.

A framework describing how an organization divides risk and control responsibilities: operational management owns risk, a risk and compliance function monitors it, and internal audit provides independent assurance to the board.

An organization-wide process led by the board and management to identify, assess, prioritize, and respond to risks across all functions, aligning risk tolerance with strategy and reporting aggregate risk exposure.

The amount and type of risk an organization is willing to accept in pursuit of its strategy, expressed through statements or limits that guide decisions about patient care, compliance, finance, and operations.

A board subcommittee of independent directors that oversees financial reporting, internal controls, compliance, and the internal and external audit functions, including approving the audit plan and receiving results.

A federal statute that imposes liability on entities or people who knowingly submit, or cause submission of, false or fraudulent claims to government programs, with treble damages and per-claim penalties.

A federal criminal law that prohibits knowingly offering, paying, soliciting, or receiving anything of value to induce or reward referrals of items or services payable by federal healthcare programs.

A civil statute that bars physicians from referring Medicare patients for designated health services to entities in which the physician or an immediate family member has a financial relationship, absent a regulatory exception.

The List of Excluded Individuals and Entities maintained by the Office of Inspector General; providers must check it before hiring or contracting so they do not bill federal programs for services furnished by excluded persons.

The OIG framework requiring written policies, compliance leadership, training and education, communication, monitoring and auditing, enforcement and discipline, and prompt response and corrective action.

A negotiated agreement between a healthcare organization and the OIG, usually settling civil fraud allegations, that imposes compliance obligations such as independent review, training, and reporting for a defined period.

A hospital's catalog of billable items and services with their codes, descriptions, and prices; auditors test it for accuracy, completeness, pricing consistency, and compliance with coding and billing rules.

Procedure-to-procedure edit pairs that Medicare and many payers use to prevent improper separate payment for services considered bundled; modifiers may override some edits only when clinical circumstances support it.

The process of tracking, analyzing, appealing, and preventing claim denials, using root-cause categories such as registration, coding, authorization, and medical necessity to reduce preventable rework and lost revenue.

A review comparing contracted reimbursement rates and payment terms with actual payer remittances to identify shortfalls, recover the difference, and reveal contract modeling or contract management weaknesses.

A prospective, concurrent, or retrospective evaluation of whether services are medically necessary, appropriate, and delivered in the right setting, often conducted to obtain payer authorization and manage length of stay.

A program that improves the precision and completeness of provider documentation so coded diagnoses and procedures accurately reflect patient severity, support quality measurement, and justify reimbursement.

The process of verifying a clinician's licensure, training, and competence and granting permission to perform specific services; failures here create quality, liability, and billing compliance exposure.

A collaborative process that assesses, plans, and coordinates care and resources for patients, aiming to improve outcomes, avoid unnecessary days, and support safe transitions across the continuum.

An unexpected occurrence involving death, serious physical or psychological injury, or the risk thereof; it requires immediate investigation and response under accredited hospital patient safety programs.

A structured team method for reconstructing an adverse event, identifying contributing system factors and their underlying causes, and designing corrective actions rather than blaming individuals.

A clearly identifiable, serious patient safety incident that should not occur, such as wrong-site surgery or retained surgical item; many are considered largely preventable and are reported and investigated accordingly.

A condition or complication that develops during a hospital stay and was not present on admission, such as certain infections or pressure injuries; performance affects quality reporting and payment adjustments.

A digital longitudinal record of a patient's clinical information that supports care delivery, ordering, results, and documentation; auditors examine its configuration, access, and data integrity.

A chronological record of system activity showing who accessed or changed what data and when; it is essential for detecting inappropriate access, supporting investigations, and meeting security and privacy requirements.

A security approach that grants system permissions according to job duties rather than individual preference, supporting minimum necessary access and reducing the risk of unauthorized viewing or modification of records.

A contract required by HIPAA between a covered entity and a vendor that handles protected health information, specifying permitted uses, safeguards, breach reporting, and return or destruction of data.

Individually identifiable health information held or transmitted by a covered entity or business associate in any form, whose use and disclosure are governed by the HIPAA Privacy and Security Rules.

The HIPAA principle that uses, disclosures, and requests for protected health information should be limited to the least amount reasonably needed to accomplish the intended purpose, with certain treatment and regulatory exceptions.

A rule requiring covered entities to notify affected individuals, HHS, and sometimes media after discovery of an impermissible acquisition, access, use, or disclosure of unsecured protected health information, within defined timeframes.

A HIPAA method that removes 18 specified identifiers from health information and ensures no actual knowledge that remaining data could identify an individual, allowing use without privacy restrictions.

Software-based methods such as data extraction, matching, and analysis used to test entire populations or large datasets, improving coverage and allowing auditors to identify anomalies that manual review would miss.

A statistical principle describing the expected frequency of leading digits in naturally occurring numerical datasets; significant deviation may signal fabricated or manipulated values and is used as a fraud detection screen.

An ongoing, technology-enabled approach that monitors transactions or controls in near real time, allowing auditors to detect exceptions promptly rather than relying solely on periodic retrospective testing.

Selecting a subset of items using probability methods so results can be projected to the population with measurable confidence and precision, supporting defensible conclusions about control effectiveness or error rates.

A metric that provides early warning of increasing risk exposure or weakening controls, selected because changes in it are meaningfully linked to outcomes the organization wants to monitor.