Audit Planning, Risk Assessment, and Scoping
What to know
Planning begins with understanding the entity, its regulatory exposure, and its control environment. Auditors build a risk assessment weighing likelihood and impact, then set scope (what is in/out) and objectives (what questions the audit answers). Key tools: process walkthroughs, risk registers, prior audit findings, OIG Work Plan items, data analytics to target high-risk claims, and materiality thresholds. Understand the difference between inherent, control, and detection risk, and how sampling confidence ties to scope. Document the plan in an engagement memo or work program.
Traps
Questions blur 'objective' and 'scope'-the objective is the question, scope is the boundary. Another trap: treating all risks equally; risk-based scoping prioritizes high-likelihood, high-impact areas (e.g., high-dollar DRGs, modifier use, teaching physician documentation). Watch for scope creep-auditors should document and approve scope changes. Also, prior-year clean results do not eliminate risk; changes in regulations or staffing can raise inherent risk.
Rule of thumb
Scope to the risk, not to convenience. If the OIG Work Plan flags it and the dollars are material, it belongs in the plan.
Worked example
A hospital's E/M level distribution shifted sharply upward. Risk assessment flags this as high likelihood/high impact. The auditor scopes a targeted sample of high-level E/M claims, sets the objective ('are levels supported by documentation?'), and builds a work program around documentation-to-code matching.