Auditing, Monitoring, and Internal Investigations
Monitoring Versus Auditing
Monitoring is ongoing, often real-time and preventive: pre-bill edits, charge reconciliation, denial trending, exclusion screening. Auditing is periodic, retrospective, and independent validation against a defined standard. Questions frequently test whether you can place a control in the right category.
Designing an Audit
Risk assessment drives the plan. Establish a baseline to measure error rates, then define the population, sampling unit, sample size, and methodology. Random or statistical samples can support extrapolation; judgmental or targeted samples cannot. Use standardized audit tools, scoring conventions, and reviewer credentials, and document the methodology so results are defensible.
Internal Investigations
Triggers include hotline reports, audit findings, whistleblowers, and government subpoenas. Immediately issue a document preservation notice, consider engaging counsel to structure the investigation, define scope, interview witnesses, and document every step. Report findings to the compliance committee and governing body. Under the 60-day overpayment rule, identified overpayments must be reported and returned by the later of 60 days after identification or the due date of the corresponding cost report. The OIG Self-Disclosure Protocol is an option for potential fraud.
Traps
Privilege is fragile: reports shared broadly, or created in the ordinary course of business, may be discoverable. Interviews should include an Upjohn warning when counsel directs the investigation. Do not promise confidentiality you cannot guarantee. Never extrapolate from a non-random sample.
Worked Example
A hotline alleges a manager steers contracts to a family member's vendor. Correct sequence: preserve documents, engage counsel, screen the manager from the process, audit the vendor transactions, report to the committee, remediate, and evaluate disclosure obligations.