Auditing and Monitoring
Auditing and Monitoring
This domain tests how compliance teams design audits, select samples, measure findings, and monitor corrective action. Questions often ask what makes an audit defensible and how findings should be reported and remediated.
Core rules
- Auditing is periodic, independent review; monitoring is ongoing operational oversight. A compliance work plan should be risk-based, with scope, frequency, sampling method, sample size, reviewers, and reporting lines.
- Sampling can be random, stratified, or targeted. Statistical samples support extrapolation only if properly designed; convenience samples generally do not. Document the population, selection method, and exclusions.
- Common audits include coding and documentation, medical necessity, claims and denials, charge capture, privacy and security, exclusion screening, physician arrangements, and vendor compliance.
- Pre-bill audits prevent improper claims; post-bill audits measure error rates and overpayments. Both need validated audit tools and reviewer calibration.
- Findings should be quantified, root-caused, reported to the compliance committee and board, and tracked to closure. Corrective actions need owners, deadlines, and re-audit validation.
- Sanction screening should occur at hire, before contracting, and periodically thereafter against the OIG LEIE and SAM; document results and resolution.
Worked example
A 100-claim audit finds 12 errors: eight E/M upcodes, two missing modifiers, and two services without medical necessity. The error rate is 12%. Reasoning: quantify the overpayment by claim, determine whether the sample supports extrapolation, identify root causes (template changes and unclear modifier guidance), and assign corrective actions: education, a pre-bill edit, and a 90-day re-audit of 50 claims.
Traps that cost marks
- Auditing only low-risk or easy-to-review areas.
- Using a convenience sample and extrapolating as if it were statistical.
- Reporting findings only to the compliance officer, not governance.
- Closing a corrective action without re-audit validation.
- Screening exclusions only at hire and never again.