Audit Reporting and Communication
Audit Reporting and Communication tests whether findings are clear, evidence-based, and actionable without overstating certainty or accusing individuals of fraud.
Core rules
- A defensible report states the objective, scope, period, sample method, criteria, methodology, findings, risk, root cause, recommendations, and management response. Attach or reference workpapers without exposing unnecessary PHI.
- Report facts and criteria, not characterizations. Write “12 of 60 records lacked documentation of medical decision making for 99215” rather than “the provider overbilled.”
- Quantify the sample error rate and financial impact; label any extrapolation and its limitations. Separate confirmed errors from potential errors awaiting response.
- Hold an exit conference or preliminary discussion with the auditee. Give a factual summary and a reasonable chance to provide documentation or context; document the response.
- Use a corrective-action plan with owner, due date, and re-audit method. Track completion. Protect confidentiality and share only on a need-to-know basis.
Worked example
An audit of 60 high-level established-patient E/M claims finds 12 with insufficient MDM and no time statement. The report states the random sample, criteria, finding, 20% sample error rate, reviewed dollar impact, and likely template cause. It recommends targeted education and a 30-claim re-audit. It does not state that the practice committed fraud; intent is a separate determination.
Traps
- Including opinions, sarcasm, or blame in the finding.
- Calling every error “fraud” or every overpayment “abuse.”
- Omitting sampling limitations, then implying the result applies to the whole population.
- Reporting only dollar findings and no root cause or prevention plan.
- Promising confidentiality that the policy or law does not support.