How to Conduct a Medical Coding Audit: A Step by Step Guide for Compliance and Accuracy

Table of Contents

1. Introduction
2. Core Concepts and Foundations
3. Planning the Audit
4. Performing the Audit: Step by Step
5. Reviewing and Reporting Results
6. Follow Up and Continuous Monitoring
7. Best Practices and Common Pitfalls
8. When to Use External Medical Coding Audit Services
9. Conclusion and Call to Action
10. Frequently Asked Questions

Introduction

Every healthcare organization runs on accurate documentation and clean claims. The codes billed by your practice do more than try to capture payment. They also signal your compliance posture to payers and to regulators. When coding is accurate, your claims are paid correctly, your documentation tells a clear clinical story, and your organization reduces the chance of painful denials or audits. When coding is inaccurate, the costs appear in many places. You may see higher denial rates, longer accounts receivable cycles, lower net collections, and even refund demands or penalties.

A medical coding audit is your way to get ahead of those risks and to prove that your coding reflects the care that was provided. A coding audit is a structured review of documentation and claim data to determine accuracy, completeness, medical necessity, and alignment with payer and federal rules. It is also the most practical way to identify training needs for coders and providers, and to improve your templates and workflows inside the electronic health record.

Regulators expect it. The Office of Inspector General (OIG) highlights internal auditing and monitoring as a core element of an effective compliance program. Their guidance places consistent auditing near the top of the list of practical steps that providers can take to avoid waste, abuse, and fraud. You can review their materials here: OIG Compliance Guidance. (Office of Inspector General)

Audits also protect your business and the clinical providers. Many practices lose revenue because of undercoding. Others face requests for repayment because of overcoding or unbundling. Patients feel the effects as well, since incorrect coding can produce confusing bills and disputes. If you want context on the current enforcement landscape, this overview is helpful: OIG Compliance in 2025: What’s Changing and How Your Practice Should Prepare. (DoctorsManagement)

This guide gives you a complete, step by step method to conduct a medical coding audit. It is friendly to beginners who are new to compliance, and it is detailed enough for experienced leaders who want to refine their existing program. Along the way you will find examples, checklists, common pitfalls, and suggestions for technology that can make the work easier. You will also find links to internal resources from Doctors Management so that you can connect the audit process to documentation quality, revenue cycle, and overall compliance leadership. Browse the latest posts here: DoctorsManagement Blog. (DoctorsManagement)

Core Concepts and Foundations

What is a medical coding audit

A medical coding audit is a systematic review of clinical documentation and billed codes to confirm three things. First, that the documentation supports the medical necessity of services. Second, that the codes selected are the correct representation of those services. Third, that the claim complies with payer rules and federal policy. An audit can be broad, such as a random sample across a department or your entire billing universe. An audit can also be narrow, such as a focused look at a single high risk code family.

Audits do more than count errors. The best programs identify risk patterns and root causes. For example, a report that shows repeated misuse of modifier 25 points to a need for provider education and perhaps a revision of charge capture templates. A report that finds frequent unbundling inside a certain procedure suggests that EHR defaults or a favorite macro might be at fault – or points to the need for additional education of your providers or staff.

Types of coding audits

Most organizations combine several methods to see the full picture.

• Internal audits. Conducted by your team. They are cost friendly and can be run frequently.
• External audits. Conducted by a third party. They bring independence and benchmarking that internal teams rarely have.
• Prospective audits. Performed before claim submission. These reviews prevent errors from ever reaching a payer.
• Retrospective audits. Performed after submission. These reveal patterns and system issues.
• Focused audits. Target a specific code set, provider, location, or procedure.
• Random audits. Provide a general snapshot of overall accuracy.

A brief overview of audit types and their use cases is here: Coding Clarified on medical coding audits. (Coding Clarified)

If you are still building your internal team, this primer helps you think through staffing and timing: Is It Time to Hire a Coder? A Guide for Small Practices. (DoctorsManagement)

The building blocks that audits test

• ICD codes describe diagnoses. An example is I10 for essential hypertension.
• CPT codes describe physician services and procedures. An example is 99214 for an established patient office visit that requires moderate medical decision making.
• HCPCS codes include supplies, drugs, and services not captured by CPT. An example is J1885 for ketorolac injection.
• Modifiers add clarity to codes. Examples include 25 for a significant and separately identifiable evaluation and management service performed on the same day as another service, 59 for a distinct procedural service, and 50 for a bilateral procedure.
• Medical necessity requires that the service be reasonable and necessary for the diagnosis or condition. Documentation should reflect that necessity through history, exam, assessment, and plan.

Why audits matter for compliance

Payers and government agencies use data analytics to find outliers. A profile that shows unusually frequent level 5 visits, frequent use of modifier 25, high volumes of medically unlikely combinations, or claim patterns that differ from peer groups may trigger a review. The Centers for Medicare and Medicaid Services facilitate a variety of medical review and education programs designed to ensure that payment is made only for services that meet coverage, coding, billing, and medical necessity requirements. See the overview here: CMS Medical Review and Education. (CMS)

A regular internal audit program helps you monitor your own outlier risk. It also puts you in a prepared position if you receive a payer request for records. You will know your strengths and your vulnerabilities, and you will already have a plan in motion.

Planning the Audit

Good planning turns a stressful exercise into a predictable, teachable process.

Set clear objectives

Decide what you want to achieve. Consider the following objectives and choose the ones that fit your risks.

• Compliance goals. Validate alignment with CMS guidance, NCCI edits, MUEs, and payer policies.
• Revenue goals. Reduce undercoding and prevent avoidable denials.
• Quality goals. Improve documentation clarity and completeness.
• Education goals. Identify targeted training needs for providers and coders.
• Governance goals. Satisfy the auditing and monitoring expectations within your compliance program.

The Medical Group Management Association offers perspective on how audits connect to broader organizational goals: MGMA on medical coding audits.

Choose internal, external, or hybrid

Internal audits are frequent and flexible. External audits are objective and bring benchmarking and specialty depth. Many practices choose a hybrid approach. They run small internal reviews each month, then bring in an external auditor annually or semiannually to validate and deepen insight. A short overview of why and how to combine both approaches is here: Optum on coding audits. (brellium.com)

Define the scope

Scope choices include departments, locations, providers, service types, or code families. A cardiology service line might focus on catheterization services and cardiac imaging. A primary care group might concentrate on evaluation and management visits and preventive services. A surgical group might concentrate on global period rules and modifier selection.

Include both high risk and high volume areas to balance compliance exposure with revenue impact.

Select a sampling strategy

Sampling determines how representative your results will be. Match your method to your goals.

• Random sampling. Offers a broad accuracy snapshot when you want to measure overall performance.
• Judgmental sampling. Focuses on areas already suspected of problems. Use it when a denial trend or prior finding needs follow up.
• Risk based sampling. Targets high dollar or high volume items. Use it to reduce immediate exposure or validate revenue integrity in key services.

AHIMA encourages tailoring your sample and method to your purpose and risk profile and offers education that aligns with these skills. See examples and outlines here: AHIMA Microcredential for Auditing Outpatient Coding and the content outline PDF linked from that page. (AHIMA)

Decide on sample size

Your sample should be large enough to identify patterns and small enough to complete within the timeline. A common approach for physician practices is ten to twenty records per provider. Hospital departments often review twenty five to thirty records per unit. You can begin smaller for a pilot and scale up once the process is stable.

Build the timeline and assign roles

Create a simple project plan. Define start and end dates, data pulls, audit windows, report dates, education sessions, and re audit points. Assign a project owner, an audit lead, an education lead, and a provider champion. The more visible the roles, the smoother the process.

If you need to connect your audit plan to the financial side of the house, this guide is a strong companion resource: Best Practices to Oversee Your Billing and Collections. (DoctorsManagement)

Executing the Audit: Step by Step

This is the heart of your work. The steps below can be used for any specialty with only minor adjustments.

Step 1. Retrieve the records and the claim data

Collect the full record for each sampled encounter. Include progress notes, orders, diagnostic test results, operative reports, anesthesia records when relevant, and any addenda. Include the claim, the codes, the modifiers, and the charge capture source. Confirm that the record is complete and signed.

Step 2. Evaluate documentation quality

Begin with the story. Does the note explain why the patient is here, what the provider considered, and what was done? Confirm that the documentation meets the basics.

• Legibility and signature or appropriate electronic authentication
• Date, time, and place of service
• Complete elements of the service that was billed
• Clear assessment and plan that match the diagnoses and services

Consider the documentation lens for each major service type.

• For evaluation and management services, check that the medical decision making or time meets the level selected. Confirm that any time based coding is supported with total time on the date of the encounter and that time includes only activities that the rules allow.
• For procedures, check indications, consent, a complete operative or procedural description, and any assistant or device details that are required.
• For diagnostic services, check the order, the reason for the test, the result or interpretation when appropriate, and the link to the diagnosis.

If you want to improve the clarity of provider notes in general, this piece is a practical complement to the audit process: Your Care Is Personal, Your Note Should Be Too. (DoctorsManagement)

Step 3. Check coding accuracy

Crosswalk the documentation to the codes line by line. Confirm diagnosis coding first. Then confirm procedure coding and any supplies or drugs that were billed.

Helpful checks include the following.

• Does the principal diagnosis reflect the primary reason for the visit or admission.
• Do secondary diagnoses meet the standard for coding and affect care or resource use when required by the setting.
• Does each CPT or HCPCS code have clear support in the documentation.
• Are modifiers necessary, and if so, are they correct.

Examples bring this to life.

• If a physician bills an established office visit at a moderate level, confirm that the documentation supports moderate medical decision making or that time meets the threshold for the code.
• If a surgeon bills a lysis of adhesions with a separate procedure, confirm that the documentation supports the separate nature of the work and that unbundling rules were followed.
• If a stress test is billed with supervision and interpretation, confirm that all required components were performed and documented.

Step 4. Validate that codes match services

This is where you identify both overcoding and undercoding. Overcoding means coding at a higher level than the documentation supports or billing for services that were not performed. Undercoding means selecting a lower level or missing services that should have been billed.

Reasons for undercoding include caution, lack of familiarity with current rules, or EHR templates that suppress needed detail. Reasons for overcoding include overreliance on templates, copied content, or misunderstandings of code guidelines or modifier rules. Your audit should teach you which of these forces are at work.

Step 5. Assess compliance with payer rules

Review the claim against payer policies, National Correct Coding Initiative edits, and Medically Unlikely Edits. These tools exist to prevent incompatible pairs and quantities from being paid. A useful overview is here: CMS Medical Review and Education. (CMS)

Consider payer specific rules. Commercial carriers often have medical policies that differ from Medicare on prior authorization, place of service, or coverage for certain indications. Your audit should reference the applicable policy when you identify an issue.

Step 6. Identify coding errors and patterns

Common error categories include the following.

• Undercoding of evaluation and management services because time or decision making was not fully captured
• Overcoding of visits because copied documentation or template defaults exaggerate complexity
• Unbundling of services that are included in a higher level code
• Omission or misuse of modifiers, especially 25, 59, 51, 50, 24, and 57
• Use of deleted or outdated codes when the code set changed for the new year
• Missing medical necessity or weak connection between diagnosis and service

For a quick orientation on what auditors often look for, AAPC maintains plain language resources and FAQs: AAPC Medical Auditing FAQs. (AAPC)

Step 7. Perform root cause analysis

Go beyond the error count and identify why it happened. Ask these questions.

• Did the provider understand the documentation rules for the service and the specialty.
• Did the coder have the right references and policies.
• Did the EHR template or macro cause the problem.
• Did the team receive training when code sets or payer policies changed.
• Did denials come with clear reasons that the team ignored or misinterpreted.

Root cause analysis turns findings into solutions. It helps you design education, update templates, or change workflows rather than simply correcting past claims.

Step 8. Quantify the impact

Translate findings into financial and compliance terms. For revenue impact, calculate the difference between billed and correct codes across the sample, then project the effect across the population that the sample represents. For compliance risk, identify the categories that payers monitor closely and estimate the exposure if similar patterns exist across all claims.

Include easy to grasp illustrations. For example, show how accurate time based coding for prolonged services changes reimbursement. Or show how the correct application of modifier 59 prevents denial when two distinct procedures are performed on the same day.

Step 9. Document findings clearly

Create a report that tells a concise story. Include an executive summary for leadership, a detailed section for coders, and a provider friendly section that uses clinical language.

A useful report includes these items.

• Purpose and scope of the audit
• Methodology and sample description
• Overall accuracy rate and error rate
• Breakdown of errors by type and by provider or location
• Financial impact estimates and compliance exposure
• Recommendations and an action plan

Timetable for education and re audit

Reviewing and Reporting Results

The way you present results determines whether the organization learns and improves.

Tailor the report to the audience

Create a version for leadership that focuses on risk and return. Create a version for providers that focuses on clinical documentation and code selection with clear examples. Create a version for coders that focuses on the coding rules and payer policy references.

Include visual summaries. Bar charts for error types, trend lines for accuracy by month, and small tables for before and after comparisons help busy readers grasp the message quickly. If your organization measures revenue integrity formally, you can connect audit outcomes to those metrics. For broader finance context, HFMA’s body of work on revenue integrity is a helpful backdrop: HFMA.

Advance from results to action

Schedule provider debriefs that are educational in tone. Focus on what to do next rather than what went wrong. If your findings include frequent misuse of modifier 25, plan a brief education session and share a pocket guide that clarifies when the modifier is appropriate.

Build a corrective action plan with clear owners and dates. Track each item to completion. If you need to connect audit outcomes to revenue cycle improvements, this article helps frame the conversation with your billing and collections leads: Best Practices to Oversee Your Billing and Collections. (DoctorsManagement)

Follow Up and Continuous Monitoring

Audits lose power when they are one time events. The real value appears when you move into a cycle of monitoring and improvement.

Establish a recurring audit schedule

High risk areas deserve more frequent reviews. Many practices review selected high risk codes each quarter and run a broader random sample semiannually or annually. Lower risk areas can be checked once per year.

Track progress with simple metrics

Choose a small set of indicators that you can update monthly.

• Overall coding accuracy rate
• Error rates by category
• Denial rates for top codes or services
• Turnaround time from education to corrected performance
• Net collections for audited code families

Share these metrics in your compliance committee and in provider meetings. Use them as feedback rather than as punishment.

Update policies and templates

Translate lessons into workflow changes. Adjust your EHR templates to reduce copied content. Add prompts that remind providers to capture total time when time based coding is used. Update cheat sheets and coding guides. Record short microlearning videos that providers can watch quickly.

Use technology wisely

Coding audit software and analytics tools can highlight outliers and automate parts of the review. Some platforms compare documentation to codes and flag discrepancies. Others help you track education and re audit performance over time. A plain language look at using modern tools to support audits can be found here: Brellium on mastering medical coding audits. (brellium.com)

If you want to connect these activities to the broader role of compliance leadership, this post offers a helpful overview: The Role of the Healthcare Compliance Officer in Modern Medical Practices. (DoctorsManagement)

Best Practices and Common Pitfalls

Best practices that build momentum

• Treat audits as learning experiences. People improve when they feel supported.
• Keep auditors independent from daily production coding whenever possible.
• Stay current with ICD and CPT updates and with payer policies that affect your specialty.
• Combine prospective and retrospective reviews so you prevent errors while also fixing system issues.
• Share quick wins. Celebrate when accuracy improves or when a denial trend declines.

Pitfalls that stall improvement

• Failing to act on findings. A report without follow through will not change outcomes.
• Sampling that hides the problem. Samples that are too small or too narrow may look clean but miss real risk.
• Templates that mislead. EHR defaults can exaggerate complexity or insert copied content that does not reflect the visit.
• Resistance that goes unaddressed. Provider concerns are often about time and fairness. Address both directly and respectfully.
• Training that is generic. Most improvement comes from targeted coaching tied to the exact errors that were found.

For additional professional perspectives on targeting audit work and improving coding quality, see AHIMA’s recent articles and toolkits related to audit focus, analytics, and documentation standards. A selection is here:

• How to Create Internal Coding Policies for Risk Adjustment (Journal of AHIMA)
• Strategies to Focus Internal Audit Activities (Journal of AHIMA)
• Guidelines for Achieving a Compliant Query Practice (AHIMA)
  

When to Use External Medical Coding Audit Services

External audits can accelerate progress. Here is how to decide when to bring in a partner.

Advantages of external auditors

• Independence. Outside reviewers are not attached to internal politics or workflows.
• Specialty expertise. Third parties often see many organizations in your specialty and can spot subtle issues.
• Benchmarking. External teams can compare your patterns to peer norms.
• Credibility. Findings from an outside party may carry more weight with skeptical leaders or providers.

How to select a strong vendor

Evaluate experience in your specialty, methodology transparency, sample design, reporting clarity, education offerings, and references. Ask to see a sample report. Ask how they handle disagreements with providers. Ask how they estimate financial impact and how they design re audit plans.

ROI you can show

External audits have direct and indirect returns. Direct returns include recovered revenue from undercoding and prevention of denials through cleaner claims. Indirect returns include stronger documentation, fewer disputes, and fewer requests for repayment. Build a simple model that compares audit costs to the combined value of recovered revenue and avoided write offs over a year.

Bringing It Together & Taking Action

Medical coding audits are one of the most practical and powerful tools for protecting both compliance and financial performance. They verify that your documentation supports the services billed. They confirm that codes are applied correctly. They help you align with payer policy and with federal guidance. Most importantly, they turn lessons into better processes and better patient records.

Build a simple plan. Start small and grow. Use internal reviews to learn continuously. Invite an external perspective when you need independence or specialty depth. Teach with kindness and clarity. Measure your progress and celebrate improvement. Your claims will flow more smoothly, your denials will decline, and your compliance posture will strengthen.

If you are ready to move from theory to action, our team is here to help. Start a conversation with experts who build audit programs for practices across the country. Connect with the Doctors Management team for OIG regulatory compliance services. Together we can create an audit roadmap that fits your specialty, your culture, and your goals. (DoctorsManagement)

Frequently Asked Questions

Contact Us