Internal Coding Audit Methodology and Worksheet Design

What Is an Internal Coding Audit?

An internal coding audit is a systematic review of coded medical records to verify that the diagnosis codes, procedure codes, and documentation are accurate, complete, and compliant with payer rules and federal regulations. Practices perform these audits voluntarily—before a payer or government agency performs one for them. The Office of Inspector General (OIG) of the Department of Health and Human Services has long encouraged healthcare providers to conduct routine internal audits as part of an effective compliance program. When a practice finds and corrects its own errors, it demonstrates good faith and reduces the risk of overpayment demands or fraud allegations.

As a coder, you may be asked to participate in, or even lead, an internal audit. Understanding the methodology protects you professionally and directly supports patient safety: correct coding ensures that the documented clinical picture follows the patient, influencing future care decisions and eligibility determinations.

The Audit Worksheet: Your Primary Tool

An audit worksheet is a structured form that guides the reviewer through every element that must be verified in a medical record. A well-designed worksheet prevents the auditor from skipping steps and creates a written record of findings. OIG compliance guidance and AAPC audit resources both describe common fields an outpatient coding audit worksheet should include:

• Patient and encounter identifiers – date of service, provider name, account or medical record number (de-identified in training settings)
• Billed codes – the diagnosis and procedure codes actually submitted to the payer
• Audited codes – the codes the auditor determines are correct based on documentation
• Agreement or discrepancy indicator – a simple match/no-match field for each code
• Error type – category of the discrepancy (see below)
• Rationale – a brief explanation citing the coding guideline, encoder logic, or documentation element that supports the audited code
• Financial impact – whether the error resulted in over-coding (higher-than-supported level) or under-coding (lower level than documentation supports)

When you adapt a template for outpatient Evaluation and Management (E/M) services specifically, you should add fields that capture the documented level of medical decision making or total time, because those are the key elements that determine the correct E/M code under current CPT guidelines.

Common Error Categories in Outpatient Coding

Organizing errors by type helps a practice target its education efforts. The three major categories you will use in this lab are:

1. E/M level errors – The billed E/M code does not match what the documentation supports. This includes up-coding (billing a higher level than documented) and down-coding (billing a lower level).

2. Diagnosis coding errors – The ICD-10-CM code is incorrect, incomplete (missing specificity), sequenced wrong, or not supported by documentation.

3. Procedure coding errors – A CPT or HCPCS code is wrong, unbundled when it should not be, or conflicts with an NCCI (National Correct Coding Initiative) edit.

Calculating the Error Rate

The error rate tells a practice how often its coding deviates from what the documentation supports. The standard formula is:

Error Rate = (Number of records with at least one error ÷ Total records audited) × 100

Some audits calculate error rate at the line level (individual codes) rather than the record level. Clarify which method your worksheet uses before you start, and apply it consistently. The OIG has historically considered an error rate above a certain threshold a signal for follow-up review, though no single published threshold applies universally—context and payer policies matter. In practice, any error rate above roughly 10–20% typically prompts a focused corrective action plan, but your facility's compliance officer sets the specific benchmark.

You will also calculate category-specific error rates:

Category Error Rate = (Errors in that category ÷ Total records audited) × 100

This tells you whether the biggest problem is E/M selection, diagnosis coding, or procedure coding—so recommendations can be targeted.

Writing the Audit Summary Report

The summary report translates numbers into action. A one-page report for an internal audience should include:

• A brief statement of audit scope (number of records, date range, provider, service type)
• Overall error rate and category error rates presented clearly
• The top three specific findings with examples
• Three concrete, actionable recommendations (for example: provider education on medical decision making documentation, a targeted coder refresher on ICD-10-CM specificity, or a pre-submission NCCI edit check routine)

Avoid vague language such as "improve documentation." Name the specific code, guideline, or process that needs to change.

Scope of Practice and Safety Considerations

Coders do not change a provider's clinical judgment—they code what is documented. If documentation is insufficient to support a code, the correct audit finding is to flag the discrepancy and recommend a query process, not to assume a higher level of service. Altering audit findings, suppressing error rates, or retaliating against a coder who finds errors are serious compliance violations. Protect patient safety by ensuring that diagnosis codes accurately reflect the patient's conditions; miscoded diagnoses can affect insurance eligibility, risk scores, and downstream care.