HCP 516 Week 2 Planning a Risk-Based Compliance Audit Example

Five Audits, Not Fifty: Building a Risk-Based Annual Audit Plan for an Outpatient Therapy Company From Federal Findings, Billing Data and Its Own History

[Student Name]

University of Phoenix

HCP/516: Auditing, Monitoring and Corrective Action in Compliance

Week 2 Assignment

[Instructor Name]

[Date]

The therapy company, its risk scores, samples and schedule are composites written for a model paper; federal reports, thresholds and protocols come from the sources listed.

The composite outpatient therapy company's compliance manager had budget and staff time for about five audits in the coming year. Her first list of things worth auditing had 22 items. This paper describes how she built a risk-based annual audit plan: gathering the audit universe from credible sources, ranking risks, selecting audits, defining scope and sampling and setting a schedule.

Sources for the Audit Universe

The audit universe is every area that could be audited. The manager drew from four sources. The first was federal audit findings: in a federal audit of outpatient physical therapy claims, 61% of 300 sampled claims failed requirements, most often for services not reasonable in amount or duration, timed units that did not match documentation, deficient plans of care and incorrect modifiers (Office of Inspector General, 2018). The second was national improper payment data showing a fiscal year 2025 Medicare fee-for-service rate of 6.55%, higher for Part B providers (Centers for Medicare & Medicaid Services, n.d.). The third was payer rules, such as the 2026 therapy threshold of $2,480, above which claims must carry a modifier attesting medical necessity. The fourth was the company's own data.

What the Company's Data Showed

Billing analytics revealed patterns. One clinic billed the maximum number of timed units supported by the visit length on 71% of visits, compared with 38% company-wide. Physician signatures on plans of care arrived more than 30 days after evaluation for 22% of patients. Services by therapy assistants, which carry a payment modifier, were billed without it at two clinics. And the share of patients whose annual charges exceeded the therapy threshold had risen from 18% to 27% in two years.

Scoring Risk

Each of the 22 areas was scored from 1 to 5 for likelihood, based on data and findings, and from 1 to 5 for impact, considering dollars at risk, patient harm and legal exposure. The product gave a score from 1 to 25. The scoring was reviewed with clinic directors and the chief financial officer, who adjusted two scores based on information the manager lacked.

The Five Selected Audits

The top five were: timed units matching documentation, scored 20; plan of care certification timeliness, 16; medical necessity for services above the threshold, 16; assistant modifiers, 15; and supervision of assistants, 12. Lower-scoring areas, such as evaluation coding and duplicate billing, stayed under monitoring rather than audit. A plan that audits everything a little finds nothing clearly; a plan that audits five things well finds what matters.

Audit One: Timed Units

Objective: determine whether billed timed units match documented treatment minutes under Medicare's timing rules. Period: the prior six months. Population: all Medicare visits with timed codes, about 17,000. Standards: Medicare timing rules and the company's documentation policy. The outlier clinic receives a separate focused review of 30 additional visits drawn only from its records.

Audit Two: Plan of Care Certification

Objective: determine whether plans of care were certified by a physician or other qualified practitioner within the required time and whether recertifications were timely. Period and population: episodes of care begun in the prior year.

Audit Three: Services Above the Threshold

Objective: determine whether services billed with the modifier above the threshold were medically necessary and documented as such, including progress toward goals. This audit uses the contracted outside therapist reviewer.

Audits Four and Five

The assistant modifier audit tests whether services furnished in whole or part by therapy assistants carried the required modifier. The supervision audit tests whether assistants were supervised as required by state law and Medicare rules, using schedules and documentation.

Sampling Choices

Each audit begins with a probe sample of 30 randomly selected claims or episodes. A probe can show whether a problem exists and how common it might be but cannot support a reliable estimate across the population. If the probe finds an error rate that suggests a significant overpayment, the company moves to a statistically valid random sample. The federal self-disclosure protocol, for example, expects organizations estimating overpayments to use a random sample of at least 100 items and a defined estimation method, with the full population and sampling frame documented (Office of Inspector General, 2021).

Why Not Audit Every Clinic Equally

Clinic directors asked whether it was fair to focus on the outlier clinic. The manager explained that every audit includes a random sample from all clinics, so each clinic is tested, and the focused review adds depth where data point to higher risk. Spreading effort evenly regardless of risk would mean spending the same time on a clinic with a 38% maximum-units rate as on one with 71%, which would neither protect the company nor treat the outlier clinic's patients fairly. Risk-based planning is also what regulators expect: the inspector general's guidance ties auditing to an organization's assessed risks rather than to a fixed rotation.

Engaging Clinic Directors Early

The manager shared the draft plan with clinic directors before it went to the committee. Two directors pointed out that a new electronic documentation template introduced in the spring had changed how treatment minutes were recorded, so the timed units audit period was split to test before and after the change. Another noted that one clinic's high threshold rate reflected a contract with a spinal cord injury program whose patients legitimately need long courses of therapy. Involving directors improved the plan and made the eventual findings easier to accept.

Documenting the Plan

Each audit has a written protocol listing the objective, period, population, data sources, sampling method, standards, reviewer, timeline and reporting path. Protocols make audits repeatable and defensible: if a finding leads to repayment or disclosure, the company can show exactly how it reached its conclusions.

Resources and Schedule

The compliance manager performs audits one, two, four and five, supported by a certified coder for 20 hours a month. The outside reviewer performs audit three. Audits are scheduled one per quarter, with the fifth in the final quarter and time reserved for follow-up audits and unplanned reviews triggered by monitoring or hotline reports.

Approval and Adjustment

The compliance committee approved the plan in January. The plan will be reviewed at midyear, and the manager may substitute an audit if monitoring reveals a higher risk, with committee approval. A hotline report, a new federal audit finding in therapy or a payer's records request could each justify a change, and every change is documented with its reason.

Conclusion

With resources for five audits and 22 possible areas, the company needed a plan that chose well. Federal audit findings, national improper payment data, payer rules and its own billing analytics built the universe; a transparent score ranked it; and five audits with clear objectives, scopes and staged sampling made the plan. Approval and a midyear review keep it responsive to what monitoring reveals.

References

Centers for Medicare & Medicaid Services. (n.d.). Improper payment rates and additional data. Retrieved September 30, 2026, from https://www.cms.gov/data-research/monitoring-programs/improper-payment-measurement-programs/comprehensive-error-rate-testing-cert/improper-payment-rates-and-additional-data

Office of Inspector General. (2018). Many Medicare claims for outpatient physical therapy services did not comply with Medicare requirements (A-05-14-00041). U.S. Department of Health and Human Services. https://oig.hhs.gov/oas/reports/region5/51400041.pdf

Office of Inspector General. (2021). OIG's health care fraud self-disclosure protocol. U.S. Department of Health and Human Services. https://oig.hhs.gov/documents/self-disclosure-info/1006/Self-Disclosure-Protocol-2021.pdf