Medical Coding Audit: Types, Sample Size and Process

By Awais Afzal, Healthcare Operations & Data Analyst · Published February 23, 2026 · Updated October 14, 2026

A medical coding audit is a structured review that compares the codes on a sample of claims with what the medical record supports. Practices run it before billing or after payment, in-house or with an outside reviewer, then use the errors found to fix coding, documentation and training.

Most practices know they should audit their coding and few know where to start. The questions are practical: which kind of audit, how many charts, who should review them, and what to do when the review finds a problem. This guide answers those in order. It also separates a coding audit from the payer reviews that share the word “audit”, because the two are often confused. For the wider picture, see our guide to medical billing audits across the revenue cycle.

What a medical coding audit checks

A coding audit checks one thing: whether the codes on the claim are the codes the documentation supports. The reviewer reads the record, then compares it with the CPT or HCPCS procedure codes, the ICD-10-CM diagnosis codes, the modifiers and the units that were billed.

The OIG’s compliance guidance for physician practices describes what a claims audit can establish: whether bills are accurately coded and reflect the services provided, whether documentation is complete, and whether the services were reasonable and necessary. That is a useful working scope.

• Code selection: does the level of service or procedure code match what was documented?
• Diagnosis linkage: do the diagnosis codes support the service and are they coded to the detail the record allows?
• Modifiers and units: was each modifier justified, and do the units match the record?
• Documentation: is the note signed, dated, and specific enough for a third party to see why the service was done?

It is not a clinical quality review, a privacy or security risk assessment, or a check of medication dispensing. Those are worthwhile, but they answer different questions. Mixing them into a coding audit makes the sample too broad to say anything about code accuracy.

Types of medical coding audits

Audits differ by timing and by who runs them. The most common mistake is to treat a payer review and a practice self-review as the same thing. They are not.

Source: CMS, Medicare Program Integrity Manual, Chapter 3 (current edition), for the prepayment and post-payment definitions. The pre-bill and retrospective rows describe practice self-audits.

CMS’s manual defines the payer side by timing. Prepayment review is a claim determination made before payment. Post-payment review is a determination made after the claim has been paid, and it can end in a revised determination that shows an overpayment or underpayment. If you are preparing for that kind of review, our guide to RAC audits covers the contractor side.

Internal or external: how to decide

Use an internal audit for routine monitoring and an outside reviewer when independence matters. The deciding factor is rarely cost. It is whether the person reviewing the work is free to say it is wrong.

The OIG guidance suggests that a practice’s self-audit team include the billing person and a medically trained person, preferably a physician. It also says a practice may outsource all or part of its compliance officer functions to a third party such as a consultant or billing company. Neither point makes outside review mandatory. Both show that audit roles can be split or shared.

Whoever reviews, the same rule applies: a person should not be the only reviewer of their own coding. Modifiers are a good test case. If your audits keep finding problems with modifier 25 versus modifier 59, that is a focused audit and a training topic.

How many charts to sample

For a small practice, the OIG’s starting point is five or more medical records per federal payer, or five to ten per physician. That is a screen. It tells you whether a problem exists, not how large it is.

Sources: HHS OIG, Federal Register (October 5, 2000); CMS, Medicare Program Integrity Manual, Chapter 3 (current edition).

None of these is a statistical guarantee for your whole claim population. If a small sample finds errors, widen it for the same provider or code family before you draw conclusions. If you need a dollar estimate across many claims, ask a statistician or your compliance adviser to design the sample.

Mix random and targeted claims

Pull some claims at random so the result is fair. Add targeted claims for the codes that carry the most risk: high-level visit codes, procedures with modifiers, and any code a payer has denied repeatedly. Error patterns differ by code family, so a specialty-specific list of your highest-volume codes is a better starting point for the targeted part than a generic list.

The audit process, step by step

A repeatable audit has six steps, and the last two decide whether it was worth doing. Write the steps into policy so each round is run the same way.

1. Define scope. Choose the period, providers, payers and code families. Decide whether this is a pre-bill or retrospective review.
2. Pull the sample. Combine random and targeted claims. Record how each was chosen.
3. Compare code to record. The reviewer sees the full note and the claim, and decides what the documentation supports.
4. Score and categorize. Mark each claim or line correct, over-coded, under-coded or unsupported, and name the cause.
5. Fix and retrain. Correct the claims that need it, update templates and checklists, and brief the people involved.
6. Re-audit. Draw a fresh sample after the fix to confirm the error did not return.

Use a fixed error vocabulary

Findings are only useful if errors are named the same way each time. CMS’s CERT program sorts Medicare improper payments into categories you can borrow: incorrect coding, insufficient documentation, medical necessity and no documentation. Its incorrect-coding example is a claim billed as 99214 that met only the requirements for 99213. Using a short list like this lets you compare one quarter with the next.

Decide how you will score

Pick one unit and keep it. Scoring by claim treats a claim with one wrong code as a miss. Scoring by line or code gives a finer result. The accuracy rate is correct items divided by items reviewed. For example, 27 correct out of 30 reviewed is 90 percent. The sources used here do not set a pass mark, so set your own in your compliance policy and do not change the definition between rounds.

What to do when the audit finds money owed

If you find that a payer was overpaid, act on it promptly, because Medicare sets a deadline. Under 42 CFR 401.305, a person who has received an overpayment must report and return it by the later of 60 days after it was identified or the date any related cost report is due.

The same rule treats an overpayment as identified when a person knowingly receives or retains it. It reaches back six years from the date of receipt. It also allows a timely, good-faith investigation into whether related overpayments exist, which can suspend the deadline until the investigation ends or 180 days after the first overpayment was identified, whichever comes first.

Findings that repeat are often denial causes in disguise. Feed them into your denial management process and your claim scrubbing rules so the fix applies to every claim, not just the sampled ones.

Where tools and outside help fit

Software can narrow what a human has to read, but it cannot decide whether a note supports a code. A system that checks for missing fields, conflicting codes or unusual combinations before submission removes the cheapest errors. That is the idea behind a practice management system that tracks claims by stage, which runs data-completeness checks before submission and keeps an audit log of who changed a claim. It does not replace a coder reading the record.

If your team lacks the time or independence to review its own work, outsourced medical billing services with coding support can cover the review and hand your coders a list of what to fix. Ask any outside reviewer which coding credentials they hold, whether they have worked on your specialty, how they choose and score a sample, and whether they will sign a Business Associate Agreement before seeing records.

Our recommendations

1. Audit on a schedule, not after a problem. We recommend a written schedule: a baseline first, then at least one audit each year, with more frequent focused audits for new providers and high-risk codes.
2. Separate the reviewer from the coder. Make sure the person scoring a claim did not code it. If the practice is too small, use an outside reviewer for part of each round.
3. Fix the question before the sample. Write down what the audit tests, the period, the payers and how errors are scored. A vague scope produces a result no one can compare.
4. Name every error the same way. Use a short fixed list such as incorrect coding, insufficient documentation, medical necessity and no documentation, and add the cause.
5. Widen the sample when errors appear. A small first sample is a screen. If it finds a pattern, pull more claims from that provider or code family before concluding.
6. Give every finding an owner and a date. A finding without an owner is a report. Assign the fix, set a re-audit date, and keep the record of what changed. Use the revenue calculator to size what a recurring error may cost.

Bottom line

A medical coding audit pays off when it is repeatable, scored the same way each time, and followed by a fix and a re-audit. Start small, name your errors, and treat any overpayment as time-sensitive. If repeated errors are showing up as denials, our denial management services work from the same root causes, and a free practice audit is a low-effort way to see your workflow.

Frequently asked questions

What is a medical coding audit?

A medical coding audit is a structured review that compares the codes on a sample of claims with the documentation in the record. The reviewer checks procedure codes, diagnosis codes, modifiers and units, then records which were correct, over-coded, under-coded or unsupported. The goal is to find patterns and fix them, not to judge individuals.

How often should a practice run a coding audit?

The OIG’s physician practice guidance recommends periodic audits at least once each year, starting with a baseline of claims from the first three months after training. Practices commonly add focused reviews when a provider is new, a code starts denying, or a payer changes policy. Set the schedule in writing and follow it.

How many charts should I review?

For a small practice, the OIG suggests five or more records per federal payer, or five to ten per physician, as a basic guide. Medicare contractors use probe samples of generally 20 to 40 claims. Treat a small sample as a screen and widen it if you find errors.

What is the difference between a coding audit and a billing audit?

A coding audit tests whether the codes match the record. A billing audit is broader: it can include charge entry, payment posting, adjustments and follow-up. Our billing audit guide covers that wider scope. Many practices run the coding audit as one part of it.

Do we have to refund an overpayment found in an audit?

For Medicare, 42 CFR 401.305 requires a person who has received an overpayment to report and return it by the later of 60 days after it was identified or the date any cost report is due. Commercial and Medicaid terms differ, so confirm each payer’s rules and ask your compliance counsel before you act.

Who should perform a medical coding audit?

A coder who did not code the sample, ideally paired with someone clinically trained, as the OIG’s self-audit suggestion describes. Practices without that independence use an outside reviewer. Ask about coding credentials, specialty experience, how the sample is chosen and scored, and whether a Business Associate Agreement will be signed before records are shared.

Sources

1. OIG Compliance Program Guidance for Individual and Small Group Physician Practices — HHS Office of Inspector General, Federal Register (2000)
2. Medicare Program Integrity Manual, Chapter 3: Verifying Potential Errors and Taking Corrective Actions — CMS (current edition)
3. 42 CFR 401.305: Requirements for reporting and returning of overpayments — eCFR / GPO (current)
4. Introduction to the Comprehensive Error Rate Testing (CERT) Program — CMS (current)