Revenue Cycle Assessment Checklist: What a Practice Audit Should Check

By Awais Afzal, Healthcare Operations & Data Analyst · Published January 4, 2027

A revenue cycle assessment is a structured review of every step between a patient's first call and the final payment. A good one pulls 90 days of remittances, aging and denial data, computes standard KPIs, checks 11 areas from marketing attribution to software audit logs, scores each area and ranks the fixes by dollars at stake.

January is a good month for it: last year’s numbers are closed and this year’s habits are not set yet. This checklist covers what an assessment should review, the reports to pull, the KPIs to compute with published formulas and a simple scoring table.

It is broader than a billing audit. Our guide to medical billing audits covers claim and coding accuracy; this post looks at the whole cycle, including marketing attribution, eligibility, underpayments and who can open your software. Use it to run your own assessment, or to judge any vendor’s audit, including ours.

What is a revenue cycle assessment, and how is it different from a billing audit?

A revenue cycle assessment reviews every step that turns a patient visit into collected revenue, from how a new patient finds you to how a payment is posted and who can see the data. A billing audit is narrower: it samples claims and checks codes and documentation against payer rules.

You need both: the assessment finds the costliest stage, then a billing or medical coding audit goes deep on it. HHS-OIG‘s General Compliance Program Guidance (November 2023) names risk assessment, auditing and monitoring as one of seven compliance program elements.

The 11 areas a complete assessment covers

1. Marketing attribution: lead source to booked and kept visit.
2. Scheduling and registration.
3. Eligibility and prior authorization.
4. Charge capture and documentation.
5. Coding.
6. Claim submission and edits.
7. Denials by root cause.
8. Payment posting and underpayments against expected amounts.
9. A/R aging.
10. Patient collections.
11. Software access controls and audit logs.

What data should you pull before a revenue cycle assessment?

Pull the last 90 days of electronic remittances (835 files), a current A/R aging report by payer and a denial report by reason code, plus the five reports below. Staff describe the process they intend; remittances show the one that runs.

Working checklist; no sourced statistics. PM = practice management.

Ninety days shows patterns and reflects current staff and payers. If an outside firm reviews the data, note that HHS lists data analysis, billing and practice management as business associate functions: put a Business Associate Agreement in place before disclosing patient data, and share only what the review needs under the minimum necessary standard.

We build our billing pipeline around how claims actually move through a practice: registration, charge entry, submission, payment and follow-up. In our view, line-level remittance data shows more than any summary report.

Which KPIs should a revenue cycle assessment compute?

Compute six: net days in A/R, the share of A/R over 90 days, the initial denial rate, the clean claim rate, the net collection rate and cost to collect. Print the published definition beside each number so next quarter compares like with like.

HFMA‘s MAP Keys (2023 edition) cover physician organizations as well as hospitals; MGMA‘s data definitions are built for medical groups. HFMA has no “initial denial rate” key: its remittance denial rate (AR-5) counts initial and appeal denials together, so count only first remittances and note the adaptation.

Sources: HFMA MAP Keys (2023 edition); MGMA Data Definitions (2025). FFS = fee-for-service. MGMA’s days in A/R: total A/R ÷ (adjusted FFS charges × 1/365). Neither sets a universal target.

That spread is why an assessment computes denial rate by payer. For more on each metric, see our guide to revenue cycle KPIs.

Front end: what should the assessment check before the visit?

Check that each new patient’s source is recorded and followed to a kept visit, that registration matches the insurance card, and that eligibility and prior authorization are confirmed before the visit. Front-end errors surface weeks later as denials.

Marketing attribution: from lead to booked visit

• Lead source recorded at booking for every new patient.
• Leads followed to booked, kept and paid visits, not just form fills.
• Calls answered, and missed calls returned the same day.
• No health information sent to ad platforms by tracking tools.

That last item is a compliance check: HHS OCR says tracking on scheduling pages that need no login may collect protected health information (a court vacated part of that guidance on June 20, 2024; review your setup with counsel). Our post on the four handoffs where practices lose revenue covers the ad-to-call step, and our healthcare marketing services cover local SEO, Google Ads and reputation.

Scheduling, registration and eligibility

• Demographics and member ID checked against the card at booking.
• Eligibility and benefits verified before every visit, including returning patients.
• Coordination of benefits confirmed when a patient has two plans.

Prior authorization

Check that each authorization’s number, codes, units and dates match the claim. Under CMS‘s prior authorization final rule (fact sheet, January 17, 2024), Medicare Advantage, Medicaid and CHIP payers must decide expedited requests within 72 hours and standard requests within 7 calendar days from January 1, 2026, and must give a specific reason for denials. For most payers, the rule’s Prior Authorization API requirement applies from January 1, 2027. Track turnaround by payer.

Our virtual medical assistants handle scheduling, eligibility checks, prior authorizations and intake. For January plan changes, see our January deductible reset checklist.

Mid-cycle: how do you check charge capture, coding and claim edits?

Reconcile kept visits to charges, sample notes against the codes billed and read the rejection report by reason. These checks show whether every service becomes a claim and whether claims leave clean.

Charge capture and documentation

• Kept visits matched to charges, day by day, for at least two weeks.
• Charge lag (date of service to claim) measured by provider.
• Unsigned or late notes that hold charges.
• Procedures, injections and supplies in the note reaching the claim.

Coding

Sample visits for each provider and compare the documentation with the codes, modifiers and diagnosis links billed. Ask whether reviewers hold an AAPC or AHIMA credential. If the sample shows a pattern, a focused coding audit is the next step.

Claim submission and edits

• Rejections grouped by reason; repeat data errors traced to the front desk.
• Clean claim rate measured per HFMA’s CL-1.
• Scrubber edits updated when a payer rule changes or a rejection repeats.
• Claims filed within each payer’s limit; for Medicare, 42 CFR 424.44 sets 1 calendar year after the date of service.

Back end: what should you check in denials, payments, A/R and patient collections?

Group denials by root cause, compare payments with expected amounts, work A/R by deadline and check how patient balances are estimated and collected.

Denials by root cause

Tag each denial with its reason code and the stage where it started. In KFF‘s 2024 HealthCare.gov data, administrative reasons were 25% and missing prior authorization or referral 9% of in-network denial reasons. Rework costs money: Premier reported in February 2025 that hospitals’ cost to fight a denial rose from $43.84 per claim in 2022 to $57.23 in 2023. See our denial root cause analysis workflow.

Payment posting and underpayments

• Each deposit matched to a remittance.
• Fee schedules loaded, so each payment has an expected amount.
• Short payments appealed, not written off unreviewed.
• Contractual adjustments kept separate from denial write-offs.

Our portal flags payments below the expected amount, but any such check is only as good as the fee schedules behind it.

A/R aging

Review aging by payer in HFMA’s five buckets, then sort claims past 90 days by nearest filing or appeal deadline and by value. Our year-end A/R cleanup checklist lists the Medicare deadlines.

Patient collections

• Likely cost shared with the patient before the visit.
• Good faith estimates for uninsured and self-pay patients on time: CMS says within 1 business day when care is booked 3–9 business days ahead, and within 3 business days when booked 10 or more business days ahead or on request.
• Copays collected at the visit under a written financial policy.
• Statements on a set schedule, with payment plans.

Why should a revenue cycle assessment check software access and audit logs?

The systems that hold your claims also hold patient data, and HIPAA requires you to control and review who uses them. Many published assessment checklists skip it, yet it needs only a user list, an audit log and your system administrator.

The Security Rule requires a unique user ID for each person and audit controls that record system activity (45 CFR 164.312), plus procedures to regularly review records such as audit logs and access reports (45 CFR 164.308). Each role should see only what its job requires.

• Every user has their own login; no shared front-desk or billing accounts.
• Former staff and old vendor accounts are disabled.
• Roles match jobs: front-desk users do not need adjustment rights.
• Someone reviews the audit log on a schedule and records the review.
• Every outside vendor with access has a signed Business Associate Agreement.

The RCM Finder portal uses role-based staff permissions and keeps an audit log; see our practice management system.

How do you score a revenue cycle assessment and turn it into a 2027 plan?

Score each area 0, 1 or 2 against the evidence you collected, then rank low scores by the dollars at stake in your 90-day data. Give each fix one owner and re-score in 90 days.

RCM Finder scale for internal comparison; not an industry standard.

The scale is ours, not a benchmark; it makes gaps comparable quarter to quarter. In our view, a 1 in a high-dollar area such as denials comes before a 0 in an area that rarely touches revenue. Use the same table to judge any outside audit: which rows did it cover, and with what data?

Our recommendations

1. Pull the data before the meetings. We recommend requesting remittances, aging and denial reports first, then asking staff about what the data shows.
2. Write the definition next to every number. We label each KPI with its HFMA or MGMA formula, and say so when we adapt one.
3. Give the front end the same scrutiny as billing. Lead source, registration, eligibility and prior authorization decide whether a claim can be clean.
4. Load expected amounts before judging payments. Without fee schedules, short payments look like normal adjustments. We treat them as part of the data pull.
5. Put access reviews on the calendar. Review user lists and the audit log on a set schedule and after every staff departure.
6. Re-score every quarter with the same pull. Same reports, same period length. If a score doesn’t move, the fix needs a new owner or a new approach.

Bottom line

A revenue cycle assessment is a checklist, not a mystery: pull 90 days of data, compute six KPIs with published definitions, check 11 areas from lead source to audit log, score them and give each fix an owner. Run it yourself, or request a free practice audit through our end-to-end revenue cycle management services and use this checklist to judge what it covers.

Frequently asked questions

What is a revenue cycle assessment?

It is a structured review of every step between a patient’s first contact and the final payment: marketing attribution, scheduling, eligibility, prior authorization, charge capture, coding, claim edits, denials, payment posting, A/R, patient collections and software access. It uses your own data and standard KPIs to show which stage costs the most, so you know where to focus first.

How is a revenue cycle assessment different from a medical billing audit?

A billing audit samples claims and checks codes, documentation and payer rules. A revenue cycle assessment covers the whole process, including steps before the claim exists, such as lead source and eligibility, and after it is paid, such as underpayments and A/R. A sensible order is to run the assessment first, then point a billing or coding audit at the weakest stage.

What reports do I need for a revenue cycle assessment?

Start with 90 days of electronic remittances (835 files), a current A/R aging report by payer and a denial report by reason code. Add clearinghouse rejections, charge lag, payer fee schedules, a scheduling and lead-source report, and a user access list with an audit log sample. If an outside firm reviews them, put a Business Associate Agreement in place first.

How often should a medical practice assess its revenue cycle?

No rule sets a frequency for practices. In our view, a full assessment once a year, such as in January, plus a monthly KPI review is a sensible rhythm. Re-run it after a new EHR, a new billing vendor or a major payer contract change. HHS proposed an annual Security Rule compliance audit in December 2024; check whether a final rule has been issued.

Which KPIs matter most in a revenue cycle assessment?

Net days in A/R, the share of A/R over 90 days, the initial denial rate, the clean claim rate, the net collection rate and cost to collect. Use HFMA MAP Keys or MGMA formulas and state which one each number follows. Neither source sets a universal target, so compare each figure with your own trend and calculate denial rates by payer.

What should a free practice audit include?

A useful free audit should look at the whole cycle, show the data and definitions behind each finding and give written fixes you can make without hiring the vendor. It should not promise percentages before anyone sees your data. RCM Finder offers a free practice audit; we put a Business Associate Agreement in place before accessing patient data, and pricing is quoted afterwards.

Sources

1. MAP Keys: Indicators of Revenue Cycle Excellence, 2023 Edition — HFMA (2023)
2. MGMA Data Definitions (DataDive glossary) — MGMA (2025)
3. Strategic improvements in your RCM to reduce your practice's claim denials (MGMA Stat) — MGMA (2024)
4. Claims Denials and Appeals in ACA Marketplace Plans in 2024 — KFF (2026)
5. Claims Adjudication Costs Providers $25.7 Billion – $18 Billion is Potentially Unnecessary Expense — Premier Inc. (2025)
6. CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) fact sheet — CMS (2024)
7. CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) policy page — CMS (2026)
8. 42 CFR 424.44 — Time limits for filing claims — eCFR (National Archives) (2026)
9. Good faith estimate guide — CMS (2024)
10. Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates — HHS Office for Civil Rights (2024)
11. 45 CFR 164.312 — Technical safeguards — eCFR (National Archives) (2026)
12. 45 CFR 164.308 — Administrative safeguards — eCFR (National Archives) (2026)
13. HIPAA Security Rule Notice of Proposed Rulemaking fact sheet — HHS Office for Civil Rights (2024)
14. Business Associates — HHS Office for Civil Rights (2026)
15. Minimum Necessary Requirement — HHS Office for Civil Rights (2013 (page updated 2026))
16. General Compliance Program Guidance — HHS Office of Inspector General (2023)