Healthcare Administration & Management · Independent exam preparation
Certified Healthcare Auditor (CHA) Study Guide
Practise audit planning, sampling, documentation review, statistical interpretation and corrective action decisions for AIHC's Certified Healthcare Auditor exam.
By CertMedbry · Updated 3 November 2026
Learn to turn a healthcare compliance concern into a defensible audit: define the population, evaluate documentation, interpret findings and verify corrective effectiveness. This guide addresses AIHC's Certified Healthcare Auditor (CHA) examination using its January 2026 information packet. Its 60 concepts are selective; the issuer's complete learning objectives and five-domain outline remain the full study scope. No official domain weights are published, so each domain receives equal coverage here.
Try 20 free practice questionsWhat is the exam format?
Check the question types, timing and outline before planning your revision.
Which credential and pathway does this guide address?
This guide addresses AIHC's Certified Healthcare Auditor (CHA), associated with its Auditing for Compliance program. The January 2026 packet describes optional certification after successful course completion. This is a healthcare auditing credential, not a nursing licensure or advanced practice examination.
Auditing for Compliance — AIHC · Auditing for Compliance: Healthcare Auditor Online Training Program — Revised January 2026
How many questions are on the examination, and are any unscored?
The January 2026 packet specifies 100 questions. It does not identify a separate scored versus pretest question count, so no such breakdown can be established from that publication.
Auditing for Compliance: Healthcare Auditor Online Training Program — Revised January 2026
What are the examination duration and delivery arrangements?
The issuer describes a three-hour, open-note examination taken online from home or office by appointment with a professional proctor. The course's four-month access period is a training arrangement, not the examination duration.
Auditing for Compliance: Healthcare Auditor Online Training Program — Revised January 2026
Which item styles and adaptive features are verified?
The packet specifies the question count but does not describe item styles or state whether delivery is adaptive. This guide's 20 four-option, single-best-answer questions are independent learning drills; they do not establish the format of actual examination items.
Auditing for Compliance: Healthcare Auditor Online Training Program — Revised January 2026
What passing standard does the issuer publish?
The January 2026 packet states a passing score of 80%. Performance on these independently authored drills does not predict an examination result.
Auditing for Compliance: Healthcare Auditor Online Training Program — Revised January 2026
Which blueprint and dates apply to this guide?
The program page links the information packet revised January 2026. That packet lists five examination domains without percentages or a separate examination effective date. This guide gives each domain 12 concepts, four questions and four flashcards as an educational allocation, not an official weighting.
Auditing for Compliance — AIHC · Auditing for Compliance: Healthcare Auditor Online Training Program — Revised January 2026
How do newer disclosure references relate to the January 2026 outline?
The outline establishes disclosure pathways as study topics. Substantive discussion here also uses the CMS SRDP currently linked as revised September 2026, bearing Form CMS-10328 (07/2026), and the OIG protocol updated October 15, 2026. September 2026 identifies the CMS protocol revision; July 2026 identifies the form edition and does not establish a publication date. These source dates do not establish a new CHA blueprint or examination effective date.
Auditing for Compliance: Healthcare Auditor Online Training Program — Revised January 2026 · Self-Referral Disclosure Protocol — CMS · CMS Voluntary Self-Referral Disclosure Protocol — Form CMS-10328, July 2026 · Health Care Fraud Self-Disclosure Protocol — Updated October 15, 2026
These independently authored learning materials address the US healthcare compliance auditing credential awarded by the American Institute of Healthcare Compliance, Inc. The workbook wording 'Certified in Healthcare Auditing' maps to AIHC's official Certified Healthcare Auditor designation; it does not establish a separate credential or historical examination name.
Outline used: AIHC Auditing for Compliance information packet, revised January 2026, currently linked from the issuer's program page. The workbook label 'Certified in Healthcare Auditing (CHA)' is mapped to AIHC's Certified Healthcare Auditor (CHA) examination based on the matching designation and healthcare auditing program. The workbook wording is not the issuer's official credential name. The packet identifies five examination domains but states no domain weights or separate examination effective date.
60 key concepts: understand, apply and avoid the traps
Work through the questions by exam domain. Explain the answer in your own words, try the example, then check the common pitfall.
Acronyms and Termsnot stated
1.How does PERC organize a complete audit?
PERC means Plan, Execute, Report and Corrective Action. Planning establishes the objective, scope, criteria and method; execution collects and evaluates evidence; reporting communicates supported findings; corrective action addresses causes and checks results. The phases are connected: an unclear criterion weakens execution, while a report without follow-up leaves recurrence unresolved. Use PERC to locate the next required decision rather than treating completion of fieldwork as completion of the audit.
Apply it
A team finishes reviewing claims and sends an error spreadsheet to management. Apply PERC by developing a supported report, assigning corrective responsibilities and defining how a later review will determine whether the problem recurs.
Common pitfall: Treating PERC as four unrelated documents misses the information loop: findings should drive actions, and monitoring results should influence the next audit plan.
Auditing for Compliance: Healthcare Auditor Online Training Program — Revised January 2026
2.What distinguishes audit criteria, evidence and findings?
Criteria are the requirements or reference standards against which an audit evaluates performance. Evidence is relevant, verifiable information about what occurred. A finding results from evaluating that evidence against the criteria. The discriminating question is whether a statement identifies the rule, the observed condition or the comparison between them. This separation helps an auditor explain a nonconformity without substituting personal preference for an applicable requirement.
Apply it
A policy requires documented approval before a refund. Transaction records show three refunds approved afterward. The policy supplies the criterion, the records supply evidence and the timing mismatch supports the finding for those transactions.
Common pitfall: A staff member's preferred workflow is not automatically an audit criterion. Establish its authority and applicability before describing a different practice as nonconforming.
3.How do auditing and ongoing monitoring differ?
Auditing uses a defined scope and systematic evidence evaluation to assess performance against criteria. Monitoring provides continuing checks of operations and controls, often through routine measures or exception reports. Both can detect problems, but a favorable dashboard does not establish that its underlying data or controls are reliable. A useful distinction is whether the activity independently evaluates a process or routinely watches its operation over time.
Apply it
A billing supervisor checks unsigned encounters every morning. An audit team later tests whether that report includes all eligible encounters and whether signatures meet applicable requirements. The daily check monitors operations; the scoped review evaluates its reliability.
Common pitfall: Repeatedly producing a dashboard does not prove control effectiveness. A monitoring measure can remain reassuring when its population is incomplete or its exception logic is defective.
General Compliance Program Guidance — November 2023 · What Is Auditing? — ASQ
4.Which relationships define first-, second- and third-party audits?
A first-party audit is performed for an organization on its own activities. A second-party audit evaluates a supplier for a customer or another party with a direct interest in that relationship. A third-party audit is conducted by an organization independent of that customer-supplier relationship. Classification follows whose interests the engagement serves and the relationship being examined, rather than simply whether the individual auditor works outside the audited organization.
Apply it
A health system hires a consultant to evaluate its claims-processing vendor against their contract. The consultant is external, but the engagement remains a second-party audit because it evaluates a supplier on the customer's behalf.
Common pitfall: Calling every consultant-led engagement third-party confuses employment status with audit relationships. An outsourced internal audit can still serve a first-party audit purpose for the organization.
5.What distinguishes an NCD from local Medicare coverage material?
An NCD is a national coverage determination issued by CMS and applicable nationally to the Medicare coverage issue it addresses. LCD means local coverage determination; local coverage articles provide related contractor guidance, including coding information where applicable. Audit interpretation requires attention to the service, jurisdiction and date of service. A national rule should not be treated as a contractor preference, and local material should not be assumed to establish nationwide policy.
Apply it
Two offices use different contractors. Before comparing their coverage decisions, an auditor checks whether an NCD governs the service and then identifies applicable local materials and versions for each office's dates of service and jurisdiction.
Common pitfall: A current webpage may differ from the rule applicable to an older claim. Match coverage material to the relevant service period before reaching a conclusion.
Medicare Coverage — General Information · Auditing for Compliance: Healthcare Auditor Online Training Program — Revised January 2026
6.What do FCA knowledge terms mean for an auditor?
The False Claims Act, or FCA, addresses knowingly submitting or causing false or fraudulent claims for government payment. Knowledge includes actual knowledge, deliberate ignorance and reckless disregard; proof of a specific intent to defraud is not required for civil FCA liability. These terms distinguish a legal risk inquiry from simply counting documentation errors. An auditor should preserve facts about awareness and responses without declaring that every inaccurate claim establishes fraud.
Apply it
A manager repeatedly receives credible reports that a billing edit creates unsupported charges but orders continued billing without investigation. Document the notifications and decisions because they may illuminate knowledge beyond the existence of erroneous claims.
Common pitfall: An error rate alone does not establish FCA knowledge. Conversely, absence of an admission of intentional fraud does not eliminate deliberate ignorance or reckless disregard.
7.Which facts distinguish AKS and Stark terminology?
AKS means the federal Anti-Kickback Statute, which addresses knowing and willful remuneration to induce or reward federal healthcare program business. Stark refers to the physician self-referral law governing certain physician referrals for designated health services where a financial relationship exists, unless an exception applies. The principal sorting cues are remuneration and inducement for AKS, versus a covered referral, financial relationship and applicable exception for Stark. An arrangement can implicate both laws.
Apply it
An auditor reviews payments to a referring physician. First identify the services, payer, financial relationship and compensation purpose. Those facts help distinguish a self-referral exception analysis from a potential inducement analysis requiring examination of intent and remuneration.
Common pitfall: A Stark exception does not automatically resolve AKS concerns. The laws ask different questions, so one favorable classification cannot substitute for evaluating the other framework.
8.How do population, sampling frame and sampling unit differ?
The population is the complete set about which an audit seeks conclusions. The sampling frame is the operational list from which selection occurs. The sampling unit is the individual element selected, such as a claim, beneficiary or encounter. These can differ materially: a claim-line file does not automatically provide an encounter-level frame. Define each explicitly so inclusion probabilities and the eventual conclusion refer to the same intended group.
Apply it
An audit asks about paid claims, but the extract contains multiple lines per claim. The team defines each claim as one sampling unit, consolidates the lines and reconciles the resulting frame to the eligible paid-claims population.
Common pitfall: Random selection from a flawed frame remains flawed. Duplicate units, omitted facilities or mismatched dates can undermine representativeness before the random-number generator is used.
9.What separates a population parameter from a sample statistic?
A parameter describes an entire defined population, such as its true mean overpayment. A statistic describes the observed sample, such as the sample mean used to estimate that parameter. Sampling uncertainty arises because another valid sample could produce a different statistic. The distinction determines how confidently an auditor can generalize: a sample result is directly observed for reviewed units, while a population estimate requires an appropriate design and uncertainty assessment.
Apply it
A random sample has a mean overpayment of $42 per claim. Report $42 as the observed sample mean and, when supported by the design, use it to estimate the population mean with stated uncertainty.
Common pitfall: Labeling the sample mean the population's exact mean erases sampling uncertainty. Reviewing many records does not make a sample statistic a known population parameter.
Confidence Limits for the Mean — NIST/SEMATECH · Statistical Sampling: A Toolkit for MFCUs — September 2018
10.How do confidence and precision describe different properties?
Confidence describes the long-run coverage performance of an interval-producing method under its assumptions. Precision describes how tightly an estimate is bounded, commonly through an interval's margin of error. Higher confidence generally produces a wider interval when the data and method remain fixed. A planning decision must therefore specify both the desired confidence and acceptable precision, rather than treating a confidence percentage as a guarantee of a small estimation error.
Apply it
Two proposed designs both target 95% confidence. One allows an error margin of $10 and the other $3. The second seeks greater precision and generally requires more observations when other design assumptions remain comparable.
Common pitfall: A 95% confidence level does not mean 95% of claims are correct or that a completed interval has a 95% frequentist probability of containing a fixed parameter.
Selecting Sample Sizes — NIST/SEMATECH · Confidence Limits for the Mean — NIST/SEMATECH
11.Why distinguish standard deviation from standard error?
Standard deviation describes spread among individual observations. Standard error describes uncertainty in an estimated statistic. For an ordinary mean of independent observations, the estimated standard error is the sample standard deviation divided by the square root of sample size: s/√n. Increasing sample size can reduce uncertainty in the mean without making individual claims more similar. The distinction prevents an auditor from interpreting a precise estimate as evidence of a uniform population.
Apply it
Claim adjustments have a sample standard deviation of $80 across 64 independent observations. The estimated standard error of the mean is $10. Individual adjustments remain variable even though their estimated average is measured more precisely.
Common pitfall: Dividing by the sample size instead of its square root understates standard error. Complex sampling designs may require a different variance calculation from the simple independent-observation formula.
12.What distinguishes inherent risk from residual risk?
Inherent risk is exposure before considering controls; residual risk is exposure remaining after controls are considered. A high-risk activity can have lower residual risk if effective controls reduce its likelihood or impact. Conversely, a policy that exists only on paper may provide little reduction. The useful audit question is whether evidence supports the claimed control effect, rather than whether management can identify a written procedure.
Apply it
A high-volume refund process has substantial inherent exposure. Management cites automated approval limits as mitigation. The auditor tests configuration and actual transactions before accepting management's assessment that the remaining risk is relatively low after controls.
Common pitfall: Residual risk is not the amount of risk management wishes to accept. It requires evaluating control effectiveness, including failures, overrides and changes in operating conditions.
Auditing for Compliance: Healthcare Auditor Online Training Program — Revised January 2026 · General Compliance Program Guidance — November 2023
Planning the Business System Audit, Leadership, Sample Size and OIG Compliance Standardsnot stated
13.How should an audit plan connect objective, scope and criteria?
The objective states the question the audit will answer. Scope sets boundaries such as processes, locations, payers and dates. Criteria identify the applicable standards used to evaluate evidence. These choices should align before sampling begins: a review of signature compliance cannot alone answer whether every service was medically necessary. A coherent plan also identifies the evidence and expertise required to reach conclusions within the stated boundaries.
Apply it
Management asks whether outpatient claims were supported. The team narrows the objective to authentication compliance for Medicare encounters during one quarter, states the applicable CMS criteria and avoids presenting the result as a comprehensive medical-necessity assessment.
Common pitfall: A broad title can imply more assurance than the work supports. Match the eventual conclusion to the objective, scope and criteria actually examined in fieldwork.
Auditing for Compliance: Healthcare Auditor Online Training Program — Revised January 2026 · What Is Auditing? — ASQ
14.Why does leadership support affect audit quality?
Leadership support gives an audit practical authority through access, resources, escalation routes and accountability for corrective action. Support should facilitate evidence-based conclusions rather than dictate a preferred result. A useful distinction is between resolving an operational obstacle and suppressing an unfavorable finding. When leadership provides a clear reporting route and adequate expertise, the audit team can investigate significant issues without allowing the audited function to control the conclusion.
Apply it
A department delays records needed for a scheduled review. The audit lead uses the agreed escalation route to obtain access and documents the effect on timing, while keeping conclusions dependent on evidence rather than executive expectations.
Common pitfall: A senior sponsor's confidence in a department is not audit evidence. Leadership endorsement should enable objective work, not replace testing or determine findings before fieldwork.
Auditing for Compliance: Healthcare Auditor Online Training Program — Revised January 2026 · General Compliance Program Guidance — November 2023
15.Which competencies should an audit team demonstrate?
Auditor competence must fit the engagement's subject matter and methods. Relevant capabilities include understanding criteria, interviewing, evaluating records, documenting conclusions and recognizing limits of expertise. A claims review may require coding, clinical and statistical skills that no single auditor possesses. OIG recommends medical-necessity review by an appropriately credentialed clinician. Team design should therefore follow the audit questions, with specialist involvement where the evidence requires professional judgment outside the lead auditor's competence.
Apply it
A coding specialist identifies a correctly coded procedure but cannot determine whether the documented clinical condition justified it. The plan assigns the necessity assessment to an appropriately credentialed clinician and keeps coding and clinical conclusions separately supported.
Common pitfall: Coding accuracy does not establish medical necessity. An auditor's familiarity with terminology cannot substitute for the clinical qualifications needed to evaluate a clinical justification question.
General Compliance Program Guidance — November 2023 · Auditing for Compliance: Healthcare Auditor Online Training Program — Revised January 2026
16.How should risk assessment determine audit priorities?
Risk assessment identifies exposures and evaluates their significance using factors such as likelihood, impact, prior findings, operational changes and control effectiveness. OIG recommends at least annual compliance risk assessment with attention to emerging risks between assessments. A useful audit plan translates that assessment into specific review priorities rather than repeating the previous year's schedule unchanged. External enforcement attention can inform priorities, but organization-specific exposure remains essential to the selection.
Apply it
A provider introduces a new billing interface after completing its annual assessment. Early exception reports show duplicate charges. The audit committee adjusts the plan to review the new interface instead of waiting for the next annual cycle.
Common pitfall: An annual assessment is not permission to ignore new risks. OIG's recommended cadence also should not be described as a universal statutory deadline for every organization.
17.What authority does OIG's general compliance guidance carry?
OIG's General Compliance Program Guidance is voluntary and nonbinding. It explains recommended compliance practices but does not itself create a universal legal obligation for every recommendation. Auditors should distinguish recommendations from applicable statutes, regulations, contracts and organization-specific agreements. The decisive step is identifying the authority for the criterion being tested. A departure from recommended practice may indicate risk or an improvement opportunity without automatically establishing a legal violation.
Apply it
An auditor finds no annual risk-assessment schedule. The report explains the departure from OIG's recommended practice and its risk implications, then separately checks whether another binding requirement or organizational policy establishes an enforceable obligation.
Common pitfall: Calling every departure an OIG violation overstates the guidance's authority. Calling the guidance irrelevant because it is voluntary ignores its value in evaluating program effectiveness.
18.How do compliance program elements work together?
OIG's compliance framework connects written policies, leadership and oversight, training, communication, consequences, risk assessment and auditing, and response to detected problems. These elements operate as a system: reporting concerns has limited value if no investigation follows, and training cannot compensate for contradictory incentives. An effectiveness review should examine whether information moves between elements and produces action, rather than merely confirming that each element has a named document or assigned office.
Apply it
An organization has a hotline and annual training, but repeated billing concerns receive no documented response. The audit follows concerns through investigation, action and feedback to determine whether the program converts reports into meaningful risk reduction.
Common pitfall: Counting policies and training sessions measures activity. It does not demonstrate that staff understand expectations, concerns reach decision makers or detected problems receive effective corrective action.
19.How can an audit preserve objectivity when interests conflict?
Objectivity requires conclusions to follow evidence and criteria despite personal, operational or financial pressures. An auditor reviewing a process they designed may face a self-review concern; an auditor rewarded for low findings may face another conflict. Planning should identify these relationships and use suitable assignments, oversight or independent review. The practical test is whether someone with a stake in the outcome can influence selection, evaluation or reporting without an effective counterbalance.
Apply it
The manager who designed a new charge edit is asked to audit its accuracy. The organization assigns evaluation to another qualified reviewer and uses the manager's knowledge as process input rather than as the sole basis for assurance.
Common pitfall: Technical expertise does not remove a conflict of interest. Conversely, recognizing a conflict should lead to a suitable safeguard rather than automatic loss of useful subject expertise.
What Is Auditing? — ASQ · Auditing for Compliance: Healthcare Auditor Online Training Program — Revised January 2026
20.How should eligibility rules shape a sampling frame?
Eligibility rules translate an audit objective into reproducible inclusion and exclusion conditions. Define dates, payment status, services, locations and unit handling before selection, then reconcile the frame to reliable source totals. Excluding canceled or unpaid claims can be appropriate for a paid-claims objective, but those exclusions change the population described by the results. Preserve the extract and filters so another reviewer can understand exactly what was eligible for selection.
Apply it
An audit estimates improper payments for claims paid during a quarter. The analyst documents the payment-date filter, excludes canceled transactions under the stated rule and reconciles claim counts and paid dollars before drawing the sample from the frame.
Common pitfall: Deleting inconvenient cases after selection changes the design and can bias results. Eligibility decisions should follow the defined objective, not the availability or apparent quality of records.
21.What makes random selection reproducible?
Traceability identifies which units were selected and documents how selection occurred. Reproducibility additionally permits regeneration of the original random draw. For reproducible pseudorandom selection, retain the generator and relevant software version and settings, the random seed, the original ordered and numbered sampling frame, the generated random numbers and the selected identifiers. Record the sample size and selection rules, including whether sampling permits replacement and how duplicate numbers are handled. The seed initializes the generator's sequence; reproducing that sequence also requires the same generator and relevant settings. Preserving the frame's original order ensures that regenerated numbers map to the same units.
Apply it
For an illustrative sample of 50 claims from 2,000 eligible claims, an analyst preserves the eligibility criteria and original frame numbered 1 through 2,000. The analyst records the generator, software version, settings and seed, then saves the generated numbers and their corresponding claim identifiers. An independent reviewer can regenerate the sequence and verify the mapping. If the analyst instead used Excel RAND and froze its output, the saved values and frame would document the selections, but would not provide seed-based regeneration of the original draw.
Common pitfall: Freezing spreadsheet random values preserves useful selection evidence; it does not create a random seed. OIG's sampling toolkit warns that Excel RAND lacks a random seed, which can make a sample harder to defend. This limitation does not automatically invalidate the sample. Distinguish the documentation available to trace saved selections from the information required to regenerate the draw. A seed alone is also insufficient if the generator, relevant settings or original frame order is missing.
22.When is a targeted nonstatistical sample useful?
A targeted sample deliberately selects units with characteristics relevant to an audit question, such as unusually large payments or a known risk indicator. It can efficiently identify failure mechanisms and guide further work. Its selection process generally does not support design-based estimates for all claims. The key distinction is the intended inference: finding whether a suspected problem exists differs from estimating its prevalence or financial effect across a defined population.
Apply it
A team selects twenty unusually high-value claims to investigate a suspected edit failure. It reports the observed defects and their mechanism, then develops a separate probability sampling plan if management needs a defensible population estimate.
Common pitfall: A large targeted sample is still targeted. Sample size alone does not justify applying its error percentage to every claim in the organization's broader population.
23.Which factors increase the sample size needed for an estimate?
For comparable estimation designs, greater variability, higher desired confidence and a narrower acceptable error margin generally increase required sample size. Planning also depends on the quantity being estimated and the sampling design. Prior data or a suitable pilot can inform variability assumptions. For a simple mean approximation, sample size varies with variance and inversely with squared precision, explaining why modest improvements in precision can require substantial additional review effort.
Apply it
A pilot shows twice the expected standard deviation in payment errors. Holding confidence and the desired error margin constant, the simple mean-based sample-size approximation requires roughly four times the observations because variance is squared standard deviation.
Common pitfall: A fixed percentage of claims is not a universal sample-size rule. State the estimation objective, assumptions and desired precision before choosing a number of records.
24.How do stratification and RAT-STATS support sampling?
Stratification separates a population into defined, nonoverlapping groups before sampling, potentially improving efficiency when units within groups are more similar than the population overall. Estimates must then account for the design and each stratum's population contribution. RAT-STATS provides tools for random selection and improper-payment estimation. Its availability does not make its use universally mandatory, and software cannot decide whether the population, review criteria or design assumptions fit the audit objective.
Apply it
A few very large claims create substantial variability. The statistician separates payment bands before selection and documents stratum counts and estimation methods. RAT-STATS assists the calculations, while the team validates that all eligible claims belong to one stratum.
Common pitfall: Averaging stratum means without appropriate population weighting can distort results. Also, OIG's software page does not establish a general requirement that every audit use RAT-STATS.
Statistical Sampling: A Toolkit for MFCUs — September 2018 · RAT-STATS — Statistical Software
Executing the Audit, Project Management & Attorney-Client Privilege, Medical Record Documentation Standardsnot stated
25.How should an opening meeting support project execution?
An opening meeting establishes a shared understanding of the audit objective, boundaries, criteria, information requests, responsibilities and communication arrangements. It should identify practical obstacles early without allowing the audited department to renegotiate unfavorable criteria informally. Project management then tracks dependencies, access problems and agreed changes. The discriminating issue is whether a change merely adjusts scheduling or materially changes the work needed to answer the audit question and therefore requires documented reconsideration.
Apply it
During the opening meeting, staff explain that archived records require an additional week to obtain. The audit lead adjusts milestones, assigns retrieval responsibility and assesses whether the delay affects the planned evidence or reporting date for the engagement.
Common pitfall: Agreeing to a convenient deadline does not justify omitting necessary evidence silently. Document material scope limitations and their effect on the conclusions the audit can support.
Auditing for Compliance: Healthcare Auditor Online Training Program — Revised January 2026 · What Is Auditing? — ASQ
26.How does gap analysis turn observations into supported nonconformities?
Gap analysis compares the current condition with an applicable expected condition. A supported nonconformity identifies the criterion, relevant evidence and the specific difference between them. Interviews help explain work, but corroborating records or direct observation strengthen conclusions when available. Separate what is established from what remains uncertain. A useful gap statement is narrow enough that another reviewer can follow the evidence and understand precisely which requirement was unmet.
Apply it
Staff report that every adjustment receives approval, but transaction logs show several adjustments with no approval record. The auditor verifies how approvals are stored, confirms the applicable requirement and documents only the gaps supported by the completed review.
Common pitfall: An absent record in one system may reflect storage elsewhere rather than a missing action. Resolve plausible evidence gaps before equating unavailable documentation with confirmed nonperformance.
Auditing for Compliance: Healthcare Auditor Online Training Program — Revised January 2026 · What Is Auditing? — ASQ
27.Why does attorney involvement not automatically privilege an audit?
Attorney-client privilege concerns qualifying confidential communications for legal advice; it does not automatically cover every audit document involving an attorney. Routine business review and legal advice can coexist, making purpose, participants and handling important. The CHA outline includes conducting audits under attorney-client privilege, but a label alone cannot establish protection. When an engagement is intended to support legal advice, clarify counsel's role and communication arrangements before work proceeds and preserve underlying evidence accurately.
Apply it
A compliance team plans to copy counsel on a routine billing report and mark it privileged. Before circulation, it clarifies whether counsel is directing a legal-advice engagement and establishes appropriate handling rather than assuming the copied recipient creates protection.
Common pitfall: Marking a document privileged or copying an attorney is not decisive. Privilege questions depend on applicable law and circumstances, and underlying facts do not disappear.
Auditing for Compliance: Healthcare Auditor Online Training Program — Revised January 2026
28.How should an auditor evaluate facts suggesting false claims risk?
A false-claims review should distinguish the unsupported claim, the applicable payment requirement and evidence relevant to knowledge. FCA knowledge can include actual knowledge, deliberate ignorance or reckless disregard. Interview accounts, prior warnings, edit overrides and responses to detected errors may therefore matter alongside the claim itself. An auditor documents these facts and escalates significant concerns through the established process, while avoiding a legal conclusion based solely on error frequency or reimbursement size.
Apply it
A review finds unsupported services after multiple internal warnings about the same billing rule. The auditor retains the warnings, claim evidence and management responses, then escalates the pattern for appropriate investigation rather than reporting only a numerical error rate.
Common pitfall: Correcting a claim does not answer how the error arose or whether similar claims remain affected. Conversely, a documentation defect alone does not prove fraudulent intent.
29.Which arrangement facts distinguish referral-law concerns?
Review the parties, financial relationships, services, payer involvement, referral activity and compensation terms before classifying a referral arrangement. Stark generally prohibits specified Medicare referrals for designated health services where a physician financial relationship exists unless an exception applies. AKS examines knowing and willful remuneration intended to induce or reward federal program business. A compensation arrangement can require both analyses, and commercially reasonable wording does not substitute for examining actual terms and conduct.
Apply it
A hospital pays a referring physician under a consulting agreement. The auditor compares contracted duties with services actually performed, traces payments and referrals, and identifies the designated services involved before routing the facts for the relevant legal analyses.
Common pitfall: A signed contract does not establish that an exception or safe harbor is satisfied. Actual performance, payment structure and referral-related facts can change the analysis materially.
30.When does a signature log resolve an authentication issue?
A signature log helps identify an author when a handwritten signature or initials are present but illegible. It connects the mark to the individual's printed identity and credentials. This differs from supplying an absent signature or proving medical necessity. The auditor should first determine whether the problem is illegibility, missing authentication or a substantive documentation deficiency, because the appropriate response depends on which element is actually missing from the record.
Apply it
A progress note contains an unreadable signature. A valid signature log links that mark to the treating practitioner. The auditor uses the log for author identification and separately reviews whether the note supports the billed service and other requirements.
Common pitfall: A log identifies an existing mark; it does not create a signature where none exists. Do not use author identification to excuse unrelated documentation or coverage deficiencies.
31.How do signature attestations differ from late order signatures?
CMS permits an author attestation in specified circumstances to address missing authentication of a medical record entry. An attestation confirms authorship; it does not add clinical facts or operate as a universal cure for an unsigned order. CMS distinguishes orders from other documentation and does not permit using the attestation process simply to supply a missing order signature. First classify the document and applicable signature requirement before deciding whether an attestation is appropriate.
Apply it
An unsigned progress note and an unsigned order appear in the same file. The reviewer evaluates whether an author attestation is acceptable for the note, then separately applies the order-specific rule instead of requesting identical attestations for both documents.
Common pitfall: A later statement of authorship cannot manufacture contemporaneous medical necessity. Authentication remediation and the substantive support for an ordered or billed service remain separate audit questions.
32.How should an auditor assess AI-scribed documentation?
An AI-generated draft does not relieve the practitioner of responsibility for the medical record. Review whether the responsible practitioner reviewed, verified and authenticated the documentation as required, and whether the content accurately supports the service. The software's production timestamp or system attribution is different from practitioner authentication. Audit attention should therefore follow authorship responsibility and actual verification, while also considering the security of information handled by the tool.
Apply it
An encounter note is labeled AI-generated and contains a system timestamp but no practitioner authentication. The auditor checks whether the treating practitioner reviewed and authenticated it and tests content support rather than treating the software label as sufficient authorship.
Common pitfall: Fluent text and automated completion indicators do not establish accuracy or authentication. Technology can assist documentation, but its output still requires the responsible practitioner's required verification.
Complying with Medicare Signature Requirements — July 2025 · Summary of the HIPAA Security Rule — HHS
33.Which evidence supports an unsigned diagnostic laboratory order?
Certain Medicare clinical diagnostic laboratory orders do not require an order signature. That exception does not eliminate the need for documentation showing the treating practitioner's intent to order the specific test and supporting medical necessity. Evaluate the order together with the relevant medical record, including authenticated documentation where required. The discriminating cue is evidence of a specific clinical ordering decision, rather than simply a laboratory's possession of a requisition or a test result.
Apply it
A laboratory requisition lacks a signature, but an authenticated visit note identifies the exact test and clinical reason. The auditor evaluates that documented intent and necessity under the applicable laboratory requirements instead of denying solely because the requisition is unsigned.
Common pitfall: An unsigned-order exception is not an exception to medical necessity. A test result or generic standing phrase alone may not establish the practitioner's intent for the specific test.
34.Why must coverage and medical necessity be reviewed separately from coding?
A code can accurately describe a performed service while the claim still lacks support for coverage or medical necessity. Review the applicable coverage requirements and the clinical record, using appropriately credentialed clinical expertise for necessity judgments. National coverage determinations establish national policy for their covered issues; applicable local material may add relevant detail. A paid claim or clean coding edit is therefore insufficient evidence that all substantive payment requirements were satisfied.
Apply it
A procedure code matches the operative report, but the preprocedure record does not explain the qualifying indication. The auditor obtains the applicable coverage criteria and clinical review before deciding whether accurate coding also supports payment for that service.
Common pitfall: Payment by a payer is not an audit finding of medical necessity. Automated edits and code matching may leave important clinical coverage conditions entirely untested.
General Compliance Program Guidance — November 2023 · Medicare Coverage — General Information
35.How does minimum necessary apply to audit access?
For uses and disclosures subject to HIPAA's minimum necessary requirement, access should be reasonably limited to information needed for the purpose. Organizations should define role-based access and criteria for routine requests. Access to an entire record requires policies that explicitly justify that need. The rule has exceptions, including disclosures to or requests by a healthcare provider for treatment; a compliance audit should not be classified as treatment merely to avoid purpose-based access decisions.
Apply it
An audit examines whether demographic corrections were authorized. The team first requests the fields and audit history needed for that question. If full clinical records become necessary, it documents the purpose and follows policies supporting that broader access.
Common pitfall: Auditor status does not create unlimited access. Also, applying minimum necessary mechanically to a treatment disclosure ignores an express exception and can produce the wrong rule.
36.What evidence supports a HIPAA Security Rule control assessment?
The Security Rule addresses administrative, physical and technical safeguards for electronic protected health information. Audit controls should record and permit examination of system activity, while authentication verifies that a person or entity is who they claim to be. Evaluate actual configuration, access and review practices rather than policy existence alone. An addressable implementation specification requires a reasoned assessment and appropriate documentation; its designation does not make the underlying security decision simply optional.
Apply it
A vendor handling electronic patient records says its addressable safeguard is unnecessary. The auditor requests the documented assessment, implemented measures and any appropriate alternative, then examines whether access authentication and activity records operate as represented in practice.
Common pitfall: A vendor's claim of advanced technology does not exempt it from safeguards. Addressable specifications require analysis, and unused logs provide limited evidence of effective activity review.
Report Auditing Findings, Data Analysis, Benchmarks, Statistical Analysisnot stated
37.What makes an audit finding defensible?
A defensible finding connects an applicable criterion with a documented condition and explains the significance supported by the work. Distinguish verified observations, assumptions, possible causes and established conclusions. State the population reviewed and any limits on inference. This structure lets a reader assess the reasoning without accepting the auditor's authority on trust. If cause or financial impact remains uncertain, identify the uncertainty rather than presenting an estimate or hypothesis as an established fact.
Apply it
A report states that six of forty reviewed encounters lacked required authentication. It identifies the criterion and sample method, describes the affected records and separates the confirmed documentation issue from any still-unresolved conclusion about broader payment impact.
Common pitfall: Strong adjectives cannot replace evidence. Calling a process broken or fraudulent without defined criteria and supporting facts weakens the finding and may overstate the work performed.
What Is Auditing? — ASQ · Auditing for Compliance: Healthcare Auditor Online Training Program — Revised January 2026
38.Which information belongs in an executive summary?
An executive summary should communicate why the audit occurred, what was examined, the most significant supported findings and the decisions or actions required. Include material scope limitations so readers understand the assurance provided. Detailed workpapers support the message but should not obscure it. The useful test is whether leadership can identify the exposure, responsible action and basis for prioritization without mistaking a limited review for an organization-wide conclusion.
Apply it
A targeted review identifies a recurring authorization failure. The summary states that the sample was risk-selected, explains the confirmed mechanism and recommends control redesign, while placing transaction details in the supporting report rather than implying a population error estimate.
Common pitfall: Removing all methodological limits for brevity can mislead decision makers. A concise summary still needs the boundaries that materially affect interpretation of the findings and recommendations.
Auditing for Compliance: Healthcare Auditor Online Training Program — Revised January 2026 · What Is Auditing? — ASQ
39.How do error-rate denominators and median calculations affect audit reporting?
An error rate depends on its counting unit: claims containing at least one defined error divided by eligible reviewed claims gives a claim-level rate; defective lines divided by eligible reviewed lines gives a line-level rate. Multiple defects on one claim do not become multiple erroneous claims. A median answers a separate question about the center of ordered numerical observations. Sort the values first. For an odd number of observations, use the middle observation. For an even number, calculate the arithmetic average of the two middle observations.
Apply it
Ten erroneous claims among fifty reviewed claims produce a 20% claim error rate. Fifteen defective lines among two hundred reviewed lines produce a 7.5% line error rate. For ordered overpayment amounts of $10, $20, $40 and $130, the median is ($20 + $40)/2 = $30, although no observation equals $30. For $10, $20 and $130, the median is the single middle observation, $20. Label each measure so readers understand whether it describes error frequency or a central dollar amount.
Common pitfall: Do not select either middle observation arbitrarily when the count is even, or average the smallest and largest values. Compare error rates only when eligibility, units and error definitions match. A median dollar amount cannot substitute for the total financial exposure.
Auditing for Compliance: Healthcare Auditor Online Training Program — Revised January 2026 · What Is Benchmarking? — ASQ · Measures of Location — NIST/SEMATECH
40.When do mean, median and mode answer different questions?
The mean is the arithmetic average, the median is the middle ordered value and the mode is the most frequent value. Extreme observations can move the mean substantially while leaving the median comparatively stable. The mode can be nonunique and is useful for identifying the most common observed value. Select the measure that matches the question: typical central position, arithmetic financial average and most frequent outcome are distinct descriptions of the same dataset.
Apply it
Five adjustments are $0, $0, $10, $20 and $470. The mean is $100, the median $10 and the mode $0. An auditor explains the large adjustment instead of describing $100 as the most typical observed transaction.
Common pitfall: The median's resistance to extremes does not make the extreme payment irrelevant. A financial exposure analysis may require the mean and total alongside a description of skewness.
41.Why report dispersion alongside a central value?
A central value alone can conceal materially different distributions. Range describes the difference between maximum and minimum, while standard deviation summarizes spread around the mean in the original measurement units. Two departments can have equal average adjustments but different consistency and exposure to unusual values. Dispersion helps explain variability and informs sampling assumptions. It does not, by itself, establish whether individual observations violate a policy or whether the underlying process is acceptable.
Apply it
Two teams average $50 in adjustments. One has nearly identical amounts; the other alternates between negligible and very large adjustments. Reporting spread reveals the second team's uneven distribution and supports investigating whether distinct transaction groups explain the variation.
Common pitfall: A wide range may be driven by a single observation, while a small standard deviation does not establish compliance. Statistical spread and rule conformity answer different questions.
Auditing for Compliance: Healthcare Auditor Online Training Program — Revised January 2026 · Confidence Limits for the Mean — NIST/SEMATECH
42.When is the coefficient of variation informative?
The coefficient of variation is standard deviation divided by the mean, often expressed as a percentage. It describes spread relative to the average and can help compare positive ratio-scale measurements with different magnitudes. Interpretation becomes unstable when the mean approaches zero and problematic when the measurement lacks a meaningful zero. Check the data's scale and sign before using a relative variation measure merely because two groups have different averages.
Apply it
Group A has mean payment $100 and standard deviation $20, giving a 20% coefficient of variation. Group B has mean $500 and standard deviation $50, giving 10%; its larger absolute spread is smaller relative to its mean.
Common pitfall: A near-zero mean can create an enormous coefficient without a meaningful practical comparison. Do not use the ratio mechanically for signed adjustments that largely cancel each other.
43.How is a confidence interval for a mean constructed?
For a suitable independent sample, a conventional confidence interval for a mean has the form sample mean plus or minus a critical value times its estimated standard error. When population standard deviation is unknown, a t-based method uses s/√n with the relevant degrees of freedom. Applicability depends on design and distributional conditions. The interval quantifies uncertainty in the population mean; it does not describe the expected range of individual claims.
Apply it
A suitable sample has mean $40, standard deviation $30 and 36 observations. Its estimated standard error is $5. Using a supplied critical value of 2 gives an illustrative interval from $30 to $50 for the population mean.
Common pitfall: Do not interpret a mean's interval as containing most individual observations. Also, plug-in formulas may be inappropriate when the sampling design or data conditions require different methods.
44.How should a Pareto chart guide prioritization?
A Pareto chart ranks categories by a chosen measure and commonly shows their cumulative contribution. Frequency, financial loss and review time can produce different rankings, so state the measure before interpreting priorities. The chart helps identify categories contributing most to the measured total; it does not prove their causes or require an exact 80/20 split. Safety or legal significance may also justify attention to an infrequent category despite its small numerical contribution.
Apply it
Missing signatures are the most frequent defect, but duplicate payments account for most lost dollars. The auditor prepares separate frequency and dollar Pareto views so management can distinguish documentation workload from immediate financial exposure when selecting corrective priorities.
Common pitfall: The 80/20 principle is a prioritization heuristic, not a required dataset pattern. A ranked bar does not establish causation or make rare severe hazards unimportant.
45.What can a scatter diagram establish?
A scatter diagram plots paired numerical measurements to reveal possible relationships, clusters and unusual points. A pattern can support further investigation, but association alone does not establish causation. Consider other variables, selection effects and whether the relationship changes across groups. Statistical significance also does not automatically establish practical importance. A small association may be detectable in a large dataset while explaining little of the operational problem an auditor needs to address.
Apply it
A scatterplot shows more errors in months with more overtime. The auditor examines staffing changes, workload and system releases before attributing errors to overtime, and checks whether the relationship persists within comparable departments and time periods.
Common pitfall: A visible trend does not identify its direction of causation. Combining unlike departments can also create a relationship that weakens or reverses when groups are examined separately.
What Is a Scatter Diagram? — ASQ · Auditing for Compliance: Healthcare Auditor Online Training Program — Revised January 2026
46.How should an auditor use a benchmark responsibly?
Benchmarking compares performance and processes to identify gaps and learn from better practices. A credible comparison requires compatible definitions, populations, periods and measurement methods. Differences in payer mix or case complexity can otherwise masquerade as performance differences. After identifying a gap, investigate how the better result was achieved and adapt relevant practices to the local setting. An external average is informative but does not automatically become a legal requirement or appropriate target.
Apply it
A clinic's denial rate exceeds a peer's rate. Before recommending the peer's workflow, the auditor aligns denial definitions and payer populations, investigates process differences and tests whether the useful practices improve results in the clinic's own operating environment.
Common pitfall: Copying a top performer's policy without understanding its context can fail. Comparable measurement and an explanation of the effective process matter more than the ranking alone.
47.How does a flowchart reveal process vulnerabilities?
A flowchart represents the actual sequence of activities, decisions and handoffs. Mapping work with the people who perform it can reveal loops, delays, duplicated tasks and unclear responsibility. Compare the observed process with intended procedures to locate where a requirement is lost. The diagram organizes investigation rather than proving a cause by itself. Its value depends on accurately representing real practice, including exceptions and workarounds that an idealized policy diagram may omit.
Apply it
A refund flowchart shows that two teams each assume the other verifies the destination account. The auditor confirms the handoff through interviews and transaction evidence, then identifies the missing ownership point for a corrective control in the process.
Common pitfall: Mapping only the written procedure can hide actual workarounds. A plausible diagram still needs verification against practice before its apparent failure point becomes a supported audit conclusion.
48.Which limitations should accompany a population conclusion?
A population conclusion must remain within the defined frame, selection design, review rules and estimation method. Disclose material exclusions, unavailable records and assumptions that affect interpretation. A probability sample can support quantified inference under its design; a targeted sample usually supports conclusions about reviewed cases and mechanisms. Separate statistical uncertainty from other limitations, such as misclassification or omitted facilities, because a narrow confidence interval does not correct systematic defects in data or review.
Apply it
A precise estimate covers paid outpatient claims from three facilities. The report names those facilities and the payment period, explains any excluded services and avoids extending the estimate to inpatient claims or a fourth facility absent from the frame.
Common pitfall: Precision is not proof of completeness or accuracy. A narrow interval around an estimate from a defective frame can create unjustified confidence in a systematically biased conclusion.
Statistical Sampling: A Toolkit for MFCUs — September 2018 · Confidence Limits for the Mean — NIST/SEMATECH
Corrective Action Plan After the Audit, VA's Approach to Patient Safety, Root Cause Analysis, Self-Referral Disclosure Protocol versus OIG Self-Disclosure Protocol, Monitoring Auditsnot stated
49.What makes a corrective action plan measurable?
A corrective action plan links each significant finding to an action, responsible owner, completion expectation and method for evaluating effectiveness. Distinguish fixing identified transactions from changing the process that produced them. The plan should state what evidence will demonstrate implementation and what later outcome will indicate reduced recurrence. A measurable plan enables management to judge whether the exposure has changed, rather than closing the issue merely because a task was marked complete.
Apply it
After duplicate claims are corrected, the plan assigns an owner to revise the interface edit, sets a validation milestone and specifies a later review of eligible claims to determine whether duplicates still pass through the redesigned control.
Common pitfall: Correcting the sampled claims alone leaves the failure mechanism intact. Completion evidence, such as a deployed edit, also differs from evidence that the edit actually prevents recurrence.
General Compliance Program Guidance — November 2023 · Auditing for Compliance: Healthcare Auditor Online Training Program — Revised January 2026
50.How does PDCA support controlled improvement?
Plan-Do-Check-Act structures iterative improvement. Plan defines the problem, proposed change and expected result. Do tests the change, often on a limited scale. Check compares observed results with expectations. Act uses that learning to adopt, revise or abandon the change and begin another cycle. The decisive distinction is between implementing a solution and evaluating its performance; a promising intervention should not be assumed effective simply because staff followed the rollout instructions.
Apply it
A clinic pilots a revised order screen in one department. It measures missing-order events and workflow delays, compares the results with the planned targets and revises the design before deciding whether to expand the change across departments.
Common pitfall: Skipping Check converts PDCA into unverified implementation. A completed rollout can coexist with unchanged defects or new operational problems that the original plan did not anticipate.
51.How does an RCA chronology improve causal investigation?
Root cause analysis reconstructs what happened before deciding why it happened. A chronology aligns actions, conditions, communications and system responses, exposing information gaps and points requiring verification. A multidisciplinary team can then examine how processes and safeguards interacted. Distinguish known facts from assumptions throughout the timeline. Starting with a preferred cause, such as careless staff, risks interpreting every later detail to fit that explanation and missing conditions that made the event possible.
Apply it
An apparent late notification precedes a patient safety event. The RCA team aligns system timestamps, interviews and workflow records, discovers that a message entered the wrong queue and verifies the sequence before selecting a notification-related corrective action.
Common pitfall: A timeline is not a complete causal explanation. Events occurring before harm may be relevant, incidental or consequences of another failure and require further investigation.
Guide to Performing a Root Cause Analysis — Revision February 5, 2021
52.When does a fishbone diagram support RCA?
A fishbone diagram organizes possible contributing causes into categories so a team can investigate broadly instead of settling on its first explanation. It is a structure for hypotheses, not evidence that every branch caused the event. Follow each important possibility with records, observations or interviews that can support or challenge it. The useful transition is from listing possible influences to demonstrating the specific causal relationship that a corrective action will address.
Apply it
A team lists staffing, software design and training as possible contributors to unsigned notes. Testing shows that a queue defect hides some encounters from clinicians. The final causal statement emphasizes the verified mechanism rather than treating every brainstormed branch as established.
Common pitfall: Consensus among participants does not validate a fishbone branch. A long list of possible causes can obscure the need to test which conditions actually contributed.
What Is a Fishbone Diagram? — ASQ · Guide to Performing a Root Cause Analysis — Revision February 5, 2021
53.Why are system changes often stronger than reminders?
Actions that redesign a vulnerable process can reduce dependence on memory, vigilance and individual workarounds. Standardization, appropriate constraints and reliable workflow design may address a demonstrated failure mechanism more directly than another reminder. Training remains useful when a genuine knowledge or skill gap exists, but it should match the cause. Evaluate potential unintended effects of stronger controls, since a poorly designed restriction can create delays or encourage unsafe bypasses.
Apply it
Staff repeatedly forget a required account verification despite refresher training. The team adds a verified account-selection step before payment release, tests exception handling and monitors whether users bypass the control or experience delays that create new operational problems.
Common pitfall: Choosing the strongest-sounding technology without matching the cause can fail. A hard stop that blocks legitimate work may generate workarounds and shift risk elsewhere in the process.
Proactive Risk Assessment — VHA National Center for Patient Safety · Guide to Performing a Root Cause Analysis — Revision February 5, 2021
54.When should HFMEA be used instead of event-focused RCA?
Healthcare Failure Mode and Effect Analysis, or HFMEA, prospectively examines how a process might fail before harm occurs. VA combines hazard scoring with qualitative decision-tree analysis to determine which failure modes require action. RCA generally investigates an event or close call to understand contributing conditions. The distinguishing cue is the starting question: potential failure in a planned or existing process favors HFMEA; reconstruction of a particular event favors RCA.
Apply it
Before introducing a new specimen-routing system, a team maps process steps, identifies possible misrouting failures and evaluates hazards and safeguards. HFMEA fits because the team is preventing anticipated failures rather than reconstructing a specific completed incident.
Common pitfall: HFMEA is not simply an RCA with a future date. Its prospective process analysis and hazard prioritization should be performed before assuming which failures deserve intervention.
Proactive Risk Assessment — VHA National Center for Patient Safety · Root Cause Analysis — VHA National Center for Patient Safety
55.How does VA's Safety Assessment Code determine investigation priorities?
VA's Safety Assessment Code (SAC) pairs a severity category with a probability category in a matrix. Severity categories are catastrophic, major, moderate and minor; probability categories are frequent, occasional, uncommon and remote. The resulting ranks are 3 for highest risk, 2 for intermediate risk and 1 for lowest risk. Record actual consequences separately from credible potential consequences. Under VA's February 2021 RCA guidebook, Actual 3 or Potential 3 events require RCA, subject to specified alternatives for some frequently occurring Potential 3 events. Those events should undergo aggregated analysis, such as the annual Medication Aggregated Review RCA, or review for inclusion in a patient safety assessment tool (PSAT), such as the annual Wandering and Missing Patient PSAT. An individual RCA remains discretionary for events within those alternatives. SAC 1 or 2 events may also receive individual or aggregated RCA according to the topic and facility needs. These are VA requirements described in that guidebook.
Apply it
Suppose an intercepted medication error causes no injury or increased care, meeting minor actual severity, while the documented circumstances support catastrophic potential harm without interception. Assume occasional probability. The matrix gives minor plus occasional an Actual SAC of 1, and catastrophic plus occasional a Potential SAC of 3. The Potential 3 triggers the VA investigation requirement despite the harmless outcome. Determine whether the medication event qualifies for the guidebook's aggregated-review alternative; otherwise conduct an individual RCA.
Common pitfall: SAC scores are ranked matrix results, not severity multiplied by probability. A low actual score does not cancel a Potential 3. The aggregate-review and PSAT alternatives require the specified review pathway; they do not authorize simply closing a close call without analysis.
Guide to Performing a Root Cause Analysis — Revision February 5, 2021 · Auditing for Compliance: Healthcare Auditor Online Training Program — Revised January 2026
56.Why can a near miss justify root cause analysis?
A near miss can expose the same system vulnerabilities that might produce harm under slightly different circumstances. VA's RCA approach includes close calls and no-harm events because prevention should not depend on waiting for an adverse outcome. Examine both the conditions permitting the failure and the safeguard that intercepted it. The discriminating question is whether the escape from harm was reliably engineered or depended on chance and extraordinary individual vigilance.
Apply it
A nurse notices a mislabeled specimen immediately before use. The team investigates label generation and handoffs, while also studying how the nurse detected the mismatch, to determine whether interception is dependable or merely fortunate in that workflow.
Common pitfall: Praising the interception without examining the initiating failure leaves the hazard available for another patient. Outcome luck should not be mistaken for a dependable control.
Root Cause Analysis — VHA National Center for Patient Safety
57.When is CMS's Self-Referral Disclosure Protocol relevant?
CMS's Self-Referral Disclosure Protocol, or SRDP, provides a pathway for actual or potential violations of the physician self-referral law. It is designed for disclosure and resolution, not advance approval of an arrangement. CMS has discretion to reduce amounts owed; a reduction is not guaranteed. The protocol also recognizes reporting and refunding the full overpayment to the Medicare Administrative Contractor as an alternative, making factual classification and the chosen resolution route important decisions.
Apply it
A review identifies a physician compensation arrangement potentially failing a Stark exception, with no identified kickback concern. The organization evaluates SRDP disclosure and the alternative full-refund route while determining affected referrals, claims and financial exposure from the arrangement.
Common pitfall: Submitting an SRDP disclosure does not guarantee reduced repayment or validate the arrangement. Do not describe the protocol as a routine refund form or prospective advisory opinion.
Self-Referral Disclosure Protocol — CMS · CMS Voluntary Self-Referral Disclosure Protocol — Form CMS-10328, July 2026
58.How should criminal, civil False Claims Act and administrative exposure guide disclosure of physician arrangements?
First classify potentially overlapping exposure: federal criminal conduct, civil False Claims Act (FCA) liability and administrative liability. Potentially criminal healthcare conduct should be disclosed to DOJ; OIG's updated SDP excludes federal criminal disclosures. Under the October 2026 coordination policy, a qualifying corporate disclosure to DOJ's Health Care Fraud Section receives OIG SDP benefits without a duplicate OIG submission. For overlapping civil FCA and HHS administrative exposure, evaluate the temporary FCA Self-Disclosure Pilot Program. Its complete submissions must arrive by 11:59 PM on April 22, 2027; late or partial submissions will not be accepted or reviewed. This fixed eligibility boundary distinguishes the pilot from the separate DOJ criminal disclosure, OIG SDP and CMS SRDP pathways. Within eligible OIG administrative disclosures, arrangements involving potential Anti-Kickback Statute (AKS) liability, including mixed AKS/Stark arrangements, use OIG's SDP. Stark-only matters without FCA exposure use CMS's SRDP when protocol disclosure is chosen; reporting and refunding the full Stark-related overpayment to the Medicare Administrative Contractor is another permitted approach.
Apply it
Emails suggesting payments intentionally induced referrals require assessment of potential criminal exposure before selecting an administrative protocol. If criminal disclosure is appropriate, route it to DOJ. If an eligible healthcare company instead identifies potential civil FCA violations previously unknown to the federal government, evaluate the [official FCA pilot requirements](https://www.hhs.gov/sites/default/files/doj-hhs-fcas-self-disclosure-pilot-program.pdf), including a complete, truthful, certified submission supported by relevant documents, remediation and financial information. A partial submission arriving April 22, 2027, with required material supplied April 23 does not meet the pilot's complete-submission deadline. If the issue specifically concerns an eligible administrative disclosure of a mixed AKS/Stark arrangement, use OIG's SDP without duplicating that arrangement in CMS's SRDP.
Common pitfall: Neither physician involvement nor an AKS concern alone completes the routing analysis. Administrative settlement does not automatically resolve criminal or FCA exposure. An OIG-only disclosure generally does not qualify as a voluntary self-disclosure under DOJ's Corporate Enforcement and Voluntary Self-Disclosure Policy. Likewise, the FCA pilot addresses civil exposure and does not replace criminal disclosure. Do not assume the pilot remains available indefinitely or that an incomplete filing preserves eligibility. Distinguish releases actually obtained from benefits potentially available, and distinguish ordinary refund matters from conduct eligible for a fraud disclosure protocol.
Health Care Fraud Self-Disclosure — HHS-OIG · Health Care Fraud Self-Disclosure Protocol — Updated October 15, 2026 · CMS Voluntary Self-Referral Disclosure Protocol — Form CMS-10328, July 2026 · dl
59.What identification trigger, deadline and suspensions govern a Medicare Parts A and B overpayment response?
For Medicare Parts A and B, 42 CFR 401.305 identifies an overpayment when a person knowingly receives or retains it. Knowingly includes actual knowledge, deliberate ignorance or reckless disregard; it does not require specific intent to defraud. The ordinary reporting and return deadline is the later of 60 days after identification or the corresponding cost-report due date, if applicable. Paragraph (b)(3) suspends both reporting and returning when an identified overpayment prompts a timely, good-faith investigation of related overpayments arising from the same or a similar cause, and that investigation is not yet complete. This suspension ends at the earlier of investigation completion with calculation of the aggregate amount, or 180 days after initial identification. Paragraph (b)(2) separately suspends returning: OIG or CMS acknowledgment of an SDP or SRDP submission triggers suspension until settlement, withdrawal or removal. Requesting an extended repayment schedule as defined in section 401.603 also suspends returning, until CMS or its contractor rejects the request or the provider or supplier fails to comply with the schedule's terms.
Apply it
An audit identifies a duplicate Medicare Part B payment caused by an interface defect. On that identification date, the organization begins a timely, good-faith investigation of related duplicates, stops the defect and preserves its calculations. It completes the investigation and aggregate calculation 90 days later. Assuming no applicable cost report and no other suspension, the 60-day reporting and return period follows that suspension, producing a deadline 150 days after initial identification. If the organization instead requests a qualifying extended repayment schedule before the return deadline, paragraph (b)(2)(iii) suspends returning while that request is pending and while it complies with an approved schedule. Rejection or noncompliance ends that suspension; the request alone does not suspend reporting.
Common pitfall: The investigation suspension is conditional, not an automatic 180-day extension for every error. Waiting to quantify every related claim before recognizing an already identified overpayment misstates the identification trigger. Keep the two suspension mechanisms distinct: paragraph (b)(3) suspends reporting and returning, whereas paragraph (b)(2) suspends returning and may continue that suspension after a qualifying investigation ends. Merely preparing an SDP or SRDP submission does not satisfy the acknowledgment trigger. For an extended repayment schedule, the qualifying request triggers suspension; rejection or failure to comply with its terms terminates it. Financial difficulty alone does not establish this suspension. Refunds, disclosures and repayment arrangements also do not replace correction and monitoring of the underlying defect.
General Compliance Program Guidance — November 2023 · CMS Voluntary Self-Referral Disclosure Protocol — Form CMS-10328, July 2026 · Health Care Fraud Self-Disclosure — HHS-OIG · Federal Register :: Request Access · CFR-2025-title42-vol2-sec401-305.pdf
60.How can monitoring establish corrective effectiveness?
Effectiveness monitoring tests whether the implemented action reduces the failure it was intended to address and whether improvement persists. Define measures, eligible populations, timing and escalation thresholds in advance. Use comparable baseline and follow-up definitions, and consider unintended effects such as delays or workarounds. Training attendance or software installation demonstrates implementation, while later evidence about actual transactions demonstrates performance. Recurrent findings should trigger reassessment of the causal explanation and corrective design.
Apply it
After a signature control is introduced, monitoring examines eligible encounters for missing authentication and tracks delayed claim release. Comparable follow-up periods show whether the control reduces defects without creating a backlog that prompts staff to bypass the intended workflow.
Common pitfall: One clean week may reflect low volume or altered case mix. Sustained, comparable measurement is more informative than declaring success immediately after implementation or refresher training.
General Compliance Program Guidance — November 2023 · Plan-Do-Check-Act Cycle — ASQ
What to focus on during revision
The following are CertMedbry study suggestions. Use the official outline to check the full scope of your examination.
- Use PERC to connect scope, evidence, reporting and verified corrective effectiveness.
- Distinguish audit terminology by the decision it controls, especially criteria versus evidence and population versus sampling frame.
- Practise sampling assumptions, reproducible selection, confidence, precision and the limits of targeted reviews.
- Separate authentication, coding, clinical necessity and coverage; each requires its own supporting evidence.
- Interpret ratios, location, dispersion and confidence intervals without overstating population conclusions.
- Choose charts by their purpose: ranked contribution, paired relationships, actual workflow or possible causes.
- Match corrective actions to demonstrated mechanisms and distinguish implementation measures from outcome measures.
- Differentiate CMS's physician self-referral pathway from OIG's potential-fraud pathway, including arrangements implicating both Stark and AKS.
A practical preparation plan
1. Map the complete official scope
Read the January 2026 packet's learning objectives and five examination domains. Mark subjects not sampled by this selective guide, including issuer-specific terminology, and add them to your study plan.
2. Build a usable open-note reference
Organize notes by PERC and the five domains. Index signature distinctions, coverage sources, sampling definitions, statistical formulas and disclosure pathways so you can locate rules and their boundaries efficiently.
3. Design one defensible audit
Choose a healthcare billing process and write its objective, scope, criteria, eligible population, sampling unit and evidence plan. Identify the clinical, legal or statistical expertise needed for particular judgments.
4. Calculate and explain
Practise claim and line error rates, mean versus median, standard error, coefficient of variation and illustrative confidence intervals. State assumptions and explain what each result does and does not establish.
5. Work through the independent drills
Answer all 20 questions before reading explanations. For each error, identify the decisive cue and explain why the tempting alternative fails; use the flashcards to retrieve those distinctions later.
6. Close the audit loop
Turn a finding into a causal investigation, measurable action plan and follow-up measure. Revisit the full issuer outline after practice and check the current issuer examination arrangements before scheduling.
Use your sample score as a starting point
The free set contains 20 original practice questions. It is a small learning sample, not an official examination or a validated pass prediction. Review each explanation and its source before moving to another topic.
Start the free sampleOfficial sources and updates
- Auditing for Compliance — AIHC
- Auditing for Compliance: Healthcare Auditor Online Training Program — Revised January 2026
- What Is Auditing? — ASQ
- General Compliance Program Guidance — HHS-OIG
- General Compliance Program Guidance — November 2023
- Statistical Sampling: A Toolkit for MFCUs — September 2018
- RAT-STATS — Statistical Software
- Selecting Sample Sizes — NIST/SEMATECH
- Confidence Limits for the Mean — NIST/SEMATECH
- Measures of Location — NIST/SEMATECH
- Coefficient of Variation — NIST Dataplot
- Complying with Medicare Signature Requirements — July 2025
- Lab Test Order Requirements — CMS
- Medicare Coverage — General Information
- Fraud & Abuse Laws — HHS-OIG
- Minimum Necessary Requirement — HHS
- Summary of the HIPAA Security Rule — HHS
- What Is a Pareto Chart? — ASQ
- What Is a Fishbone Diagram? — ASQ
- What Is Benchmarking? — ASQ
- What Is a Scatter Diagram? — ASQ
- What Is a Flowchart? — ASQ
- Plan-Do-Check-Act Cycle — ASQ
- Root Cause Analysis — VHA National Center for Patient Safety
- Guide to Performing a Root Cause Analysis — Revision February 5, 2021
- Proactive Risk Assessment — VHA National Center for Patient Safety
- Self-Referral Disclosure Protocol — CMS
- Health Care Fraud Self-Disclosure — HHS-OIG
- CMS Voluntary Self-Referral Disclosure Protocol — Form CMS-10328, July 2026
- Health Care Fraud Self-Disclosure Protocol — Updated October 15, 2026
- Federal Register :: Request Access
- dl
- CFR-2025-title42-vol2-sec401-305.pdf
- dl
- How To - Consolidated MCD Page Help
- rca-guidebook_02052021.pdf
- VAOIG-18-04132-163.pdf
- www.eeoc.gov
- usrep449383.pdf
- dl
Confirm current eligibility, fees, scheduling and policies directly with the examination provider. CertMedbry is independent and is not endorsed by these organisations. How we handle content and corrections.