I have sat across the table from practice owners who were certain their billing was fine right up until the audit report landed on their desk. The claims were going out. The payments were coming in. Nothing looked broken from the front office. Then the audit traced eighteen months of quietly denied claims that nobody had appealed, a fee schedule that was two contract updates out of date, and a coding pattern that would have drawn a payer’s attention within another quarter. None of that showed up on a daily production report. It only showed up because someone finally sat down and audited the whole cycle, not just the part that was easiest to see.

That is what a revenue cycle audit is for. It is not a punishment and it is not busywork for the billing team to survive once a year. It is the only way to see your practice’s financial process the way a payer, an auditor, or a new CFO would see it: end to end, with nothing hidden by habit.

This guide walks through what a revenue cycle audit actually covers, how to run one from planning through action, a complete stage-by-stage checklist, the KPIs worth tracking, what audits typically cost, how often to run them, and the questions providers ask most often before committing to one.

What Is a Revenue Cycle Audit? (Quick Answer)

A revenue cycle audit is a structured review of every financial and administrative step a healthcare organization takes to get paid for care, from the moment a patient is scheduled through the moment the balance is collected in full. It examines registration accuracy, eligibility verification, prior authorization, clinical documentation, coding, charge capture, claims submission, payment posting, denial management, and accounts receivable, then compares what actually happened against what payer rules, contracts, and internal policy require.

The purpose is straightforward even when the work is not: find where revenue is being lost, delayed, underpaid, or exposed to compliance risk, and turn those findings into fixed workflows instead of a report that sits in a folder.

Revenue Cycle Audit vs. Financial Audit vs. Coding Audit

These three terms get used interchangeably, and mixing them up is one of the fastest ways to scope a review incorrectly.

A financial audit can tell you the numbers on your books are accurate. It cannot tell you why your net collection rate dropped four points last quarter. A coding audit can catch a modifier problem. It will not catch the eligibility failure that caused the claim to be denied before coding ever mattered. A full revenue cycle audit checklist style review is the only one of the three built to catch both, because it follows the claim through every handoff instead of stopping at one department’s door.

Why Revenue Cycle Audits Matter More Right Now

Payer scrutiny is not softening. CMS’s Comprehensive Error Rate Testing (CERT) program put the Medicare Fee-for-Service improper payment rate at roughly 6.55 percent for fiscal year 2025, translating to close to $28.8 billion in improper payments nationally. CMS has been consistent in noting that the majority of that figure comes from insufficient documentation and administrative missteps rather than intentional fraud, which means most of it was preventable with a consistent audit habit.

The American Hospital Association has also reported that overall hospital expenses climbed roughly 17.5 percent between 2019 and 2022, driven largely by labor and supply costs. Margins that used to absorb a sloppy revenue cycle no longer have the room to do it. Industry benchmarking from groups like MGMA has repeatedly put avoidable revenue loss from billing inefficiencies somewhere between 5 and 10 percent of net revenue for a typical practice, which on a $4 million book of business is a swing of $200,000 or more sitting in claims nobody ever traced back to a root cause.

A few forces are converging to make 2026 a worse year than most to skip this work:

Payer rules keep getting more specific. Prior authorization requirements, medical necessity documentation standards, and claim edit logic are updated by payers far more often than most billing teams can track manually.

AI-driven claim review works both ways. Payers are using automated systems to flag outlier billing patterns faster than ever. If your practice has a pattern worth flagging, an algorithm will likely find it before a person does. The only real defense is finding it yourself first, which is exactly what a medical billing compliance posture built on regular internal audits is designed to do.

Denials are trending up, not down. A widely cited industry range puts typical claim denial rates between 5 and 10 percent, with practices that skip regular audits often running well above that. Every denial that has to be reworked carries real cost. HFMA-cited industry estimates put the average cost of reworking a single denied claim at roughly $25, which adds up quickly across a few thousand claims a month.

High-deductible plans have shifted more collections risk to the patient side. Front-end accuracy at registration matters more than it did a decade ago, because a growing share of the balance now depends on the patient paying it rather than the payer.

None of this means panic. It means audits have moved from a nice-to-have compliance ritual to one of the highest-leverage things a practice can do for its own cash flow.

Types of Revenue Cycle Audits

Not every audit needs to cover everything. Matching the audit type to the actual concern saves time and produces findings people can act on.

Internal, focused, and prospective audits are the ones a practice fully controls, and running them consistently is the best preparation there is for the ones a practice does not control, since a payer or OIG reviewer finds far less to flag in a practice that already knows and has fixed its own weak points.

How to Perform a Revenue Cycle Audit: The Three-Phase Process

A revenue cycle audit that produces real change follows the same basic arc regardless of practice size or specialty.

Phase 1: Define Scope, Goals, and Risk Areas

An audit without a clear goal collects data nobody asked for and produces a report nobody acts on. Before pulling a single claim, decide what question the audit needs to answer. Common starting goals include:

• Reduce denials in a specific payer or service line
• Confirm coding and documentation accuracy across providers
• Find underpayments hiding inside contractual adjustments
• Evaluate whether the prior authorization workflow is holding up
• Prepare proactively for an anticipated payer or regulatory review
• Decide whether outsourced billing or RCM support is actually needed

Once the goal is set, define the audit charter: sample size, time period under review, departments involved, systems and data sources, the KPIs that will be tracked, and who owns the final report.

Phase 2: Collect Data and Review Workflows

This is where the audit team pulls records and compares actual performance against payer rules, internal policy, contract terms, and documentation standards. Typical data sources include registration and eligibility records, prior authorization logs, clinical documentation, coding records, charge capture reports, claims data, clearinghouse rejection reports, payer remittances (ERA/EOB), payment posting records, denial and appeal logs, and AR aging reports.

If data is scattered across an EHR, a separate billing platform, spreadsheets, and payer portals, say so plainly in the findings instead of presenting reconciled-looking numbers that paper over the gap. An audit that overstates its own data quality produces conclusions that fall apart the first time someone tries to act on them.

Phase 3: Turn Findings Into an Action Plan

A finding without an owner and a deadline is just a fact. The audit report should include the root cause behind each issue (not only the symptom), the estimated financial impact, the compliance risk level, the team responsible for fixing it, a realistic timeline, and the KPI that will confirm the fix worked.

If the audit finds a high denial rate tied to missing prior authorizations, telling staff to “be more careful” fixes nothing. The action plan needs to look at the authorization workflow itself: who checks requirements, when, how the payer’s specific rules are documented, and how that status gets communicated to scheduling and billing before the visit happens.

The Complete Revenue Cycle Audit Checklist

This checklist follows the revenue cycle in the order a claim actually travels, front desk to final collection, so an issue caught upstream does not compound into a denial or a write-off six weeks later.

1. Patient Registration and Demographic Accuracy

• Patient name, date of birth, and address match the insurance card and the chart exactly
• Correct payer, plan, group number, and subscriber ID were captured
• Coordination of benefits is documented when a patient has more than one active policy
• Guarantor and responsible-party information is accurate for minors and dependents
• Duplicate patient records are not splitting one patient’s history across two accounts

Registration errors are disproportionately responsible for downstream denials, which is why a small improvement here tends to produce an outsized return. A deeper walkthrough of this stage lives in our patient registration process guide.

2. Insurance Eligibility Verification

• Coverage is verified for the actual date of service, not just at intake or scheduling
• Plan-specific benefit details (copay, deductible, coinsurance) are captured accurately
• Real-time eligibility checks are run consistently rather than relied on from memory of a prior visit
• Eligibility-related denials are tracked as their own category so patterns are visible

A stale eligibility check is one of the most common and most preventable sources of denied revenue. Our insurance eligibility verification guide walks through how to tighten this specific step.

3. Prior Authorization Workflow

• Authorization requirements are confirmed before the service, not after
• Approved units and service dates match what actually gets billed on the claim
• Authorization numbers are captured accurately and stored where billing staff can see them
• Denied or expired authorizations are tracked and followed up on, not just noted and dropped

4. Clinical Documentation and Medical Necessity

• Notes support the level of service billed, including history, exam, and medical decision-making for E/M codes
• Diagnosis codes reflect actual clinical findings from that visit rather than being carried forward automatically
• Signatures, credentials, and dates are present and legible
• Time-based codes include the documented time and required elements
• Templated or copy-forward notes are flagged when they do not reflect what happened at that specific encounter

5. Medical Coding Accuracy

• CPT, HCPCS, and ICD-10 codes match documentation and the current code year
• ICD-10 codes reflect the highest specificity the documentation actually supports
• Modifier use is checked against National Correct Coding Initiative (NCCI) edits and bundling rules
• Units billed match what was actually performed or dispensed
• E/M code selection is reviewed for undercoding and overcoding patterns, both of which carry risk in opposite directions

6. Charge Capture and Reconciliation

• Charges are compared against the encounter form or EHR to catch missed or duplicate entries
• Fee schedules used for charge estimates match the current, correct payer contract
• Bundled services are not being billed separately by mistake
• A reconciliation loop exists between clinical activity, coding, and what actually got billed

Charge capture failures are quiet by nature, because nothing rejects the claim, the revenue simply never gets billed at all. Our charge capture guide goes deeper into building a reconciliation process that catches this.

7. Claims Submission and Clean Claim Performance

• Claims are submitted within each payer’s timely filing window
• Clean claim rate (accepted without manual correction) is tracked and trending in the right direction
• Clearinghouse rejection patterns are reviewed for repeat causes rather than corrected one at a time
• Claims reflect current CMS and payer-specific rules, including recent regulatory updates

A high clean claim rate is a good sign but not a complete one, since a claim can pass every payer edit and still be paid below contract or denied on medical necessity later. Our clean claim rate guide breaks down how to calculate and benchmark this metric correctly.

8. Payment Posting and Contractual Adjustments

• Payments posted match the amount actually allowed under the payer contract
• Contractual adjustments are calculated precisely, not applied as a flat estimate
• Underpayments are flagged for follow-up rather than posted and forgotten
• Secondary and tertiary payer balances are billed correctly after the primary payment posts

Payment posting errors are one of the easiest ways for a practice to lose revenue without any single number looking wrong on its own, because the totals can look correct in aggregate even when individual line items are misapplied. Our payment posting guide covers the reconciliation steps most practices skip.

9. Denial Management and Appeals

• Denials are tracked by payer, reason code, and root cause, not lumped into one generic bucket
• Appeals are submitted within the payer’s window with the documentation needed to support reversal
• Repeat denial categories are traced back to the workflow stage that caused them
• Write-offs are reviewed to confirm they reflect a genuinely unrecoverable balance, not just an easier path than appealing

A practice does not need a high overall denial rate to lose significant revenue here. Slow follow-up and a weak appeal success rate can cost just as much as a higher denial rate would. Our claim denial management guide covers how to build a structured process instead of handling denials one at a time as they arrive.

10. Accounts Receivable and Collections

• AR aging is reviewed by payer and by service line, not only in total
• Balances stuck past 60, 90, and 120 days are identified and assigned an owner
• Patient balance follow-up has a defined cadence, especially given how much high-deductible plans have shifted collection responsibility to patients
• Bad debt trends are tracked over time rather than reviewed only at year-end

Aging AR is one of the clearest and most visible signs of revenue cycle health or trouble. Our AR aging report guide and full accounts receivable process guide walk through how to build this into an ongoing review instead of a once-a-year scramble. Why this specific number gets so much attention from leadership is also covered in our piece on why CFOs analyze aging accounts receivable.

11. Reporting and KPI Visibility

• KPI definitions are consistent across systems and departments (a “denial rate” calculated two different ways is not a usable comparison)
• Dashboards are refreshed on a schedule leadership actually checks
• Reports reach the people who can act on them, not just the people who generate them

12. Vendor and Outsourced Billing Performance (If Applicable)

• SLA terms are being met, not just referenced in a contract
• Vendor-reported numbers can be independently verified against source data
• Cost-to-collect and vendor-specific denial trends are reviewed regularly

This checklist is a starting framework, not a finished audit plan. The right depth for each section depends on your audit’s goal, your risk profile, and any issues leadership already suspects.

Key Metrics to Track During a Revenue Cycle Audit

Numbers give an audit something to hold onto beyond a stack of chart notes. The metrics worth prioritizing include:

• Clean claim rate
• Initial denial rate
• First-pass resolution rate
• Days in AR
• AR over 90 days
• Net collection rate
• Claim rejection rate
• Appeal success rate
• Payment lag (time from claim submission to payment)
• Eligibility-related and prior authorization-related denial rates
• Coding-related denial rate

These behave differently depending on setting. Days in AR, for example, runs naturally higher for a hospital handling complex inpatient billing than for an ambulatory practice with a simpler claim mix, so benchmark against peers in your own setting and specialty rather than a single industry-wide average. For a deeper look at how to calculate and interpret the two metrics that tend to matter most to leadership, see our guides on net collection rate and revenue integrity in healthcare.

Where Revenue Actually Leaks (And Why It’s Rarely One Big Mistake)

Revenue leakage almost never comes from a single dramatic failure. It builds from small, repeated errors at multiple points in the cycle. A useful audit traces leakage back to the exact stage where it started rather than stopping at the symptom.

Front-end leakage. Inaccurate registration data, missed eligibility checks, and expired prior authorizations are responsible for a disproportionate share of everything that gets denied later. These are inexpensive to fix at the point of registration and expensive to fix after a claim has already been denied or recouped.

Mid-cycle leakage. Incomplete documentation, undercoding, and missed charges create a gap between the care that was delivered and the revenue that gets collected for it. Small coding inaccuracies in percentage terms translate into large dollar losses once you scale them across a year of claims.

Submission and timing leakage. Delayed claim submission and timely filing misses convert otherwise collectible revenue directly into write-offs. Even a strong front end can be undermined by a submission process that lets claims sit until they age past a payer’s deadline.

Denial and appeal leakage. A significant share of denied claims are never appealed at all and simply get written off, which is lost revenue no front-end fix can recover after the fact.

Payment posting leakage. Underpayments quietly masked as routine adjustments and unapplied payments hide revenue the practice actually earned but never collected.

Patient-side leakage. Unclear billing statements and missed point-of-service collection opportunities raise the cost of collecting and grow bad debt, a pattern that has become a larger share of total leakage as high-deductible plans have spread. Our guide on revenue leakage in medical billing and our piece on physician group revenue leakage prevention go deeper into each of these categories.

A practice will often walk into an audit convinced the main problem is “payer denials,” only to find the real root cause sitting further upstream in eligibility or documentation. Treating denials only at the payer level, without tracing them back, tends to leave the underlying leak in place even after a wave of successful appeals.

How Much Does a Revenue Cycle Audit Cost?

There is no single number here, and any guide that hands you one without qualification is guessing. What actually drives cost:

Scope. A comprehensive audit covering registration through final collection costs more than a focused audit targeting one problem area, like denial patterns for a single payer.

Claim volume. Reviewing a sample of a few dozen claims per provider is far less expensive than a full-population review across thousands of encounters.

Depth of reporting. A high-level summary costs less than a granular report with root-cause analysis, financial impact estimates, and a stage-by-stage action plan.

Who performs it. Internal staff time has a real cost even without an invoice attached. Outside specialists typically charge either an hourly rate, which offers flexibility but less budget certainty, or a flat fee for a defined scope, which offers predictability but a fixed boundary on depth.

Auditor expertise. A consultant with deep, current knowledge of payer-specific edit logic and specialty-specific risk areas costs more per hour than a generalist, but tends to find more of what actually matters.

The way to think about cost is against what an audit typically returns. If MGMA-cited industry benchmarks putting avoidable revenue loss at 5 to 10 percent of net revenue are anywhere close to accurate for your practice, the audit that finds and fixes even a portion of that gap pays for itself many times over, often within a single quarter of corrected workflow.

How Often Should You Run a Revenue Cycle Audit?

Frequency should match risk, not calendar convenience.

Practices with rising denials, aging AR, frequent underpayments, recent growth, new locations, or billing staff turnover should audit more often than this baseline suggests. The industry has also been shifting away from a single annual retrospective review toward continuous, risk-based auditing, particularly for organizations in heavily scrutinized areas like Medicare Advantage, behavioral health, and post-acute care.

Internal Audit or Outsourced Review: Which Makes Sense?

Most practices land somewhere in between: monthly internal spot checks handled in-house, paired with a deeper annual or semiannual audit from an outside partner who brings current, cross-practice payer knowledge to the table. If your denial rate has been climbing without an obvious cause, a full revenue cycle management review can usually surface the root cause faster than adding the work onto an already stretched front office. Practices dealing specifically with aging AR often benefit from a focused AR follow-up engagement layered onto the broader audit, and practices seeing denial volume they cannot keep pace with internally often pair the audit with ongoing denial management support.

Common Challenges (And How to Avoid Wasting an Audit)

The hardest part of a revenue cycle audit is rarely the analysis itself. It is everything around it.

Incomplete or inconsistent data. When the same metric produces two different numbers depending on which system you pull it from, findings become debatable instead of actionable.

Unclear ownership. Without a named owner for each finding, problems get documented in the report and then quietly reappear in next year’s audit.

Resistance from staff. An audit adds work to teams that are usually already stretched thin. Communicating the purpose clearly, and framing it as protecting the team rather than grading it, materially changes participation.

Narrow focus on denials alone. Denial-only reviews miss underpayments, charge capture failures, and AR aging that often represent a larger share of total revenue loss than denials do.

Findings without follow-through. An audit that lists problems but produces no workflow change is reporting work, not improvement work. The value of an audit lives entirely in what happens after the report is delivered.

Turning Audit Findings Into an Action Plan That Sticks

1. Assign an owner and a deadline to every finding, not just the ones that feel urgent this week.
2. Fix the workflow, not just the individual claim. If prior authorization was missing on one claim, ask why, and check whether the same gap exists across the last quarter of claims for that service.
3. Re-audit the specific area after the fix is implemented. A correction that was never verified is just a plan, not a result.
4. Feed findings into staff training, especially where the root cause traces back to a documentation habit rather than a system limitation.
5. Set the next audit date before closing out the current one. Audits that get scheduled reactively, after revenue has already dropped, are always working from a worse starting position than audits that run on a set cadence.

Frequently Asked Questions

What is the difference between a revenue cycle audit and an RCM audit? They refer to the same thing. “RCM audit” is simply shorthand for “revenue cycle management audit,” and both describe a structured review of the entire billing and collections process from registration through final payment.

How long does a revenue cycle audit take? A focused audit on one area, such as denial patterns for a specific payer, can often be completed in one to two weeks. A comprehensive, full-cycle audit across all stages typically takes several weeks to a couple of months, depending on claim volume, data accessibility, and how many departments need to be involved.

How many claims should an audit review? Most practices review a random sample of roughly 15 to 30 claims per provider per quarter, supplemented with targeted reviews of the highest-denial codes and highest-dollar claims. Larger organizations facing a specific compliance concern may need a statistically valid sample sized by a compliance specialist rather than a general practice audit.

Can a small practice run its own revenue cycle audit without outside help? Yes, using the checklist framework in this guide as a starting structure. The honest tradeoff is that staff reviewing their own work tend to miss their own blind spots, which is why many small practices pair internal monthly spot checks with an outside audit once or twice a year.

What triggers an external payer or OIG audit? Common triggers include billing patterns that differ sharply from specialty peers, heavy reliance on high-level E/M codes, frequent modifier 25 or 59 use without clear supporting documentation, a sudden spike in billing volume, and prior audit findings that were never remediated.

Does a revenue cycle audit only apply to hospitals, or do small practices need one too? Every setting that bills a payer benefits from one. The scope and cadence should scale to the organization’s size and risk, but the underlying leakage patterns (registration errors, eligibility gaps, coding mismatches, and unworked denials) show up in a two-provider clinic just as often as in a large health system.

Where to Start

A revenue cycle audit is not about finding blame. It is about finally seeing the whole financial picture at once instead of piecing it together from whichever report happens to be open that day. The practices that stay ahead of denials, aging AR, and payer scrutiny are not the ones with a perfect billing process. They are the ones that audit consistently enough to catch problems while the correction window is still open.

If it has been longer than a year since your last full review, or you have never run one at all, The Billing Advisors team can walk through your revenue cycle with you, stage by stage, and help build an audit process that actually fits your practice’s size and specialty. Get in touch to talk through where your revenue cycle stands today.