No universal sample size exists. ACDIS cites 30 cases as a common starting point for routine quality review, and a 1999 AHIMA article suggested 50 randomly chosen records for physician office audits. The right number depends on your objective, population, expected error rate and risk.
What is an internal medical coding audit?
An internal medical coding audit is a structured review of medical records to determine whether diagnoses, procedures, modifiers, and other reported codes are supported by the clinical documentation and the applicable coding requirements.
Audits fall into several categories, and the type should follow the objective:
- Routine quality audits evaluate coding accuracy across a representative sample of completed records.
- Focused audits examine specific codes, procedures, specialties, payers, or error patterns.
- Compliance audits assess whether coding practices follow applicable regulations, official guidelines, and internal policy.
A routine quality audit uses a representative sample. A focused compliance review targets a known risk area. Choose the audit type according to the risk or performance question you need to investigate.
Why conduct internal coding audits?
Audits surface problems before they become recurring operational or compliance risks. Internal coding audits serve six practical purposes.
Identify coding errors. Incorrect diagnosis codes, unsupported procedures, missing modifiers, and inaccurate sequencing show where review or education is needed.
Verify documentation support. Every reported code should trace to the record. Audits establish whether the documentation supports the conditions, procedures, and services reported.
Monitor compliance risk. Coding decisions must follow applicable guidelines, payer requirements, and internal policy. Regular review finds practices that create exposure.
Improve consistency. Coders interpret documentation differently. Reviewing records against the same criteria shows where interpretations diverge.
Measure performance over time. Results give you a baseline for tracking accuracy, recurring errors, and whether corrective action worked.
Reduce avoidable rework. Finding issues before submission removes post-submission corrections, appeals and claim rework.
How do you conduct an internal medical coding audit?
Six steps, in order. A structured process makes findings comparable across periods.
Step 1: Define the audit objective and population
Decide what the audit evaluates: overall accuracy, a recurring error, a high-risk code category, or compliance with one payer requirement. Then set which records are eligible by period, department, provider, coder, claim type, or service category. The objective determines everything downstream, so settle it before you pull a chart.
Step 2: Establish the coding criteria
Apply the relevant official coding guidelines, code-set instructions and payer policies. Consult authoritative interpretive references, such as AHA Coding Clinic and AMA CPT Assistant, where applicable. The criteria set usually includes ICD-10-CM, CPT and HCPCS Level II guidelines, ICD-10-PCS where the audit reaches inpatient procedural coding, documentation requirements, NCCI and other applicable edits, LCD and NCD requirements, and internal policy.
Name the code sets in scope. An outpatient professional-fee audit and an inpatient audit measured on MS-DRG assignment produce numbers nobody should compare.
Step 3: Select and document the sample
Use random selection to assess overall performance, or targeted selection to investigate a suspected problem. Write down how you chose the records. An audit nobody can reproduce is hard to defend.
Step 4: Review records and classify errors
Check each record against the documentation and the criteria: whether diagnoses are supported, procedures and services are coded correctly, modifiers are appropriate, sequencing follows the guidelines, and medical necessity and payer requirements were considered.
Log every finding with the documentation behind it, the criterion it failed, and the record identifier, reviewer, date and severity. Classify errors by type and by direction, since overstating a service and understating one carry different compliance and revenue consequences, and a net accuracy rate hides both.
Step 5: Validate findings and calculate impact
Let the coder respond before anything is final, so documentation the auditor missed surfaces on the record rather than in a meeting. Send whatever stays disputed, and any high-impact finding, to a second qualified reviewer.
Where the setting allows it, quantify the effect of confirmed errors in RVUs, DRG shift, or dollars. That turns an accuracy percentage into a prioritized worklist, though not every coding error carries a directly measurable financial effect.
Step 6: Report results and follow up
Report the objective, population, sample, methodology and findings, then assign corrective actions to named teams: coder education, documentation improvement, workflow changes, additional review, or policy updates. Re-audit comparable records afterwards and compare the error rate against the original, which tells you whether the intervention worked or the problem sits somewhere you have not looked.
What sample size should you use for a coding audit?
No single sample size applies to every audit. The number depends on purpose, population size, risk, and the confidence you need in the result. Four reference points give you a defensible starting position.
Thirty records for routine quality review. ACDIS, in a June 2018 Q&A excerpted from Rose T. Dunn's JustCoding's Essential Guide to Coding Audits, states that "a commonly recommended audit sample size is 30 cases for routine quality auditing with no known serious compliance issues." For a new coder, 30 cases may not be sufficient. ACDIS notes that organizations may need to review all cases until the coder demonstrates consistent understanding and application of the coding guidelines.
Fifty records as an older rule of thumb for physician office audits. AHIMA guidance from Zeisset and Scichilone , published in the Journal of AHIMA in 1999, offers "a good rule of thumb: 50 records is an adequate sample as long as they are chosen randomly." That article predates ICD-10-CM and the current E/M documentation guidelines, so treat the number as a historical benchmark rather than current guidance.
One hundred percent review for low-volume or high-risk areas. The same AHIMA guidance directs that all low-volume or high-risk areas be audited in full, naming a newly introduced procedure or an OIG focus area as examples.
Expand when findings warrant it. The ACDIS source describes auditing by exception: start with a smaller sample, such as five encounters per coder, when auditing every coder against an OIG Work Plan item with nothing suggesting errors, then increase to 10 for any coder with errors in that issue, and keep expanding if more errors appear. The approach limits deeper review to the coders who need it.
Document why you chose a sample size and whether it supports the conclusions you intend to draw.
Internal quality audits are not statistical overpayment estimation
Your internal audit and a Medicare extrapolation are different exercises. CMS's Medicare Program Integrity Manual, Chapter 8 , §8.4, sets out the statistical sampling method Medicare contractors use to estimate overpayments, and those rules bind the contractor rather than your quality program. One line from it is worth borrowing: "It is neither possible nor desirable to specify a minimum sample size that applies to all situations." If you ever need a statistically valid sample of your own, the HHS Office of Inspector General publishes RAT-STATS free, for Windows. If you are weighing extrapolation on an actual overpayment, get statistical and legal advice before you start.
What if the audit finds Medicare overpayments?
A finding can trigger a legal obligation, not just a corrective action. Under 42 CFR 401.305 , a person must report and return an identified Medicare overpayment by the later of 60 days after identification or the date any corresponding cost report is due. Since January 1, 2025, under the CY 2025 Physician Fee Schedule final rule , identification follows the knowing standard: a person has identified an overpayment when they knowingly receive or retain one.
The same rule now allows breathing room to size the problem. The deadline is suspended while you conduct a timely, good-faith investigation into related overpayments sharing the same or a similar cause, and the suspension runs until the earlier of the date that investigation concludes and the amounts are calculated, or 180 days after the initial overpayment was identified.
Treat this paragraph as orientation rather than advice. Bring your compliance officer and counsel in as soon as an audit suggests a refund may be owed, because the decisions that follow, including how wide to cast the related-claims review, carry False Claims Act exposure.
How does MediCodio AI support audit readiness?
A retrospective audit identifies errors after coding or claim submission. MediCodio AI works on both sides of that line, through software that applies the checks during coding and a separate audit service staffed by credentialed auditors.
CODIO AI: coding accuracy and traceability
The CODIO AI engine tests code assignments against NCCI edits, MUE limits, LCD and NCD requirements and payer-specific rules while the chart is coded. Complete charts flow through AutoPilot for fully autonomous coding. Charts where the documentation is thin or contradictory stay in CoPilot, where certified coders review and finalize the output. A code-level audit trail holds the documentation and rationale behind each code, which is what an auditor otherwise rebuilds by hand.
Medical coding audit services: review by credentialed auditors
Medical coding audit services cover pre-bill audits, where charts are reviewed before submission so errors are corrected rather than appealed, and post-bill audits that measure accuracy and surface patterns of error and undercoding. Compliance audits check against coding guidelines, NCCI edits, MUE limits and coverage policy. Payer-specific and specialty-specific audits go deeper on one payer's rules or one specialty's documentation. Auditors re-derive the correct codes from the same documentation the original coder saw, and findings come back as root causes logged against the specialty, provider, documentation gap or rule, rather than as a list of corrections. The work is performed by AAPC- and AHIMA-credentialed coders and auditors.
Frequently asked questions
How many charts should be reviewed in a medical coding audit?
There is no universal sample size. ACDIS describes 30 cases as a commonly recommended sample for routine quality auditing with no known serious compliance issues, and a 1999 AHIMA article offered 50 randomly chosen records for physician office audits. Your objective, population and risk decide the number.
Is a 5% sample sufficient for a medical coding audit?
Not necessarily. A fixed percentage does not produce a representative sample on its own, and CMS states that no minimum sample size applies to all situations. The number depends on population size, objective, expected error rate and the confidence you need. Document the rationale.
What is the difference between random and targeted coding audits?
Random audits draw records from a defined population to assess overall performance. Targeted audits focus on records tied to known or suspected risk. Random sampling answers how the team is doing; targeted sampling answers what is happening in one area. Most programs need both.
How often should internal coding audits be conducted?
Frequency follows coding volume, risk and previous findings rather than a fixed rule. Monthly sampling, quarterly trend review and an annual program assessment give a workable structure. Checks applied during coding, as MediCodio AI's engine does, reduce what an audit has to catch without replacing it.
What is the difference between code-level and record-level accuracy?
Record-level accuracy is the share of audited records meeting your criteria. Code-level accuracy is the share of individual code assignments that are correct. The same sample produces different percentages under each, so report which you used. A code-level audit trail, of the kind MediCodio AI keeps, makes the second measure cheaper to produce.
References
- ACDIS, Q&A: Choosing sample cases for a coding audit , June 5, 2018, excerpted from Rose T. Dunn, JustCoding's Essential Guide to Coding Audits
- Zeisset, Ann, and Rita Scichilone, "Steps to Internal Audits for Physician Office Records" , Journal of AHIMA 70, no. 9 (1999): 88-92
- CMS, Medicare Program Integrity Manual, Chapter 8 , §8.4, statistical sampling for overpayment estimation
- 42 CFR 401.305 , reporting and returning identified Medicare overpayments, including the suspension for investigating related overpayments
- HHS Office of Inspector General, RAT-STATS statistical software