, ,

Hospital Revenue Cycle Audit: Controls From Registration to Collections, With 14 Tests

The hospital revenue cycle is the chain of processes that turns a patient encounter into cash: scheduling and registration, insurance verification and authorisation, the clinical documentation and charge capture that record what was done, coding, claim submission, payer adjudication and denials, payment posting and contractual adjustments, patient billing and collections, and the reserves and write-offs that close the loop. It is the largest process in any hospital by dollars, the one with the most hand-offs between clinical and financial staff, and the one where control failures show up as cash that never arrives, compliance exposure under the False Claims Act, and patients billed for care they were told would be covered. This guide sets out the cycle stage by stage with the risks and controls at each, the metrics that show whether it is working, the regulatory obligations that run through it as they stand in 2026, the cyber and third-party dependencies the 2024 Change Healthcare attack exposed, a fourteen-test audit program, the findings that recur, and a worked engagement at the illustrative health system used across this site.

It replaces the earlier risk overview at this address and is the revenue-cycle companion to the internal audit in healthcare guide, which covers the sector’s universe, regulators and the compliance program the revenue cycle sits inside.

In this guide

The cycle, stage by stage

The table maps the cycle with the owner of each stage, the control objective and the failure that shows up downstream. Revenue cycle failures are almost always upstream of where they are detected: a denial in the back end was usually caused in registration or documentation, which is why audits that start at the denial and trace backward find the root causes that audits of the billing office do not.

StageOwnerControl objectiveDownstream symptom of failure
Scheduling and registrationPatient accessThe right patient, demographics, insurance and guarantor captured once, correctlyEligibility denials; returned statements; duplicate records
Eligibility verification and authorisationPatient access; financial clearanceCoverage confirmed and authorisation obtained before service where required; patient estimate givenAuthorisation denials; no-coverage write-offs; surprise bills
Clinical documentationPhysicians and nurses; clinical documentation integrityDocumentation supports the services, severity and medical necessityCoding queries; DRG downgrades; medical necessity denials; audit recoupments
Charge captureDepartments; charge description master ownerEvery billable service and supply captured at the right code and price, onceMissing charges; late charges; duplicate charges; price transparency errors
CodingHealth information managementDiagnoses and procedures coded accurately and completely from the documentationCoding denials; compliance exposure; case-mix index drift
Claim creation and submissionPatient financial servicesClean, timely claims to the right payer with the right dataRejections; timely-filing write-offs; discharged-not-final-billed backlog
Adjudication and denialsPatient financial services; denials teamPayer responses worked, appealed and prevented at sourceDenial write-offs; unworked remits; appeals missed
Payment posting and contractual adjustmentsCash postingPayments posted to the right account at the contracted rate; variances pursuedUnderpayments unnoticed; credit balances; unapplied cash
Patient billing and collectionsPatient financial services; vendorsAccurate statements, financial assistance applied, collections compliantBad debt; complaints; 501(r) and consumer-law exposure
Reserves, write-offs and reportingFinanceNet revenue, allowances and bad debt estimated and approved; write-offs authorisedRevenue restatements; write-off abuse

Front end: access, eligibility and authorisation

Most denials and most patient complaints originate here, and the controls are cheap compared with the cost of fixing their failures later. The table gives the risks and the controls to test.

RiskControlTestEvidence
Wrong or incomplete demographics and insuranceRegistration quality checks; electronic eligibility verification at scheduling and arrival; identity verificationSample registrations against source documents and eligibility responses; registration error rate by registrarRegistration records, eligibility transactions, quality scores
Services performed without required authorisationAuthorisation work queues by payer rule; pre-service financial clearance; escalation for urgent casesTrace scheduled procedures requiring authorisation to the authorisation on file before serviceAuthorisation records, denial data by reason
Patients not told what they will oweGood-faith estimates for uninsured and self-pay patients; price estimates against the published standard charges; financial counsellingSample estimates against the rules and the actual billEstimates, bills, complaint data
Financial assistance not offeredScreening at registration; policy published and applied; plain-language summary providedSample self-pay accounts for screening and assistance applicationScreening records, assistance determinations
Duplicate medical recordsMaster patient index controls; search before create; merge governanceDuplicate rate; merge auditMPI reports
Point-of-service cashReceipting, reconciliation and deposit controls at every collection pointReconcile receipts to deposits for a sample of days and locationsReceipt logs, deposits

Middle: documentation, charge capture and coding

The middle of the cycle is where compliance risk concentrates, because a claim that does not match the documentation is a false claim whether the error was careless or deliberate, and because the government’s audit contractors and the Office of Inspector General test exactly this. The healthcare guide covers the enforcement environment; the table gives the controls.

RiskControlTestEvidence
Documentation does not support the level of service, severity or medical necessityClinical documentation integrity program with queries; physician education; pre-bill review of high-risk DRGsIndependent re-review of a sample of inpatient records against the coded DRG and the documentation; query compliance (non-leading)Records, queries, re-review results
Charges missed, late or duplicatedCharge reconciliation by department (orders to charges, supplies to charges); late-charge monitoring; duplicate charge editsReconcile a sample of orders and procedures to charges; late-charge days; duplicate rateDepartment reconciliations, charge lag reports
Charge master errorsAnnual review of the charge description master against code sets and pricing policy; change control for additions and price changesSample CDM lines for valid codes, descriptions and prices; test change approvalsCDM, change log
Coding errors and upcodingCertified coders; coding audits with accuracy targets; edits for unbundling and modifiers; separate outside re-review annuallyIndependent coding accuracy sample by coder and service line; modifier and unbundling analyticsCoding audit results, claims data
Observation versus inpatient status errorsUtilisation review applying the two-midnight rule and payer criteria; physician advisor review; status change controlsSample short-stay admissions for status determination and documentationUR records, status changes
Provider-based and site-of-service billingLocation coding and modifiers per rule; provider-based attestationSample claims from off-campus locationsClaims, attestations
Unlicensed or excluded providers billedCredentialing and exclusion screening before billing and monthlyReconcile billing providers to credentialing and exclusion listsScreening results

Back end: claims, denials, posting and collections

RiskControlTestEvidence
Claims rejected, late or heldClaim scrubber edits maintained; discharged-not-final-billed monitoring with targets; timely-filing tracking by payerDNFB days and dollars; timely-filing write-offs by cause; edit maintenanceBilling system reports
Denials unworked or lostDenial work queues by reason and dollar; appeal deadlines tracked; root-cause feedback to the front and middleAge of unworked denials; appeal success rate; denial rate by reason trendDenial management system
Underpayments unnoticedContract management system modelling expected reimbursement; variance work queuesRecompute expected payment for a sample of claims against contracts; test variance follow-upContracts, remittances, variance reports
Cash misposted or unappliedDaily cash reconciliation of remittances to deposits to postings; unapplied cash ageingReconcile a sample of days end to end; age unapplied and credit balancesReconciliations, ageing reports
Credit balances and refundsCredit balance review; Medicare credit balance reporting; refund controlsAge credit balances; test refund timelinessCredit balance reports
Patient collections non-compliantStatement accuracy; financial assistance applied before extraordinary collection actions; vendor oversight; consumer-law complianceSample accounts sent to collections for assistance screening and notice; vendor auditCollection files, vendor reports
Write-offs and adjustments abusedAdjustment codes with approval thresholds; segregation between posting and adjusting; monitoring by userAnalytics on adjustments by user, code and amount; test approvals above thresholdsAdjustment data
Reserves wrongNet revenue and allowance models with assumptions reviewed; hindsight testingCompare prior reserves to actual collections; test assumption approvalsReserve models, hindsight analysis

The metrics and what they mean

Revenue cycle leaders run on a standard set of indicators, most defined by the industry’s own benchmarking bodies, and an auditor should rebuild the ones that matter from source rather than take the dashboard. The KRI examples guide gives the five-field pattern; the table gives the revenue cycle set.

MetricDefinitionWhat it signalsTypical range (varies by payer mix and setting)
Days in accounts receivableNet A/R divided by average daily net patient revenueOverall cycle speedLow 40s is strong; above 50 warrants attention
Clean claim rateClaims accepted by the payer on first submission as a share of claimsFront and middle qualityAbove 90 per cent
Initial denial rateDenied claims (by count or dollars) as a share of submittedFront-end and coding quality; payer behaviourBelow 10 per cent by count; rising across the industry
Denial overturn and appeal success rateDenials overturned as a share of appealedBack-end effectiveness and the quality of the original claimHigh rates with high denial rates mean the payer is denying what it later pays
Discharged not final billed (DNFB) daysDollars discharged and not billed, in days of revenueDocumentation, coding and query backlogBelow 5 days
Net collection ratePayments collected as a share of what was contractually collectibleLeakage after contractual adjustmentsAbove 95 per cent
Cost to collectRevenue cycle cost as a share of cash collectedEfficiencyAround 3 per cent; vendor costs included
Late charge rate and charge lagCharges posted after a set number of days from serviceCharge capture disciplineBelow 2 per cent; lag under 3 days
Bad debt and charity care as a share of gross revenueWrite-offs by categoryPatient collections and assistanceTracked against policy and community benefit reporting
Credit balance and unapplied cash ageingBalances over 60 and 90 daysPosting discipline and compliance exposureZero over 90 days for Medicare credits

The regulatory obligations in 2026

The revenue cycle runs through more regulation than any other hospital process, and the table lists the obligations an audit should know with their status in October 2026; the healthcare guide and the compliance risk guide cover the compliance program around them.

ObligationWhat it requiresWhere it bites in the cycleStatus and notes
False Claims Act and the Anti-Kickback StatuteNo claims that are false or that result from prohibited remuneration; identified overpayments reported and returned within 60 daysCoding, documentation, medical necessity, status, credit balancesEnforcement continuous; the 60-day overpayment rule and the OIG’s compliance program guidance frame the response
Medicare conditions and billing rulesThe two-midnight rule for inpatient status; outpatient and provider-based rules; the inpatient and outpatient payment systems updated annuallyUtilisation review, charge capture, site-of-service billingAnnual rule updates each October (inpatient) and January (outpatient)
Hospital price transparencyMachine-readable standard charges file and shoppable services display; CMS enforcement with civil monetary penalties, increased since 2024Charge master, estimatesIn force; CMS tightened the file format and enforcement in 2024 and 2025
No Surprises ActGood-faith estimates for uninsured and self-pay patients; protections against balance billing for emergency and certain out-of-network care; independent dispute resolutionEstimates, out-of-network billingIn force since 2022; estimate requirements for insured patients still pending
Section 501(r) for tax-exempt hospitalsFinancial assistance policy, limits on charges to eligible patients, no extraordinary collection actions before reasonable efforts to determine eligibilityPatient collectionsIn force; tax exemption at stake
Medicare Advantage and payer auditsPayer prior authorisation and medical necessity rules; RAC and payer post-payment auditsAuthorisation, documentation, denialsPrior authorisation reforms for Medicare Advantage phased in from 2026 under the 2024 interoperability and prior authorisation rule
HIPAAPrivacy and security of protected health information throughout the cycle and at vendorsEvery stage; vendorsIn force; the security rule update proposed in late 2024 remained pending in 2026
State lawsFacility fee disclosure, medical debt collection limits, charity care mandates, surprise billing lawsBilling and collectionsVaries by state; medical debt reporting restrictions expanded in several states in 2025 and 2026

Read together, the metrics also expose the trade-offs revenue cycle leaders make: a function that drives days in accounts receivable down by writing off aged balances improves one number and worsens the net collection rate; one that holds claims for coding review raises DNFB and lowers denials. An auditor who sees one metric improving should look for the one that paid for it.

Cyber and third-party dependency

The ransomware attack on Change Healthcare in February 2024 stopped claims and payments for a large share of US providers for weeks, and it changed the revenue cycle audit: the clearinghouse, the eligibility vendor, the coding and billing outsourcer and the collection agency are single points of failure for cash. The audit now tests the inventory of revenue cycle vendors and what each one holds; the contingency plan for losing the clearinghouse (alternate submission routes, payer portals, cash reserves); the security assessment and incident clauses for each critical vendor; and the organisation’s own resilience for the billing systems. The third-party risk management guide gives the program and the AI governance guide the controls for the coding and denial-prediction tools now sold into the cycle, which carry their own accuracy and bias questions.

Scoping the engagement: where to start

A full-cycle audit at a multi-hospital system runs to a thousand hours, and most functions cannot spend them every year, so the scope is chosen from the symptoms. The table maps the symptom the audit committee or the chief financial officer raises to the stages to audit first; the rest of the cycle is covered on rotation. The annual risk assessment guide gives the method for sizing the engagement and the assurance mapping guide for recording what the revenue cycle’s own quality and compliance teams already cover.

Symptom raisedLikely originStages to audit firstAnalytics to run before fieldwork
Denial write-offs risingAuthorisation, registration, coding, or unowned denial queuesEligibility and authorisation; denials management; codingDenials by reason, payer, department and age over two years
Days in A/R risingDNFB backlog, slow posting, payer behaviour, unworked queuesDocumentation and coding backlog; claims timeliness; postingA/R ageing by payer and financial class; DNFB trend
Cash below budget with volumes on planCharge capture gaps, underpayments, adjustmentsCharge reconciliation; expected reimbursement; adjustmentsCharges per case by department versus prior year; variance to contract
Patient complaints and press about billsEstimates, assistance, collections, out-of-network billingFront-end estimates and assistance; patient collectionsComplaints by category; accounts placed before screening
Payer or government audit findingsDocumentation, coding, status, site of serviceDocumentation and coding; utilisation reviewDRG mix shift; short-stay admission rates; modifier usage
Vendor outage or cyber incidentClearinghouse, outsourcer, agency dependencyVendor dependency and resilience; cash postingClaims and cash volumes through each vendor
New system or outsourcingConversion errors, lost edits, unreconciled balancesCharge master; claims; posting; adjustmentsPre- and post-conversion charge, claim and cash volumes

The audit program: fourteen tests

The program below assumes a hospital or system with an electronic health record and an integrated billing system; the work program guide covers documentation. Analytics on the full claims population replace sampling wherever the data allows, and the SQL for auditors guide gives the query patterns.

#TestMethodTypical finding
1Registration accuracySample registrations to source; registrar error ratesError rates uncontrolled; no feedback
2Eligibility and authorisation before serviceTrace scheduled procedures to authorisations; denial data by reasonAuthorisation denials from services scheduled outside the clearance process
3Estimates and financial assistanceSample uninsured and self-pay accounts for estimates and screeningEstimates not provided; assistance applied after collections
4Charge reconciliation by departmentOrders and procedures to charges for high-volume departmentsDepartments with no reconciliation; missed charges
5Charge master integrityCDM lines against code sets and pricing policy; change approvalsInvalid codes; unapproved price changes
6Coding accuracyIndependent re-review sample by service line; unbundling and modifier analyticsAccuracy below target in a service line; modifier misuse
7Documentation and statusShort-stay sample for status determination; query complianceLeading queries; status changes without physician advisor review
8Claims timelinessDNFB and timely-filing analysis by causeTimely-filing write-offs from a work queue nobody owned
9Denials managementAge and value of unworked denials; appeal deadlines; root-cause feedbackDenials written off after the appeal window; no feedback loop
10Expected reimbursement and underpaymentsRecompute payments against contracts for a sample; variance follow-upContracts not loaded; underpayments unpursued
11Cash posting and reconciliationRemittance to deposit to posting for sample days; unapplied and credit balance ageingUnapplied cash aged; Medicare credits unreported
12Adjustments and write-offsAnalytics by user, code, amount; approval testsAdjustment authority exceeded; the same user posting and adjusting
13Patient collections and vendorsSample accounts sent to agencies for 501(r) steps; vendor compliance and remittance reconciliationAccounts placed before assistance screening; vendor remittances unreconciled
14Vendor dependency and resilienceInventory, contingency plan, security assessments, incident clausesNo alternate claims route; clearinghouse contract silent on incidents

Two notes on method. Revenue cycle data is large and well structured, so population analytics replace sampling for most of the tests: every claim, every denial, every adjustment and every remittance in the year can be examined, and the sample is reserved for the record reviews (registration to source, documentation to code) that need a human reader. And the revenue cycle has its own second line, usually a revenue integrity team and the compliance department’s billing audits, whose work the internal audit function tests and may rely on in the way the internal audit versus compliance guide describes; an engagement that re-performs the compliance department’s coding audit without first assessing it has spent its hours on the wrong question.

The findings that recur

FindingRoot causeFix that holds
Authorisation denials from scheduled servicesScheduling outside the financial clearance process; payer rule changes not maintainedHard stop for unauthorised scheduled services; payer rule maintenance owner
Charge capture gaps in procedural departmentsNo order-to-charge reconciliation; charge capture dependent on cliniciansAutomated reconciliation; department accountability with metrics
Coding accuracy below target in one service lineComplex documentation; coder turnover; no specialty reviewSpecialty coding review; physician documentation education
Denials written offWork queues unowned; appeal windows missedOwnership, ageing reports, escalation; root-cause feedback
Underpayments unpursuedContract models not loaded or outdatedContract management discipline; variance queues
Credit balances and unapplied cash agedPosting staff measured on volume; refunds low priorityAgeing targets; Medicare credit reporting control
Collections before financial assistanceVendor placement automated; screening manualScreening before placement; vendor contract terms
Adjustment authority exceededThresholds not enforced in the systemSystem-enforced thresholds; monitoring by user

Worked example: Ashgrove Health System’s revenue cycle audit

Ashgrove Health System is the illustrative nonprofit system used in the healthcare examples on this site: five hospitals, about 190 clinics, 2.1 billion dollars of revenue with 58 per cent from Medicare and Medicaid, and a twelve-person internal audit function reporting to the board’s compliance and audit committee. Its FY27 plan included a 900-hour revenue cycle audit, scoped after denial write-offs rose for two years and the committee asked whether the problem was the payers or the system. The engagement ran the fourteen tests, with analytics on the full year’s claims.

TestWhat the audit foundRating
AuthorisationAuthorisation denials of 11.2 million dollars in the year; 64 per cent traced to procedures scheduled by physician offices outside the financial clearance processHigh
Charge reconciliationThree of nine procedural departments reconciled orders to charges; an estimate of 3.8 million dollars of missed charges in the other six from a sample extrapolationHigh
Coding accuracyOverall 95 per cent; cardiology 88 per cent, with a pattern of unsupported severity codes that also created compliance exposureHigh
Denials managementDenials of 6.4 million dollars written off after the appeal window; two work queues with no owner since a reorganisationHigh
UnderpaymentsTwo commercial contracts not loaded in the contract management system; underpayments of 2.1 million dollars identified by recomputation, 1.6 million still recoverableMedium
Cash postingUnapplied cash of 4.3 million dollars over 90 days; Medicare credit balances reported late in two quartersMedium
Patient collectionsOf 60 accounts placed with agencies, 9 had no financial assistance screening recorded; one agency’s remittances unreconciled for five monthsHigh
Vendor dependencyThe clearinghouse contract had no incident clause; the 2024 contingency plan had not been tested sinceMedium
Registration, estimates, charge master, status, timeliness, adjustmentsFindings rated low to medium; adjustment thresholds enforced in the systemLow to medium

The audit committee received the report with the dollar effects, and management’s actions were tracked under the issue tracking standard: a hard stop for unauthorised scheduled services with a physician-office clearance workflow; automated order-to-charge reconciliation in all nine departments; a cardiology documentation and coding program with an outside re-review and a disclosure analysis of the severity pattern under the overpayment rule; ownership and ageing for every denial queue with a root-cause feedback report to the front end; the two contracts loaded and underpayments pursued; unapplied cash and credit balance targets; screening before any agency placement and reconciliation of agency remittances; and a tested contingency plan and an incident clause at the clearinghouse contract renewal. Internal audit validated the actions over two quarters and reported the denial write-off trend to the committee as a continuous monitoring indicator.

Frequently asked questions

What is the hospital revenue cycle?

The chain of processes from scheduling and registration through eligibility and authorisation, clinical documentation, charge capture, coding, claim submission, payer adjudication and denials, payment posting, patient billing and collections, to the reserves and write-offs that close the books. It is the largest process in a hospital by dollars and the one with the most hand-offs between clinical and financial staff.

What are the most common revenue cycle control failures?

Services scheduled without required authorisation; charges missed in procedural departments with no order-to-charge reconciliation; coding accuracy below target in complex service lines; denials written off after the appeal window from unowned work queues; underpayments unpursued because contracts are not modelled; aged unapplied cash and credit balances; accounts sent to collections before financial assistance screening; and adjustment authority not enforced in the system.

How should internal audit audit the revenue cycle?

By following the money from the denial backward to the cause, with analytics on the full claims population: registration accuracy, authorisation before service, estimates and assistance, charge reconciliation, charge master integrity, coding accuracy with an independent re-review, documentation and status, claims timeliness, denials management, expected reimbursement, cash posting, adjustments, patient collections and vendors, and vendor dependency and resilience. Findings carry dollar effects and compliance exposure.

What metrics show whether a revenue cycle is healthy?

Days in accounts receivable, clean claim rate, initial denial rate and appeal success, discharged-not-final-billed days, net collection rate, cost to collect, late charge rate, bad debt and charity care shares, and the ageing of credit balances and unapplied cash. Auditors rebuild the ones that matter from source rather than accepting the dashboard, and read them together: a high appeal success rate beside a high denial rate means the payer is denying what it later pays.

What regulations apply to the hospital revenue cycle?

The False Claims Act and the Anti-Kickback Statute with the 60-day overpayment rule; Medicare billing rules including the two-midnight rule and the annual payment system updates; the hospital price transparency rule with its tightened enforcement; the No Surprises Act’s estimates and balance-billing protections; Section 501(r) for tax-exempt hospitals’ financial assistance and collections; Medicare Advantage prior authorisation reforms phasing in from 2026; HIPAA throughout; and state laws on facility fees, medical debt and charity care.

What did the Change Healthcare attack change for revenue cycle audits?

It showed that the clearinghouse and other revenue cycle vendors are single points of failure for cash. Audits now test the vendor inventory and what each holds, the contingency plan for losing the clearinghouse (alternate submission routes, payer portals, cash reserves), security assessments and incident clauses in vendor contracts, and the resilience of the billing systems themselves.

How does coding accuracy relate to compliance risk?

A claim that does not match the documentation is a false claim whether the error was careless or deliberate, and the government’s audit contractors and the Office of Inspector General test exactly that match. A pattern of unsupported severity or procedure codes is a compliance matter requiring analysis under the 60-day overpayment rule, not only a revenue matter, which is why coding audits are independent, sampled by service line and followed by disclosure analysis when a pattern appears.

What is the role of AI in the revenue cycle, and what should auditors test?

AI tools are now sold for coding assistance, denial prediction and appeal drafting, prior authorisation automation and patient estimate generation. Auditors test them as they test any model: accuracy against an independent re-review, bias across patient groups and payers, the human review step before a claim or an appeal is submitted, change control, and the vendor’s access to protected health information. The AI governance guide gives the framework.

Free PDF · 15 one-page cheat sheets

The Internal Audit Desk Reference, free by email.

GIAS 2024 on one page, the sample-size tables, the risk and control matrix, the five-C finding, the SOX deficiency ladder, the CIA exam at a glance, and nine more. Printable. Written by working auditors.

Free. Confirm your address once; the PDF link follows. Unsubscribe anytime.

Cover of The Internal Audit Desk Reference: fifteen one-page cheat sheets and templates (PDF)
Cover of The Internal Audit Desk Reference: fifteen one-page cheat sheets and templates (PDF)

Free PDF

The desk reference: 15 cheat sheets, one page each.

GIAS map, sample sizes, the RCM, the five-C finding, SOX deficiency ladder, CIA at a glance. Free, printable.

Confirm once; the PDF link follows. Unsubscribe anytime.

Comments

Leave a Reply