Q&A: Responding to governmental audits

Q: What departments should be involved in governmental audit response efforts?

A: Governmental audits are handled differently at every facility, but favorable results are more likely with a strong audit response that meets all additional documentation request (ADR) requirements.

“It is imperative that organizations determine who the right folks are to engage in the process,” says Diane Weiss, CPC, CPB, CCP, CHRI, vice president of revenue integrity and education at RestorixHealth in Metairie, Louisiana.

Some facilities split up auditing responsibilities across several departments (e.g., compliance, revenue integrity, HIM, billing), but others take a more centralized approach. Large health systems, especially those that experience a high volume of audits across several facility types and specialties, may need to use a combination of both approaches, according to Dawn Crump, MA, SSBB, CHC, vice president of revenue integrity at MRO in Norristown, Pennsylvania.

Regardless of structure, she recommends securing early engagement from HIM staff and release of information vendors.

“They can help get the appropriate documentation out of your facility and into the contractor’s hands as soon as possible,” she says.

She also notes that revenue integrity professionals are another key piece of the puzzle. Their expertise and involvement in internal auditing processes are helpful, as is their ability to identify areas of opportunity and compliance concerns before contractors do, she says.

“They can help their facility follow a more holistic approach instead of waiting for external auditors to point out opportunities and flaws,” she says.

Designating a point of contact (POC) for every audit is best practice. Organizations may choose to assign the same POC for certain types of audits or specific contractors.

“For some of our hospital partners, the POC is the lead compliance professional,” says Weiss. “For others, it is someone on the revenue integrity team.”

The POC should understand the contractor’s audit protocols and be a good communicator. When engaging with the auditor, the POC should prioritize transparency, cooperation, and timeliness.

Contractors appreciate when organizations are timely in not only responding to the ADR, but informing them of delays as well. Note that there are only limited reasons as to why an auditor would grant an extension. For example, an organization can’t ask for more time because it is understaffed, as all organizations are dealing with staffing problems, says Crump. Extenuating circumstances could lead to more flexibility, as long as the POC is transparent with the auditor.

“They can’t always go outside of their statement of work, but they will try to work with you if possible,” she says.

For example, in the aftermath of a cyberattack, a hospital may not be able to access its electronic health record to retrieve items requested in the ADR.

“In that scenario, your POC would inform the auditor that your organization is under breach protocol and is unable to meet the deadline,” says Crump.

Editor’s note: This answer was excerpted from “Governmental audits: Ensuring a thorough, timely reply” in the October 2025 issue of the NAHRI Journal.