SNF Audit Preparation and Common Audit Risks

Skilled nursing facilities are getting audited more, and getting caught more, than at any point I can remember in this industry. The national SNF improper payment rate nearly doubled from 7.79% in 2021 to 17.2% in 2024, according to the CERT report, which puts the projected dollar figure at $5.9 billion for 2024 alone. SNFs led every care setting in error rates last year, and 68% of improper payments nationally trace back to missing or thin documentation. Sit with that number for a second, because nearly everything else in this piece grows out of it.

The overlapping contractor system facilities are actually audited by

Administrators talk about "the audit" like it's one thing, one event, one letter in the mail. A SNF today sits inside a stack of contractor relationships, each with its own authority, its own triggers, and its own clock.

Medicare Administrative Contractors, or MACs, process claims day to day. They send Additional Documentation Requests, issue recoupment letters when something doesn't check out, and walk facilities through appeals when a claim gets denied. Above that sits Targeted Probe and Educate, or TPE, which pulls facilities in based on data: high denial rates, billing patterns that look off. A TPE round usually means 20 to 40 claims get probed, and showing the same problems twice gets a facility escalated to full program integrity review, a different animal entirely.

CERT, the Comprehensive Error Rate Testing program, is where the national improper payment figures actually come from; it checks whether a claim should have been paid at all, based on coverage, coding, and billing rules. Recovery Audit Contractors, or RACs, work differently, looking back roughly three years from the pay date and focusing on episodes of care rather than individual line items. Throw in the Supplemental Medical Review Contractor and the Unified Program Integrity Contractors, and a facility can end up facing four or five audit vectors running at once, none of them sharing a calendar or a documentation standard.

Geography matters more than most administrators want to believe. Palmetto GBA's Jurisdiction J, covering Alabama, Georgia, and Tennessee, posted a 27% error rate for July through September 2024, while WPS Jurisdiction 5, covering Iowa, Kansas, Missouri, and Nebraska, announced a 24.85% error rate back in January 2024. Now put that next to Palmetto's Jurisdiction M (North Carolina, South Carolina, Virginia, West Virginia) at 10%, or Noridian's Jurisdiction E (California, Hawaii, Nevada) at 9%. A facility in Tennessee is not living in the same risk environment as one in Nevada, even with identical documentation habits. Knowing your own MAC's current focus areas, not the national average everyone quotes, should decide where internal review time actually goes.

What CMS's new SNF Validation Program actually audits

CMS launched something genuinely new in September 2025: the SNF Validation Program, the first audit built specifically to check whether MDS 3.0 submissions match what's actually sitting in the clinical record.

The mechanics matter because the timeline is tight. Facilities land in the sample at random, as long as they filed at least one MDS record in the prior fiscal year and the current one, and size or location doesn't get them out of it. Once selected, the assigned auditor, Healthcare Management Solutions, LLC, requests documentation for up to 10 sampled MDS assessments, and the facility has 45 calendar days from the notification date to get it all in. Forty-five days sounds like plenty until you're the one chasing down therapy notes, physician documentation, and nursing charting that were never filed in a way anyone could pull together quickly.

Miss the mark and the penalty is blunt: a 2% cut to the annual payment update. Real money, right away.

Here's what makes this one hard to fix after the fact: MDS accuracy is the sum of nursing documentation, therapy records, and physician notes all telling the same story about a resident. The MDS form itself is just the last stop, and the real accuracy question gets settled at the bedside, days or weeks before anyone touches a form. This program doesn't replace the MAC ADRs or TPE reviews already running; it runs alongside them. Facilities now face audit pressure from several directions at once, and treating each one as its own separate fire misses how tightly they're connected.

Why PDPM has created retroactive audit exposure reaching back to 2019

PDPM swapped volume-based therapy minutes for clinical factors and care complexity as the basis for payment when it took effect in 2019. That sounds like an administrative tweak, but it means the precision of a facility's clinical documentation now decides reimbursement directly, in a way the old therapy-minutes model never came close to demanding.

OIG has opened a new audit series built around PDPM compliance, and the first released audit, targeting a New York skilled nursing facility, shows exactly what's at stake when documentation doesn't hold up. The Pinnacle Multicare case is the number everyone in this space should carry around: of 100 sampled claims, 99 failed to meet Medicare requirements. Identified overpayments on just those sampled claims came to $1.1 million, and OIG then extrapolated that finding across the facility's full claim volume and landed on an estimated overpayment of at least $31.2 million. The recurring problems were incorrect HIPPS code assignment and documentation too thin to support medical necessity, exactly the kind of gaps that look minor at filing time and turn enormous once extrapolated.

Facilities should also note the part that catches many off guard: PDPM reviews can reach back to 2019, the year the model launched. A facility that assumed claims from five or six years ago were long settled may be sitting on real, latent exposure without knowing it. What this demands isn't complicated to state, even if it's hard to do consistently, day after day: HIPPS code assignment has to trace back to actual clinical documentation, and the functional and diagnostic complexity driving the payment grouping needs to be written down, not assumed.

Cost report errors that turn routine filings into audit triggers

Related-party transactions trip facilities up more than almost anything else, largely because the scrutiny is baked into the regulation itself. Facilities currently pay roughly 40% of revenues to related parties, a share big enough that CMS treats it as a standing concern rather than an occasional red flag. Under 42 CFR §413.17, related-party costs have to be reported at the cost actually incurred by the related organization, capped at open-market comparable rates — what was actually spent, not what got billed.

One case makes this concrete. A management company billed $600,000 a year but could only back up $450,000 in actual expenses, and CMS required a $150,000 downward adjustment. Nobody alleged fraud; the facility simply couldn't produce the paperwork to support the number, and that's the uncomfortable part: a documentation gap produced the same financial hit a facility would face if the intent had been dishonest.

A handful of other cost report errors show up again and again, year after year. Misallocating therapy costs into nursing or administrative categories distorts true costs under PDPM in ways that ripple through rate calculations, while failing to separate contract and agency labor from regular staff wages breaks the required per-patient cost calculation. Capital and lease omissions, especially around depreciation, throw off rate-setting and the financial ratios both regulators and lenders check. Late filing carries its own blunt consequence too: Medicare payments get suspended until the cost report is accepted, period.

One more thing worth flagging now, before it turns into a scramble: for reporting periods ending on or after September 30, 2025, the CMS-2540-24 form replaces the prior version. It's a procedural change on paper, but procedural changes are exactly the kind of thing that catch a finance team flat-footed.

How PBJ staffing data became its own audit risk

Payroll-Based Journal, or PBJ, submissions happen quarterly and cover all direct care staffing, agency and contract staff included. That data feeds straight into public Five-Star ratings and into regulatory enforcement decisions, and OIG has said plainly it will audit whether reported PBJ hours are accurate and whether they meet regulatory staffing ratios. This is happening now, not some hypothetical future review.

The deadlines don't bend: February 14, May 15, August 14, and November 14, each one landing 45 calendar days after the prior fiscal quarter closes. What goes wrong tends to follow the same pattern every time. Agency hours get missed or logged inconsistently, and staff get mapped to the wrong job code, which quietly throws off the ratio calculations regulators lean on. Employee IDs drift across systems, creating duplicate or missing records from one quarter to the next. In plenty of facilities, nobody looks at the submission exceptions until the final week before the deadline, and by then fixing anything meaningful is close to impossible.

Because PBJ data is public, getting it wrong costs a facility twice: once in an audit finding, and once in a Five-Star drop that families and referral sources see immediately. The reputational hit and the financial one feed each other.

What the OIG's November 2024 compliance guidance tells facilities to do now

OIG published its Nursing Facility Industry Specific Compliance Guidance, the ICPG, in November 2024, the first guidance of its kind for this industry since the general compliance update in November 2023. It's technically voluntary and nonbinding, but in practice it works like a baseline standard: if problems surface later, this is the document regulators will hold a facility's compliance posture up against.

Medicare and Medicaid billing accuracy is one of four risk areas the ICPG calls out by name, with a specific push for facilities to run regular auditing and monitoring that confirms coding actually reflects residents' real characteristics and comorbidities. True, not just defensible on paper.

OIG's active workplan for 2025 and 2026 gives a fairly clear signal of where clinical review is headed next. Falls and antipsychotic medication prevalence, first flagged in 2023 and 2024, remain active targets. On the financial side, reviews now cover PDPM reimbursement accuracy, Medicare Part B services billed during a Part A stay, Supplemental Medicaid Payments, and Part D medication responsibility during Part A stays. That's a wide net, and nothing about it suggests it's slowing down.

Facilities without a formal compliance program should take note here: an organization that can't show regular internal claim review isn't just exposed to payment clawbacks. Errors without a documented compliance history can get labeled under the False Claims Act as "reckless disregard," a category carrying far heavier consequences than an honest billing mistake. Read the right way, the ICPG hands facilities a structured argument for building compliance infrastructure before the audit notice arrives, not after.

Building the internal controls that make year-round readiness possible

That 68% documentation-failure number from the opening isn't happening to facilities from the outside. It's an internal workflow problem, which means the fix is internal too.

Start by treating MDS accuracy as a genuinely shared job, not one coordinator's cross to bear. Nursing, therapy, dietary, and social work should each own their section of the MDS explicitly, with clear accountability attached to a name. Build pre-submission reconciliation checkpoints where clinical records get checked against MDS entries before filing, not after an ADR lands on someone's desk. HIPPS code assignment needs independent verification before the claim goes out the door, because errors caught after payment trigger the full audit and recovery machinery, and that machinery moves slowly and expensively once it starts.

On the cost report side, keep contemporaneous records of related-party service costs, meaning actual evidence of expenses incurred, not just an invoice with a number on it. Benchmark management fees and related-party charges against market rates every year and keep that comparison on file. It costs almost nothing to maintain in the moment and saves an enormous amount of grief later.

PBJ discipline runs on the same logic. Assign a named owner to each quarterly submission, with a review cycle starting well before the 45-day deadline, not in the final week. Audit agency and contract hour capture monthly instead of quarterly; errors caught after submission require formal correction filings, which draw more attention than the original mistake ever would have.

Pre-billing claim audits deserve their own line of focus, because they're the real difference between a self-corrected error and a RAC finding, between an honest mistake and False Claims Act exposure. CMS and its contractors already run data analytics and pattern detection to find outliers, and facilities running the same kind of internal checks catch the problems before an auditor does. A documented compliance program is the baseline now, not an extra. The ICPG treats it that way, and internal audit schedules, training logs, and corrective action records are exactly the evidence a facility needs if it ever has to defend itself.

What a specialized SNF auditor brings to readiness that a generalist firm does not

PDPM grouping logic, MDS data structures, PBJ submission rules, HUD 232 compliance, the specific audit priorities of individual MAC jurisdictions: all of it demands a level of sector fluency that a general accounting background doesn't hand you automatically. A financial statement audit run by a firm without direct SNF experience is unlikely to catch the cost report misallocations, related-party documentation gaps, or HIPPS coding weak spots that federal contractors are trained specifically to find. Generalist firms simply carry a mismatch of tools to this particular job.

So what should a facility actually look for in an audit partner? Direct, hands-on experience with skilled nursing facility audits and cost report review specifically, not healthcare experience in general, paired with working familiarity with the current OIG ICPG, the PDPM audit risk landscape, and the mechanics of the SNF Validation Program. A posture that catches risk in cost reports and MDS workflows before an audit notice shows up, not after, matters just as much as the operational muscle to actually help a facility hit a 45-day SNF Validation Program deadline once the clock has already started.

Pease Bell CPAs works in exactly this space: SNF-specific accounting and compliance work, including skilled nursing facility audits and cost report review, paired with the kind of regulatory depth this environment now demands. That comes with the partner-level attention facilities need while juggling four or five overlapping contractor relationships at once, a different kind of relationship than what a typical compliance vendor offers.

The thread running through all of this is simple enough to say plainly: audit risk in skilled nursing stopped being a once-a-year event a while ago. It's constant, it's layered, and it rewards facilities that treat readiness as something they build year-round rather than assemble in the weeks before a deadline. The right outside partner should move at that same pace, staying engaged through the whole year instead of showing up only when the paperwork is due.