Bottom line: CMS audit risk has two parts, the odds of being selected and the odds of an adverse finding once you are. Both track back to the same thing: the error rate and billing patterns your claims produce. Lower the errors at intake and you lower both.
Audit exposure is something you should manage proactively.
What Is CMS Audit Risk?
CMS audit risk is your exposure to a records review that ends in a repayment demand. It isn't one program.
Several contractors review DME claims, each with a different trigger and a different consequence, and a supplier can face any of them.
- CERT samples claims at random to measure the Medicare improper payment rate, then extrapolates it across fee-for-service claims.
- TPE, run by the MAC, is education-focused and targets suppliers with high error rates or unusual billing, reviewing a sample of claims across up to three rounds.
- Recovery Auditors (RACs) work on contingency to find and recover improper payments.
- UPICs focus on fraud, waste, and abuse, using data mining and running both pre-payment and post-payment reviews that can lead to extrapolated overpayments or payment suspension.
- The SMRC conducts post-payment reviews nationwide and issues an additional documentation request to pull the records.
Risk isn't evenly spread across these. Some are random, but most are driven by your own data, which means the exposure is largely in your control.
What Flags a DME Supplier for a CMS Audit?
Outside of random CERT sampling, audits are targeted, and the target is chosen from data.
MACs and integrity contractors look for suppliers whose numbers stand out: a high claim error rate, denial patterns that repeat, billing volumes or utilization that run above peers for a given item, and coding or modifier use that looks aberrant against the norm.
TPE exists specifically to review suppliers with high error rates or unusual billing.
The pattern that gets you flagged is usually the same pattern that produces denials. A documentation gap that causes a denial today also raises your error rate, and a rising error rate is what draws a reviewer's attention. So the claims that quietly fail at billing aren't just lost revenue. They're the signal that invites the audit.
Reducing CMS audit risk starts with reducing the errors that make you visible.
Why CMS Audit Risk Is a Documentation Problem
When an audit does arrive, the finding almost always traces to a gap that existed before the claim went out. A missing face-to-face note. A proof of delivery without a signature. An order lacking a required element. An authorization the payer required and nobody captured. The reviewer isn't creating the problem, just pulling the record and finding what was already missing.
That's why audit risk is a documentation problem vs a luck problem.
Audit readiness is the output of daily process quality.
If every order's documentation is complete and consistent as a matter of routine, your error rate stays low, fewer claims are denied, your billing patterns look clean, and an audit becomes a retrieval exercise. If documentation is inconsistent, the same gaps that drive denials also drive your selection risk and your findings when reviewed. Billing can't reconstruct a signature that was never collected or an authorization that was never obtained.
How to Reduce CMS Audit Risk
The way to lower exposure is to stop defects before they become claims, so both your error rate and your billing patterns improve. Rules-based automation validates each order against the requirements at intake, which keeps errors out of the claim stream and keeps every record retrieval-ready if it's pulled.
In practice, automation confirms the order is complete, checks that face-to-face and medical-necessity documentation are on file when required, verifies authorization and payer-specific rules, and confirms the proof of delivery carries the right elements. Clean orders advance and are audit-ready by default. Orders that fail route to an exception queue with the specific gap attached, so staff fix the record while it's still fixable, before it becomes a denial and a data point.
This layers into your existing system. If you run Brightree, the validation can drive WIP routing inside the workflow you already use, so an order can't reach a billable state until its documentation would survive a review. A status tracker becomes a workflow engine only when the state changes are tied to validated conditions instead of a manual click. Lower error rates and cleaner patterns are the byproduct, and they're exactly what shrinks audit exposure.
CMS Audit Risk FAQs
What increases a DME supplier's CMS audit risk?
A high claim error rate, repeating denial patterns, and billing or utilization that runs above peers for an item. Most targeted audits are selected from data, so the numbers your claims produce are what raise or lower your exposure.
Can you eliminate CMS audit risk completely?
No. CERT sampling is random, and any supplier can be reviewed. What you can control is your error rate and billing patterns, which reduces the odds of a targeted audit and the odds of an adverse finding when one happens.
How does reducing denials also reduce audit risk?
The documentation gaps that cause denials are the same gaps that raise your error rate and produce the patterns reviewers target. Fixing them at intake lowers denials and audit exposure at the same time.
Does reducing audit risk require replacing Brightree?
No. Documentation validation and rule enforcement can run inside your current Brightree workflows as an added layer, not a platform swap.
Where to Start
You don't need to overhaul compliance at once. Start where your data is most exposed.
- Pull 60 to 90 days of denials and any past audit findings to see which documentation gaps recur.
- Identify the items and payers driving your highest error rates and most unusual patterns.
- Trace each gap to its upstream cause, usually a check a person is doing by hand.
- Configure intake validation for those causes so orders can't advance until the record is complete.
- Route incomplete records to an exception queue with the specific gap attached.
- Confirm retention and retrieval so requested records can be produced quickly.
- Track your error rate and denial patterns over time, then expand once they improve.
CMS audit risk isn't luck, and it isn't something you handle only when an ADR shows up. It's the visible result of your documentation quality, and the suppliers with the lowest exposure are the ones who make every order right before it's billed.
