Coding Audit Guide for the FY2027 Code Set

A coding audit is the most direct way an HIM department can confirm that the codes leaving the building match the record, and October is the month it matters most. The FY2027 ICD-10-CM and ICD-10-PCS code sets and MS-DRG Version 44 took effect for discharges on and after October 1, 2026, which means every coder on your team is now working under new codes, new DRG logic, and new severity designations at the same time.

This article is written for HIM directors, coding managers, and revenue integrity leaders deciding when to run an external coding audit, what to sample, how to measure accuracy, and what to do with the findings. The goal throughout is accurate, supportable claims. A coding audit designed to find errors in only one direction is not an audit, and it is not a program any compliance officer should sign off on.

Why a Coding Audit Belongs on the Calendar Now

Annual code set changes are routine, but they are not small. According to Revenue Cycle Advisor, the FY2027 ICD-10-CM update added 190 new codes, deleted 30, and revised four. On the procedure side, the CMS FY2027 errata brought the total to 103 new ICD-10-PCS codes, with 38 deleted and three titles revised, and the PCS code set grew from 79,193 to 79,258 codes.

The grouper changed too. CMS lists MS-DRG Version 44 as the FY2027 grouper, effective October 1, 2026 through March 31, 2027. The HFMA summary of the FY2027 IPPS final rule describes restructured MS-DRGs in areas including spinal fusion, pacemaker procedures, periprosthetic joint infection, and uterine and adnexal procedures, plus ten housing-related Z codes moving from CC to non-CC status.

Each of those changes is a place where a well-trained coder can apply last year's logic out of habit. The first few weeks after an update are when those habits show up, and they compound quickly at inpatient volume. A focused review in the first quarter of the fiscal year catches them while they are still patterns you can correct with education rather than a backlog of claims to rebill.

Note that the windows differ. CMS lists the FY2027 ICD-10-CM files as covering October 1, 2026 through September 30, 2027, while the ICD-10-PCS files run through March 31, 2027, so plan for another round of change in April.

What Should Trigger a Coding Audit

The new fiscal year is one trigger. There are others, and a mature program treats each one as a reason to look closer.

• New coders or new contract coders. Every coder brings habits from a previous employer or client. A baseline review in the first 30 to 60 days tells you how quickly they have adopted your facility's guidelines and query workflow.
• Denial patterns. A cluster of DRG downgrades or clinical validation denials from one payer is a signal to review the coded record, not just the appeal. Our article on hospital claim denials covers the clinical validation side in more depth.
• Shifts in DRG or severity mix. A sudden change in case mix, CC and MCC capture, or a specific DRG pair is worth explaining before anyone outside the department asks.
• New service lines or new providers. Unfamiliar procedures and documentation styles create predictable error points.
• System changes. An EHR conversion, a new encoder, or a computer-assisted coding rollout changes the way codes are assigned, which changes the errors you will see.
• External audit focus areas. CMS keeps inpatient MS-DRG coding validation on its list of approved Recovery Audit Contractor topics. If outside reviewers are looking, you should be looking first.

Pre-Bill vs. Retrospective: Choosing the Coding Audit Type

The two main approaches answer different questions, and most strong programs use both.

Pre-bill review

A pre-bill coding audit reviews a sample of records after coding but before the claim drops. Errors are corrected before submission, so there is nothing to rebill or repay. The tradeoff is time: pre-bill review adds a step between coding and billing, and if it is not staffed adequately, it shows up in your DNFB. Our DNFB article explains why that number gets attention from the CFO.

Retrospective review

A retrospective coding audit looks at claims already billed. It is the better tool for measuring a coder's or a department's true accuracy over a period, for testing a specific risk area such as a DRG pair or a high-volume diagnosis, and for validating that corrective action worked. When a retrospective review finds an overpayment, the facility has obligations to address it, which is covered below.

Scope choices

Within either approach, decide what you are auditing. Inpatient MS-DRG validation, outpatient and ambulatory surgery coding, professional fee coding, and specific high-risk targets each need reviewers with the right expertise. An audit that sends an outpatient reviewer into complex inpatient surgical records will produce findings nobody trusts.

How to Sample and Measure Coding Accuracy

No single published sample size applies to every facility, so sample design is a method choice you should be able to explain. Two common approaches: a random sample sized to give you a reliable picture of overall accuracy, and a targeted sample focused on known risk areas. Random samples tell you how the department is doing. Targeted samples tell you whether a specific problem exists.

Be clear about what you are measuring, because two departments can report very different accuracy rates from the same work. As ICD10monitor explains, code-over-code measurement scores each code reviewed, while case-over-case measurement scores whether the record's final DRG or APC was correct. A record can have the right DRG and still contain coding errors that matter for quality reporting and risk adjustment, so a complete audit reports both.

You will hear 95% cited as the accuracy target. It is a common industry expectation, not a published AHIMA standard, and our post on managed coding services explains why it should be treated as a floor rather than a selling point. Whatever target you set, define it in writing, apply it consistently, and make sure everyone on the team knows how they are being measured.

Finally, the auditor's own work deserves scrutiny. Disagreements between coder and auditor should go through a documented rebuttal process with references to the Official Guidelines and Coding Clinic, not a judgment call. An audit is only as credible as the reviewer behind it.

What the OIG Expects From Auditing and Monitoring

The HHS Office of Inspector General's General Compliance Program Guidance, published in November 2023, is voluntary guidance, but it is the clearest statement of what regulators look for in an effective compliance program. Its auditing and monitoring element calls for audits scheduled according to an annual risk assessment, conducted by internal or external auditors with the right expertise. It names medical record documentation and high-value billing codes among the areas to monitor, and it describes short-term monitoring as a way to confirm that a fix actually worked.

The guidance also expects organizations to find the root cause of a problem so it does not recur, and to promptly repay overpayments once identified. It restates the 60-day window for reporting and returning an identified overpayment. That is a compliance reason to run a coding audit, not a scare tactic: if a problem exists, you want to find it on your schedule, with your reviewers, and with time to act.

The OIG's own audit work shows where coding risk tends to concentrate. In a 2020 review of severe malnutrition coding, the OIG found that 173 of 200 sampled claims were billed incorrectly. In a 2024 review of mechanical ventilation claims, 17 of 250 sampled claims did not comply, with errors including incorrect use of the ventilation-duration code. Both reports used samples to estimate wider overpayments, and both point to the same lesson: specific diagnoses and procedures with clear documentation requirements are where a targeted coding audit pays for itself in risk reduction.

Turning Coding Audit Findings Into Better Coding

An audit report that sits in a shared drive changes nothing. The value is in what happens next.

Look for patterns, not people

Group findings by root cause: a guideline misunderstood, a documentation gap that should go to CDI, an encoder default, a new code nobody trained on. Patterns point to fixes. Individual error counts, used alone, point to blame.

Close the loop with education

Share findings with coders individually and as a team, with the reference behind each correction. The best audit programs treat every finding as a teaching case. Coders who understand why an answer changed are far less likely to repeat the error.

Bring CDI into the conversation

Many coding errors start as documentation problems. When a coding audit shows that the record did not support a code, the fix may belong in provider education or a query, not in coder retraining.

Re-audit to confirm the fix

Schedule a follow-up review on the same risk area after education. That short-term monitoring is exactly what the OIG guidance describes, and it is the only way to know whether accuracy actually improved.

Keep incentives clean

Evaluate coders on accuracy and on how they respond to education, never on the financial direction of audit findings. Accuracy in both directions is the goal: an effective coding audit finds overcoding and undercoding alike, and rewards neither.

When an External Coding Audit Makes Sense

Internal audit capacity is valuable, but it has limits. Internal auditors review colleagues they work beside every day, they may share the same blind spots as the coders they review, and in many departments the auditor role is the first to be pulled back into production when the DNFB climbs.

An external coding audit adds independence, a second interpretation of the guidelines, and reviewers who see many facilities' coding patterns. It is especially useful after a code set update, before or after a payer audit, when onboarding a new coding vendor, and when the internal team simply does not have hours to spare.

At Medovent, auditing is built into how our health information management team works. Our managed model pairs credentialed coders with coding managers and dedicated auditors, so review and education run alongside production rather than competing with it. We also provide audit-only engagements for facilities that want an independent look at a specific area. All of our work is performed by US-based staff. We do not promise a financial outcome from any coding audit, because the purpose is accurate, defensible coding.

This article is educational and is not coding or legal advice. Always confirm coding decisions against the ICD-10-CM and ICD-10-PCS Official Guidelines for Coding and Reporting and AHA Coding Clinic.

Frequently Asked Questions

How often should a hospital run an external coding audit?

There is no single required frequency. The OIG's General Compliance Program Guidance recommends scheduling audits based on an annual risk assessment. A practical approach is at least one external coding audit a year, plus targeted reviews after code set updates, new coder onboarding, system changes, or denial trends.

What's the difference between a pre-bill and a retrospective coding audit?

A pre-bill coding audit reviews records after coding but before the claim is submitted, so errors are corrected before billing. A retrospective coding audit reviews claims already billed, which is better for measuring accuracy over time and testing specific risk areas, but any overpayment found must be addressed.

Is 95% coding accuracy a required standard?

No. A 95% accuracy rate is a common industry expectation, not a published AHIMA standard. Define your target in writing, specify whether you measure code-over-code or case-over-case accuracy, and apply it consistently.

What should we do with coding audit findings?

Group findings by root cause, educate coders with the reference behind each correction, route documentation problems to CDI, address any identified overpayments promptly, and re-audit the same area to confirm the fix worked.