The One Audit Question Most Practices Cannot Answer
Most practices believe they are prepared for a CMS audit. They have policies on file. They can produce reports. They trust that their EHR and reporting vendors are doing what they are supposed to do.
Then the audit question arrives.
It is not dramatic. It is not complex. It does not ask for intent or effort. It asks for something far more basic and far more revealing.
Show us how this measure was met.
For many practices, this is where confidence breaks down. Not because care was not delivered, but because no one can clearly demonstrate how the care moved from the encounter to the score. The audit does not fail on clinical grounds. It fails on traceability.
This is the gap that quietly undermines MIPS, APP Plus, and ACO performance every year.
The Question CMS Is Really Asking
CMS audits are often misunderstood. Practices prepare for them as if they are clinical reviews or documentation spot checks. They are neither.
CMS audits are evidence reviews. At their core, auditors are asking one question repeatedly, across different measures and performance categories.
Can you trace this score back to the care that was delivered, step by step, without inference?
That question applies regardless of specialty, reporting pathway, or care setting. It applies to in-person care and virtual care alike. It applies to quality measures, Promoting Interoperability, and improvement activities.
Most practices cannot answer it cleanly.
Why This Question Is So Difficult to Answer
The difficulty does not come from lack of effort. It comes from how healthcare workflows evolved. Care delivery, documentation, reporting, and submission often live in different operational silos. Each silo functions well enough on its own. Together, they create gaps that only become apparent during an audit.
Below are the most common reasons practices struggle to answer the audit question.
Breakdown Point One: The Encounter Is Treated as the Finish Line
Many workflows treat the completed visit as the end of the process. Notes are signed. Orders are placed. The day moves on.
From a reporting perspective, the encounter is only the beginning.
CMS scoring requires that specific actions occurred, that they were documented in a specific way, and that the documentation can be extracted and validated. If no one verifies that those requirements were met after the visit, the encounter may never qualify as performance.
Action you should take now:
Identify which encounters actually trigger measure eligibility. Not every visit does. Build a post-visit check to confirm whether the required elements were captured for reporting purposes.
Breakdown Point Two: Attribution Is Assumed Instead of Monitored
Attribution is often treated as background noise. Patients appear on schedules, so practices assume they count.
Under ACO models and APP Plus, attribution is fluid. It changes based on claims, timing, and beneficiary alignment rules. A patient who appears eligible at the time of the visit may not be attributed when performance is calculated.
Auditors do not accept assumptions. They accept evidence.
Action you should take now:
Implement regular attribution reviews for reportable patients. Monthly is safer than quarterly. If attribution changes, document when and why it occurred.
Breakdown Point Three: Documentation Supports Care but Not Scoring
Clinical documentation is designed to support patient care. Measure documentation is designed to support scoring. These are not the same thing.
Audits fail when documentation lacks required elements, uses unstructured narrative instead of discrete fields, or omits timing details that measure logic depends on. The care may be sound. The evidence is not.
Action you should take now:
Review documentation templates against measure specifications, not clinical standards. If a field is required for scoring, it must be present and structured.
Breakdown Point Four: Follow-Up Lives Outside the Reporting Entity
Many measures depend on actions that occur after the visit. Labs are reviewed later. Medications are adjusted later. Education is delivered later.
In shared care models, those actions may be completed by different teams or organizations. Reporting responsibility often remains with a single entity. CMS does not reconcile shared responsibility. It scores based on reported evidence.
Action you should take now:
Assign a single owner for follow-up completion and documentation for each measure. Shared workflows still require singular accountability.
Breakdown Point Five: Data Cannot Be Reconstructed After the Fact
When audit requests arrive, practices often scramble to recreate performance narratives. They pull screenshots. They assemble notes. They rely on memory and interpretation.
Auditors do not reconstruct. They validate.
If evidence cannot be traced directly from encounter to submission file, the score is vulnerable.
Action you should take now:
Test traceability before submission. Select one reported measure and follow it from patient encounter to submission file. If any step requires explanation instead of evidence, the measure is at risk.
Why APP Plus Raises the Stakes
APP Plus increases audit exposure by consolidating reporting responsibility while increasing complexity.
Specialty providers contribute to measures they do not submit. ACOs submit measures influenced by workflows they do not fully control. Virtual care introduces additional systems and handoffs.
The audit question does not change. The difficulty of answering it does.
Practices that rely on informal understanding or assumed coverage are the most exposed under APP Plus.
What Audit Readiness Actually Looks Like
Audit readiness is not about preparing binders or policies. It is about operational clarity.
Audit-ready practices can answer the following without hesitation:
Which patients counted for this measure
Why they were attributed at the time of scoring
What actions met the measure requirements
Where the evidence lives in the system
How that evidence appeared in the submission file
If any of those answers rely on explanation rather than demonstration, readiness is incomplete.
A Practical Audit Readiness Exercise
This simple exercise reveals more than most readiness assessments.
Choose one measure you plan to report.
Select one patient tied to that measure.
Pull the encounter record.
Identify required measure elements.
Locate each element in the documentation.
Trace how those elements appear in your reporting output.
Confirm they appear correctly in the submission file.
Do not explain gaps. Document them.
This exercise shows you exactly where performance is at risk.
Why Now Is the Right Time to Address This
Mid-year is when audit readiness matters most. There is still time to adjust workflows. Documentation templates can still be updated. Attribution monitoring can still be formalized. Waiting until submission season limits options. Waiting until an audit removes them entirely. Practices that address audit readiness now reduce both risk and stress later.
Here’s the thing
The most dangerous audit failures are not dramatic. They are quiet. They happen when good care cannot be proven with precision. The one audit question most practices cannot answer is not a trick. It reflects how well care, data, and accountability align.
If you can trace your performance from encounter to submission without inference, you are prepared. If you cannot, now is the time to fix it.
Care deserves to count. Evidence makes it possible.
