How to Hire a Coding Auditor: Credentials, Sourcing and Screening

An auditor is a different hire from a coder. Your coders assign codes; a coding auditor reviews the coded work against the documentation, judges whether it was right, and reports the pattern in a form your compliance program can act on. AAPC describes the expertise behind its Certified Professional Medical Auditor credential as reviewing medical records, coding accuracy and documentation practices for compliance — a fair one-line job description for the seat.

Day one, that means three skills. Reading the record and the claim together. Quantifying what the review finds — error patterns by code, payer or provider, not anecdotes. And writing findings that survive being read by the coder, the manager and, if needed, an outside reviewer.

Anchor the audit plan in the risk areas the OIG names. OIG's 1998 compliance guidance for third-party billing companies lists unbundling, upcoding and duplicate billing among the billing risk areas written policies should address — territory an internal audit program works in too.

Scope the seat to your book of business, because the knowledge base changes with it. Professional-fee audits run on CPT and HCPCS knowledge and Medicare's NCCI edits, which CMS updates quarterly. AAPC's inpatient credential, the CIC, centers on ICD-10-CM and ICD-10-PCS coding for hospital inpatient services and MS-DRG assignment rules — the technical core of a facility inpatient audit. Risk adjustment audits carry their own stakes: CMS conducts Risk Adjustment Data Validation (RADV) audits of Medicare Advantage organizations to ensure risk-adjusted payment integrity and accuracy (42 CFR 422.311). Name your setting, specialties and payer mix in the posting so candidates can judge the fit.

One boundary belongs in the job design from the start. OIG's General Compliance Program Guidance says claims reviews and audits should include a review of medical necessity by an appropriately credentialed clinician. A non-clinician auditor can own the coding-accuracy review; the medical-necessity judgment needs the clinician your process pairs them with.

The candidate-side view of the role — training routes, settings and career path — belongs to the career guide on what a coding auditor does.

For an auditor seat, the practical requirement is a coding credential plus demonstrated audit experience — you are buying judgment about other people's coding, not just a certificate. BLS's description of the occupation treats certification as a hiring signal: medical records specialists typically need a postsecondary certificate to enter the occupation, though some qualify with a high school diploma, and certification may be required or preferred. BLS also says employers may prefer to hire certified applicants, or expect applicants to earn certification shortly after being hired.

AAPC's CPMA (Certified Professional Medical Auditor) is the credential aimed at the work: AAPC describes it as validating expertise in reviewing medical records, coding accuracy and documentation practices for compliance.

AHIMA's CCS (Certified Coding Specialist) is the deep-coding line. AHIMA says CCS professionals demonstrate tested skills in data quality and accuracy as well as mastery of coding proficiency, and requires holders to complete CEUs and pay a recertification fee over each two-year certification period — a built-in currency check.

Two more credentials cover the edges of the job. AAPC describes the CDEO as validating outpatient clinical documentation improvement expertise — the one to weight when your audits are mostly about whether the documentation supports the code. And the CPC is the general coding credential: AAPC describes it as validating comprehensive coding knowledge across outpatient and physician services, including ICD-10-CM, CPT and HCPCS Level II, compliance, payer rules and reimbursement.

Phrase the line in your posting as your own qualification — for example, CPMA, CCS or CPC with audit experience preferred — and verify whatever the candidate claims at the issuing body, never from a certificate image. AAPC's online verification tool takes a member ID and last name, or email and last name, and returns the credential, earned date, renewal date and status. AHIMA verifies credentials with the person's last name plus the credential number or AHIMA ID.

Our step-by-step guide to verifying credentials before you hire walks through the AAPC lookup and its use terms.

Verify with the body: credential names, eligibility and renewal rules change. Confirm current CPMA details with AAPC and current CCS details with AHIMA before a requirement reaches your posting.

Look inside first. A senior coder arrives already knowing your systems, documentation habits and payer mix. Pair the move with an audit-focused credential and a trial audit, and screen the internal candidate as hard as an outside one.

Then know the external market. Per BLS, medical records specialists held about 200,700 jobs in 2025 — the occupation coding auditors are counted in, which also includes records staff who do not code. The largest employers were hospitals (28%) and offices of physicians (18%), followed by professional, scientific and technical services (10%), administrative and support services (8%) and management of companies (7%). The occupation spreads across all of these industries, not only provider settings — and the experienced people you want are already working in them.

The pool is not getting deeper on its own. BLS projects employment in the occupation to grow 7.8% from 200,700 in 2025 to 216,300 in 2035, with about 14,000 openings per year on average. The AHIMA-commissioned NORC survey of health information professionals (fielded August 2023, released November 1, 2023) found 66% reporting persistent staffing shortages over the past two years. In that survey, 83% saw unfilled health information positions increase or persist over the past year, and 53% ranked a limited local talent pool among their top-three recruiting issues.

Go where credentialed people already gather. AAPC says its members have access to nearly 400 local chapters that collectively host over 3,000 events per year, with finding or sharing job opportunities listed among the chapter benefits. AHIMA is a federation of state-level Component Associations — CHIA in California and NYHIMA in New York are two.

Post the role where auditors look: our guide to where to post billing and coding jobs compares the channels. And read the coding auditor jobs live on this board before you write yours — competing postings show how other employers describe setting, scope and credential expectations.

Screen the résumé for audit work specifically: years coding in your setting, the code sets and claim types you actually bill, and named audit experience — an internal audit program, an outside audit firm, or payer-side review. Ask candidates to walk one audit they ran: the sample, what it found, and what changed because of it.

Then test the work. AAPC markets Practicode Team Assessments to employers to evaluate candidates and staff with standardized real-world coding cases across 19+ specialties, tracking accuracy and speed. A work sample built from your own de-identified records is the alternative: give every finalist the same short set and ask for findings written the way you would want them filed. Our guide to testing coders before you hire covers the build.

Whatever you use has to meet hiring-law basics: the EEOC says a test you require applicants to take must be necessary and related to the job, and may not exclude people based on protected characteristics.

Reference and background checks carry extra weight here. OIG's 1998 billing-company guidance says that for new employees with discretionary authority over compliance-related decisions, billing companies should conduct a reasonable and prudent background investigation including a reference check, and should require applicants to disclose criminal convictions or exclusion actions. An auditor is that job: their findings can start repayments, re-education and payer attention.

Interview for judgment, not trivia. How does the candidate brief a coder whose pattern they questioned? What do they do when the documentation is ambiguous — assume, or query? When did they last escalate a finding they were not certain about? The answers separate an auditor who can hold the seat from one who held the title.

The seat exists inside a framework the OIG has drawn. OIG's General Compliance Program Guidance, published in November 2023 as voluntary, nonbinding guidance, organizes a compliance program around seven elements, one of which is risk assessment, auditing and monitoring. OIG's 2000 guidance for individual and small group physician practices recommends a baseline audit and then periodic audits at least once a year. As a basic guide, OIG suggests five or more medical records per federal payor or five to ten records per physician — the workload skeleton the hire is there to run.

Screen the hire the way you would any billing or coding employee. OIG says entities should check the LEIE before employing or contracting with individuals and periodically afterward; because OIG updates the list monthly, OIG says screening each month best minimizes potential overpayment and civil monetary penalty liability. OIG's guidance lists monthly screening of the LEIE and state Medicaid exclusion lists among its examples of routine compliance monitoring, and notes many state Medicaid programs keep their own exclusion lists.

The exposure is concrete. OIG states that anyone who hires an individual or entity on the LEIE may be subject to civil monetary penalties. OIG's FAQ adds that the payment ban applies regardless of who submits the claims, and that it covers all administrative and management services the excluded person furnishes.

Know what a finding starts. Under 42 CFR 401.305, a Medicare overpayment must be reported and returned by the later of 60 days after it is identified or the date a cost report is due. The deadline can be suspended up to 180 days while a timely good-faith investigation of related overpayments is under way. The precision of your auditor's documentation is what makes those clocks manageable.

The False Claims Act (31 U.S.C. 3729) defines knowingly to include deliberate ignorance or reckless disregard of the truth, and requires no proof of specific intent to defraud. That is why an audit function that finds and fixes problems matters — and the legal questions around any specific finding belong to your health-care counsel.

Protect the independence of the seat. OIG's guidance recommends that small entities unable to support a compliance officer designate a compliance contact who, whenever possible, is not involved in billing, coding or claim submission. The same logic argues against grading your auditor on the productivity of the coders they audit — the findings have to be free to land where they fall.

Onboarding closes the loop. OIG's 2000 physician-practice guidance recommends at least an annual coding and billing training program for everyone involved in coding and billing, and says new coding and billing staff should be trained as soon as possible and work under an experienced employee until training is complete.

These rules belong to the OIG, CMS and HHS, and they change. Confirm your audit scope, screening workflow and training plan with your compliance advisor or health-care counsel before you rely on them.

All three models can work; they fail differently. In-house keeps the auditor close to the coders whose work they review — and needs a reporting line that protects the findings, per the independence point above. Remote widens the pool past your commute radius. Outsourcing buys experience and an outside perspective, and adds a vendor-oversight problem of its own.

The remote signal comes from the AHIMA/NORC survey: 40% of respondents said their organization increased its number of remote workers while addressing recruitment problems, and 21% named lack of remote or hybrid flexibility as the most impactful driver of turnover. Audit work happens in record systems and spreadsheets, and the survey's remote figures show health information work moving that direction. It carries a security footprint with it: the HIPAA Security Rule's workstation-use and physical-safeguard policies apply to all workstations that access ePHI, home workstations included. Settle equipment, workspace and access policy before the first remote start date.

Outsourcing changes the paperwork more than the duties. If an outside auditor handles your PHI, business-associate rules can come into play — HHS lists billing, claims processing and practice management among the activities that make a vendor a HIPAA business associate when PHI is involved. Have health-care counsel review how the business-associate provisions apply to your audit arrangement before records move.

If the decision spans your whole revenue-cycle team rather than one audit seat, the broader guide to hiring billing and coding staff works the in-house, remote and outsourced question across the billing and coding roles. Whichever model you pick, credential verification and exclusion screening do not change — only who performs them does.

The turnover data that exists is for health information staff overall: in the 2023 AHIMA/NORC survey, compensation was the top driver of turnover. Burnout was ranked the second most impactful driver by 28% of respondents, and 41% in revenue-cycle vendor settings ranked it the top driver. Budget pay against the labeled federal benchmark at the top of this page, and read it for what it is: medical records specialists is the closest available group, and it also includes records staff who do not code.

Pay pressure is measurable on the recruiting side too: local pay constraints ranked among the top-three recruiting issues for 59% of survey respondents, and salaries not competitive with remote jobs elsewhere for 51%. An auditor who can work from anywhere knows what the market pays.

What organizations actually changed when recruiting got hard: 45% increased pay, 40% increased remote workers, 28% increased training opportunities and 22% increased reliance on automation and machine learning. Twenty percent took no action.

Grow the seat. BLS says medical records specialists may advance to health information technologist or medical and health services manager roles after completing a higher certification program or earning a degree in health information technology. An audit seat sits naturally on that ladder — say in writing where it leads next, whether that is coding management or a compliance role.

Fund the credential, not just the hire. AHIMA requires CCS holders to complete CEUs and pay a recertification fee over each two-year certification period. AAPC requires the holders of its credentials — the CPC and most core credentials — to keep an annual membership and earn 36 CEUs every two years. Confirm the terms for the credential your auditor holds, and put the budget line in before renewal season.

Use the auditor's own output as retention. Findings that turn into education and fixed workflows make the job feel productive; findings that vanish into a drawer make it feel futile. OIG's recommendation of at least an annual coding and billing training program gives the feedback loop a calendar slot.

Weigh what an empty seat costs. AHIMA's 2023 survey release says health information understaffing has led to reduced reimbursement, increased claims denials, lowered patient data quality and slower information releases, with notable shortages in revenue cycle management.

Employer information, not coding, billing-compliance, legal or tax advice. The rules named here belong to the OIG, CMS, HHS, the EEOC, BLS, AAPC and AHIMA, and they change. Confirm screening, audit, pay and contracting decisions with the agency or body named, and with health-care counsel where the decision is yours.