A retrospective audit is a formal review of transactions that have already been completed and paid, conducted to find errors, calculate overpayments, and recover money. It shows up most often in three places: healthcare billing, IRS tax examinations, and commercial insurance premium reconciliations. The auditor works backward from finalized records, and the financial exposure can be severe. Medicare auditors can extrapolate a small sample of billing errors across an entire claims history. The IRS can stack penalties of 20% to 75% on top of any unpaid tax it discovers.
What Makes an Audit Retrospective
Timing. A prospective audit happens before a transaction goes through, like an insurer requiring pre-authorization before approving surgery. A concurrent audit runs while activity is still underway, such as a utilization reviewer checking whether a hospital stay remains medically necessary. A retrospective audit only starts after the money has changed hands.
That distinction changes what the audit can do. Prospective and concurrent reviews exist to prevent errors. A retrospective audit exists to find errors that already happened and put a dollar amount on them. The auditor works from finalized documentation — medical charts, tax returns, payroll ledgers — hunting for mismatches between what was paid and what the rules required.
Where Retrospective Audits Show Up
Healthcare Claims
Medicare, Medicaid, and private insurers use retrospective audits as their main tool for verifying that providers billed correctly. Auditors pull patient charts, physician notes, and the claims, then check whether the procedure and diagnosis codes match what the documentation supports. Common findings include billing for a higher-complexity service than the record justifies (upcoding), charging separately for procedures that should have been billed as a single bundled service (unbundling), and claims where the chart lacks the documentation needed to support medical necessity.
Providers who find their own billing errors have an independent obligation to report and return the overpayment to their Medicare Administrative Contractor within 60 days of discovering it, with a lookback covering the prior six years.1Centers for Medicare & Medicaid Services. Medicare Overpayments Fact Sheet Failing to return a known overpayment can turn a billing mistake into a fraud allegation.
Federal Tax Examinations
The IRS calls its retrospective audits examinations. Not every return gets equal scrutiny. The IRS runs each return through a computer scoring system called the Discriminant Function System, which assigns a numeric score based on the return’s likelihood of containing errors worth pursuing.2Internal Revenue Service. The Examination (Audit) Process
The general statute of limitations gives the IRS three years from the date a return was filed (or its due date, whichever is later) to assess additional tax. That window expands to six years if a taxpayer omits gross income exceeding 25% of what was reported.3Office of the Law Revision Counsel. 26 U.S. Code 6501 – Limitations on Assessment and Collection If no return was filed at all, or if the return was fraudulent, there is no time limit.
Commercial Insurance Premiums
Businesses with Workers’ Compensation or General Liability policies face a different kind of retrospective audit. These policies are initially priced using an estimate of payroll and employee job classifications, since the insurer cannot know the actual exposure until the policy period ends. Once the policy expires, usually within 60 days, the insurer conducts a premium audit against the estimates.
The auditor reviews payroll records, quarterly federal tax returns, state unemployment filings, certificates of insurance for subcontractors, and W-2 and 1099 forms. If the actual payroll was higher than the estimate, or workers performed duties in a higher-risk classification than reported, the business receives an additional premium bill. If exposure was lower, the insurer issues a refund. One common surprise: if a business hired subcontractors who lacked their own workers’ compensation coverage, the insurer folds the payments to those subcontractors into the payroll calculation and charges premium on them.
How the Process Runs
Regardless of industry, retrospective audits follow a similar sequence. The auditor first defines the scope — the time period under review and the categories of transactions to be examined. High-risk areas get prioritized. In a tax examination, the IRS identifies specific line items most likely to contain errors. In a healthcare audit, the contractor might focus on a procedure code the provider bills at an unusually high rate.
Then comes a formal request for documentation. For a tax audit, that means receipts, bank statements, and supporting schedules. For a healthcare audit, patient charts and clinical records for specific dates of service. For an insurance premium audit, payroll records and tax filings covering the policy period. The audited party generally has 30 to 45 days to produce what was asked for.
Once the documentation arrives, the auditor compares it against the applicable rules: tax code provisions, payer billing policies, or insurance classification guidelines. Each discrepancy gets categorized and documented. The auditor then compiles a preliminary report identifying the errors, explaining why each is noncompliant, and calculating the financial impact.
How Sampling and Extrapolation Multiply the Damage
Healthcare retrospective audits work differently from other types in a way that catches many providers off guard. Rather than reviewing every claim submitted over a multi-year period, Medicare auditors review a statistical sample — often just a few dozen claims. They then project the error rate from that sample across the entire universe of claims the provider submitted during the audit period.
Federal rules require that before using extrapolation, the auditor must first determine there was a sustained or high level of payment error, or that educational outreach already failed to correct the problem.4Centers for Medicare & Medicaid Services. Medicare Program Integrity Manual Chapter 8 Once that threshold is met, the auditor selects a sample using accepted statistical methods, reviews each sampled claim for overpayment, and calculates an estimated total for the entire population.
CMS policy requires auditors to demand the lower limit of a one-sided 90% confidence interval rather than the point estimate.4Centers for Medicare & Medicaid Services. Medicare Program Integrity Manual Chapter 8 In plain terms, the demanded amount is statistically likely to be less than the actual overpayment. Even so, the methodology can turn a handful of documented errors worth a few thousand dollars into a demand in the hundreds of thousands. Challenging the statistical validity of the sample design is one of the most common and effective grounds for appeal.
The Financial Consequences
Recoupment
The most immediate consequence of a negative finding is recoupment: the payer takes back money it already paid. In Medicare, the contractor offsets the overpayment against future claim payments owed to the provider.1Centers for Medicare & Medicaid Services. Medicare Overpayments Fact Sheet That offset can start within days of the demand letter unless the provider files a redetermination request within 30 calendar days.5Noridian Medicare. Appealing Demand Letters Missing that 30-day window is one of the most expensive procedural mistakes a provider can make. The overpayment starts getting deducted from incoming payments while the appeal grinds forward.
For tax examinations, recoupment takes the form of an additional tax assessment. The IRS sends a notice showing proposed changes and the amount owed, including interest calculated from the original due date of the return.
Penalties on Top
Repaying the overpayment is often just the start. The IRS imposes an accuracy-related penalty of 20% of the underpayment when errors stem from negligence or a substantial understatement of income tax. For individuals, a substantial understatement means the tax was understated by more than 10% of the correct tax or $5,000, whichever is greater.6Internal Revenue Service. Accuracy-Related Penalty If the IRS establishes that any portion of the underpayment was due to fraud, the penalty jumps to 75% of the fraudulent portion, and the IRS treats the entire underpayment as fraudulent unless the taxpayer can prove otherwise.7Office of the Law Revision Counsel. 26 U.S. Code 6663 – Imposition of Fraud Penalty
Healthcare providers face wider consequences. Under the False Claims Act, knowingly submitting false claims to a federal healthcare program exposes the provider to treble damages plus per-claim penalties adjusted annually for inflation. Beyond dollars, CMS can revoke a provider’s Medicare billing privileges entirely, with a re-enrollment bar lasting one to ten years, or up to 20 years for a second revocation.8Centers for Medicare & Medicaid Services. Medicare Provider Enrollment Compliance A provider revoked from Medicare also gets terminated from state Medicaid programs through mandatory cross-termination.
How to Dispute the Findings
Medicare Appeals
Medicare has a five-level appeals structure. The first level, a redetermination, is an independent review conducted by the Medicare Administrative Contractor. The provider has 120 days from the demand letter to file, but filing within 30 days is what stops recoupment from starting.5Noridian Medicare. Appealing Demand Letters
If the redetermination goes against the provider, the second level is a reconsideration by a Qualified Independent Contractor, organizationally separate from the MAC that made the original decision. The third level is a hearing before an Administrative Law Judge at the Office of Medicare Hearings and Appeals. A provider has 60 days from the reconsideration decision to request this hearing, and the amount in controversy must be at least $200 for claims in calendar year 2026.9Centers for Medicare & Medicaid Services. Third Level of Appeal: Decision by Office of Medicare Hearings and Appeals The ALJ hearing is the first stage where the provider can present testimony and cross-examine witnesses, and it is where many extrapolation-based demands get reduced or overturned.
IRS Appeals
After an IRS examination, the auditor sends a report (Form 4549) showing proposed changes. The taxpayer gets a 30-day letter with the chance to agree, provide additional documentation, or request a conference with the examiner’s manager.10IRS Taxpayer Advocate Service. Audit Report Letter Giving Taxpayer 30 Days to Respond If that does not resolve the dispute, the taxpayer can request a hearing with the IRS Independent Office of Appeals by filing a written protest.11Internal Revenue Service. Preparing a Request for Appeals
If Appeals fails to produce an agreement, the IRS issues a Notice of Deficiency, sometimes called a 90-day letter, which gives the taxpayer 90 days (150 days if the notice is addressed outside the United States) to petition the U.S. Tax Court.10IRS Taxpayer Advocate Service. Audit Report Letter Giving Taxpayer 30 Days to Respond Filing a Tax Court petition is the last chance to dispute the assessment before it becomes legally enforceable. Ignore the 90-day window and the IRS assesses the tax and begins collection.
Record Retention as Your Defense
The single most useful thing you can do to survive a retrospective audit is keep records long enough for them to still exist when the audit arrives. Retention periods vary by context, and the safest approach is to follow the longest applicable requirement.
For federal tax purposes, the IRS recommends the following minimums:
- Three years for records supporting income, deductions, and credits on a tax return.
- Six years if you failed to report income exceeding 25% of the gross income shown on your return.
- Seven years if you claimed a deduction for worthless securities or bad debt.
- Four years for employment tax records, measured from the date the tax was due or paid, whichever is later.
- Indefinitely if no return was filed or if the return was fraudulent.
Property records should be kept until the statute of limitations runs out for the tax year in which you sell or dispose of the property, since the IRS needs to verify your cost basis to calculate gain or loss.12Internal Revenue Service. How Long Should I Keep Records
Healthcare providers participating in Medicare must retain medical records for at least five years.13eCFR. 42 CFR 482.24 – Condition of Participation: Medical Record Services HIPAA separately requires covered entities to keep compliance documentation for six years. Since the Medicare overpayment lookback period also covers six years, providers who want to be able to defend old claims should treat six years as the practical floor.1Centers for Medicare & Medicaid Services. Medicare Overpayments Fact Sheet State laws may require longer retention, so checking your state’s rules is worth the effort.
When the Notice Arrives
Verify the notice is legitimate first. Confirm the sender, return address, and any case or reference numbers before responding. Phishing schemes impersonating government agencies and insurers are common enough that this step alone prevents costly mistakes.
Read the notice carefully to identify exactly what records are being requested and for which time period. Gather only what the auditor asked for. Volunteering extra information beyond the scope of the request creates risk without benefit. If you need more time, call the contact number on the notice before the deadline expires. Both the IRS and Medicare contractors will generally grant reasonable extensions when asked in advance.
For IRS examinations, you have the right to representation by an attorney, CPA, or enrolled agent at any point in the process. For Medicare audits, particularly those involving extrapolation, engaging a healthcare attorney or coding specialist before submitting your response is often the difference between a manageable outcome and a catastrophic one. The statistical methodology, the sample frame, and the universe definition are all challengeable, but only if someone on your side knows how to identify the flaws.
Whatever the industry, do not ignore a demand letter. Silence triggers the worst default outcome: the IRS assesses the full proposed adjustment, Medicare begins offsetting future payments, or the insurer calculates your premium using the highest available exposure estimates. Engaging with the process, even just to negotiate a payment plan, almost always produces a better result than doing nothing.