SNF Financial Audit Readiness and Medicaid Compliance Preparation

Research cited by the University of Pennsylvania's LDI finds that Medicaid pays for two out of every three dollars that flow into nursing home operations. That single fact explains why the reconciliation bill passed in mid-2025, which cuts hundreds of billions from Medicaid with the bulk of the impact phasing in starting January 2027, matters so much to skilled nursing finance teams right now. The FY 2026 SNF PPS Final Rule (CMS-1827-F, issued July 31, 2025) nets a $1.16 billion aggregate payment increase but claws back an estimated $208.36 million through a value-based payment adjustment program for skilled nursing facilities, and layering that on top narrows the margin for error on audit exposure fast. A university-based public health study already flagged 579 nursing homes. nursing homes as high-risk for closure under the Medicaid changes tied to the One Big Beautiful Bill Act.

In that kind of environment, an audit finding that triggers a payment reduction or recoupment isn't a paperwork headache. A facility that holds on and one that closes can hinge on that audit finding. There's some operational breathing room from the staffing mandate moratorium included in the same bill, but that relief doesn't touch declining Medicaid revenue. Facilities dependent on Medicaid census face compounding pressure regardless of what happens with staffing ratios. That's the backdrop against which the audit apparatus described below becomes consequential in a way it simply wouldn't in a stable reimbursement year.

What CMS and OIG are auditing in 2026 and what triggers selection

CMS runs its MDS Validation Audit Program on a random selection basis, pulling up to 1,500 SNFs a year. Healthcare Management Solutions, LLC holds the contractor role, and reporting from Blue & Co. shows notifications land in a facility's iQIES Provider Preview Reports folder, not in anyone's email inbox. and SMK Medical. Any SNF that submitted at least one MDS assessment in the prior calendar year and one in the current fiscal year is eligible. There's no risk-scoring formula that exempts a facility with a clean history. Selection is random, so being audited says nothing, by itself, about whether a facility did anything wrong.

What the audit actually checks is whether the MDS-based quality measures feeding into VBP and the Quality Reporting Program match the medical chart. CMS cross-references MDS coding against the underlying documentation, and any gap between what got coded and what the chart supports becomes the finding.

A separate compliance track runs alongside this. Facilities had until September 4, 2026 to file a reconsideration request. There's no second bite if that window is missed.

Then there's the Risk-Based Survey process, which CMS is rolling out nationwide for qualifying nursing homes starting September 8, 2026. That's a survey mechanism, distinct from the MDS Validation Audit, but it adds another layer of scrutiny operating on its own schedule.

OIG's active workplan gives a clearer picture of where financial attention is concentrated: skilled nursing reimbursement accuracy, Medicare Part B services billed during a Part A stay, supplemental Medicaid payments, and SNF financial responsibility for Part D medications during Part A stays. On the clinical side, falls with injury and antipsychotic medication prevalence have also drawn ongoing regulatory attention. None of this is speculative; it's published, and it's the roadmap OIG is working from.

The OIG's Nursing Facility Industry Segment Specific Program Guidance, published in November 2024, matters here too. It follows the 2023 General Compliance Program Guidance, and while it isn't mandatory on its own, the Requirements of Participation, which are mandatory, are modeled on the same compliance framework OIG describes. So the guidance functions as a preview of what regulators expect, even where it doesn't carry direct legal force.

A January 2025 OIG report found that CMS doesn't currently review Medicare cost reports for related-party compliance at all, even though facilities pay out roughly 40% of revenues to related parties. OIG flagged this as a forward-looking priority. That's a polite way of saying the scrutiny that hasn't existed is coming, and facilities with related-party arrangements that haven't been documented carefully are sitting on exposure nobody has tested yet.

The CMS-2540-24 cost report redesign's new tracking requirements for SNFs

The Medicare Cost Report used by SNFs just went through a significant redesign. CMS-2540-24 applies to reporting periods ending on or after September 30, 2025. Facilities aren't preparing for this, they're already inside it.

The core shift, according to Zimmet Healthcare Services Group experts cited in Skilled Nursing News, is that CMS-2540-24 no longer lets facilities lean on RUGs-based proxies to represent PDPM costs. It wants auditable reporting tied to actual costs, actual staffing, and actual services delivered. That's a meaningful jump in granularity, and it changes what a finance team needs to have on file day to day, not just at filing time.

The new form asks for expanded ownership reporting, with more detail on related-party transactions and ownership interests than the old form required. It wants agency and contract labor tracked as a separate line item from employee labor, not blended together the way many facilities have handled it historically. It wants facility characteristics like bed count and occupancy rate. And it wants payer utilization broken out clearly between Medicare Advantage and Medicaid managed care, rather than lumped into broader categories.

Why does this raise audit risk rather than just administrative burden? Because the added granularity makes discrepancies visible. A gap between what's on the cost report and what's in the general ledger or payroll system used to hide inside vaguer reporting categories. Under CMS-2540-24, that gap has fewer places to hide, and an auditor doesn't need to dig particularly hard to spot a mismatch between reported agency labor and payroll records.

State Medicaid cost reports run on their own parallel track, with deadlines set by each state's program requirements. That's a separate filing obligation, with its own deadlines and its own audit pipeline, and it doesn't pause because the federal form is going through a redesign.

Michigan's experience offers a useful, concrete look at what these pipelines look like in practice. A state health department's 2025 Annual Report shows 495 cost reports accepted for FY 2023, taking an average of 28 days to accept, and 483 accepted for FY 2024, also averaging 28 days. Audits of all 473 FY 2022 cost reports were completed, but 64 of them ran past the state's 21-month completion window. That backlog detail matters: it shows facilities can carry audit exposure across multiple fiscal years at once, with older cost reports still working their way through review long after the facility has moved on to filing the next year's numbers.

Why MDS documentation accuracy now drives both reimbursement and audit outcomes simultaneously

CMS finalized version 1.20.11 of the MDS 3.0 RAI User's Manual on September 17, 2026, effective October 1, 2026. That's now the operative standard for every SNF QRP assessment, and any internal coding guide or cheat sheet still referencing an earlier version needs to be retired. The SNF QRP Measure Calculations and Reporting User's Manual, version 8.0, followed close behind, released September 11, 2026, with updated specifications also effective October 1, 2026. Finance and compliance teams need to confirm their internal reporting logic matches V8.0 methodology specifically, not whatever version was current when someone last built the tracking spreadsheet.

The Validation Audit itself centers on a 10-record review. A selected facility has 45 calendar days from notification to submit 10 MDS assessment records as PDFs. The review focuses on Section GG functional scoring and the therapy notes that back it up, ARD dates and the clinical justification behind them, diagnosis coding aligned to PDPM clinical categories, and the underlying quality measure data points. There's a naming convention requirement (CCN_Validation ID), a prohibition on including Social Security numbers, and a rule against submitting documentation outside the requested date range. Get any of that wrong procedurally, and the submission can be invalidated regardless of whether the underlying clinical documentation was solid.

Missing the deadline, or failing the review, results in a 2-percentage-point reduction to the Annual Payment Update for FY 2027. That penalty stacks on top of whatever a facility is already losing through VBP withholding, which pulls 2% of Medicare fee-for-service Part A payments and redistributes it based on quality performance. New measures phasing into VBP for FY 2026 and beyond include staffing levels, healthcare-associated infections, falls with injury, discharge function scores, and successful community discharge rates. So the measures determining payment and the measures determining audit exposure are increasingly the same measures, drawn from the same MDS data.

That's the point worth sitting with: MDS coding that doesn't match the chart is the exact mechanism CMS uses to catch miscoded PDPM categories and inflated quality scores. It's the exact mechanism CMS uses to catch miscoded PDPM categories and inflated quality scores, and both of those feed directly into reimbursement and into what gets published for the public to see. CMS has added web-based training to help close this gap, including a Chapter 2 course on Assessment Types and Timing and an APU Compliance Essentials course, both available through the SNF QRP Training webpage as of August 2026.

Building internal controls and monitoring routines that catch problems before auditors do

The Requirements of Participation make OIG's seven compliance program elements mandatory, and they're a useful structural checklist for any facility building out internal controls: compliance policies and a designated compliance officer, staff training on compliance requirements, ongoing auditing and monitoring of billing practices and overpayment rates, a process for reassessing the compliance program as risks and regulations shift, quality-of-care oversight through active care planning, policies aimed at preventing abuse and neglect, and consistent enforcement when violations happen.

OIG has been direct that a compliance manual sitting in a binder on a shelf doesn't satisfy any of this. The seven elements have to actually run.

Blue & Co. recommends quarterly MDS mock audits as a core practice, and the logic is straightforward: pull the same kind of documentation CMS's Validation Audit would request, and review it internally before CMS ever asks. Gaps appear on a facility's own timeline, with room to fix them, rather than appearing during the 45-day response window with a penalty already looming.

Somebody at each facility needs to own the iQIES Provider Preview Report specifically, checking it regularly for audit notifications. Since those notices don't arrive by email, a facility that isn't watching the portal can miss the notification entirely and burn through the 45-day window without realizing an audit was underway. That's an automatic non-compliance finding for a reason that has nothing to do with clinical quality.

QRP Provider Preview Reports updated as of July 15, 2026 give facilities a look at the performance scores headed for the October 2026 Medicare.gov refresh. That window, between the preview update and the public refresh, is the last chance to catch and dispute inaccurate data before it's visible to families, referral sources, and anyone else comparing facilities online.

On the cost report side, practitioners point to a handful of concrete habits: track data by department and payer type year-round rather than reconstructing it at filing time, align internal cost tracking with PDPM reporting categories, keep agency labor separate from employee labor as its own line, run a pre-submission review before anything goes out the door, and file electronically through the MCReF portal.

Related-party transactions deserve specific attention given where OIG has pointed its January 2025 report and where CMS-2540-24 has expanded its ownership disclosure requirements. Facilities with related-party arrangements should document the business basis for those transactions and confirm they're disclosed correctly on the cost report. This is a gap that's gone largely unexamined by CMS historically. That history is exactly why it's now a named target.

Where external audit and advisory relationships reduce residual risk SNF teams can't fully manage internally

The case for outside audit help here is structural, tied to specific requirements that didn't exist in this form before. It's structural, tied to specific requirements that didn't exist in this form before. The cost report's expanded related-party and ownership reporting requirements, PDPM-aligned cost categorization, and payer-specific utilization reporting all call for auditors who understand how SNF reimbursement methodology actually maps onto financial statement presentation. A generalist audit background doesn't transfer cleanly into that intersection, and the gap appears exactly where it hurts most: in the cost report line items regulators are now watching most closely.

OIG's industry-specific guidance and its active nursing home workplan items together signal that government reviewers treat SNF compliance as a continuous enforcement priority now, not a periodic check-in. That shifts the practical standard for what counts as a defensible compliance program, because the standard is effectively being written by the same regulators actively pursuing enforcement action.

Financial statement audits for SNFs increasingly have to treat certain items as material on their own terms: CMS-2540-24 transition adjustments, related-party transaction disclosures, and VBP performance-based payment structures. Each of those needs an auditor who's actually worked inside SNF-specific accounting, not applied a generic healthcare audit template and hoped it fit.

There's a business development angle too. The Transforming Episode Accountability Model launched January 1, 2026, covering five surgical episode types across 741 participating hospitals. For SNFs sitting in the relevant core-based statistical areas, being able to demonstrate strong compliance and clean quality documentation makes a facility a more attractive discharge partner for those hospitals. Audit readiness now functions as a referral advantage rather than purely a defensive exercise.

What should a facility look for in an external audit partner? Demonstrated hands-on experience with SNF Medicare cost reports, including direct work with the CMS-2540-24 transition, familiarity with the specific risk areas OIG's industry guidance names, and the ability to advise on related-party documentation rather than just signing off on a set of numbers at year-end. Firms with dedicated skilled nursing and healthcare audit practices bring a kind of sector fluency that a general practice audit simply doesn't carry, and that fluency is what catches a cost classification problem or a staffing documentation gap before it turns into a finding with a dollar figure attached.

None of this works as a sprint in the weeks before an auditor shows up. Audit readiness, in the environment described across every section here, is a year-round discipline, built into how a facility tracks labor costs, codes an MDS assessment, and documents a related-party lease. The facilities best positioned for whatever the 2026 audit cycle brings are the ones that started treating it that way back in FY 2025, when CMS-2540-24 first took effect.