NEMT Medicaid Audit Checklist: What Auditors Actually Look For

A Medicaid or broker audit isn’t usually triggered by a single bad claim. It’s triggered by a pattern: a denial rate that stands out, a documentation gap that shows up across multiple trips, or a routine compliance review that every contracted NEMT operator eventually goes through. Whatever the trigger, the operators who get through an audit cleanly are the ones who already have their documentation organized before the request letter arrives.

How operators end up on the audit list

Audits generally fall into two buckets. Routine audits are scheduled as part of a broker’s or state’s standard oversight cycle, and every contracted operator eventually gets one regardless of performance. Targeted audits are triggered by something in your data or your history: a denial rate meaningfully above your peers, a spike in a specific complaint type, a prior finding that wasn’t fully resolved, or billing volume that grew faster than your documentation practices did. You can’t control when a routine audit lands, but you have real influence over whether you ever end up in the targeted bucket, and that influence comes almost entirely from the same documentation discipline that keeps your day-to-day denial rate low.

Desk audits vs. on-site audits

Not every audit looks the same, and knowing which type you’re facing changes how you prepare. A desk audit is a document review conducted remotely: you receive a request letter listing the trips or time period in scope, and you submit the corresponding documentation by mail, portal upload, or secure file transfer within a set deadline. Most routine oversight audits happen this way, and the entire process can run for weeks without anyone from the broker or state setting foot in your office.

An on-site audit is more involved. An auditor visits your facility, may interview dispatch or billing staff directly, and often wants to see your systems in action rather than just the records they produce, how a trip gets logged from dispatch through completion, how authorizations get checked before a trip runs, where physical or digital files are stored. On-site audits are more common after a serious complaint, a prior finding that wasn’t resolved, or when a desk audit surfaced enough concerns to warrant a closer look. They’re also harder to prepare for retroactively, because an auditor watching your actual workflow will notice if it doesn’t match what your written policy says.

Either format draws from the same underlying documentation, so the preparation described in this guide covers both. The difference is mostly about how much of your operational reality is visible on top of your paperwork.

What auditors typically review

Trip-level documentation. For a sample of trips, auditors will ask for proof the trip happened as billed: pickup and drop-off timestamps, addresses, mileage, and driver identification. Gaps here are the single most common finding in NEMT audits, and they’re almost always a documentation problem, not evidence the trip didn’t occur.

Prior authorization records. Auditors will cross-reference billed trips against authorization records to confirm each trip was actually authorized for the dates, addresses, and service level billed. A trip billed outside its authorized parameters, even by one day or one address, is a standard audit finding.

Rider eligibility at time of service. Auditors verify that the rider was Medicaid-eligible on the actual date of service, not just at some point during the billing period. This is one of the fastest checks an auditor runs, and one of the easiest to fail if your eligibility verification isn’t happening close to the trip date.

Driver credentialing and vehicle compliance. Depending on the state and broker, auditors may request proof of driver background checks, licensing, and required training, along with vehicle inspection and insurance records. These are often requested as a batch, not per trip, so incomplete files are usually a systemic gap rather than a one-off.

Service level justification. For wheelchair or stretcher-level trips, auditors look for documentation supporting why that service level was medically necessary, not just that it was billed. A pattern of higher-level trips without supporting documentation is a common audit flag.

Mileage and trip-time consistency. Where GPS or telematics data exists, auditors increasingly compare it against billed mileage and trip duration. A pattern of billed mileage that doesn’t reasonably match the pickup-to-drop-off distance is now one of the easier findings for an auditor to generate, since it doesn’t require pulling paper records at all.

Why the sample matters more than it seems

Most Medicaid and broker audits don’t review every trip you billed in the audit period, they review a sample. That matters because of how findings usually get applied: if an auditor finds a documentation or billing error rate in the sample, that error rate is often extrapolated across your full trip volume for the audited period, not just charged back on the specific trips reviewed. A handful of bad trips in a sample of fifty can translate into a repayment demand calculated against thousands of trips. This is exactly why “most of our trips were fine” isn’t a defense that holds up. The sample is meant to be representative, and if it finds a systemic gap, the state or broker will typically treat it as systemic.

What happens after a finding

An audit with findings usually doesn’t end with a bill. Most programs require a corrective action plan (CAP): a written response describing what caused the gap and what you’re changing so it doesn’t recur, submitted within a set window after the findings letter. Alongside the CAP, you may face a repayment demand for the specific claims in question, or an extrapolated repayment if the sampling method applies. Repeated findings, or a CAP that isn’t followed through on, is what typically escalates a routine compliance issue into contract review or termination. Treating the CAP as a real operational change, not a paperwork exercise, is usually what determines whether a finding stays a one-time event or becomes the reason you lose a contract.

The cost usually extends past the repayment itself. A repayment demand is the most visible line item, but it’s rarely the only cost. There’s the staff time spent pulling records, writing the CAP, and managing the back-and-forth, which is time your billing team isn’t spending on current claims. There’s the cash flow impact of an unplanned repayment landing in the middle of normal operations. And there’s the standing impact on your relationship with the broker or state: a contract that’s already flagged for one finding gets scrutinized more closely on the next one, which is how a single audit turns into an ongoing pattern of closer oversight.

Building an audit-ready file before you’re asked for one

Keep trip documentation centralized, not scattered across drivers’ paper logs. If pulling documentation for a single trip requires tracking down a specific driver’s paper trip sheet, you are not audit-ready. Centralize trip records as they’re generated, not after an audit request arrives.

Match authorizations to claims as a standing process, not a one-time check. The same authorization-matching discipline that prevents denials is what makes an audit response fast. If you’re already verifying authorization coverage before every submission, most of the audit response work is already done.

Retain records for the full required window. Most state Medicaid programs require documentation retention well beyond the claim payment date, often several years. Confirm your state’s specific retention requirement and make sure your recordkeeping, not just your billing software, actually covers that window.

Run your own periodic internal spot-check. Pull a random sample of trips each month and confirm the full documentation chain exists: authorization, trip completion record, eligibility verification, and service level justification where applicable. Operators who do this catch gaps before an auditor does.

Assign a single owner for audit readiness. Documentation gaps tend to multiply when the responsibility for “make sure this trip is fully documented” is implicitly everyone’s job. Naming one person or role accountable for closing gaps, even if the underlying work is distributed across dispatch and billing, is what keeps the standing process from quietly lapsing once the person who set it up gets busy.

Treat a mock audit like a fire drill. Once or twice a year, pull a real sample the way an auditor would, request the full file for each trip within a tight internal deadline, and see how long it actually takes and what’s missing. The gaps a mock audit surfaces are almost always the same gaps a real auditor would find, but on your timeline instead of theirs.

Frequently asked questions

How often are NEMT operators audited? There’s no universal schedule. Routine oversight audits typically recur on a cycle set by the broker’s or state’s contract terms, often annually or every few years, while targeted audits can happen any time something in your data draws attention. Operators with a clean history and a stable denial rate tend to see fewer targeted audits, even where the routine cycle is fixed.

What’s the difference between a broker audit and a state Medicaid audit? A broker audit is conducted by the managed care organization or NEMT broker you’re contracted with, as part of their oversight of their provider network. A state Medicaid audit is conducted by the state agency itself, sometimes directly and sometimes through a contracted program integrity vendor. You can be contracted with multiple brokers and the state simultaneously, which means the same underlying documentation may need to satisfy more than one auditor with different specific requirements.

Can I appeal an audit finding? Most programs have a formal appeal or reconsideration process, with its own deadline and documentation requirements, separate from a standard claim appeal. If you believe a finding is wrong, for example the documentation existed but wasn’t provided in time, or the sample was applied incorrectly, that process is worth using. It’s a distinct process from a claim-level denial appeal, so don’t assume the same steps apply.

How long should I keep trip records? Retention requirements vary by state and by contract, and are commonly several years past the date of payment. Check your specific state Medicaid program and each broker contract for their stated minimum, and set your retention policy to the longest of the requirements that apply to you, not the shortest.

What happens if I fail an audit? “Failing” usually means the audit produced findings serious or frequent enough to trigger a corrective action plan and a repayment demand. A single audit with findings, promptly corrected, is a normal part of operating in this space and not usually contract-ending on its own. What tends to escalate things is a pattern: repeated findings on the same issue, or a CAP that wasn’t actually implemented, which signals to the broker or state that the underlying problem hasn’t been fixed.

The pattern behind most audit findings

Almost every recurring audit finding traces back to the same root cause: documentation that exists somewhere, but isn’t organized, centralized, or verified as a standing process. Auditors aren’t typically looking for evidence of intentional fraud. They’re looking for whether your documentation supports the claims you submitted, and most operators who fail an audit had the underlying trips happen exactly as billed. They just couldn’t prove it fast enough.

Clean, centralized documentation isn’t just an audit safeguard. It’s the same discipline that keeps your day-to-day denial rate down. If you want to see what a lower denial rate could mean for your fleet’s revenue, try our NEMT revenue calculator.