Module 2: Internal Controls & Payment Posting Integrity

Collecting the money is half the job. Making sure it's recorded accurately — and that no single person controls the whole process from start to finish — is the other half. This module is about the systems that protect the revenue you've already worked hard to earn.

Internal controls are the policies and procedures a practice puts in place to get reasonable assurance that a few key things are true: operations run efficiently, money is handled responsibly, financial reporting is accurate, and the practice stays compliant with payer rules and regulations.

The size of your controls should match the size of your risk. A solo practice with one biller needs a different setup than a multi-location clinic — but every practice needs some structure. Controls aren't about distrust. They're about making sure honest mistakes get caught early, before they become expensive ones.

The single most important internal control in the revenue cycle is simple: no one person should control an entire transaction from beginning to end. If the same person submits the charge, posts the payment, approves the adjustment, and follows up on the account, there is no second set of eyes anywhere in that chain — and errors or fraud can go unnoticed for months.

Posting looks like a simple data-entry task, but it drives almost every number leadership relies on — accounts receivable, net collection rate, and revenue reports. A posting shortcut that seems harmless in the moment can quietly distort all three.

Here's the pattern: a payer pays less than the contracted allowed amount, and instead of investigating why, an employee adjusts off the entire remaining balance as a "contractual adjustment" to make the account look closed. The account looks clean. But the practice just gave away money it was owed, the net collection rate now looks artificially high, and nobody flagged the underpayment with the payer. Multiply that across a few accounts a month, and it adds up to real, permanent revenue loss — the kind that never shows up on anyone's radar because the accounts look "resolved."

The fix isn't more speed. It's a habit: when a payment doesn't match the expected allowed amount, that's a flag to investigate before adjusting, not a reason to close the account faster.

• A patient says they paid at check-in, but the statement still shows a balance due.
• Write-offs are happening regularly with no manager review or dollar threshold.
• One employee handles deposits, posting, and account follow-up for the same accounts with no overlap from anyone else.
• Bank reconciliation hasn't happened in over a month, or is done by the same person who posts payments.
• An account shows a credit balance that no one has investigated or refunded.

None of these automatically mean something is wrong. They mean it's worth a second look.

• No single employee handles cash receipt, posting, and deposit completion alone.
• Payment posting and balance write-offs are not approved by the same person without review.
• Write-offs above a set dollar amount require manager sign-off.
• Bank reconciliation happens at least monthly, by someone independent of daily posting.
• Patient complaints about "already paid" balances get investigated, not just adjusted away.

Content developed by Continuity Practice Partners, informed by the MGMA Physician Billing Process, 3rd Edition.