SNF Financial Statement Audit Preparation Checklist

A skilled nursing facility audit is not a routine accounting exercise. The financial statements sit at the intersection of Medicare and Medicaid billing rules, cost report obligations, HUD mortgage covenants where a mortgage exists, state licensure requirements, and quality-program data, and any one of those can trigger a finding that a generic accounting checklist would never catch. Florida made this concrete in April 2022, when House Bill 539 was signed into law, bringing nearly 700 licensed nursing facilities into mandatory annual audit territory, many for the first time, effective that July. The standard auditors work toward doesn't bend for any of this: an unqualified opinion means the statements are free of material misstatement and presented in accordance with GAAP, full stop. What changes in the SNF setting is how hard that opinion is to earn, and facilities that treat prep as a scramble in the final weeks tend to pay for it in extended fieldwork, higher fees, and a longer list of findings.

The timeline and planning window that determine whether audit prep succeeds or fails

Deadlines differ by regulatory track, and missing the wrong one carries consequences well beyond an annoyed auditor. Under Florida HB 539, SNFs have 120 days after fiscal year-end to submit audited financials, so a facility with a December 31 year-end is working against an end-of-April deadline. HUD Section 232 borrowers have less room: audited financials are due no later than 90 days after fiscal year-end, meaning March 31 for that same calendar-year filer, and auditors typically need the underlying records well before the deadline to finish fieldwork on time. Miss that window and HUD compliance flags appear, which is a different category of problem than a late state filing.

First-year audits deserve extra caution. A facility going through its first audit under a new mandate, like the roughly 700 Florida SNFs swept in by HB 539, is doing more work than a facility with five years of clean audit history behind it. That makes early engagement with the audit firm not just useful but close to mandatory.

The practical move is to work backward from the submission deadline. Set an internal "books closed" date, set a data-delivery date to the auditors, and build in margin, because reconciliation surprises occur more often than anyone plans for. Facilities that keep up monthly financial statement reviews and rolling account reconciliations year-round aren't doing extra work, they're just spreading out work that other facilities cram into six weeks. And capacity matters on the auditor's side too. Locking in that relationship early in the fiscal year, not in the final weeks before fieldwork, secures both the expertise and the calendar slot.

The core financial documentation a finance team must have ready before fieldwork begins

Before an auditor sets foot in the building, or logs into a shared folder, every required document should already sit in one organized, electronic repository. Paper files and scattered spreadsheets don't just slow fieldwork down, they turn every reconciliation into a hunt.

The required statements are standard: fiscal year-end balance sheet, income statement, statement of cash flows, and statement of retained earnings or changes in equity. Bank reconciliations need to be complete through year-end, with any unreconciled items flagged and explained ahead of fieldwork rather than discovered during it. The same discipline applies beyond cash: deferred revenue, accrued liabilities, prepaid expenses, and any account carrying a material balance should be tied out before auditors ask.

Physical inventory counts need to be finished, recorded, and any variance adjusted in the books before fieldwork starts. Patient and resident receivables deserve particular attention, since this is where auditors tend to dig. An AR aging schedule current as of year-end is table stakes. Beyond that, the facility needs a documented collectibility assessment, because auditors will scrutinize the allowance for doubtful accounts closely. Grassi Advisors noted that most successful SNFs keep AR days outstanding at 60 days or fewer. Numbers well above that threshold signal collection risk, and auditors will probe accordingly. Any account in dispute, pending appeal, or written off needs supporting rationale attached beyond a note that it happened.

Supporting transaction data, invoices, contracts, disbursement records, should be organized and searchable rather than filed by memory. Auditors use prior-year audit workpapers and the management letter as their starting point, so clearing those findings before fieldwork begins is one of the clearest signals of control improvement a facility can send.

Payer-mix and revenue cycle documentation specific to SNF reimbursement

SNF revenue isn't one thing. Medicare Part A under PDPM, Medicaid, Medicare Advantage, Medicaid managed care, and private pay each come with their own recognition rules, rates, and paperwork, and an auditor testing revenue has to test each stream separately.

On the PDPM side, primary diagnosis selections and ICD-10 code mapping need to reflect the version current as of October 1, 2025, when 34 ICD-10 mapping revisions took effect and reclassified a number of diagnoses to Return to Provider status. Get that mapping wrong and revenue distorts directly, not as a rounding error but as a structural misstatement. MDS assessments need to tie back to clinical records for every reimbursable episode, since that linkage is what both auditors and CMS validators test. Patient-day tracking records should reconcile cleanly to census reports, and contract therapy cost allocation needs to be documented separately from other labor costs, not folded in.

Cost reporting itself is shifting. For reporting periods ending on or after September 30, 2025, SNFs move to the CMS-2540-24 form, which expands ownership and related-party transaction reporting, separates out agency and contract labor tracking, and adds clearer fields for facility characteristics and Medicare Advantage and Medicaid managed-care utilization. Every one of those fields has to be populated accurately at audit time. The underlying data has to exist well before that.

Related-party transactions deserve their own line of attention. CMS's expanded transparency requirements, paired with OIG's focus in its Industry Segment Specific Compliance Program Guidance, mean management fees, shared services, and lease payments to affiliated entities all need documentation, arm's-length pricing (or an adjustment where they aren't priced that way), and disclosure. Auditors will test these arrangements, so the facility should test them first.

A few other mechanics round out the payer-mix picture. CMS withholds 2% of fee-for-service Part A Medicare payments to fund the Value-Based Purchasing program, and that withholding has to show up correctly in revenue recognition, not as collectible revenue it never was. OIG has active workplan items covering SNF billing and payment accuracy, so the basis and calculation behind any supplemental amounts received should be on file. And Medicare Part B services billed during a Part A stay is another active OIG workplan area: the facility's policy and its actual billing practice need to match, and that match needs to be documented, not just assumed.

Cost report preparation and the audit risk it carries

The Medicare cost report isn't a side project that happens alongside the financial statement audit. Auditors treat the CMS-2540-24 as a primary source when testing revenue, expenses, and related-party disclosures. Errors in the cost report don't stay contained to the cost report.

Under PDPM, clinical factors drive payment rather than therapy volume, so cost allocation has to be precise in a way it didn't strictly need to be under older payment models. Misclassified contract therapy costs or incomplete patient records don't just create an audit finding, they distort CMS's analysis and can reduce future reimbursement.

A few specific items belong on the pre-fieldwork checklist. Agency and contract labor costs need to be broken out separately, as CMS-2540-24 now requires, and traceable back to actual invoices rather than estimated. Overhead allocation methodology should be documented and applied the same way year over year, since inconsistency there is one of the easier things for an auditor to flag. OIG has also named related-party cost report compliance as a priority area, so reviewing cost reports for allowable related-provider costs against the regulatory standard, before the auditor does, saves a finding.

Context matters here too. CMS's final rule, issued July 31, 2025, raised SNF PPS payment rates by 3.2% for FY 2026, with CMS estimating roughly $1.16 billion in additional payments to SNFs relative to FY 2025. Finance teams should check that revenue projections and actuals reflect these updated rates rather than carrying forward prior-year assumptions by habit. And three OIG workplan areas sit directly on top of cost report accuracy: nursing facility skilled nursing reimbursement, Medicare Part B services during a Part A stay, and Medicaid supplemental payments. Documentation gaps in any of these can escalate from an audit finding into a repayment demand or an enforcement action, which is a different order of problem than a management letter comment.

The practical fix is straightforward, even if it takes discipline: have the cost report reviewed internally before fieldwork, not while fieldwork is happening.

The CMS SNF Validation Program's implications for financial audit documentation

CMS launched the SNF Validation Program in September 2025, building an audit process specifically to confirm that submitted MDS data matches the underlying clinical records. Starting in FY 2026, CMS will randomly select up to 1,500 SNFs each year, and each selected facility has to submit documentation for up to 10 MDS assessment records. The contractor running this is Healthcare Management Solutions, LLC.

Eligibility for selection is broad by design: any facility that submitted at least one MDS assessment in the prior calendar year and at least one in the current fiscal year can be pulled. Notification comes through the iQIES MDS 3.0 Provider Preview Reports folder. Someone on staff needs to be assigned to check that folder regularly. Missing the notification doesn't pause the clock, it starts a non-compliance finding.

The response window is 45 days to retrieve and submit the requested documentation. That's tight enough that a facility can't improvise a response; the retrieval process needs to already exist and already be tested before a selection notice ever arrives. Failure to respond triggers a 2% reduction in the Annual Payment Update for the following fiscal year, which is a direct hit to the financial statements, not an abstract compliance penalty.

The measures currently subject to validation include falls with major injuries, pressure ulcer and injury rate, Drug Regimen Review with follow-up, Discharge Function scores, Discharge to Community, and Transfer of Health Information. The connection to the financial audit runs through PDPM: MDS accuracy drives reimbursement, reimbursement drives revenue, and a validation finding that triggers reclassification or repayment creates a prior-period adjustment that auditors have to evaluate on the financial statements themselves.

It's also worth considering that a facility might face a SNF Validation audit at the same time it's fielding a MAC Additional Documentation Request, a Targeted Probe and Educate review, and a program integrity audit, all running concurrently. Documentation systems need to hold up across all of them consistently, not just the one getting the most attention that quarter. A workable preparation checklist includes: assign a named staff member to monitor the iQIES Provider Preview Reports, build and test a documentation retrieval process with the 45-day window in mind, cross-check MDS assessments against clinical documentation on a routine basis rather than only when selected, and run quarterly MDS mock audits alongside an active QAPI plan that involves the relevant team members directly.

HUD Section 232 audit requirements for SNFs with insured mortgages

Facilities carrying a mortgage insured under Section 232 of the National Housing Act face a separate audit track entirely, governed by the HUD Consolidated Audit Guide and overseen by the Deputy Assistant Secretary for Healthcare Programs. The Section 232 Handbook picks up new provisions effective January 5, 2026, so a facility's auditor needs to be working from the current version, and it's worth confirming that directly rather than assuming.

A reclassification finding that regularly appears in Section 232 audits involves HUD escrow accounts, meaning replacement reserves, property tax escrows, and insurance escrows, recorded on the operating company's books instead of the property company's, which is the borrower's, books. This is entirely preventable, and auditors catch it reliably, but catching it means a correction has to happen before the opinion can be issued, which costs time nobody budgeted for.

The escrow and reserve requirements are specific to the HUD Consolidated Audit Guide, and the facility's records need to reflect compliance with those requirements before fieldwork begins. Every escrow account needs to sit on the borrower's, the property company's, books.

The submission deadline matches the rest of the HUD process, since audited financial statements and the auditor's opinion are all due within 90 days of fiscal year-end, so March 31 for a December 31 filer, with records generally needed by the auditor well before that deadline. All statements have to comply with HUD's Uniform Financial Reporting Standards under 24 CFR 5.801 and 24 CFR 200.36.

As of June 2024, nearly 5% of HUD-insured Section 232 borrowers had defaulted on their mortgages, and documentation deficiencies alongside financial statement errors contributed to HUD OIG's decision to audit the program more closely. As of June 2024, nearly 5% of HUD-insured Section 232 borrowers had defaulted on their mortgages, and documentation deficiencies alongside financial statement errors contributed to HUD OIG's decision to audit the program more closely. Clean financials and a timely submission function as covenant compliance here, not paperwork for its own sake. Operator financial statements may only need to be operator-certified rather than fully audited, unless the operator is also the borrower, in which case a full audit applies. Confirming which role the facility occupies, operator, borrower, or both, before assuming a lighter-touch requirement applies is worth the five minutes it takes.

How OIG compliance program requirements shape what auditors examine

OIG published the Nursing Facility Industry Segment Specific Compliance Program Guidance in November 2024, the first industry-specific guidance of its kind since the general compliance guidance update issued in November 2023. The ICPG itself isn't mandatory. The Requirements of Participation modeled on it are not mandatory either, AIHC reported in June 2025, so the guidance shapes behavior even without carrying direct legal force.

OIG currently runs 13 active workplans aimed at nursing homes, some of them open since 2023, and several sit directly on top of what a financial statement audit examines. Related-party cost report requirements and allowable related-provider costs is one. Nursing facility skilled nursing reimbursement accuracy is another. Medicare Part B services billed during a Part A stay round out the group most relevant here.

None of these workplans exist in isolation from the checklist items covered earlier: related-party documentation from the payer-mix section, cost allocation from the cost report section, Part D policy consistency from the revenue cycle discussion. That overlap is the point. An OIG workplan doesn't create a separate compliance track running parallel to the financial audit; it tells the finance team where the auditor's attention is already headed, because the same documentation gaps that draw OIG scrutiny are the ones that produce audit findings.