PERM Is Not Just an Audit

For many Medicaid organizations, the Payment Error Rate Measurement program enters executive attention when a measurement cycle begins, a sample is drawn, documentation is requested, or preliminary findings start to emerge.

That is too late.

PERM is often described as an audit or measurement process. Technically, that is understandable. Operationally, however, PERM is better viewed as a downstream test of decisions made throughout the Medicaid enterprise.

Eligibility policy. Systems configuration. Worker instructions. Verification practices. Documentation standards. Vendor performance. Quality controls. Escalation processes. Governance.

By the time an error appears in a PERM sample, the conditions that produced it may have existed for months—or years.

A PERM eligibility finding rarely begins with the auditor.

It may begin when a policy is written without enough consideration of how evidence will later be produced. It may begin when an eligibility system permits a transaction that technically completes but leaves an incomplete audit trail. It may begin when manual workarounds become routine, when self-attestation expands without corresponding controls, or when an operational exception slowly becomes standard practice.

Each individual decision may seem reasonable in isolation.

PERM examines the accumulated result.

That distinction matters because organizations that approach PERM primarily as an audit-response exercise tend to focus on assembling records, answering requests, defending individual cases, and responding to findings.

Those activities are necessary. They are not sufficient.

The more important question is:

What operating conditions made the finding possible in the first place?

A mature PERM strategy should operate continuously—not only during the measurement cycle.

That means integrating PERM risk into several ordinary management functions.

Policy design. Before an eligibility policy is implemented, leaders should ask not only whether the policy is permissible, but whether its execution will be demonstrable later.

Systems design. Eligibility systems should preserve the data, verification history, timestamps, notices, interfaces, and decision logic necessary to reconstruct a determination.

Operational procedures. Staff instructions should reflect both program requirements and the evidence necessary to support compliance.

Quality assurance. Internal reviews should test the same kinds of vulnerabilities that external reviewers may eventually encounter.

Vendor and partner accountability. Responsibility for an activity may be delegated. Fiscal and audit consequences often cannot.

Executive governance. Material changes in eligibility policy or operational controls should include explicit consideration of downstream audit and fiscal exposure.

This shifts PERM from a periodic compliance event into an ongoing management discipline.

One of the most consequential misunderstandings in large public programs is the belief that a correct operational decision and a defensible operational decision are necessarily the same thing.

They are not.

An eligibility determination may have been reasonable. An employee may have followed the intended process. Information may even have existed somewhere in the enterprise.

But if the record available for review cannot substantiate the determination, the distinction may become largely academic during an audit.

That makes documentation more than administrative housekeeping.

Documentation is part of the control environment.

The strongest organizations therefore design processes with future reconstruction in mind: Could an independent reviewer understand what happened, what information was considered, which rule was applied, and why the determination was made?

If the answer is uncertain, operational risk already exists.

Medicaid programs frequently face pressure to simplify enrollment, reduce administrative burden, accelerate implementation, or create operational flexibility.

Those can be legitimate policy objectives.

But every simplification should be evaluated against a second question:

What evidence will remain when this case is reviewed later?

A policy choice that reduces front-end documentation may transfer risk downstream. A system shortcut may reduce current workload while weakening the historical record. An attestation policy may improve accessibility while simultaneously increasing the importance of post-eligibility validation and quality controls.

None of these choices is inherently wrong.

The risk arises when the tradeoff is not explicitly recognized.

Policy decisions and audit consequences should therefore be considered together—not sequentially.

PERM findings are not merely quality metrics.

They can contribute to estimates of improper payments and create significant federal-state financial consequences. That means eligibility accuracy belongs not only with audit, compliance, or quality teams, but also with executive leadership, finance, policy, technology, and operations.

A meaningful change in eligibility risk should be considered with the same seriousness as other material operational exposures.

Executives should know:

That is enterprise risk management—not audit preparation.

The objective should not be to build an organization that can prepare for PERM.

It should be to build an organization whose ordinary operations are already PERM-ready.

That means the evidence, controls, accountability, and governance needed to withstand external review are produced naturally through normal business operations.

When that happens, PERM becomes less of an extraordinary event.

It becomes what it should be: an independent measurement of an operating environment that already understands its risks.

PERM findings are signals.

They tell leaders something about the interaction among policy, technology, process, documentation, training, quality control, and accountability.

Organizations that treat those signals as isolated audit exceptions may correct individual cases.

Organizations that treat them as evidence of underlying operational conditions have the opportunity to correct systems.

That is the distinction this publication will continue to explore.

PERM is not simply where Medicaid error is measured. It is where the consequences of earlier operational decisions eventually become visible.