Internal Audit of Hospital: A Complete Guide for Indian Healthcare Facilities (Updated 2026)

Running a hospital is one of the most complex management challenges in India. You are responsible not just for patient health but also for financial accuracy, legal compliance, employee management, and regulatory adherence across multiple laws and standards. This is exactly why an internal audit of a hospital is not optional — it is essential.

This guide covers everything you need to know about the internal audit of a hospital in India. It is written for hospital management, finance teams, compliance officers, and anyone who wants to understand how hospital audits work in plain, simple language.

What Is an Internal Audit of a Hospital?

An internal audit is an independent and objective review of a hospital’s operations, financial records, regulatory compliance, and internal controls. It is carried out by a team that is not directly involved in the day-to-day management of the areas being reviewed. The purpose is to identify problems, risks, and inefficiencies before they become serious issues. Many hospital management teams confuse internal audit with statutory audit — they serve very different purposes. Read our detailed guide on the difference between statutory audit and internal audit to understand which applies when and why both matter.

In a hospital setting, an internal audit covers a wide range of areas:

•       Financial accounting and billing accuracy
•       Pharmacy and drug management
•       Regulatory and legal compliance
•       Clinical quality and patient safety standards
•       Human resources and staff management
•       Biomedical waste management
•       Infrastructure and equipment maintenance

A well-structured internal audit gives hospital management a clear, honest picture of what is working well and what needs fixing. It is also a critical step in preparing for external audits, accreditation assessments, and statutory inspections.

Why Is Internal Audit Especially Important for Hospitals?

Hospitals in India operate under a unique combination of pressures: they must generate revenue while simultaneously complying with a large number of laws, rules, and accreditation standards. A single compliance failure can result in licence suspension, financial penalties, or reputational damage that takes years to recover from.

Here are some of the key reasons why internal audits matter deeply in the hospital sector:

Financial Complexity

Hospitals deal with high volumes of transactions every day — patient billing, insurance claims, pharmacy sales, vendor payments, staff salaries, and capital expenditure. Without regular internal audits, errors and fraud can go undetected for months.

Regulatory Exposure

A hospital typically needs to comply with the Clinical Establishments Act, Drugs and Cosmetics Act, Biomedical Waste Management Rules, PCPNDT Act (if it has an ultrasound facility), labour laws, GST, and potentially NABH accreditation standards. Missing any of these can have serious consequences.

Insurance and Third-Party Billing

Hospitals empanelled with insurance companies and government health schemes (such as Ayushman Bharat) must maintain high standards of billing accuracy. Incorrect or inflated claims can trigger investigations and blacklisting.

Patient Safety Accountability

Internal audits help hospitals identify clinical risks, near-miss events, and gaps in patient care protocols before they result in adverse events or legal liability.

Like hospitals, food manufacturing companies also face multi-layered regulatory compliance requirements — read our guide on internal audit for food manufacturing companies in India to see how sector-specific audit frameworks differ across industries.”

 Scope of Internal Audit in a Hospital

A comprehensive internal audit of a hospital typically covers the following areas:

1. Financial and Accounts Audit

This area reviews the hospital’s accounting records, financial statements, cash and bank management, accounts payable and receivable, revenue recognition, and tax compliance. Key checks include:

•       Verification of daily cash collections against patient billing records
•       Review of petty cash handling and reconciliation
•       Checking that payments to vendors are properly authorised and supported by purchase orders and invoices
•       Verifying GST compliance — registration, invoicing, ITC claims, and returns filing
•       Review of TDS deductions and timely deposits
•       Capital expenditure tracking and fixed asset register accuracy

2. Revenue and Billing Audit

Revenue leakage is a significant concern in hospitals. Billing audit checks whether all services provided to patients are correctly billed and collected. This includes:

•       Cross-checking OPD and IPD billing against patient treatment records
•       Verifying diagnostic test charges against the hospital’s rate card
•       Reviewing cashless insurance claim documentation and submission timelines
•       Checking for over-billing, under-billing, or unbundling of charges

3. Procurement and Inventory Audit

This covers the purchase, storage, and consumption of medicines, consumables, and medical equipment. Key checks include verifying that procurement follows approved vendor lists, purchase orders are raised before goods are received, and physical stock matches system records.

4. HR and Payroll Audit

This area reviews employee records, salary calculations, PF and ESI compliance, doctor credentialing, staff ratios, and adherence to labour laws.

5. Clinical and Quality Audit

This covers patient safety protocols, infection control, clinical documentation, consent procedures, and compliance with standard treatment guidelines.

6. Regulatory Compliance Audit

This includes checks on statutory registrations, licence validity, NABH accreditation compliance, biomedical waste management, PCPNDT compliance, and MCI or NMC-related requirements.

 NABH Accreditation — Internal Audit Role in Compliance

The National Accreditation Board for Hospitals and Healthcare Providers (NABH) is India’s most recognised hospital accreditation body. NABH accreditation signals that a hospital meets high standards of patient safety and quality of care. The current applicable standard is the NABH 6th Edition, which became effective from January 2025.

Internal audits play a central role in helping hospitals achieve and maintain NABH accreditation. The audit checks whether day-to-day operations match the written policies and procedures that the hospital has submitted to NABH.

10 Key NABH Standards That Internal Audit Must Verify

The NABH 6th Edition covers 10 key chapters. Here is what internal auditors must check under each:

NABH Chapter	What It Covers	Key Internal Audit Check
1. Access, Assessment & Continuity of Care	Patient admission, clinical assessment, discharge planning	Are admission and discharge protocols documented and followed?
2. Care of Patients	Treatment protocols, patient identification, medication safety	Are patient identification checks done before every procedure?
3. Management of Medication	Drug storage, prescription, dispensing, adverse drug reaction reporting	Are Schedule H, H1, X drugs stored and dispensed as per rules?
4. Patient Rights & Education	Informed consent, patient grievance redressal, rights charter	Are signed consent forms present in all surgical case files?
5. Hospital Infection Control	Hand hygiene, sterilisation, BMW management, needle stick policy	Are hand hygiene compliance rates monitored and recorded?
6. Continuous Quality Improvement	Quality indicators, incident reporting, root cause analysis	Are near-miss incidents being reported and analysed?
7. Responsibilities of Management	Governance structure, resource management, clinical risk management	Are management review meetings held and minuted?
8. Facility Management & Safety	Equipment calibration, fire safety, emergency preparedness	Are fire drills conducted and documented at least twice a year?
9. Human Resource Management	Staff credentials, training records, performance appraisals	Are all doctors’ registration certificates current and on file?
10. Information Management System	Medical records accuracy, data confidentiality, record retention	Are medical records stored and retained for the required period?

 NABH recommends that hospitals conduct internal audits quarterly, with monthly spot checks in high-risk areas such as the pharmacy, ICU, and operation theatres. Any gaps identified during internal audits must be documented with corrective action plans and timelines.

A key point for hospital management to understand: NABH assessors check not just whether written policies exist, but whether those policies are actually followed in practice. Internal audits are the mechanism that closes this gap.

Hospital Billing Audit — Key Red Flags and Checks

Billing is the lifeblood of hospital revenue. At the same time, billing errors and irregularities are among the most common findings in hospital internal audits. Billing problems can result in revenue leakage, insurance claim rejections, and even fraud investigations.

A hospital billing audit examines every stage of the billing process: from when a patient arrives to when payment is collected or a claim is settled.

Insurance Claim Verification

Hospitals empanelled with health insurance companies or government schemes must follow specific billing protocols. Internal audits must check:

•       That pre-authorisation from the insurance company or TPA (Third Party Administrator) was obtained before planned procedures
•       That the diagnosis and treatment codes (ICD-10 and CPT codes) recorded in the claim match the actual clinical documentation
•       That the discharge summary, investigation reports, and treatment notes are complete and support the claim amount
•       That the claim was submitted within the required timeline (usually within 7 days of discharge)
•       Whether any claims have been rejected and the reasons for rejection — a pattern of rejections for the same reason is a red flag

Unbundling Checks

Unbundling means charging separately for individual services that should be billed as a single package. For example, if a hospital has a “surgery package” price but charges separately for the OT room, anaesthesia, consumables, and surgeon’s fee in addition to the package — that is unbundling.

Internal auditors must:

•       Compare individual line items on patient bills against the hospital’s published package rates
•       Check that consumables like syringes, gloves, and IV sets are not charged separately when already included in a package
•       Verify that surgical procedures are not split into multiple billing entries to inflate the total
•       Cross-check bills with Ayushman Bharat or any other cashless scheme package rates where applicable

Discharge Summary Audit

The discharge summary is a critical document in hospital billing because insurance companies use it to verify claims. A discharge summary audit checks:

•       Whether the admission date, discharge date, and length of stay mentioned in the bill match the discharge summary
•       Whether the final diagnosis listed in the discharge summary is consistent with the treatment given and the medicines charged
•       Whether the discharge summary was completed by an authorised doctor and signed before the patient left
•       Whether investigation results and procedure notes referenced in the discharge summary are present in the file
•       Whether follow-up instructions and medicine lists in the discharge summary match the pharmacy bill

Common Billing Red Flags to Watch For

During a hospital billing audit, the following are common warning signs that require deeper investigation:

•       Billing for services on dates when the treating doctor was not present or on leave
•       Identical bills for multiple patients with different diagnoses — possible copy-paste errors
•       Consistently high bills for patients on certain wards or under certain doctors, relative to peers
•       Cash payments not supported by receipts in the hospital’s billing system
•       High rates of “package upgrades” or add-on charges being applied after admission

Pharmacy and Drug Inventory Audit Checklist

The hospital pharmacy is one of the highest-risk areas for internal audit. It involves large value transactions, controlled substances, expiry date management, and complex compliance requirements under the Drugs and Cosmetics Act, 1940 and the Drugs and Cosmetics Rules, 1945.

A pharmacy audit must cover three major areas: procurement compliance, storage and security, and dispensing records.

Schedule H, H1, and X Drugs — What Internal Auditors Must Know

India’s drug schedule system creates different levels of control for different types of medicines. Internal auditors need to understand what each schedule means and what compliance looks like:

• Schedule H: Covers most common prescription medicines — antibiotics, antihypertensives, antidiabetics, hormones, and hundreds of other drugs. These can only be sold against a valid doctor’s prescription. The pharmacist must retain prescriptions and maintain proper records.
• Schedule H1: A stricter subset introduced in 2013 covering powerful antibiotics (third and fourth generation cephalosporins, carbapenems), anti-tuberculosis drugs, and certain sedatives. A separate H1 Register must be maintained with details of each dispensing, including the patient’s contact number and the prescribing doctor’s details. This register must be retained for at least three years. The drug packaging must display the text “Rx” and carry a red-bordered warning label.
• Schedule X: Covers narcotic and psychotropic substances with valid medical uses (such as morphine and certain sedatives). These must be kept under lock and key. Prescriptions must be in duplicate. Records must be retained for at least two years. Additional compliance under the NDPS Act also applies. Forms 3D, 3E, and 3H must be maintained for narcotic drugs.

Pharmacy Procurement Compliance Checklist

Internal auditors must verify the following for all pharmacy purchases:

•       All drug purchases are from licensed suppliers — check valid wholesale drug licence of suppliers
•       Purchase orders are raised before goods are received and are approved by an authorised person
•       Goods received notes (GRN) match the actual quantities delivered and the invoice
•       Batch numbers and expiry dates are recorded at the time of receipt
•       No purchases from unlicensed or grey-market suppliers
•       Controlled drugs (Schedule X and NDPS substances) are purchased only through the approved government process with proper forms

Drug Storage Compliance Checklist

Improper storage is a significant risk area. Internal auditors must check:

•       Cold chain drugs (insulin, vaccines, biologics, some eye drops) are stored at 2 to 8 degrees Celsius in a calibrated cold storage unit with a temperature log
•       Schedule H drugs are kept in a locked area separate from general items
•       Schedule H1 drugs are clearly labelled and kept in a designated area
•       Schedule X and NDPS substances are stored in a double-locked safe with access restricted to the licensed pharmacist
•       There are no expired medicines on the dispensing shelves — expired drugs must be segregated and disposed of as per Biomedical Waste Management Rules (yellow bag / incineration)
•       Ambient temperature monitoring for the main pharmacy store is being done and recorded

Drug Dispensing Compliance Checklist

For each category of drug, auditors should verify:

•       Schedule H: A valid prescription from a registered medical practitioner is present for every dispensing. Prescriptions are retained.
•       Schedule H1: The separate H1 Register has been filled completely for every dispensing — patient name, address, contact number, prescribing doctor’s name and registration number, drug name, and quantity supplied.
•       Schedule X: Prescription in duplicate is present. The quantity dispensed matches what is recorded in the controlled substances register. Stock balance is verified.
•       No dispensing of any prescription drug without a valid prescription — even to hospital staff
•       The dispensed quantity matches the prescription — no over-dispensing or substitution without doctor’s approval

Drug Inventory Reconciliation

Physical stock verification is a key part of the pharmacy audit. Auditors must:

•       Conduct a random physical count of at least a representative sample of drugs and compare it against the pharmacy management system records
•       Investigate any discrepancies between physical stock and system records
•       Verify that the system accounts for returns, breakages, and wastage correctly
•       Check whether high-value items (biologics, oncology drugs) are physically accounted for and match purchase invoices

Regulatory Compliance Audit — PCPNDT, MCI/NMC, and Biomedical Waste

Hospitals in India are subject to a wide range of regulatory requirements beyond NABH accreditation. The internal audit must cover each of these independently because the consequences of non-compliance are severe — including licence cancellation, criminal prosecution, and reputational damage.

PCPNDT Compliance Audit — Mandatory for Hospitals with Ultrasound Facilities

The Pre-Conception and Pre-Natal Diagnostic Techniques (PCPNDT) Act, 1994 (amended in 2003) is one of the most strictly enforced laws in Indian healthcare. Any hospital, nursing home, or clinic that has an ultrasound machine must comply with this Act. Non-compliance can result in the machine being seized, the facility being de-registered, and the responsible doctors facing criminal prosecution.

The PCPNDT compliance audit must verify the following:

•       Valid registration of the ultrasound facility under the PCPNDT Act — registration must be renewed on time and the certificate must be prominently displayed in the facility
•       Form F is being filled for every pregnant patient who undergoes an ultrasound scan — all columns must be filled; blank columns are a compliance violation
•       The referral form from a registered medical practitioner is present before every prenatal scan
•       A copy of the PCPNDT Act handbook is available at the facility
•       No display of any board or notice that could be interpreted as advertising sex determination services
•       ANC (Antenatal Care) register is being maintained and updated regularly
•       Any change in staff, equipment, or address has been intimated to the Appropriate Authority within 30 days
•       The sex of the foetus has not been disclosed to any person — there should be no record or note suggesting disclosure

Inspections under PCPNDT are conducted by teams constituted by the Chief Medical and Health Officer (CMHO) or the Appropriate Authority at the district level. Internal audits help hospitals stay continuously ready for such inspections.

HR Compliance — Doctor Credentialing, Nursing Staff Ratios, and Labour Laws

Human resources compliance is a critical but often overlooked area of hospital internal audit. Key checks include:

Doctor Credentialing

•       All doctors have valid registration with the National Medical Commission (NMC) — formerly the Medical Council of India (MCI) — or the relevant State Medical Council
•       Specialist doctors have the required post-graduate qualifications for the specialty they are practising in
•       Visiting consultants have signed agreements, and their credentials are on file
•       No doctor is practising beyond the scope of their qualifications
•       Under NABH, doctor credentials must be formally verified through a privilege delineation process — the internal audit must check that this is documented

Nursing Staff Ratios

•       The State Clinical Establishments Act or the applicable state regulation specifies minimum nurse-to-patient ratios. Internal auditors must verify that the hospital is meeting these ratios — especially in ICU, post-operative care, and maternity wards.
•       Nursing staff have valid registration with the Indian Nursing Council (INC) or the State Nursing Council
•       Nursing staff training records are maintained and updated

Labour Law Compliance

•       Provident Fund (PF) contributions are deducted from eligible employees and deposited on time with the EPFO
•       ESI (Employee State Insurance) contributions are paid for eligible employees
•       Appointment letters, employment contracts, and salary slips are issued to all staff
•       Contract workers deployed through agencies are covered under EPF and ESI through the contractor
•       Overtime payments are made as per the applicable shop and establishment or factories act

Biomedical Waste (BMW) Audit — BMW Management Rules 2016 Compliance Checklist

The Bio-Medical Waste Management Rules, 2016 (amended in 2018) are mandatory for all healthcare facilities in India, regardless of size. Non-compliance can result in heavy fines, criminal charges, and hospital licence suspension. The BMW audit must cover:

Authorisation and Registration:

•       The hospital holds valid authorisation from the State Pollution Control Board (SPCB) for biomedical waste generation and management
•       The authorisation certificate is current and has been renewed on time

Colour-Coded Segregation (the four-category system):

•       Yellow Bags: Human anatomical waste, soiled dressings, discarded medicines, chemical waste — to be incinerated or deep buried
•       Red Bags: Recyclable contaminated plastic items — to be autoclaved / shredded
•       White Puncture-Proof Containers: Sharps (needles, blades, broken glass) — to be autoclaved / shredded / encapsulated
•       Blue Boxes / Puncture-Proof Containers: Glassware and metallic implants — to be autoclaved / shredded
•       Internal auditors must verify that waste is being segregated correctly at the point of generation, not mixed at the nursing station or ward level

Storage and Transportation:

•       BMW is not stored in the healthcare facility for more than 48 hours
•       Separate trolleys are used for BMW transport — patient trolleys are not used for waste
•       BMW transport routes within the hospital are separate from patient and supply routes
•       The waste storage room has exhaust ventilation, proper lighting, and signage

Records and Reporting:

•       Daily log of biomedical waste generated (in kg) is being maintained
•       Annual report on BMW generation, treatment, and disposal has been filed with the State Pollution Control Board and published on the hospital’s website
•       Incident reports for needle-stick injuries, mercury spills, or other BMW-related accidents have been recorded in Form I and reported to authorities

CBWTF (Common Biomedical Waste Treatment Facility) Linkage:

•       The hospital has a contract with an authorized CBWTF for collection and disposal
•       CBWTF collection records and receipts are maintained

Staff Training:

•       All staff handling BMW have been trained on color-coding, segregation, and personal protective equipment (PPE) use
•       Training records are maintained

How Is a Hospital Internal Audit Conducted? Step by Step

A well-structured hospital internal audit follows a standard process:

1.   Audit Planning: Define the scope, identify the departments and processes to be reviewed, gather relevant regulations and accreditation standards, and prepare an audit schedule.
2.   Data Collection: Collect financial records, billing data, pharmacy registers, HR files, compliance certificates, and regulatory documents.
3.   Field Observation: Visit wards, pharmacy, OT, ICU, biomedical waste storage areas, and other locations for physical inspection and staff interviews.
4.   Testing and Verification: Cross-check records, perform reconciliations, verify calculations, and compare findings against applicable rules and standards.
5.   Findings Documentation: Prepare a list of observations, categorised as major non-conformities, minor non-conformities, and observations for improvement.
6.   Management Discussion: Present draft findings to management for factual verification and initial response.
7.   Audit Report: Issue the final internal audit report with findings, risk ratings, root causes, and recommended corrective actions.
8.   Follow-up Audit: At a defined interval (usually 3 to 6 months), conduct a follow-up review to verify that corrective actions have been implemented.

 Key Risk Areas in Hospital Internal Audit — What to Watch Out For

Revenue Cycle Risks

The revenue cycle is the biggest financial risk area in hospitals. Common issues include patient services that are provided but not billed, packages being offered at undiscounted rates without proper approvals, insurance claims rejected due to incomplete documentation, and cash collections not deposited in the bank account on time.

Vendor and Procurement Risks

Procurement fraud is a significant concern in hospital supply chains. Internal auditors look for inflated purchase prices compared to market rates, purchases from vendors who are related parties to hospital management, payments made without proper purchase orders or goods receipt notes, and advance payments to vendors without deliverables.

Payroll Risks

Hospitals often employ a large number of staff across different employment categories — permanent employees, contract staff, daily wage workers, and visiting consultants. Payroll risks include ghost employees, incorrect PF deductions, consultants paid as employees to avoid tax, and unpaid statutory dues.

IT and Data Security Risks

As hospitals move to Hospital Information Management Systems (HIMS) and Electronic Medical Records (EMR), data security becomes important. Internal audits check access controls, data backup procedures, patient data confidentiality, and whether the system has audit trails for changes made to billing or clinical records.

How PKC India Can Help with Hospital Internal Audits

PKC India is a mid-tier Chartered Accountant firm with deep experience in internal audits for healthcare facilities. We understand the unique challenges that Indian hospitals face — balancing clinical priorities with financial controls, complying with multiple regulatory frameworks, and preparing for NABH assessments.

Our hospital internal audit services cover:

•       Financial and accounts audit including GST and TDS compliance
•       Revenue cycle and billing audit with insurance claim verification
•       Pharmacy audit covering Schedule H, H1, X drugs and drug inventory reconciliation
•       NABH accreditation compliance review against the 6th Edition standards
•       Biomedical waste management audit as per BMW Rules 2016
•       PCPNDT compliance audit for hospitals with ultrasound facilities
•       HR compliance including doctor credentialing, nursing staff ratios, and labour law adherence
•       Procurement and vendor management audit

Whether you are preparing for NABH accreditation, strengthening your internal controls, or simply ensuring that your hospital is compliant with all applicable laws, PKC India can be your partner. Visit us at www.pkcindia.com or reach out to our team to discuss how we can help your hospital.

 Disclaimer: This blog has been prepared for general informational purposes only. Regulations and accreditation standards are subject to change. Readers should verify current requirements with the relevant authorities and consult a qualified professional for advice specific to their situation. Information in this article reflects the position as updated to May 2026.

 FAQs 

1. What is the purpose of an internal audit in a hospital?

An internal audit in a hospital serves to review financial accuracy, identify revenue leakage, verify compliance with laws and accreditation standards, assess clinical quality, and strengthen internal controls. It helps hospital management understand what is working, what is not, and what corrective steps are needed before a problem becomes serious.

2. How often should a hospital conduct an internal audit?

The frequency depends on the size and complexity of the hospital, but as a general guideline, high-risk areas like the pharmacy, billing, and ICU should be audited monthly or quarterly. Financial accounts should be reviewed monthly. A comprehensive hospital-wide internal audit should be done at least once a year. For NABH-accredited hospitals, quarterly internal audits are recommended, with monthly spot checks in clinical areas.

3. What are the most common findings in a hospital internal audit?

Commonly found issues include: billing entries without corresponding medical documentation, pharmacy records not matching physical stock, Schedule H1 register not maintained properly, expired medicines in stock, gaps in informed consent documentation, biomedical waste not segregated correctly, PCPNDT Form F not filled completely for all scans, doctors’ registration certificates not renewed on time, and GST input tax credit not claimed correctly.

4. Is NABH accreditation mandatory for all hospitals in India?

NABH accreditation is not mandatory by law for all hospitals. However, it is required or preferred for empanelment with many government health insurance schemes, including Ayushman Bharat PM-JAY. Many large corporate and insurance empanelments also prefer or require NABH-accredited hospitals. As of 2025, the applicable standard is the NABH 6th Edition.

5. What is PCPNDT compliance and which hospitals need to follow it?

PCPNDT stands for Pre-Conception and Pre-Natal Diagnostic Techniques (Prohibition of Sex Selection) Act, 1994. Any hospital, clinic, nursing home, or diagnostic centre that has an ultrasound machine capable of being used for prenatal scanning must register under this Act and follow its requirements. These include filling Form F for every pregnant patient, maintaining ANC registers, displaying the registration certificate, and not disclosing the sex of the foetus. Inspections under PCPNDT are conducted by the Appropriate Authority and can result in registration cancellation and criminal charges for violations.

6. What is the difference between Schedule H, H1, and X drugs in a pharmacy audit?

Schedule H covers most prescription medicines and requires dispensing only against a valid doctor’s prescription. Schedule H1 is a stricter sub-category covering powerful antibiotics and anti-TB drugs — a separate H1 Register must be maintained for every dispensing, with full patient and prescriber details, and this register must be kept for at least three years. Schedule X covers narcotic and psychotropic substances — prescriptions must be in duplicate, drugs must be under double-lock security, and records must be kept for two years. Missing any of these records is a serious violation.

7. Can an external CA firm conduct the internal audit of a hospital?

Yes. Many hospitals in India, especially mid-sized and large private hospitals, appoint external Chartered Accountant (CA) firms to conduct internal audits. An external CA firm brings independence and expertise that may not be available in-house. A firm with experience in healthcare internal audits can cover financial, operational, and regulatory compliance areas. At PKC India, we provide specialized internal audit services for hospitals and healthcare facilities, covering billing, pharmacy, NABH compliance, BMW management, PCPNDT, HR compliance, and financial controls.