Building an Audit-Ready Credentialing File (NCQA + Joint Commission)

An audit-ready credentialing file is a provider record complete enough, and documented consistently enough, that a surveyor from NCQA, The Joint Commission, or a delegating health plan could open it cold and find every required element verified, dated, and traceable to its original source. The difference between a passing file and a citation is rarely a missing physician — it is a verification with no date, a source no one can identify, or an approval signature that arrived after the provider started seeing patients. Building the file to survive an audit means capturing the right elements, verifying them the right way, and proving the timeline.

What does a complete, audit-ready credentialing file contain?

A defensible file assembles the practitioner's core qualifications and pairs each one with evidence that it was verified through the primary source or an approved equivalent. At minimum, expect to document:

• Current state licensure for every state the provider practices in, verified with the issuing board.
• DEA and state controlled-substance registration, where applicable.
• Education and training — medical school, residency, fellowship — verified with the originating institution or an approved source.
• Board certification status, verified with the certifying board.
• Work history, typically a minimum five-year chronology with any gaps explained.
• Malpractice claims history and current coverage.
• A National Practitioner Data Bank query and any resulting reports (see NPDB queries).
• Sanctions and exclusion screening against the OIG and federal debarment lists.
• The signed, dated application and attestation covering the provider's ability to perform the requested duties.

Each of these is only half the record. The other half — the half auditors actually score — is the proof of verification: the method used, the source contacted, the date completed, and the identity of the staff member who reviewed it. NCQA's standards treat this documentation as inseparable from the credential itself; if the method, source, and date are not recorded, the verification effectively did not happen, per NCQA's Credentialing standards.

What do NCQA and The Joint Commission expect?

Both accreditors converge on the same principle — verify with the primary source — but they frame it differently. NCQA specifies which elements require primary-source verification (PSV) and imposes strict timeliness: verifications must be current when the credentialing committee makes its decision, and NCQA tightened its PSV window in 2025, reducing it to 120 days for Credentialing Accreditation. A license verified more than 120 days before the committee vote is stale and scoreable. NCQA's credentialing guidance details the approved sources for each element.

The Joint Commission defines PSV as “verification of an individual practitioner's reported qualifications by the original source or an approved agent of that source,” and it explicitly accepts direct correspondence, documented telephone verification, secure electronic verification, or a report from a qualified credentials verification organization, according to its standards FAQ. Crucially, The Joint Commission holds the organization responsible for documenting the date the verification was conducted, who conducted it, what was verified, and the result. For a deeper breakdown of approved sources, see our guide to the seven primary sources.

Neither accreditor stops at the initial verification. NCQA requires the organization to designate a credentialing committee that reviews and approves practitioners, and it permits a medical director to approve “clean” files that meet every criterion while routing any file with a flag — a malpractice history, a license limitation, an unexplained gap — to the full committee for discretionary review. Both accreditors also require ongoing monitoring between credentialing events: license sanctions, Medicare and Medicaid exclusions, and complaints must be tracked continuously, and the file should show the organization acted on anything it found. A file that is pristine at the moment of approval but silent for the next three years is not, by the standard's definition, complete.

A well-built file satisfies both frameworks simultaneously. The safest approach is to hold each element to the stricter of the two requirements — the tightest timeliness window, the narrowest set of approved sources — so the same file passes regardless of which framework the auditor applies.

How is a delegated-credentialing audit different?

When a health plan delegates credentialing to a medical group, MSO, or CVO, it remains accountable for the work and audits the delegate to prove it. A delegated-credentialing audit typically involves a pre-delegation evaluation, an executed delegation agreement spelling out which activities are delegated, and an annual file review in which the plan pulls a sample — often the “8/30” methodology, a minimum of eight files up to thirty depending on population size — and scores each against its own credentialing policy.

Preparing for a delegated audit means your files cannot merely be complete; they must match the delegation agreement and your own written policies element for element. Auditors compare the sampled files back to the policy: if your policy says you verify work history covering five years, a file with only three will be cited even when it may satisfy the underlying standard. The oversight file itself — committee minutes, the credentialing policy, the current roster, and evidence of ongoing monitoring — is audited alongside the practitioner files. Plans also expect delegates to submit periodic roster and activity reports, and a delegate that cannot produce that evidence on request risks having the delegation revoked.

What are the most common credentialing file deficiencies?

Most citations are documentation failures, not missing credentials. The recurring offenders:

• Undated or unsourced verifications. A printed license screenshot with no date, no source, and no reviewer initials proves nothing.
• Stale verifications. A PSV completed outside the accreditor's window before the committee decision.
• Approval-timeline gaps. The committee sign-off is dated after the provider's start date, or a designee signed without documented authority.
• Missing ongoing monitoring. No evidence that license sanctions, Medicare and Medicaid exclusions, and complaints were tracked between credentialing events (see exclusion monitoring).
• Unexplained work-history gaps. A break in employment with no attestation or explanation.
• Attestation drift. A signed attestation older than the accreditor's allowed window at the time of the decision.

The NPDB query deserves special attention: hospitals must query at appointment and at least every two years at reappointment, and the query result must live in the file, per the NPDB's querying guidance. Exclusion screening against the OIG's list is equally non-negotiable; the OIG advises organizations to routinely check that new hires and current staff are not excluded, per its Exclusions Program.

Building the file once, then keeping it audit-ready

An audit-ready file is not a one-time achievement; it decays. Licenses expire, board certifications lapse, new sanctions post, and the recredentialing clock resets every 36 months (see re-credentialing cycles). The organizations that pass audits cleanly treat the file as a living record: they capture the method-source-date stamp at the moment of every verification, they run continuous exclusion and license monitoring rather than annual sweeps, and they maintain a tamper-evident trail so the timeline can never be questioned.

Retention matters as much as capture. Credentialing records and committee decisions must be retained and reproducible for years — long enough to cover the look-back period of a payer audit or a malpractice discovery request — so a file that exists only in a departed coordinator's inbox is a liability even if every verification was performed correctly. Centralizing the file, time-stamping each action, and locking the record against silent edits is what makes the timeline defensible when someone asks, months or years later, to see the proof.

That discipline is exactly what separates a file that survives a surprise pull from one that generates a corrective action plan. Whether accreditation runs through NCQA, The Joint Commission, or URAC, the underlying test is identical: can you prove — on paper, with dates and sources — that every credential was verified correctly and approved on time?