Director - Internal Audit Operations

What You'll Do

• Build and maintain a risk-based operational audit plan covering claims, encounters, utilization and care management, credentialing, provider data, revenue cycle, delegated functions, and vendor oversight.
• Conduct an annual operational risk assessment across markets, entities, and lines of business, and refresh it as the portfolio changes through acquisition and new health plan arrangements.
• Prioritize audit coverage by financial exposure, regulatory consequence, patient impact, and control maturity rather than by cycle habit. Weight coverage toward the areas where the company carries the most risk, including full-risk capitated arrangements.

• Lead operational audits end to end: scoping, walkthroughs, control identification, sampling, testing, workpaper documentation, and reporting.
• Test the accuracy and timeliness of core operating processes, including claims adjudication and payment integrity, encounter submission and acceptance, authorization and denial handling, credentialing and re-credentialing, and provider roster accuracy.
• Audit the completeness and accuracy of the claims and membership data that support actuarial reserve estimates, including source system reconciliation and claims lag and inventory integrity.
• Audit risk adjustment operations, including diagnosis coding accuracy, chart review and retrieval processes, encounter data completeness and acceptance, and readiness for risk adjustment data validation audits.
• Audit the operational inputs to risk pool and shared-risk settlements, including partner reporting, supporting claims and utilization data, and settlement timeliness against contractual windows.
• Audit compliance with delegated and regulatory requirements applicable to Astrana's arrangements, including CMS, DMHC, DHCS, and health plan delegation standards, and coordinate with Compliance to avoid duplicative testing.
• Use data analytics against full populations rather than small judgmental samples wherever the data supports it, and build repeatable tests that can be re-run on a schedule.
• Perform post-close operational reviews of acquired organizations to confirm that controls, workflows, and system configurations were actually implemented as the integration plan described.

• Write findings that state the condition, the quantified impact, the root cause, and a recommendation an operator can act on, with a named owner and a committed date.
• Present audit results and thematic risk trends to executive leadership and to the Audit Committee.
• Track remediation to closure and independently validate that corrective actions worked, escalating items that stall or recur.
• Identify systemic themes across engagements, including manual workarounds, undocumented processes, system configuration gaps, and unclear ownership, and raise them as enterprise issues rather than isolated exceptions.

• Establish and document audit methodology, workpaper standards, quality review, and reporting cadence consistent with IIA standards.
• Partner with Finance and SOX audit so operational and financial control coverage are complementary and gaps do not fall between the two.
• Advise business leaders on control design for new processes, new markets, and new health plan arrangements before problems are built in.
• Manage, mentor, and develop audit staff and co-source resources as the function scales.
• Maintain the internal audit charter, present the annual risk-based audit plan to the Audit Committee for approval, and report plan completion, findings and remediation status to the Committee on its cycle.
• Arrange periodic external quality assessment of the function consistent with professional standards, and run internal quality review between assessments.
• Support fraud, waste and abuse work and investigations arising from hotline intake or audit findings, and coordinate with Compliance and Legal on referral and escalation protocols.

Qualifications

• Bachelor's degree in Accounting, Finance, Business, Healthcare Administration, or a related field, or equivalent practical experience.
• 10+ years of internal audit, operational audit, compliance auditing, or process improvement experience, including experience leading engagements end to end.
• Healthcare experience in a health plan, IPA, MSO, provider organization, or healthcare-focused advisory practice.
• Working knowledge of core healthcare operating processes such as claims, encounters, utilization management, credentialing, provider data, or revenue cycle.
• Demonstrated ability to quantify the impact of a control failure and defend the analysis to the leaders who own the process.
• Strong analytical skills, including SQL or comparable data tools, and the ability to work independently against large and imperfect operational datasets.
• Excellent written and verbal communication, with experience presenting to senior executives and governance committees.
• Sound judgment and independence, with the credibility to deliver an unwelcome finding and keep the working relationship intact.

• CIA, CPA, CISA, CHC, or CFE certification.
• Experience with delegated oversight audits under CMS, DMHC, DHCS, or NCQA delegation standards.
• Experience auditing or operationalizing controls in a post-acquisition integration.
• Familiarity with value-based care economics, including capitation, shared savings, risk pools, and incentive programs.
• Experience building an operational audit function or a materially expanded audit plan from a limited starting point.
• Proficiency with audit management platforms and BI tools such as Power BI or Tableau.

Environmental Job Requirements and Working Conditions

• This position is in office with the option to be hybrid. The office is located at 1668 S. Garfield Ave. 2nd Floor, Alhambra, CA 91801. 
• The national target pay range for this role is $180,000 to $200,000. Actual compensation will be determined based on geographic location (current or future), experience, and other job-related factors.

About
Astrana Health (NASDAQ: ASTH) is a physician-centric, technology-powered healthcare management company. We are building and operating a novel, integrated, value-based healthcare delivery platform to empower our physicians to provide the highest quality of end-to-end care for their patients in a cost-effective manner. Our mission is to combine our clinical experience, best-in-class delivery network, and technological expertise to improve patient outcomes, increase access to healthcare, and make the US healthcare system more efficient. Our platform currently empowers over 20,000 physicians to provide care for over 1.7 million patients nationwide. Our rapid growth and unique position at the intersection of all major healthcare stakeholders (payer, provider, and patient) gives us an unparalleled opportunity to combine clinical and technological expertise to improve patient outcomes, increase access to quality healthcare, and reduce the waste in the US healthcare system.