Director - Internal Audit Operations

Job Description

Job Description

Description

Astrana Health is a physician-centric, technology-powered healthcare company built to deliver accessible, high-quality, high-value care. We have grown quickly, through both organic expansion and acquisition, across multiple states, lines of business, and delegated arrangements. That growth has outpaced the maturity of some of the operating controls that sit underneath it.

The Director, Internal Audit Operations owns the operational side of Astrana's internal audit function. Where financial and SOX audit answers whether the numbers are right, this role answers whether the operating processes that produce those numbers, and the outcomes patients and health plans depend on, are actually working as designed. That means auditing claims and encounter processes, utilization and care management, credentialing, provider data, revenue cycle, delegated oversight, and the integration of newly acquired organizations onto Astrana's platforms.

This is a builder's seat rather than a caretaker's. You will design the operational audit plan, run the engagements, and stand behind the findings in front of business leaders who own the processes you are testing. The value of the role is not the report; it is whether the process is measurably better six months later. We are looking for someone who is comfortable being both rigorous and useful, and who can hold a hard finding without losing the relationship.

This role is positioned to be independent of the functions it reviews. It reports functionally to the Audit Committee of the Board of Directors, with an administrative reporting line to the Chief Accounting Officer. The annual audit plan is approved by the Audit Committee, and material changes to scope are taken back to the Committee. Findings are reported without management filtering.

What You'll Do

Audit Planning & Risk Assessment

• Build and maintain a risk-based operational audit plan covering claims, encounters, utilization and care management, credentialing, provider data, revenue cycle, delegated functions, and vendor oversight.
• Conduct an annual operational risk assessment across markets, entities, and lines of business, and refresh it as the portfolio changes through acquisition and new health plan arrangements.
• Prioritize audit coverage by financial exposure, regulatory consequence, patient impact, and control maturity rather than by cycle habit. Weight coverage toward the areas where the company carries the most risk, including full-risk capitated arrangements.

Audit Execution

• Lead operational audits end to end: scoping, walkthroughs, control identification, sampling, testing, workpaper documentation, and reporting.
• Test the accuracy and timeliness of core operating processes, including claims adjudication and payment integrity, encounter submission and acceptance, authorization and denial handling, credentialing and re-credentialing, and provider roster accuracy.
• Audit the completeness and accuracy of the claims and membership data that support actuarial reserve estimates, including source system reconciliation and claims lag and inventory integrity.
• Audit risk adjustment operations, including diagnosis coding accuracy, chart review and retrieval processes, encounter data completeness and acceptance, and readiness for risk adjustment data validation audits.
• Audit the operational inputs to risk pool and shared-risk settlements, including partner reporting, supporting claims and utilization data, and settlement timeliness against contractual windows.
• Audit compliance with delegated and regulatory requirements applicable to Astrana's arrangements, including CMS, DMHC, DHCS, and health plan delegation standards, and coordinate with Compliance to avoid duplicative testing.
• Use data analytics against full populations rather than small judgmental samples wherever the data supports it, and build repeatable tests that can be re-run on a schedule.
• Perform post-close operational reviews of acquired organizations to confirm that controls, workflows, and system configurations were actually implemented as the integration plan described.

Findings, Reporting & Remediation

• Write findings that state the condition, the quantified impact, the root cause, and a recommendation an operator can act on, with a named owner and a committed date.
• Present audit results and thematic risk trends to executive leadership and to the Audit Committee.
• Track remediation to closure and independently validate that corrective actions worked, escalating items that stall or recur.
• Identify systemic themes across engagements, including manual workarounds, undocumented processes, system configuration gaps, and unclear ownership, and raise them as enterprise issues rather than isolated exceptions.

Function Building & Partnership

• Establish and document audit methodology, workpaper standards, quality review, and reporting cadence consistent with IIA standards.
• Partner with Finance and SOX audit so operational and financial control coverage are complementary and gaps do not fall between the two.
• Advise business leaders on control design for new processes, new markets, and new health plan arrangements before problems are built in.
• Manage, mentor, and develop audit staff and co-source resources as the function scales.
• Maintain the internal audit charter, present the annual risk-based audit plan to the Audit Committee for approval, and report plan completion, findings and remediation status to the Committee on its cycle.
• Arrange periodic external quality assessment of the function consistent with professional standards, and run internal quality review between assessments.
• Support fraud, waste and abuse work and investigations arising from hotline intake or audit findings, and coordinate with Compliance and Legal on referral and escalation protocols.

Qualifications

• Bachelor's degree in Accounting, Finance, Business, Healthcare Administration, or a related field, or equivalent practical experience.
• 10+ years of internal audit, operational audit, compliance auditing, or process improvement experience, including experience leading engagements end to end.
• Healthcare experience in a health plan, IPA, MSO, provider organization, or healthcare-focused advisory practice.
• Working knowledge of core healthcare operating processes such as claims, encounters, utilization management, credentialing, provider data, or revenue cycle.
• Demonstrated ability to quantify the impact of a control failure and defend the analysis to the leaders who own the process.
• Strong analytical skills, including SQL or comparable data tools, and the ability to work independently against large and imperfect operational datasets.
• Excellent written and verbal communication, with experience presenting to senior executives and governance committees.
• Sound judgment and independence, with the credibility to deliver an unwelcome finding and keep the working relationship intact.

Preferred

• CIA, CPA, CISA, CHC, or CFE certification.
• Experience with delegated oversight audits under CMS, DMHC, DHCS, or NCQA delegation standards.
• Experience auditing or operationalizing controls in a post-acquisition integration.
• Familiarity with value-based care economics, including capitation, shared savings, risk pools, and incentive programs.
• Experience building an operational audit function or a materially expanded audit plan from a limited starting point.
• Proficiency with audit management platforms and BI tools such as Power BI or Tableau.

Environmental Job Requirements and Working Conditions

• This position is in office with the option to be hybrid. The office is located at 1668 S. Garfield Ave. 2nd Floor, Alhambra, CA 91801. 
• The national target pay range for this role is $180,000 to $200,000. Actual compensation will be determined based on geographic location (current or future), experience, and other job-related factors.

Astrana Health is proud to be an Equal Employment Opportunity and Affirmative Action employer. We do not discriminate based upon race, religion, color, national origin, gender (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics. All employment is decided on the basis of qualifications, merit, and business need. If you require assistance in applying for open positions due to a disability, please email us at View email address on ziprecruiter.com to request an accommodation. 

 

Additional Information: 

The job description does not constitute an employment agreement between the employer and employee and is subject to change by the employer as the needs of the employer and requirements of the job change.