RADV Audits: What payers and risk-bearing providers need to know

A Risk Adjustment Data Validation (RADV) audit is a regulatory mechanism for confirming that the HCC diagnosis codes submitted for a Medicare Advantage member are actually supported by the medical record. Every HCC that influences a member's risk score has to trace back to clinical documentation from a qualifying valid, face-to-face encounter. Evidence must be coded to the highest level of specificity during the correct payment year. When a RADV audit determines that an HCC code is unsupported by clinical documentat, the code and the payment tied to it are reversed.

CMS runs RADV audits directly against Medicare Advantage Organizations (MAOs) at the plan level. Plans, in turn, run their own retrospective validation audits against the provider groups and delegated risk entities they contract with, since any repayment CMS assesses against the plan is ultimately traceable to the charts and coding practices of the providers submitting those diagnoses. If you're a payer, RADV is a direct financial and regulatory exposure. If you're a risk-bearing provider group, it's exposure by extension — through the audit and recoupment terms in your delegated risk or shared-savings contract.

{{CTA-BLOCK}}

How RADV audits work at the plan level

CMS selects a sample of enrollees from a plan's population, pulls the medical records supporting each enrollee's submitted HCCs, and has clinical reviewers determine whether the documentation meets CMS coding guidelines. Historically, CMS limited recovery to the dollar value of unsupported diagnoses found in the sample itself — a small fraction of a plan's total membership. Under the extrapolation methodology CMS finalized in 2023, an error rate found in the audited sample can instead be applied across the plan's full RADV-eligible population, turning a sample-level finding into a plan-wide repayment obligation. That methodology has since faced legal challenges, and portions of the 2023 rule have been vacated and are under CMS appeal, so the exact extrapolation mechanics remain somewhat unsettled — but CMS has been clear that RADV audits, and some form of extrapolated recovery, aren't going away. Plans and their delegated provider groups should expect repayment exposure at scale, not just at the sample level, to be the durable baseline going forward.

Consequences of a failed RADV audit

When a chart doesn't hold up under RADV review, the consequences extend well beyond a single reversed code:

• Extrapolated repayment. Under an extrapolated finding, an error rate identified in a few hundred sampled charts can be applied to tens of thousands of RADV-eligible members, turning a handful of documentation gaps into a repayment obligation several orders of magnitude larger than the sample itself.
• Downstream recoupment for delegated providers. Plans typically pass some or all of an audit-driven repayment obligation through to the provider group or IPA that submitted the underlying diagnosis, per the terms of the risk-sharing or delegated risk contract — meaning a provider-level documentation gap can surface as a payer-level financial hit that then flows back down.
• Increased audit frequency and scope. Plans and provider groups with a history of audit findings are more likely to be selected for future audits, and to see larger sample sizes and closer scrutiny of the specific HCCs where prior findings occurred.
• Corrective action plans and compliance burden. A failed audit typically triggers a CMS-mandated corrective action plan, which adds ongoing reporting and internal audit obligations on top of the repayment itself.
• Reputational and contracting risk. Persistent audit findings can affect a plan's standing in contract negotiations with delegated provider groups, and in some cases factor into broader CMS program integrity reviews.

How charts get selected for audit

Selection isn't random. CMS and plans typically weight sampling toward members with unusually high risk scores, HCCs with a documented history of coding errors, and diagnoses where the line between "documented" and "clinically supported" is easy to blur — conditions like morbid obesity, major depressive disorder, and vascular disease. Provider groups with rapid RAF score growth, coding concentrated in a narrow set of HCCs, or heavy reliance on prospective risk adjustment (codes added via an annual wellness visit rather than confirmed across the year) tend to draw closer scrutiny from both CMS and the plans they contract with.

What RADV audit reviewers look for

A RADV reviewer isn't just confirming a diagnosis code appears somewhere in the chart. They're checking that the documentation:

• Comes from an acceptable encounter type (typically a face-to-face visit with a physician, NP, or PA)
• Is dated within the correct payment year
• Reflects the condition as actively monitored, evaluated, treated, or managed — not just carried forward from a prior note or listed on a problem list
• Supports the specific ICD-10 code billed, at the correct level of specificity

Documentation that fails on any of these points gets the code reversed, regardless of whether the diagnosis is clinically accurate.

How payers and providers can reduce exposure before an audit happens

For payers, the highest-leverage move is validating delegated providers' documentation against RADV standards continuously, rather than relying on periodic sample audits to catch problems after they've already accumulated across a full payment year. For provider groups, that means treating every chart supporting an HCC code the way an auditor would — checking encounter type, date, specificity, and active-management language before the code is ever submitted, not after a repayment letter arrives.

How Charta reduces RADV exposure

Charta's risk adjustment platform does this automatically on the provider side, reviewing every chart against HCC documentation standards before codes go out the door, with direct citations back to the supporting note for every HCC captured. On the payer side, Charta's RADV audit management tools apply the same documentation-validation logic across a plan's delegated network, surfacing unsupported codes before CMS or an internal audit team does. That gives both sides a defensible audit trail on every HCC — not just the ones that happen to get pulled for review — and meaningfully fewer surprises when an audit letter arrives.

Learn more

To learn more about Charta's risk adjustment and RADV audit management solutions, request a demo from a member of our team today.