Getting Ahead of the RADV Audit Curve

EDITOR’S NOTE: This piece on RADV audits, written by Frank Cohen, was published on RACmonitor on Aug. 25, 2025. It’s being republished on ICD10monitor because of recent interest in the topic.

In an ideal world, every diagnosis code you submit to the Centers for Medicare & Medicaid Services (CMS) would be backed by bulletproof documentation – the kind that would make any auditor nod in approval.

In reality, most plans are making thousands of these high-stakes bets every single day without realizing the magnitude of risk they’re assuming.

Risk Adjustment Data Validation (RADV) audits have been around long enough that most risk compliance teams treat them like routine fire drills: unpleasant, but manageable. What they don’t realize is that RADV has evolved into a multi-billion-dollar contest of statistical warfare, wherein arcane mathematical models determine winners and losers. And the stakes keep climbing every year.

Let me show you what this really means.

When Statistics Become Weapons

Say CMS randomly selects 201 of your members for review. Your group health plan has 50,000 members. You provide CMS with the medical records they request for those 201 members. Their auditors find that 8 percent of the diagnoses submitted lack appropriate documentation. Perhaps a provider coded diabetes with complications, but failed to document the specific complication. Maybe someone submitted a chronic kidney disease diagnosis based on a single lab value, without the required confirmatory test. These things happen.

An 8-percent error rate across 201 members doesn’t sound catastrophic, right? Think again.

CMS now extrapolates that error rate across your entire member population, using formulas that account for confidence intervals and stratification. Your 50,000-member universe suddenly comes under scrutiny, and that 8-percent error rate from your sample gets projected across thousands of beneficiaries as an estimated overpayment. I know of plans that received initial repayment demands exceeding $100 million after audits that examined fewer members than you’d find in a typical provider’s panel.

The extrapolation methodology itself becomes a battlefield. CMS might use simple random sampling, or they might stratify by risk score. They could calculate repayments using point estimates or confidence intervals. Each methodological choice can swing the final number by millions of dollars, and most plans lack the statistical expertise to mount an effective challenge.

The Analytics Arsenal You Need

This is where leading plans are completely revolutionizing their RADV preparation. They’re building analytics capabilities that rival those of quantitative hedge funds.

Consider predictive modeling. One plan I worked with developed a machine learning model that analyzed three years of historical audit results, identifying patterns invisible to human reviewers. Certain diagnosis combinations consistently raised red flags – not because they were clinically implausible, but because providers chronically failed to document them properly. The model could predict with 78-percent accuracy which members would likely fail a RADV review, enabling targeted documentation improvements before any audit letter arrived.

Running mock audits becomes powerful when done strategically. Don’t just randomly pull charts; use stratified sampling methods that mirror CMS’s approach. Run Monte Carlo simulations to understand your risk distribution. One organization discovered through simulation that their actual risk varied by $40 million depending on which sampling methodology CMS chose. Armed with that knowledge, they prepared defensive arguments for each scenario.

Natural Language Processing (NLP) has emerged as another game-changer, though not in the way vendors typically pitch it. Forget about using NLP to automate coding; that’s a compliance disaster waiting to happen. Instead, use it to scan thousands of medical records for documentation gaps. Does the note mention “diabetes” without specifying type? Is there a medication list suggesting heart failure without a corresponding diagnosis in the assessment? These patterns become crystal-clear when you process records at scale.

The Benchmarking Blind Spot

Here’s what keeps me up at night: most plans have no idea how their coding patterns compare to peers until CMS tells them. It’s like playing poker without looking at your cards.

Building benchmarking capabilities isn’t just about flagging outliers, though it’s certainly important when one provider codes every patient with morbid obesity while others in the same demographic code it for only 5 percent of patients. It’s about understanding the statistical distribution of coding patterns across similar populations. When your rate of coding major depression sits three standard deviations above the regional mean, you need ironclad documentation or an excellent explanation.

I recently analyzed coding patterns across five Medicare Advantage (MA) plans in the same metropolitan area. The variation was staggering; one plan’s rate of peripheral vascular disease diagnoses was 400 percent higher than another’s, despite nearly identical demographics. Care to guess which plan got audited first?

The Strategic Shift Nobody’s Making (But Everyone Should)

Most organizations still treat RADV as something that happens to them. CMS sends a letter, everyone scrambles, consultants profit, and fingers point in every direction.

But the smartest plans are flipping the script entirely.

They’re building what I call “continuous audit readiness” – real-time dashboards tracking documentation completeness, provider-level risk scores, and coding pattern anomalies. When something looks suspicious, they investigate immediately, not three years later, when CMS comes knocking.

They maintain statistical models of their repayment risk under different audit scenarios, updating them quarterly as new data flows in.

One innovative approach I’ve seen: creating an internal “red team” that conducts surprise mock audits using CMS methodology. No warning, no preparation: just a sudden request for records and a full validation review. The findings feed into systematic process improvements, rather than performance reviews.

After six months of this approach, one plan’s error rate dropped from 11 percent to 3 percent.

The Clock Is Ticking

CMS has signaled that they’re not just maintaining RADV audits; they’re expanding them. The new extrapolation methodology they’ve been testing could increase repayment amounts by 40 percent or more. The U.S. Department of Justice (DOJ) has started using RADV findings as ammunition in False Claims Act cases, where damages triple and executives can face personal liability.

Meanwhile, most MA plans are still treating this like a compliance exercise instead of an existential threat. They’re bringing conventional tools to a battle where CMS deploys advanced statistical weaponry.

Plans that survive and thrive will be those that recognize a fundamental truth: RADV audits are mathematical exercises disguised as medical reviews. The diagnoses and documentation matter, obviously, but the real battles are fought in the statistical models, the confidence intervals, and the extrapolation methodologies.

Reality Check

Every MA plan CEO should ask their team three questions right now:

1. Can you tell me, within a 95-percent confidence interval, what our RADV repayment risk is today? Not after receiving an audit letter – today, based on our current documentation and coding patterns?
2. If CMS pulled a sample tomorrow, would we have the analytical capability to validate their extrapolation methodology and propose alternatives if their approach is flawed?
3. Are we identifying and fixing documentation problems in real time, or are we just hoping to avoid an audit?

If the answer to any of these is “no” or “I don’t know,” then you’re facing serious financial exposure.

The good news? The analytical tools and techniques exist to master this challenge. The bad news? While you’re reading this, your competitors might already be implementing them.

The question isn’t whether you need sophisticated analytics for RADV; it’s whether you’ll build them before or after your first eight-figure repayment demand arrives.