RADV Audit and OIG: Understanding the Regulatory Landscape for MA Plans

CMS and OIG Roles in MA Oversight

A RADV audit is CMS's Risk Adjustment Data Validation mechanism for verifying that Medicare Advantage risk-adjusted payments are supported by clinical documentation, while the OIG independently investigates fraud, waste, and abuse in the MA program — together forming a dual-layered regulatory oversight structure that exposes plans to both payment recovery and potential False Claims Act enforcement actions.

Medicare Advantage risk adjustment is subject to oversight from two distinct federal entities that operate with different mandates, methodologies, and enforcement powers. Understanding the distinction between CMS and OIG roles is fundamental to building a compliance strategy that addresses both.

• CMS (Centers for Medicare & Medicaid Services): CMS administers the MA program, sets risk adjustment rules, and conducts RADV audits to validate that risk-adjusted payments are supported by clinical documentation. CMS RADV is fundamentally a payment accuracy mechanism — it seeks to ensure plans receive the correct payment, not more and not less
• OIG (Office of Inspector General): OIG operates independently of CMS with a mandate to detect and prevent fraud, waste, and abuse across all HHS programs. OIG investigations of MA risk adjustment go beyond payment accuracy to examine whether plans engaged in practices that systematically inflate risk scores through unsupported diagnoses
• DOJ (Department of Justice): While not an auditor, DOJ receives referrals from both CMS and OIG. False Claims Act cases against MA plans for risk adjustment fraud are filed by DOJ, often based on OIG investigative findings

The practical distinction matters because CMS RADV findings result in payment adjustments — the plan repays the overpayment amount. OIG findings can escalate to enforcement actions carrying treble damages, per-claim penalties, and exclusion from federal healthcare programs. A plan can survive a RADV repayment; a False Claims Act judgment is existentially threatening.

Both entities have significantly increased their MA risk adjustment oversight in recent years, reflecting bipartisan Congressional pressure to address what Government Accountability Office reports have described as billions in annual improper payments to MA plans.

The Evolving RADV Framework

The RADV framework has undergone significant evolution in recent years, with changes that dramatically increase the financial stakes for MA plans with documentation vulnerabilities.

• Extrapolation Implementation: The most consequential change in RADV history is the application of extrapolation to payment years 2018 forward. Previously, RADV recoveries were limited to the sampled members. Extrapolation projects findings across the entire plan population, multiplying potential recoveries by orders of magnitude
• Fee-for-Service Adjuster Elimination: CMS finalized the removal of the FFS adjuster that previously reduced RADV recovery amounts to account for coding differences between MA and Traditional Medicare. Without this adjustment, the full overpayment amount is recoverable
• Expanded Audit Scope: CMS has increased the number of plans selected for RADV each audit cycle and expanded the range of payment years subject to audit. Plans can now face concurrent audits covering multiple payment years
• Condition-Specific Targeting: Newer RADV methodologies allow CMS to target specific HCC categories with high error rates rather than relying solely on random sampling, increasing the probability that audited diagnoses will include the plan's most vulnerable conditions
• Contractor Audit Expansion: CMS has expanded the use of contracted audit firms to increase RADV throughput, enabling more simultaneous audits across the industry

These changes collectively transform RADV from a manageable cost of doing business into a potentially catastrophic financial event. Plans that previously calculated RADV exposure based on sampled-only recoveries must now recalculate using extrapolated projections that can be 50-100 times larger.

OIG Work Plan Priorities

The OIG Work Plan provides the clearest signal of upcoming enforcement priorities. MA risk adjustment has been a consistent focus area, with several specific initiatives that plans should monitor.

• Chart Review Organization Practices: OIG has flagged third-party chart review vendors as a specific audit target, examining whether vendor practices inflate HCC capture through aggressive coding that is not supported by clinical documentation
• In-Home Health Risk Assessment Programs: Health Risk Assessments conducted in member homes have been identified as a significant source of unsupported diagnoses. OIG has conducted multiple investigations into HRA programs that generate conditions not subsequently treated or confirmed by treating providers
• Encounter Data Completeness: OIG is examining whether MA plans submit complete and accurate encounter data, including whether plans selectively submit encounters that maximize risk scores while omitting encounters that might reveal lower acuity
• Provider Incentive Arrangements: Compensation arrangements that incentivize providers to code specific conditions are under scrutiny, particularly where incentive structures create financial motivation to code conditions that may not be fully supported
• High-Value HCC Patterns: Specific condition categories with the highest RAF coefficient values and the highest error rates — including major organ transplant status, vascular conditions, and certain metabolic disorders — receive disproportionate OIG attention

Plans should review the OIG Work Plan annually and assess their internal practices against each identified priority. A practice that appears in the Work Plan is one that OIG has already identified as problematic — the question is not whether audits will occur but when.

Recent Enforcement Actions

Recent enforcement actions provide concrete examples of the regulatory risks that MA plans face. These cases establish precedent and signal the enforcement patterns that will continue into 2027 and beyond.

• False Claims Act Settlements: Multiple MA plans have settled False Claims Act cases alleging systematic risk adjustment fraud for amounts ranging from tens of millions to over a billion dollars. These settlements typically involve allegations that plans knew about unsupported diagnoses in their submissions and failed to correct them
• Whistleblower-Initiated Cases: A growing percentage of MA risk adjustment enforcement actions originate from qui tam (whistleblower) lawsuits filed by former employees of plans, coding vendors, or provider organizations. These insiders provide specific knowledge of practices that inflate risk scores
• Chart Review Vendor Actions: Several third-party chart review organizations have faced enforcement actions for coding practices that systematically inflated HCC capture rates beyond what medical records supported
• HRA Program Findings: OIG reports have identified specific MA plans where in-home HRA programs generated diagnoses that were never subsequently confirmed by treating providers, resulting in unsupported RAF score increases
• Self-Disclosure Outcomes: Plans that self-disclosed risk adjustment overpayments have generally received more favorable treatment than those identified through external audit, reinforcing the value of proactive compliance programs

The trajectory is clear: enforcement actions are increasing in frequency, severity, and scope. The era where RADV was an infrequent, limited-impact event is definitively over. Plans that treat compliance as optional or aspirational face existential financial risk.

What This Means for 2027

The regulatory landscape heading into 2027 presents MA plans with a more demanding compliance environment than any prior period. Several converging factors define the challenge.

• Full V28 Audit Exposure: 2026 is the first payment year under 100% V28. RADV audits of 2026 encounters will apply V28's new HCC categories and coding requirements, meaning plans are being audited against a model they have only operated under for one year
• Extrapolation Normalization: Extrapolation is no longer a theoretical future risk — it is current policy. Every diagnosis submitted today carries the potential for extrapolated recovery if it fails RADV validation. This fundamentally changes the risk calculus for every coding and documentation decision
• OIG Resource Expansion: Congressional appropriations for OIG MA oversight have increased, funding additional investigators, analysts, and audit contractors. More resources mean more audits, more investigations, and faster enforcement timelines
• Data Analytics Capability: Both CMS and OIG are deploying advanced data analytics to identify plans with anomalous coding patterns, enabling more targeted and efficient audit selection. Plans that relied on the low probability of selection as a de facto compliance strategy will find that probability increasing
• Industry Consolidation Effects: MA plan consolidation creates larger audit targets where findings at a single entity affect more members, increasing the extrapolation base and the absolute dollar exposure per audit

The message for 2027 planning is unambiguous: compliance infrastructure must be treated as core operational capability, not overhead. The plans that invest in RADV exposure reduction today will be the ones that avoid the existential-level enforcement actions of tomorrow.

Staying Ahead of Regulatory Changes

Proactive compliance requires ongoing monitoring and rapid adaptation to regulatory changes. Plans that react to enforcement actions after they occur are always playing defense. Those that anticipate changes gain strategic advantage.

• Regulatory Intelligence Program: Assign dedicated staff to monitor CMS final rules, proposed rules, OIG Work Plan updates, DOJ press releases, and Congressional hearing transcripts for signals about upcoming enforcement priorities
• Internal Mock Audits: Use a risk adjustment analytics platform to conduct quarterly mock RADV audits using CMS sampling methodology against your own data. If your internal error rate exceeds 5%, your documentation practices need immediate intervention before CMS finds the same issues
• Pre-Submission Scrubbing: Implement diagnosis code validation that catches the same issues RADV auditors find — unsupported diagnoses, insufficient specificity, non-qualifying encounter types — before data reaches CMS
• Vendor Oversight: If you use third-party chart review or HRA vendors, audit their practices with the same rigor CMS would apply. Your plan is liable for vendor coding decisions submitted under your organization's name, regardless of who made the coding determination
• Self-Disclosure Readiness: Establish a protocol for self-disclosing overpayments when internal audits identify systematic issues. Self-disclosure before external audit discovery demonstrates good faith and typically results in more favorable outcomes
• Board-Level Reporting: Elevate RADV compliance reporting to the board level. The financial exposure from RADV extrapolation is material to organizational viability, and board members have fiduciary obligations to understand and oversee this risk

The organizations that navigate the 2027 regulatory landscape successfully will be those that built their compliance infrastructure in 2025 and 2026. Compliance readiness is not something that can be achieved in response to an audit notification — it must be embedded in operations well before the auditor arrives.