Four open RADV audits: staffing and cost of a standing response program

A Medicare Advantage plan selected in every cycle now has four RADV audits open at once. PY2020 records went in on August 28 and findings are pending. PY2021 is in its record window, which closes November 6. PY2024’s window opened September 18 and closes February 5, 2027. PY2023 initiates in November. The audit calendar has no off-season anymore, and a response team built for one audit every few years was built for a different calendar.

Audit calendar: four years open, three more by spring

Sources: CMS RADV announcements, the audit schedule and Q&A updated August 28, and the January 2026 memo that set the quarterly cadence and restored what CMS calls the five-month window, measured from audit notice to deadline rather than from the window’s open date. The RADV Hub keeps this table current.

Record count: up to 1,020 retrievals per payment year for a three-contract plan

CMS publishes its sampling design, so the workload is knowable in advance. From the PY2024 methods and instructions: the ten largest contracts by sampling frame get 200 enrollees, and the rest split into thirds at 100, 50, and 35. A plan may submit a maximum number of medical records equal to twice the number of audited HCCs, and it must submit at least one valid record per HCC or the HCC is discrepant.

The hardship rules make the retrieval obligation heavier than the count suggests. Appendix B of the PY2024 document lists what does not qualify for an exception:

• providers not responding to a request;
• lost records;
• retired or deceased providers where state custodial rules have not lapsed;
• practice transfers and facility closures where custodial rules still apply;
• staffing problems;
• ordinary IT issues such as system upgrades, data migrations, and incomplete vendor handovers.

Plans must pursue records from every provider who saw the member for the audited condition, including custodians of closed practices, and document the effort. Record retention runs ten years under 42 CFR 422.504(d), and the PY2020 audit asked for 2019 dates of service.

Surge team: $100K–$150K per payment year, and a weaker packet

The model most plans run is a surge: an audit notice arrives, a team is assembled from coding, compliance, and a retrieval vendor, and it works the five-month window at full tilt. Here is an illustrative cost for the three-contract plan above, using round numbers you should replace with your own.

The direct cost is the smaller problem. The surge team assembles the evidence packet under deadline from whatever the retrieval vendor returns. It has no time to find the second record when the first is a problem list. It cannot fix a missing signature, because the only cure CMS accepts is its own attestation form, and it cannot ask a provider to amend anything once the audit has started. The packet reflects the state of documentation as it was, and for a 2019 or 2020 date of service that state is fixed.

Standing program: two to three people plus the engine

The alternative is to run the audit before CMS does. A year-round mock RADV samples each contract the way CMS samples (the frame criteria are in section 4 of the methods document, and the next article in this series covers them in detail on November 12), validates every sampled HCC against MEAT criteria and the CMS record rules, and builds the evidence packet at the time the code is validated. When the enrollee data list arrives in CDAT, the packet for most sampled HCCs already exists, and the retrieval effort concentrates on the ones that failed the internal check.

This changes the staffing question. The surge model needs a large team for five months and nothing in between. The standing model needs a small team all year: a coding lead who owns the sampling and validation cadence, a retrieval coordinator who works exceptions rather than lists, and a compliance owner for the reconsideration process. The plans we work with at this scale run it with two to three people plus the engine, and they treat each CMS audit notice as a reconciliation against work already done rather than as a project. The RADV readiness piece from December describes the clawback math the standing program is built to avoid.

It also changes the delete decision. A mock audit that finds an unsupported HCC in September gives the plan a choice CMS never offers: delete the code before the final submission deadline, or keep it and defend it. The two-way coding piece covers why that choice matters after the 2026 settlements. The surge model never sees the code until CMS has already sampled it.

Four operating details to get right now

• Register points of contact early. The PY2024 audit allows seven per contract, and the lead POC form has to come from the CEO, CFO, COO, or compliance officer. Processing takes up to five business days at the start of a cycle, and every day lost is a day off the record window.
• Suspend the right overpayment reporting. For enrollees in a sampled frame, 42 CFR 422.326(d) lets CMS direct a suspension of RAOR reporting and EDPS corrections, and the audit notice does. For everyone else in the audited contract, the 60-day report-and-return rule keeps running. Plans that suspend everything are late on the second group.
• Keep one record per file. CDAT accepts one medical record per coversheet, capped at 100MB, and a record that supports several audited HCCs should be submitted once with every applicable HCC designated on the coversheet. Duplicate submissions slow intake and confuse the feedback report.
• Read the intake feedback report daily during the window. Invalid submissions can be replaced while the window is open, and the reason codes in Appendix A (wrong record, missing signature, missing credentials, date outside the collection period, wrong source) are the same defects a mock audit would have caught six months earlier.

What to do this quarter

Model your own record count from the strata and the schedule, and put the direct cost next to the cost of a standing program. Then run one contract through a mock RADV on your own charts, inside your own environment, and count how many sampled HCCs already have a defensible packet. That number is the size of the surge you no longer need. The RADV workflow runs proactive mock audits and reactive audit responses on the same tooling. Run a mock RADV on one contract and see the count.

FAQ

How many RADV audits can be open at once in 2026?

Four, for a plan selected in each cycle: PY2020 (records submitted August 28, findings pending), PY2021 (record window closes November 6, 2026), PY2024 (window September 18, 2026 to February 5, 2027), and PY2023 (initiation scheduled for November 2026). PY2018 and PY2019 findings are also outstanding.

How many records does a RADV audit require?

Sample sizes are 200, 100, 50, or 35 enrollees by contract stratum, with a record allowance of twice the number of audited HCCs per enrollee. A contract with 100 sampled enrollees and three audited HCCs each can require up to 600 retrievals.

What does not qualify for a RADV hardship exception?

Providers not responding, lost records, ordinary IT issues, practice transfers, staffing problems, and practice transfers or closures where state custodial requirements still apply. Plans must pursue every provider and custodian and document the effort.

Can a plan fix documentation after its contract is selected?

No. Records cannot be amended and providers cannot be asked to amend them once an audit begins. A missing or illegible signature on an outpatient record can be cured only with the CMS-generated attestation form.

What is the reconsideration window after RADV findings?

Sixty days from issuance of the audit report package to request a Level One reconsideration of medical record review determinations or the payment error calculation, per CMS’s January 2025 reconsideration guidance, linked on the RADV Hub.

How does Martlet AI support a standing RADV program?

It samples contracts RADV-style, validates each sampled HCC against MEAT and CMS record rules, assembles the evidence packet at validation time, and models sample-only and extrapolated exposure per contract, all inside the plan’s environment.