Few topics draw a risk adjustment audience like RADV, and the second CMS session at The 27th Risk Adjustment Forum in Orlando put attendees in front of the team running the audits. Sophia Autrey, Deputy Director of the Division of Medicare Advantage Audits (DMAA) at CMS, walked through how far audit volume has grown, why the schedule runs out of order, where automation fits and where people take over, and what plans get wrong most often when they submit medical records. Ana Handshuh, Principal at CAT5 Strategies, moderated the Q&A.
Autrey opened with a clear disclaimer, noting the session offered an operational view current as of the presentation, official CMS guidance governs, and active litigation over RADV and extrapolation was off the table for detailed discussion.
From dozens of contracts to hundreds
Autrey leads a 12-person team inside the Audits and Vulnerabilities Group of the Center for Program Integrity, responsible for RADV execution, policy, program design and data infrastructure. Her team is carrying out the plan CMS announced in May 2025, which moved RADV from roughly 30 to 60 contracts per payment year to more than 500, replaced a flat sample of about 30 enrollees per contract with a tiered sample of 35 to 200 based on sampling frame size , and set a quarterly launch cadence to work through a backlog of five to seven years.
The PY 2024 audit, launched in August, covers 590 contracts. Autrey traced how the program reached this point, evolving from random sampling of all RADV eligible enrollees within an audited contract of the early 2010s to random sampling within targeted sub cohorts of RADV eligible enrollees most at risk for being associated with overpayments. She shared how CMS first used this risk-based approach in the PY 2014 and PY 2015 audits and further explained why sharper targeting lets CMS find overpayments without pulling larger samples from each plan.
Why the schedule skips around
Attendees tracking the calendar have noticed CMS launching payment years out of order, with PY 2024 starting before PY 2022 and PY 2023. Autrey explained the sequence is a function of data processing and readiness, and that CMS aims to use the best available transactional data when pulling audit samples to try and minimize asking plans to find medical records for members whose coverage or diagnoses may have changed or been deleted. CMS publishes the live schedule on its website, with PY 2023 next on the list, PY 2022 expected in early 2027 and PY 2025 to follow in the spring.
Once the backlog clears, Autrey described a steady state of one audit cycle per year, continued data refreshes before payment calculations, targeting of high-risk subgroups instead of entire contracts, and Audit Methods and Instructions documents published for each payment year.
Where automation stops and people take over
CMS asked the industry for input on AI and automation through a request for information, and Autrey sorted the responses into three groups: hybrid models pairing automation with human clinical judgment, commercial off-the-shelf tools needing custom work for CMS systems, and fully automated end-to-end solutions.
Today, robotic process automation runs only at record intake, inside the Central Data Abstraction Tool (CDAT), where the system checks for signatures, complete documentation and valid dates of service and gives plans fast feedback on whether a record moves on to diagnosis abstraction. No automation touches coding, and every rejection goes to a human reviewer before the plan hears about the result.
“A human is always looking at everything that is a negative response in our system currently.”
Autrey pointed to the temporary flexibilities CMS allowed during the COVID-19 public health emergency as the kind of policy nuance a human reviewer catches and a rules engine misses. Any future use of AI in abstraction, she said, will support reviewers and leave final and adverse decisions with people.
Three misconceptions CMS wants to clear up
A portion of the session addressed assumptions Autrey hears often from plans:
- CMS audits every contract. Hundreds of active contracts go unselected each year, and selection depends on a concentration of high-risk enrollees.
- An audit covers the whole contract. CMS samples from a defined, high-risk sampling frame, and findings and any extrapolation apply to the frame alone.
- CMS collects on codes a plan deleted before the deadline. Autrey explained how CMS reconciles data with the Center for Medicare before running payment error calculations, and how a deleted code interacts with other diagnoses mapping to the same HCC.
The submission habits Autrey flagged
The most practical part of the hour covered the medical record errors and timing problems CMS sees across plans. Autrey described how much control plans hold over the submission window, including the limit on records per HCC and the option to replace a rejected record while the window stays open, and why most plans lose the benefit of fast validation by waiting until the final weeks. She also addressed a provider workflow mistake serious enough to disqualify a record outright, along with the documentation elements CMS wants plans to confirm before upload.
What the Q&A covered
Handshuh’s questions went straight to the topics on the room’s mind. On the timing of collections on extrapolated findings, authorized beginning with PY 2018, Autrey answered within the limits of the pending litigation.
“We will only do what we are legally allowed to do.”
She also explained the safeguards CMS uses when a plan faces an OIG review and a RADV audit for the same payment year, and how a plan’s results in completed audits feed the machine learning models CMS uses to select contracts in later cycles. For a room full of risk adjustment and coding leaders, the session offered something rare, a direct look at how the agency running RADV thinks about volume, accuracy and fairness, from the people doing the work.
RADV readiness anchors the risk adjustment track at RISE National 2027, March 16-18 at Caesars Forum in Las Vegas, where risk adjustment, compliance and audit leaders compare notes on the next round of audits.