What should a risk adjustment coding audit checklist include for Medicare Advantage in 2026?

A risk adjustment coding audit checklist is a structured set of verification steps a clinic, care network, or Medicare Advantage (MA) organization uses before and after submitting Hierarchical Condition Category (HCC) codes that drive risk-adjusted payments. In 2026, with CMS conducting RADV audits on all MA contracts annually and enforcement actions like the Aetna upcoding settlement demonstrating real financial exposure, the checklist has shifted from an internal quality exercise to a compliance survival tool. This article walks through what belongs on the checklist, why each item exists, how to operationalize it, and where organizations most often fail.

Why Risk Adjustment Audits Have Intensified

Also worth reading: What is the definitive RPM compliance checklist for 2027 to ensure Medicare reimbursement and data security? · What is the definitive care coordination vendor evaluation checklist for clinics and care networks in 2026? · What is a CCM and RPM billing compliance checklist for 2026, and how do clinics avoid audits and denied claims?

The regulatory environment changed materially over the past several years. CMS finalized the RADV rule requiring extrapolation from audit findings, meaning a coding error found in a small sample can be projected across an entire contract year, multiplying a single documentation mistake into millions of dollars in repayment. The HHS Office of Inspector General has also published reports emphasizing prevention rather than after-the-fact recovery, signaling that OIG expects plans and their downstream provider groups to have proactive controls in place. Enforcement examples reinforce the stakes: Aetna's settlement of Medicare Advantage upcoding allegations showed that both payers and the provider organizations feeding them data share liability.

For clinics and care networks, this means the old model of annual retrospective chart reviews is no longer sufficient. Auditors now expect continuous validation, documented internal review processes, and evidence that unsupported codes were identified and removed before submission. A checklist formalizes that expectation into repeatable daily and monthly behavior. Without one, organizations tend to discover problems during an external audit, which is the most expensive possible moment to learn about them.

The Core Checklist: Pre-Submission Verification Items

The first tier of any credible checklist covers what happens before a claim or encounter record leaves your organization. Each item below should be verified for every encounter carrying a risk-adjustable diagnosis.

First, confirm the diagnosis is supported by the clinical note for the specific date of service. CMS requires that conditions coded for risk adjustment be documented in the patient's medical record by a qualified provider during a face-to-face encounter. Second, verify the condition meets the specificity threshold: 'diabetes' alone maps differently than 'type 2 diabetes with diabetic polyneuropathy,' and auditors reject codes that lack the documented complication detail. Third, check that the ICD-10-CM code was valid for the date of service, since code sets update every October 1 and stale mappings are a recurring error source. Fourth, confirm the provider signed and dated the note; unsigned notes are automatically invalid for risk adjustment purposes. Fifth, screen for excluded services — telehealth rules, certain non-face-to-face settings, and some provider types do not qualify depending on the plan's contract terms.

A sixth item often missed: reconcile against prior-year submissions. If a chronic condition such as CHF or CKD stage 4 was captured last year but disappears this year without documented resolution, either the current coding is incomplete or the historical coding was inflated. Both scenarios trigger scrutiny. Building this continuity check into the checklist catches recapture gaps worth meaningful per-member revenue while simultaneously flagging suspicious patterns early.

Post-Submission and Internal Audit Items

Verification does not end at submission. The second tier of the checklist governs ongoing self-audit activity. Organizations should sample a defined percentage of risk-adjusted encounters monthly — industry practice commonly ranges from 2% to 5% of high-risk HCC claims, weighted toward new diagnoses and high-weight categories. For each sampled chart, a credentialed coder or external reviewer independently reabstracts the diagnosis from the source documentation and compares it to what was submitted.

Discrepancy rates matter more than raw counts. A sustained error rate above roughly 5% on sampled charts suggests systemic issues in provider documentation or coder training, not random noise. Below 2%, the program is generally considered healthy, though even low rates warrant trend analysis by provider, clinic site, and code category. Every discrepancy should generate a documented finding, a root-cause note, and a corrective action with an owner and deadline. That paper trail is itself an audit artifact: when CMS or a payer comes knocking, demonstrable self-monitoring history materially improves your position and can influence whether findings escalate to extrapolation.

Internal Audit vs. External Vendor Review: Comparison

Most organizations eventually decide between building internal audit capacity and contracting outside reviewers. Both approaches work; they suit different scales and maturity levels.

The honest assessment: internal programs save money at steady state but struggle with independence, since coders auditing their own work or their colleagues' work face obvious conflicts. External vendors cost more per unit but bring benchmarking data across clients and can serve as a neutral buffer if findings ever become legal matters. Many mature organizations run a hybrid — internal pre-submission checks plus quarterly external validation samples of 200–500 charts.

Common Mistakes That Trigger Findings

Auditor reports and enforcement settlements point to a short list of recurring failures. Copy-forward documentation is the leading culprit: providers cloning prior notes without re-examining the patient, so a resolved condition persists in the record and gets coded year after year. Auditors specifically look for identical narrative text across visits and treat it as presumptive evidence of unsupported coding.

The second common failure is coding from problem lists rather than assessed diagnoses. An EHR problem list entry is not the same as a condition actively addressed during the encounter; CMS guidance requires the note to reflect evaluation, monitoring, or treatment. Third, organizations frequently ignore hierarchy logic — coding a lower-specificity diabetes code when the documentation supports a manifestation code, which undercodes and loses legitimate revenue, or conversely, capturing complications that were mentioned historically but never confirmed. Fourth, signature and attestation lapses: resident notes countersigned late, scribe documentation lacking provider authentication, or addenda added after claim submission dates that cannot be verified as contemporaneous. Fifth, and increasingly relevant, is over-reliance on natural language processing tools that suggest codes without human validation. NLP-assisted coding is legitimate and widely used, but every suggested HCC still needs a human confirming the underlying documentation supports it. Treating software output as final is exactly the pattern regulators cite when describing automation-driven upcoding.

When to Act: Timing Your Audit Cadence

Checklist execution follows a calendar tied to submission deadlines and regulatory cycles. Daily, front-line coders apply the pre-submission items at the point of charge capture. Monthly, the internal audit team runs its sample review and publishes discrepancy dashboards to medical directors. Quarterly, leadership should review trends by provider and initiate targeted education where individual error rates exceed thresholds — a provider with a 12% unsupported-code rate on heart failure charts needs coaching, not just a report.

Annually, align the program with two fixed dates. October 1 brings ICD-10-CM updates, so September is the window to remap code crosswalks and retrain staff. And because RADV audits can now target any contract year within the audit period, there is no statute-of-limitations comfort in old years; records retention policies should assume seven-plus years of retrievability. Organizations preparing for acquisition or investment face an additional trigger: due-diligence teams in health IT and care-coordination deals routinely request risk adjustment compliance documentation, error-rate histories, and repayment exposure estimates, so maintaining audit-ready records continuously protects transaction value.

Cost Considerations and Budgeting Reality

Budgeting for a risk adjustment audit program depends on scale. A single-site clinic with 3,000 MA-attributed members might spend $30,000–$60,000 annually combining part-time certified coder time and a modest external validation sample. A regional network with 50,000+ members typically budgets $250,000–$600,000 per year for full internal staffing, technology, and vendor reviews. These figures exclude the downstream cost of failed audits: extrapolated repayments, legal defense, and the reputational damage that accompanies publicized settlements.

There is a counterweight worth stating plainly: disciplined risk adjustment is also a revenue function. Accurate capture of supported HCCs frequently raises risk scores legitimately — studies of documentation-improvement programs commonly show 5–15% increases in properly supported risk scores among previously undercoded populations. The goal is accuracy in both directions, not minimization. A checklist that only strips codes out is as wrong as one that only adds them.

Operationalizing the Checklist in Care Coordination Workflows

For organizations running care-coordination programs, the checklist integrates naturally into existing touchpoints. Annual wellness visits and transitional care management encounters are prime risk adjustment opportunities because they involve comprehensive assessments anyway. Embedding the verification steps into care coordinator workflows — confirming active conditions, prompting providers to document status updates on chronic diseases, flagging patients whose risk score dropped unexpectedly — turns compliance into routine practice rather than a separate audit apparatus.

Technology helps here. Platforms that surface patient-level risk score changes, track open care gaps, and maintain audit trails of who validated which code reduce the manual burden considerably. But the tooling only works if the underlying discipline exists; software cannot make an undocumented condition supportable. The organizations that perform best treat the checklist as a shared responsibility spanning providers, coders, care coordinators, and compliance officers, with clear ownership assigned to each line item and executive visibility into the metrics. That governance structure, more than any single tool or tactic, is what distinguishes programs that pass audits from those that fund them.