The Compliance Program Effectiveness Test: Lessons from a Recent OIG Medicare Advantage Audit for RADV Readiness, Governance, and Enterprise Risk

Executive Summary

The recent OIG audit of a Medicare Advantage organization provides an important reminder for Medicare Advantage organizations: compliance programs are increasingly being evaluated not by whether they exist, but by whether they effectively identify and mitigate areas of highest risk. OIG acknowledged that the organization had numerous compliance activities in place yet concluded that its policies and procedures designed to prevent, detect, and correct noncompliance could be improved.

For compliance officers, board members, and risk adjustment leaders, this report is more than an audit of a single organization. It offers insight into how regulators may evaluate compliance program effectiveness as CMS oversight expands and RADV audits continue to evolve.

What OIG Found

The audit recognized that the organization maintained several foundational compliance controls, including provider education, coding guidance, and internal medical record reviews designed to assess diagnosis coding accuracy. OIG acknowledged that these activities were intended to ensure compliance with federal requirements.

The organization’s compliance framework included:

• Provider education programs promoting accurate diagnosis coding
• Guidance regarding multiple risk adjustment diagnoses
• Coding review guidance for internal coding staff
• Internal medical record reviews comparing submitted diagnosis codes with supporting documentation

However, OIG identified a critical weakness. Although the organization conducted internal medical record reviews, those reviews were not specifically focused on diagnosis categories identified as having a heightened risk of miscoding. OIG concluded that the organization’s compliance activities were not sufficiently targeted toward areas of elevated risk.

The report states:

However, based on our assessment of the procedures that were in place during our audit period, and because the diagnosis codes for 178 of the 220 sampled enrollee-years were not supported by medical records, we believe that the plan’s compliance procedures to prevent, detect, and correct incorrect high-risk diagnosis codes could be improved.

Compliance Programs Exist. Effectiveness Is the New Standard.

The most important takeaway is that OIG acknowledged the existence of compliance controls yet still concluded that the organization’s compliance procedures could be improved.

Historically, Medicare Advantage organizations have focused on building comprehensive compliance infrastructures through policies, procedures, provider education, coder guidance, retrospective audits, and monitoring activities. These remain essential components of a mature compliance program. The audit, however, underscores the importance of determining whether those activities effectively address known areas of risk.

The Financial Stakes Have Changed

The audit arrives during a period of heightened attention to risk adjustment accuracy and payment integrity within Medicare Advantage. Unsupported diagnoses create exposure that extends well beyond a compliance finding.

Coding inaccuracies may result in:

• Repayment obligations associated with unsupported diagnoses
• Increased audit activity and regulatory oversight
• Operational disruption related to corrective action
• Reputational concerns among regulators and stakeholders
• Enterprise risk implications affecting revenue integrity and strategic planning

As RADV oversight continues to evolve, coding vulnerabilities increasingly represent enterprise risk concerns that warrant the attention of executive leadership and boards of directors. Every organization has some degree of coding error risk. For boards and executive leaders, the more important question is whether the organization can demonstrate an effective system for identifying and correcting those errors before regulators do.

The Audit Through a RADV Lens

One of the most notable aspects of this audit is that OIG evaluated not only coding outcomes but also the effectiveness of oversight processes. OIG acknowledged provider education, coding guidance, and internal review activities, yet questioned whether those activities were sufficiently focused on diagnoses carrying the greatest risk.

This observation has direct implications for organizations preparing for current and future RADV scrutiny.

Leadership teams should consider:

• Are high-risk HCCs receiving enhanced monitoring?
• Do internal audit methodologies align with regulatory priorities?
• Are unsupported diagnosis trends identified promptly?
• Are compliance resources concentrated in areas of greatest exposure?
• Would internal reviews identify the same vulnerabilities that OIG or RADV auditors would target?

Organizations unable to answer these questions confidently may face greater financial and compliance risk than they realize.

Why Boards Should Pay Attention

Board oversight responsibilities continue to evolve as regulators increasingly examine not only coding accuracy but also the effectiveness of management’s compliance and risk adjustment oversight processes.

Board members should understand:

• Whether risk adjustment controls align with areas of highest risk
• How management identifies unsupported diagnoses before external review
• Whether monitoring activities are risk-based rather than primarily random
• How audit findings drive corrective action and process improvement
• Whether the organization can demonstrate compliance program effectiveness

Board members should oversee not only the structure of the compliance program but also management’s ability to demonstrate that its controls mitigate regulatory and financial risk. The audit serves as a reminder that an organization may have an extensive compliance infrastructure and still face questions about whether its controls are sufficiently targeted and effective.

Five Questions Every Compliance Officer, Risk Adjustment Leader, and Board Member Should Be Asking

From Compliance Activities to Compliance Effectiveness

The audit illustrates an important evolution in Medicare Advantage oversight. Compliance maturity is measured not only by the presence of controls but also by whether those controls effectively prevent, detect, and correct errors in known risk areas.

Organizations that rely primarily on broad compliance activities may remain vulnerable despite having established compliance frameworks. Those best positioned for future scrutiny will continually evaluate control effectiveness, align oversight efforts with high-risk diagnoses, and address vulnerabilities before regulators identify them.

Key Takeaway

The audit was not simply an assessment of coding accuracy. It was an assessment of compliance program effectiveness.

As Medicare Advantage organizations navigate an increasingly complex oversight environment, the critical question is no longer whether compliance controls exist. The question is whether those controls are sufficiently targeted, effective, and defensible when examined through a regulatory lens. Organizations that proactively test their controls through independent assessments, mock audits, and risk-based monitoring will be better positioned to protect revenue, strengthen governance, reduce regulatory exposure, and demonstrate compliance effectiveness before regulators arrive.

[1] Medicare Advantage Compliance Audit of Specific Diagnosis Codes That HumanaChoice (Contract H5216) Submitted to CMS, A-05-24-00010