Last Call: CMS Program Audit Protocol 30 Day Comment

Since this is one of the most restful times for compliance professionals (insert sarcasm face here), you may all have plenty of time to review the most recent release of the Centers for Medicare & Medicaid Services (CMS) program audit protocol package. On Friday, CMS released a memo announcing the opportunity for the industry to provide comment.


  • Audit letters are to be sent between March and July 2020. There are 25 parent organizations set to undergo routine audit in 2020.
  • In response to the August release, the agency received 109 unique comments and adopted many suggestions, such as removing columns no longer needed.
  • Guidance on the process for reviewing the Employee and Compliance Team and first tier entity samples was provided in the CPE audit process and data request document. This methodology has continued to evolve over the years, and certainly the industry should be pleased with this clarification.
  • Every audit area has been updated with refined data requests and/or revised instructions. CDAG and ODAG specifically have been updated to align with the Part C and D Enrollee Grievances, Organization/Coverage Determination, and Appeals guidance. For example, edits were made to accommodate revised notification requirements and exclusion of withdrawn cases.
  • CMS is accelerating the timing of scheduling of universe integrity testing. The worst-case scenario mailing policy has also been removed from their guidance.
  • The agency also removed reference to Tracer Case Summary Evaluations during Phase II, Audit Field Work, although reference to the onsite review remains. They did not provide clarification in the data request as to whether sponsor has a choice to provide only the tracers or also the supporting documentation ahead of time.
  • Additional detail is provided relating to an audit’s impact on Past Performance Reviews. This clarification should be evaluated for those organizations considering new applications or expansions.

There are also a number of requests and comments not addressed. For example, one sponsor requested CMS provide Excel versions of the universe tables. Another sponsor suggested changing a dismissal column to a streamlined, numerical field to indicate type of request dismissed (such as 1 for grievance, 2 for pre-service organization determination, and so on).

Make sure you send this revised draft package to your key business partners who typically participate in the audit process, including anyone involved in data preparation in the organization and at your delegates. Now is the time to request additional clarification or changes.  Feedback is due on January 27. Happy reading!