Medicare Parts C and D Universal Audit Guide

Attachment VIII

2013 Program Audit Process

Center for Medicare
Medicare Parts C and D Oversight
g and
Enforcement Group
p
Division of Audit Operations

Contents
INTRODUCTION .............................................................................................................. 3
HOW SPONSORS ARE SELECTED FOR AUDIT ......................................................... 3
PLANNING AND PREPARATION .................................................................................. 4
WEBINAR & ON-SITE AUDIT ACTIVITIES (10 DAYS) ............................................. 5
POST AUDIT ACTIVITIES .............................................................................................. 6

Page 2 of 7

INTRODUCTION
The Centers for Medicare & Medicaid Services (CMS) Medicare Parts and D Overight
and Enforcement Group (MOEG) conducts program audits of Prescription Drug Plan
(PDP) and Medicare Advantage Organization (MAO) Sponsoring Organizations (SO)1
who enter into contracts with the Center for Medicare (CM). As in 2012, CMS updated
the 2013 program audit process based on comments received from the industry via email,
conference events, and the post audit questionnaire distributed at the conclusion of each
audit.
AUDIT MISSION, VISION AND GOALS
Mission:

To evaluate sponsors performance to ensure beneficiaries have access to
care.

Vision:

To drive the industry toward improvements in the delivery of health care
services in the Medicare Advantage and Prescription Drug program.

Goals:

1) Utilize a data driven process to select sponsors for audit
2) Audit performance areas related to beneficiary access
· Part D Formulary and Benefit Administration,
· Part C and D Organizational/Coverage Determinations, Appeals, and
Grievances (ODAG/CDAG),
· Part C and D Outbound Enrollment Verification (OEV)
· Part C and Part D Compliance Program, and
· Special Need Plan – Model of Care (if applicable).
3) Conduct outcome based audits and ensure non-compliant issues are
corrected.
4) Conduct industry-wide outreach and education on lessons learned from
the audits.
5) Engage in continuous process of improvement (i.e. survey sponsors,
track audit team performance, etc.).

HOW SPONSORS ARE SELECTED FOR AUDIT
In 2013, sponsors will be selected for audit based on at least one of the following
categories:
1. Routine Audits - Routine audits are scheduled throughout the year
a. High Star Rated Plans

1

Please note that the term “sponsoring organization” is used to refer to both PDPs and MAOs, and Section
1876 Cost Plans.

Page 3 of 7

b.

c.
d.

e.

1) A limited number of contracts with a 2013 Star Rating of greater
than or equal to 4.5 stars will be selected for audit.
Low Performing Icons (LPI)
1) All contracts with less than 3 stars for their Part C or D summary
star rating for at least 3 years will be selected for audit1.
High Risk Plans (CMS internal risk assessment results)
Sponsors not audited in last 3 years and don’t meet audit categories a-c
above.
1) Sponsors not audited in the past 3 years (2010 – 2012) may be
selected for audit. We will consider enrollment size, age of
contracts with CMS, and budget constraints to make our
determinations.
Regional Office Referrals
1) High increase in enrollment, CTM outlier, etc.

2. Ad Hoc Audits - Ad hoc audits are not scheduled like a routine audit. Ad
hoc audits are an oversight tool that allows MOEG to promptly act when
there is reason to believe that a sponsor is non-compliant with CMS
policy.
a. New PBMs to the program or sponsors that have changed PBMs.
b. Allegations, 3rd party reporting to CMS, self-disclosures, etc.

PLANNING AND PREPARATION
Pre-Audit Activities
x

Start Notice/Engagement Letter – The MOEG Audit Lead (AL) contacts the
SO’s compliance officer via phone and then sends an audit engagement letter
including protocols (see Appendix A and B of the HPMS memo) to the SO four
weeks prior to the first day of the audit. This communication notifies the SO that
they have been selected for audit. It specifies the areas for audit under
consideration. The letter also states when and where the audit will take place as
well as CMS requirements with regard to facility/records access, information
needed prior to the audit, on-site space requirements, key personnel and system
requirements.

x

Follow-Up Call – The MOEG AL conducts a follow-up call with the SO and the
audit team 1-2 days after the date of the engagement letter. The purpose of this
call is to review the audit process, timelines, and CMS expectations and address
any questions the SO may have regarding the audit process. Other details are
covered regarding CMS requirements mentioned in the engagement letter.

x

Universe Submission to CMS from the SO – Within 10 business days of
receiving the engagement letter the SO uploads all requested data to a Secure File
Transfer Protocol (SFTP) per instructions provided by the AL.
Page 4 of 7

x

Send SO Audit Schedule – CMS will send the SO a schedule of audit activities
for the week of the webinar and onsite audit (see Appendix C of the HPMS
memo). The schedule will be broken down per audit area and days of the week.

WEBINAR & ON-SITE AUDIT ACTIVITIES (10 DAYS)
One major enhancement to the 2013 audits will be an extension of the audit timeframe
from one week to two weeks. Specifically, the first week of audit will be kicked off by
an entrance conference, and the audit of all applicable operational areas (Part D
Formulary Administration; Part D Coverage Determinations, Appeals, and Grievances;
Part C Organization Determinations, Appeals, and Grievances; Part C and D Outbound
Enrollment Verification (OEV), and Special Need Plans – Model of Care) will be
conducted virtually via webinar2. During the second week, the audit lead and the Part C
and Part D Compliance Program Effectiveness team will arrive on-site to conduct the
audit of your compliance program effectiveness. This will allow the compliance officer
to be actively engaged during the audit of all operational areas and it will allow the audit
team to deliver more focused results in a timely manner.
x

Entrance Conference – The audit starts with an entrance conference held the
morning of the first day facilitated by the MOEG AL. The purpose of this
conference is to make introductions, review the CMS audit approach and
expectations, answer questions, and allow the SO to make a presentation on their
behalf regarding their company.

x

Conducting the audit week #1 – operational areas via webinar2 – Team
Leads (TL) conduct the audit using audit protocols and record audit results as
declared by the TL. TLs will review sample cases live in the SOs system and
determine findings in real time (although some determinations may be pending
depending on additional data requests). This allows CMS to be transparent with
potential audit failures. In addition, the SO is expected to provide any supporting
documentation as requested by CMS personnel. Week #1 will include an audit of
the operational of Part D Formulary Administration; Part D Coverage
Determinations, Appeals, and Grievances; Part C Organization Determinations,
Appeals, and Grievances; Special Need Plans – Model of Care.
CMS conducts the audits virtually through the use of secure webinar technology.
The MOEG AL is responsible for ensuring that all necessary technology,
including webinar rooms, conference lines, and physical rooms for team members
are set up appropriately. Webinar technology is tested prior to the start of the
audit. Expectations of staffing are the same for both physical and virtual audits.

2

Not all audits are conducted virtually. CMS reserves the right to conduct the audit onsite if need be.

Page 5 of 7

Findings are usually determined in real time as CMS and the SO discuss each
sample case.
x

Preliminary Exit Conference – occurs at the end of week #1 – CMS will
discuss the operational findings identified during the operational audit.

x

Conducting the audit week #2 - On-Site Compliance – The compliance team
will conduct management, board of directors, and staff interviews, operations and
system walk-throughs, as well as review samples. The logistics for these
activities are discussed prior to the on-site visit. Findings for compliance
elements are communicated as soon as CMS comes to a determination. CMS
will consider the results of the operational audit in week #1 during the evaluation
of the compliance audit. This portion of the audit will generally last 3-4 days.

x

Final Exit Conference – conducted at the end of week #2 - On the last day of
the visit the MOEG AL conducts an exit conference with the SO to provide audit
results and next steps. The SO is afforded the opportunity to ask questions about
the results and audit findings and provide any follow-up information as
appropriate. The goal during the audit is to be transparent so there are no
surprises at the exit conference.

POST AUDIT ACTIVITIES
x

Draft Audit Report Preparation and Issuance to SO – At the conclusion of the
audit, CMS prepares and issues a draft audit report (goal is within 60 days of the
conclusion of the audit). The SO has 5 business days to respond to the report with
comments to CMS. CMS will review the SO’s comments and determine if the
comments warrant a change to the report. CMS may disagree or agree with the
SOs comments. CMS has the final decision in making changes to the final report.

x

Issuing the Final Audit report and Corrective Action Requirement(s) – CMS
issues the final report (the goal is within 10 days from receiving the SO
comments) and provides the SO 90 days to correct any deficiencies (72 hours for
immediate corrective actions). SO may request more time if needed. Depending
on the results of the audits, SOs could expect an enforcement action (i.e., civil
money penalty (CMP), sanction, etc.).
o Immediate Corrective Action Required (ICAR) - If CMS identifies
systemic deficiencies during an audit that have the potential to cause
significant beneficiary harm (whether medical or financial) in the areas of
Part D prescription drug formulary administration (FA); Part D coverage
determinations, appeals, and grievances (CDAG); or Part C organization
determinations, appeals, grievances, the plan will be notified that it needs
to take immediate corrective action. Significant beneficiary harm exists if
the identified deficiency resulted in the plan’s failure to provide medical
services or prescription drugs, causing financial distress, or posing a threat
Page 6 of 7

to enrollee health and safety due to non-existent or inadequate policies &
procedures, systems, operations or staffing. The SO has 72 hours to
provide a corrective action submission to CMS and CMS will begin
validation immediately to ensure resolution.
o Corrective Action Required – SOs have 90 days to correct these types of
findings. Once the time period given to the SO to correct any deficiencies
has expended (or when the SO claims all deficiencies have been corrected,
whichever is earlier), the SO submits a corrective action summary and
CEO attestation to MOEG and their Account Manager (AM). The AM is
responsible for overseeing validation activities. Using the same protocols,
the AM will request a new universe and selects samples for review (via
desk review or webinar). If the review is via desk review, the samples will
be provided in advance to the SO. If the review is via webinar, the
samples will be provided the day of the webinar to review live in the
system.
x

Closing the Audit – Once it is determined that all deficiencies have been
corrected, the SO will receive a close out letter. If issues remain, the AM decides
next steps (i.e. escalating compliance actions from original audit, etc.).

Page 7 of 7