Supporting Statement Part A

Medicare Parts C and D Program Audit Protocols and Data Requests

CMS-10191, OMB 0938-1000

Note: This information collection request was originally approved by OMB in 2016 under the title,
“Medicare Parts C and D Program Audit Protocols and Data Requests, CMS-10191, OMB
09381000”and is scheduled to expire on April 30, 2020. CMS proposed to extend the current
instruments for one year (with minor updates) in a 60-day notice that was published in the Federal
Register on August 16, 2019.

In this 30-day notice, we address public comments that were received in response to the August 16,
2019 notice. If approved by OMB, this iteration would incorporate any resultant revisions and
extend the expiration date through April 30, 2021. The OMB control number and the CMS ID
number are unchanged. Additional changes are discussed below under section 15.

In addition, on December 6, 2019, we published a new collection request under OMB control
number 10938-NEW (CMS-10717) that reflects the recent regulatory changes and strikes a better
balance between simplifying the data collection tools, minimizing the number of system changes,
and providing sufficient time to implement needed system changes. If approved by OMB, the new
collection request would be implemented for use beginning in audit year 2021. That collection
request is available at: https://www.cms.gov/Regulations-and-
Guidance/Legislation/PaperworkReductionActof1995/PRA-Listing.

Background

Under the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 and
implementing regulations at 42 CFR Parts 422 and 423, Medicare Part D plan sponsors and
Medicare Advantage organizations are required to comply with all Medicare Parts C and D program
requirements. CMS’ annual audit plan ensures that we evaluate sponsoring organizations’
compliance with these requirements. CMS program audits focus on high-risk areas that have the
greatest potential for beneficiary harm. As such, CMS has developed several audit protocols that are
included within the program area data request documents and that are posted to the CMS website
each year for use by sponsoring organizations to prepare for their audit. As part of a robust audit
process, CMS also requires sponsoring organizations who have been audited and found to have
deficiencies to undergo a validation audit to ensure correction. The validation audit utilizes the same
audit protocols, but only tests the elements where deficiencies were found, as opposed to re-
administering the entire audit.

CMS uses the following 5 protocols to audit sponsoring organization performance: Part D Formulary
and Benefit Administration (FA); Coverage Determinations, Appeals, and
Grievances (CDAG); Organization Determinations, Appeals, and Grievances (ODAG); Special
Needs Model of Care (SNP-MOC) (only administered on organizations who operate SNPs); and,
Compliance Program Effectiveness (CPE). The data collected is detailed in each of these protocols
and the exact fields are located in the record layouts, at the end of each protocol. In addition, this
1
collection request includes a pre-audit issue summary, three CPE questionnaires, one CPE
organizational structure presentation template, one FA impact analysis template, two CDAG impact
analysis templates, four OAG impact analysis templates, three SNP-MOC impact analysis templates,
and a SNP-MOC questionnaire.

A. Justification

1. Need and Legal Basis

Section 1857(d) of the Social Security Act (Act), added by the Medicare Prescription Drug,
Improvement, and Modernization Act of 2003 (MMA) and implementing regulations at 42 CFR
422.503 and 422.504state that CMS must oversee a Medicare Advantage (MA) organization’s
continued compliance with the requirements for a MA organization.

Section 1860D-12 of the Act, added by MMA and implementing regulations at 42 CFR 423.504 and
423.505 state that CMS must oversee a Part D plan sponsor’s continued compliance with the
requirements for a Part D plan sponsor.
The data collected with the audit protocols included in this package allow CMS to conduct a
comprehensive review of MA and Part D organizations’ compliance within specific program areas.
CMS uses the data collected with these tools to test an organization’s compliance with federal
requirements. More specifically:

Part D Formulary and Benefit Administration—42 CFR, Part 423, Subpart C

Part C Organization Determinations, Appeals, and Grievances—42 CFR, Part 422, Subpart M
Part D Coverage Determinations, Appeals, and Grievances—42 CFR, Part 423, Subpart M
Compliance Program Effectiveness—42 CFR, §§422.503 and 423.504
Special Needs Plan Model of Care—42 CFR §§ 422.4(a)(iv), 422.101(f), and 422.152(g)

2. Information Users

The information gathered during this audit will be used by the Medicare Parts C and D
Oversight and Enforcement Group (MOEG) within the Center for Medicare (CM) and CMS
Regional Offices to assess sponsoring organizations’ compliance with Medicare program
requirements. If outliers or other data anomalies are detected, Regional Offices will work in
collaboration with (MOEG) and other divisions within CMS for follow-up and resolution.
Additionally, MA and Part D organizations will receive the audit results and will be required to
implement corrective action to correct any identified deficiencies.

3. Use of Information Technology

Sponsoring organizations are able to produce approximately 65 percent of requested information

from their internal systems. CMS is able to obtain the remaining 30 percent via our internal

2
systems. The remaining 5 percent of data is manually entered by the sponsoring organization in
response to questionnaires or other audit requests.

Information collected from the sponsoring organizations for use in the audit is obtained
electronically via the Health Plan Management System (HPMS), a system that was developed and is
maintained by CMS and to which all sponsoring organizations have access. This system is also
secure, requiring users to request and gain access via CMS personnel and then must create and
maintain a secure user id and password.

Most of our audit is conducted remotely, utilizing secure webinar technology. This has saved CMS
and audited sponsoring organizations time, money and other resources needed to complete the audit.

4. Duplication of Efforts

This information collection does not duplicate any other effort and the information cannot be
obtained from any other source.

5. Small Businesses

This collection does not impose a significant impact on small businesses and other entities.

6. Less Frequent Collection

42 CFR part 423 subpart K and 422 subpart K stipulate that CMS must oversee a sponsoring
organization’s continued compliance with CMS requirements. In general, CMS attempts to audit
each sponsoring organization once every 4 years. However, the frequency with which an audit
occurs for a sponsoring organization can be based on a variety of factors, including the identification
of compliance issues, referral for program audit, the size of the organization, and amount of time
since last audit. In addition, CMS conducts annual timeliness monitoring of Part C organization
determinations and appeals, and Part D coverage determinations and appeals. Less frequent
collection of the data from sponsoring organizations would severely limit CMS’ ability to perform
accurate and timely oversight, monitoring, and compliance and auditing activities around the Parts C
and D Medicare benefits and could result in an increased potential for harm to Medicare
beneficiaries.

7. Special Circumstances

42 CFR 422.504(d) and 423.505(d) stipulates records are to be maintained for 10 years. CMS could
potentially require clarification around or validation of submitted data and, therefore need to contact
Medicare Part D plan sponsors and Medicare Advantage organizations within 30 days of data
submission. Ad hoc audits initiated in response to an audit referral could also require immediate
action giving a sponsoring organization less than 30 days to respond to universe requests. However,
in general, and as outlined in the five program area data requests, within 15 business days of receipt
3
of the program audit Engagement Letter, each of the pre-audit collection instruments (i.e., all except
the program area data request templates) must be populated and submitted to CMS. Sponsoring
organizations are also required to provide responses to CMS requests for root cause analyses within
two business days and impact analyses within ten business days. While these submissions are
required in fewer than 30 days of receipt of the individual notices, these timeframes are necessary to
complete the entire program audit process timely. Otherwise, there are no special circumstances that
would require an information collection to be conducted in a manner that requires respondents to:

• Report information to the agency more often than quarterly;

• Prepare a written response to a collection of information in fewer than 30 days after receipt of it;
• Submit more than an original and two copies of any document;
• Collect data in connection with a statistical survey that is not designed to produce valid and
reliable results that can be generalized to the universe of study;
• Use a statistical data classification that has not been reviewed and approved by OMB;
• Include a pledge of confidentiality that is not supported by authority established in statute or
regulation that is not supported by disclosure and data security policies that are consistent with
the pledge, or which unnecessarily impedes sharing of data with other agencies for compatible
confidential use; or
• Submit proprietary trade secret, or other confidential information unless the agency can
demonstrate that it has instituted procedures to protect the information's confidentiality to the
extent permitted by law.

8. Federal Register

Federal Register

The 60-day notice published in the Federal Register on August 16, 2019 (84 FR 41991). CMS
received 35 public submissions, which included 250 comments. We then combined the 250
comments into 109 unique comments and provided responses in the comment and response
summary that is included in this collection request. We adopted many of the commenters’
suggestions and believe that those corresponding edits simplify and clarify the collection
instruments. First, we simplified and provided greater clarity in the 5 protocols by removing
columns within the universes that were no longer needed (e.g., to better align with regulatory
changes) or to promote consistency across the program-area instructions. For example, within the
CDAG, ODAG and SNP-MOC protocols, we renamed the Cardholder ID as Enrollee ID and defined
it as the Medicare Beneficiary Identifier (MBI). We also updated the dates of examples provided in
each of the 5 protocols to provide more meaningful guidance. We also removed several CDAG and
ODAG universes entirely, renumbered the remaining CDAG universes and removed duplicative or
unnecessary SNP-MOC compliance standards. Finally, we added a SNP-MOC questionnaire to this
collection request.

Please refer to the Crosswalk of Changes for a complete summary of updates made to this collection
request since the August 16, 2019 publication. The 30-day notice published in the Federal Register
on (84 FR INSERT UPON PUBLICATION).

4
9. Payments/Gifts to Respondents

There are no payments or gifts to respondents associated with this information collection request.
MA and Part D organizations are required to comply with CMS oversight (produce records for
examination, etc.) and CMS could terminate a contract for failure to comply.

10. Confidentiality

CMS will adhere to all statutes, regulations, and agency policies regarding confidentiality. While
sponsoring organizations are required during audit to provide CMS access to records, data and other
beneficiary information, CMS will ensure that the information is maintained and used in a
confidential format. Any sensitive or personal information will be transferred and/ or stored through
the Health Plan Management System (HPMS) which is a secure site.

11. Sensitive Questions

There are no sensitive questions associated with this collection. Specifically, the collection does not
solicit questions of a sensitive nature, such as sexual behavior and attitudes, religious beliefs, and
other matters that are commonly considered private.

12. Burden Estimates (Hours & Wages)

No changes were made to the hours and wages burden estimates since the August 16, 2019
collection request.

To derive average costs, we used data from the U.S. Bureau of Labor Statistics’ May 2018 National
Occupational Employment and Wage Estimates for all salary estimates
(www.bls.gov/oes/current/oes_nat.htm). In this regard, the following table presents the mean
hourly wage, the cost of fringe benefits (calculated at 100 percent of salary), and the adjusted hourly
wage. We selected the following personnel for our burden estimate based on our previous
experiences conducting program audits in Part C and Part D and public comment from the 2016
collection request.

5
 National Occupational Mean Hourly Wage and Adjusted Hourly Wage
Occupation Title Occupation Code Mean Hourly Fringe Benefit Adjusted Hourly
Wage ($/hr.) ($/hr.) Wage ($/hr.)
General and 11-1021 59.56 59.56 119.12
Operations Managers
(Program Director)
Compliance Officer 13-1041 34.86 34.86 69.72
Management 13-1111 45.38 45.38 90.76
Analysts
Business Operations 13-1199 37.00 37.00 74.00
Specialists (Quality
Assurance
Specialist)
Computers and 11-3021 73.49 73.49 146.98
Information Systems
Manager
Administrative 43-6014 18.28 18.28 36.56
Assistants
Lead Claims Analyst 13-1031 32.47 32.47 64.94

As indicated, we are adjusting our employee hourly wage estimates by a factor of 100 percent. This
is necessarily a rough adjustment, both because fringe benefits and overhead costs vary significantly
from employer to employer, and because methods of estimating these costs vary widely from study
to study. Nonetheless, there is no practical alternative, and we believe that doubling the hourly wage
to estimate total cost is a reasonably accurate estimation method.

Wage Estimates for Routine Audits

Based on the table above, we then added the estimated hourly rate (rounded to the nearest whole
dollar) for each position and divided by the total number of positions to get the average hourly rate.

2 Program Directors $119/hr x 2 $238

1 Compliance Officer $70/hr x 1 $70
6 Management Analysts $91/hr x 6 $546
6 Quality Assurance Specialists $74/hr x 6 $444
5 Computer & Information Systems Managers $147/hr x 5 $735
6 Administrative Assistants $37/hr x 6 $222
4 Claims Analysts $65/hr x 4 $260
Total $2,515

Taking the average of the above rates, we estimate an average hourly rate of $84/hr ($2,515/30
positions).

6
Wage Estimates for Industry-Wide Monitoring

We also created a burden estimate for the industry- wide monitoring effort using the same table
above.

2 Computer & Information Systems Managers $147/hr x 2 $294

2 Administrative Assistants $37/hr x 2 $74
2 Claims Analysts $65/hr x 2 $130
Total $498

Taking the average of the above rates, we estimate an average hourly rate of $83/hr ($498/6
positions.

Burden Estimates

No changes were made to the burden estimates for routine audits or the industry-wide timeliness
monitoring project since the August 16, 2019 collection request.

Routine Audits

Based on our audit strategy, routine audits are defined as the audits scheduled throughout the year.
For each sponsoring organization, we estimate an average of 200 hours for administrative and
systemic work to assemble the requested information, 60 hours to review the information for
completeness, 30 minutes to submit the information to CMS, 160 hours for the actual administration
of the audit, 40 hours to respond to audit documentation requests, 40 hours to review and respond to
the draft audit report and 10 minutes to complete the optional post-audit survey. The total burden
equals 500 hours and 40 minutes, rounded up to 501 hours. The number of parent organizations that
will undergo routine audits in audit year 2020 is estimated at 25.

Each organization selected for a routine audit will also incur validation and close out activity burden.
We estimate an additional 200 hours for these activities, regardless of whether the sponsoring
organization is required to hire and independent auditing firm (in accordance with 42 CFR 422.503
(d)(2)(B)(iv) and 423.504 (d)(2)(B)(iv) ) or rely on CMS to conduct the validation audit. Based on
CMS experience between 2016 and 2018 (i.e., since the effective date of requiring sponsoring
organizations to hire independent auditing firms)), we estimate that 93 percent of sponsoring
organizations were required to hire an independent auditing firm. However, we have decreased that
estimate to 82 percent in this package based on changes that were made to the threshold that is used
in determining whether an organizations must hire independent auditing firm. Initially, a sponsoring
organization with more than five conditions of any kind in its final audit report was required to hire
an independent auditor. Starting in 2019, a sponsoring organization with more than five non-CPE
conditions identified in its final audit report must hire an independent auditing firm. As a result of
this change, we estimate that the number of sponsoring organizations that would be required to hire
an independent auditing firm would decrease by approximately 11 percent: we estimate that

7
annually, 21 of the 25 sponsoring organizations (82 percent of audited organizations) will be
required to hire independent auditing firms.

For each sponsoring organization that will be required to hire an independent auditing firm, we
estimate an average of 55 hours to populate the validation work plan, 8 hours to respond to CMS
input, 35 hours for administrative and systemic work in assembling/reviewing the required
information, 10 hours reviewing the information for completeness, 50 hours participating in the
independent audit, 10 hours responding/requesting validation audit documentation, 30 hours to
drafting/reviewing the validation audit report and 2 hours to submit the information to CMS. In
addition to burden hours, sponsoring organizations that will be required to hire an independent
auditing firm will incur the auditing firm’s fee. While those costs will vary, we estimate the average
cost is $150,000.

For each sponsoring organization that will be required to undergo a CMS-led validation audit, we
estimate an average of 200 hours in assembling, reviewing and submitting data to CMS,
participating in the audit with CMS, and responding to CMS’ requests for additional information.
Sponsoring organizations that undergo a CMS-led validation audit do not incur the independent
auditing firm expense.

Combining the routine and validation audit burden, we estimate a total of approximately 701 hours
for each sponsoring organization. We have included this cost in the total audit estimate.

Yearly Industry-Wide Timeliness Monitoring Project

We estimate a total of 182 sponsoring organizations will be subject to data collections for the
industry-wide timeliness monitoring effort 1. For the industry-wide timeliness monitoring effort, For
each sponsoring organization we estimate an average of 80 hours for administrative and systemic
work to assemble the requested information, 24 hours to review the information for completeness,
30 minutes to submit the information to CMS, and 16 hours to conduct validation webinars to ensure
accurate information. This is a total of approximately 120.5 hours for each sponsoring organization.

Burden Summary

Total Burden Total Labor

Responses Responses per Annual Cost of
Information (per Response Burden Reporting Total Cost
Collection Respondents Respondent) (hours) (hours) ($/hr) ($)
Routine 25 1 25 701 $84.00 $1,472,100*
Audits 17,525

1 This monitoring effort will be performed on each of the 201 sponsoring organizations in 2020. However, we have adjusted the total
from 201 to 182 to more accurately reflect the burden of the monitoring experience. Specifically, sponsoring organizations that
underwent a program audit in 2019 are exempt from submitting new data for the timeliness monitoring in 2020 unless they were
unable to produce all of the data as required during their program audit. As a result, the monitoring effort only requires, on average, a
response from 182 sponsoring organizations each year (201 total sponsoring organizations minus an estimated 19 organizations that
underwent a program audit in the prior year and successfully submitted all applicable universes).
8
 Total Burden Total Labor
Responses Responses per Annual Cost of
Information (per Response Burden Reporting Total Cost
Collection Respondents Respondent) (hours) (hours) ($/hr) ($)
Yearly 182 1 182 120.5 21,931 $83.00 $1,820,273
Timeliness
Monitoring
Total 207 1-2 207** varies 39,456 Varies 3,292,373*
*This total does not account for costs of hiring an independent auditing firm.
**The total accounts for 1 -2 annual responses per respondent.

Total Costs ($)

Routine Audits 1,472,100
Independent Auditing (21 x 150,000) 3,150,000
Monitoring 1,820,273
Total Cost 6,442,373

Attachments (Timeliness Monitoring)

Document Title Description Purpose Respondents Reporting Time Per

Frequency Response
Part D Coverage CDAG audit To evaluate MA and Part We audit These collection
Determinations, Appeals process and Coverage D Plan approx. 1/6 to tools are
and Grievances (CDAG) data request Determinations, Sponsors ¼ of MA and administered
Program Area Audit Appeals and Part D Plan simultaneously and
Process and Data Request Grievances for Sponsors responses for all
(AttachmentIIICDAGA annually.
MA and Part D areas does not
uditProcessDataReques.pdf)
Sponsors Additionally exceed 8 weeks
we will
monitor
timeliness on
all sponsors
annually.

9
Document Title Description Purpose Respondents Reporting Time Per
Frequency Response
Part C Organization ODAG audit To evaluate MA and Part We audit These collection
Determinations, Appeals process and Organization D Plan approx. 1/6 to tools are
and Grievances (ODAG) data request Determinations, Sponsors ¼ of MA and administered
Program Area Audit Appeals and Part D Plan simultaneously and
Process and Data Request Grievances for Sponsors responses for all
(AttachmentIVODAGA annually.
uditProcessDataRequest. MA and Part D areas does not
pdf) Sponsors Additionally exceed 8 weeks
we will
monitor
timeliness on
all sponsors
annually.

Attachments (Routine Audits)

Document Title Description Purpose Respondents Reporting Time Per

Frequency Response
Part C and D Compliance Compliance To evaluate MA and Part We audit These collection
Program Effectiveness Program Compliance D Plan approx. 1/6 to tools are
(CPE) Program Area Audit Effectiveness Program Sponsors ¼ of MA and administered
Process and Data Request audit process Effectiveness Part D Plan simultaneously and
(AttachmentICPEAudit and data request for Sponsors responses for all
ProcessDataRequest.pdf) MA and Part D annually areas does not
Sponsors exceed 8 weeks
Attachment I-A Medicare Compliance Evaluate MA and Part We audit These collection
Advantage and Program Compliance D Plan approx. 1/6 to tools are
Prescription Drug Effectiveness Program Sponsors ¼ of MA and administered
Compliance Program Compliance Effectiveness Part D Plan simultaneously and
Effectiveness (CPE) Officer for Sponsors responses for all
Compliance Officer Questionnaire MA and Part D annually areas does not
Questionnaire (CO-Q) Sponsors exceed 8 weeks
(AttachmentIBCPECo
mplianceOfficerQuestio
nnaireCOQ.pdf)
Attachment I-B Medicare Compliance Evaluate MA and Part We audit These collection
Advantage and Program Compliance D Plan approx. 1/6 to tools are
Prescription Drug Organizational Program Sponsors ¼ of MA and administered
Compliance Program Structure and Effectiveness Part D Plan simultaneously and
Effectiveness (CPE) Audit Governance for Sponsors responses for all
Organizational Structure and Template MA and Part D annually areas does not
Governance PPT Sponsors exceed 8 weeks
Template
(AttachmentICCPEOr
ganizationalStructureGo
vernancePPTTemplate.pdf)

10
 Document Title Description Purpose Respondents Reporting Time Per
Frequency Response
Attachment I-C Medicare Compliance Evaluate MA and Part We audit These collection
Advantage and Program Compliance D Plan approx. 1/6 to tools are
Prescription Drug Effectiveness Program Sponsors ¼ of MA and administered
Compliance Program Oversight of Effectiveness Part D Plan simultaneously and
Effectiveness (CPE) Sponsor’s FDR’s for Sponsors responses for all
Accountability for Oversight of Questionnaire MA and Part D annually areas does not
First-Tier, Sponsors exceed 8 weeks
Downstream and Related
Entities Questionnaire
(FDR-Q)
(AttachmentIDCPEFDROv
ersightQuestionnaireFDR
Q.pdf)
Attachment I-D Medicare Compliance Evaluate MA and Part We audit These collection
Advantage and Program Compliance D Plan approx. 1/6 to tools are
Prescription Drug Effectiveness Program Sponsors ¼ of MA and administered
Compliance Program SIU/FWA Effectiveness Part D Plan simultaneously and
Effectiveness (CPE) Questionnaire for Sponsors responses for all
SIU/FWA Prevention and MA and Part D annually areas does not
Detection Questionnaire Sponsors exceed 8 weeks
(FWA-Q)
(AttachmentIECPESIUFW
AQuestionnaireFWAQ.pdf)
Part D Formulary and Formulary audit To evaluate MA and Part We audit These collection
Benefit Administration process and Formulary D Plan approx. 1/6 to tools are
(FA) Program Area Audit data request Administration Sponsors ¼ of MA and administered
Process and Data Request Benefit Part D Plan simultaneously and
(AttachmentIIFAAuditP Administration Sponsors responses for all
for MA and annually areas does not
rocessDataRequest.pdf)
Part exceed 8 weeks
D Sponsors
Part D Coverage CDAG audit To evaluate MA and Part We audit These collection
Determinations, Appeals and process and Coverage D Plan approx. 1/6 to tools are
Grievances (CDAG) Program data request Determinations, Sponsors ¼ of MA and administered
Area Audit Appeals and Part D Plan simultaneously and
Process and Data Request Grievances for Sponsors responses for all
(AttachmentIIICDAGA annually.
MA and Part D areas does not
uditProcessDataRequest.p df) Additionally
Sponsors exceed 8 weeks
we will
monitor
timeliness on
all sponsors
annually

11
 Document Title Description Purpose Respondents Reporting Time Per
Frequency Response
Part C Organization ODAG audit To evaluate MA and Part We audit These collection
Determinations, Appeals and process and Organization D Plan approx. 1/6 to tools are
Grievances (ODAG) Program data request Determinations, Sponsors ¼ of MA and administered
Area Audit Appeals and Part D Plan simultaneously and
Process and Data Request Grievances for Sponsors responses for all
(AttachmentIVODAGA annually.
uditProcessDataRequest. MA and Part D areas does not
Additionally
pdf) Sponsors exceed 8 weeks
we will
monitor
timeliness on
all sponsors
annually
Special Needs Plan Model of SNP MOC Evaluate MA and Part We audit These collection
Care (SNP MOC) Program audit process Special Needs D Plan approx. 1/6 to tools are
Area Audit and data request Plan Model of Sponsors ¼ of MA and administered
Process and Data Request Cares for MA Part D Plan simultaneously and
(AttachmentVSNPMOCAu and Part D Sponsors responses for all
ditProcessDataRequest.pdf) annually
Sponsors areas does not
exceed 8 weeks
CDAG CDM IA (pdf) CDAG CDM To assess MA and Part We audit Only used if a
(CDAGCDMImpact.pdf) Impact beneficiary D Plan approx. 1/6 to deficiency is cited
Analysis impact Sponsors ¼ of MA and during the audit.
Part D Plan Response time can
Sponsors vary based on the
annually size of the impact,
but should not
exceed 10 business
days.
CDAG GRV IA (pdf) Impact Analysis To assess MA and Part We audit Only used if a
(CDAGGRVImpact.pdf) beneficiary D Plan approx. 1/6 to deficiency is cited
impact Sponsors ¼ of MA and during the audit.
Part D Plan Response time can
Sponsors vary based on the
annually size of the impact,
but should not
exceed 10 business
days.
FA IA (pdf) Impact Analysis To assess MA and Part We audit Only used if a
(FAImpactAnalysis.pdf) beneficiary D Plan approx. 1/6 to deficiency is cited
impact Sponsors ¼ of MA and during the audit.
Part D Plan Response time can
Sponsors vary based on the
annually size of the impact,
but should not
exceed 10 business
days.

12
 Document Title Description Purpose Respondents Reporting Time Per
Frequency Response
ODAG CDM IA (pdf) Impact Analysis To assess MA and Part We audit Only used if a
(ODAGCDMImpact.pdf) beneficiary D Plan approx. 1/6 to deficiency is cited
impact Sponsors ¼ of MA and during the audit.
Part D Plan Response time can
Sponsors vary based on the
annually size of the impact,
but should not
exceed 10 business
days.
ODAG DIS Impact Impact Analysis To assess MA and Part We audit Only used if a
(ODAGDISImpact.pdf) beneficiary D Plan approx. 1/6 to deficiency is cited
impact Sponsors ¼ of MA and during the audit.
Part D Plan Response time can
Sponsors vary based on the
annually size of the impact,
but should not
exceed 10 business
days.
ODAG GRV IA (pdf) Impact Analysis To assess MA and Part We audit Only used if a
(ODAGGRVImpact.pdf) beneficiary D Plan approx. 1/6 to deficiency is cited
impact Sponsors ¼ of MA and during the audit.
Part D Plan Response time can
Sponsors vary based on the
annually size of the impact,
but should not
exceed 10 business
days.
ODAG PYMT IA (pdf) Impact Analysis To assess MA and Part We audit Only used if a
(ODAGPYMTImpact.pdf) beneficiary D Plan approx. 1/6 to deficiency is cited
impact Sponsors ¼ of MA and during the audit.
Part D Plan Response time can
Sponsors vary based on the
annually size of the impact,
but should not
exceed 10 business
days.
SNP MOC IA (pdf) Impact Analysis To assess MA and Part We audit Only used if a
(SNPMOCImpact.pdf) beneficiary D Plan approx. 1/6 to deficiency is cited
impact Sponsors ¼ of MA and during the audit.
Part D Plan Response time can
Sponsors vary based on the
annually size of the impact,
but should not
exceed 10 business
days.

13
 Document Title Description Purpose Respondents Reporting Time Per
Frequency Response
SNP MOC ICP ICT IA Impact Analysis To assess MA and Part We audit Only used if a
(pdf) beneficiary D Plan approx. 1/6 to deficiency is cited
(SNPMOCICPICTImpact.pdf) impact Sponsors ¼ of MA and during the audit.
Part D Plan Response time can
Sponsors vary based on the
annually size of the impact,
but should not
exceed 10 business
days.
SNP MOC Training IA (pdf) Impact Analysis To assess MA and Part We audit Only used if a
(SNPMOCTrainingImpact.pdf) beneficiary D Plan approx. 1/6 to deficiency is cited
impact Sponsors ¼ of MA and during the audit.
Part D Plan Response time can
Sponsors vary based on the
annually size of the impact,
but should not
exceed 10 business
days.
Pre-Audit Issue Summary of To evaluate MA and Part We audit No more than 1
Summary any pre-audit MA and Part D D Plan approx. 1/6 to week
(PreAuditIssueSummary. pdf) issues Sponsors Sponsors ¼ of MA and
Part D Plan
Sponsors
annually
SNP-MOC Questionnaire SNP-MOC Evaluate SNP- MA and Part We audit These collection
Questionnaire MOC care D Plan approx. 1/6 to tools are
coordination. Sponsors ¼ of MA and administered
Part D Plan simultaneously and
Sponsors responses for all
annually areas does not
exceed 8 weeks

13. Capital Costs

There is no capital cost associated with this collection.

14. Cost to Federal Government

No changes were made to the cost to the federal government since the August 16, 2019 collection
request.
The costs to the federal government include staff time to participate in the audit, travel expenses and
money used to fund two audit support contracts that are used as staff extenders during audits, but
that also perform a host of other audit and enforcement activities outside of activities related to this
collection effort.

Staff Time

14
CMS staff serve as either team leads (TLs) or team members, or auditors-in-charge (AICs).
Team leads run their portion of the audit (e.g., CDAG, ODAG, FA, etc.) by administering the
protocol and evaluating that portion of the sponsoring organization’s operation. They are assisted by
team members who document all audit findings in the internal audit work papers.
The AIC oversees the entire audit and is the sponsoring organization’s primary point of contact
throughout the audit process. The AIC issues the audit start notice, hosts the entrance, status and exit
conference calls and travels onsite to accompany the CPE team (the only portion of the audit that is
conducted face-to-face). The AIC is also responsible for the final review and issuance of the draft
and final audit report.

The average annual number of CMS staff conducting program audits is 137. The average number of
hours that each CMS staff member spends on an audit is 170. Most CMS auditing staff are GS-12s
or GS-13s, with varying step level and locality adjustments. The median total base salary plus
locality adjustment for a CMS staff member is roughly $51.00/hr ($105,109 annually). (Refer to the
2019 Salary Table for the average GS-12 and GS-13, step 5-6 salary plus locality adjustment at:
https://www.opm.gov/policy-data-oversight/pay-leave/salaries-wages/salary-
tables/pdf/2019/DCB.pdf).

Costs to the government for CMS staff time is as follows:

137 CMS staff x 170 hours/audit = 23,290 hours

23,290 hours x $51/hour = $1,187,790

For two protocols, CDAG and ODAG, CMS is assisted by either a CMS Medical Director or a
contracted medical director during the Clinical Decision Making portion of the audit, this portion of
the audit generally lasts one to two days. The average number of hours a medical director spends on
an audit is 8 hours. There are 2 medical directors per audit, meaning a total of 90 medical directors.
Due to limited resources, only 10 of the 90 slots are staffed by a CMS Medical Director, the
remaining 80 come from contracted resources and will be included in the section discussing the
budget to fund these contracts. The average hourly rate for a CMS Medical Director is $76.80/hr.

Costs to the government for the medical director’s time is as follows:

10 Medical Directors x 8 hours per audit = 80 hours

80 hours x $76.80/hr = $6,144

Total costs to the government for staff time:

CMS staff cost = $1,187,790
MD cost = 6,144
Total cost = $1,193,934

Travel Costs

15
The total costs of travel for audits has been greatly reduced due to CMS’ use of webinar technology.
Only the CPE audit team and AIC travel during the second week of the audit to the sponsoring
organization’s location. The total travel costs to the federal government are $84,000.

Contractor Costs

As previously mentioned, CMS has two audit support contractors that perform a variety of duties
beyond just the performance of the audit. The duties performed related to this collection effort
include performing AIC duties, performing TL duties, acting as the documenter (i.e., documenting
all audit findings) for each audit team, providing the medical director for the CDAG and ODAG
portions of the audit, receiving, analyzing and ensuring completeness of all audit data collected from
sponsoring organizations and draft and final audit report generation and any subsequent validation
activities. Based on invoices received by the government. Each audit costs CMS approximately
$218,000 in contracted resources. Consequently, the total cost to the government in contracted
resources is as follows:

$218,000 per audit x 25 audits = $5,450,000

For the timeliness monitoring project, the duties from the contractor include receiving, analyzing and
ensuring the completeness of all of the data collected from 182 sponsoring organizations annually.
Additionally, contractors will run validation webinars with the sponsoring organizations to ensure
that the data in each universe contain accurate information. Finally, the contractor will conduct
timeliness tests on the universes and report out on the results. We estimate that the cost to the
contractors will be $910,000 for this monitoring effort per year.

Therefore we estimate the total contractor costs of this package to be:

$5,450,000 + $910,000 = $6,360,000

Adding up the costs to the government of staff time, travel and contractor costs we can estimate total
Cost to the government as follows:

Staff Cost: $1,193,934

Travel Cost: 84,000
Contractor Costs: 6,360,000
Total Cost: $7,637,934

15. Changes to Burden

As indicated in Section 8 above, we adopted many of the technical changes that were suggested in
public comment in the interest of simplifying and clarifying the collection instruments. First, within
the 5 protocols, we removed columns within the universes that were no longer needed (e.g., to better
align with regulatory changes) or to promote consistency across the program-area instructions. For
example, within the CDAG, ODAG and SNP-MOC protocols, we renamed the Cardholder ID as
16
Enrollee ID and defined it as the Medicare Beneficiary Identifier (MBI). We also updated the dates
of examples provided in each of the 5 protocols to provide more meaningful guidance. We also
removed several CDAG and ODAG universes entirely, renumbered the remaining CDAG universes
and removed duplicative or unnecessary SNP-MOC compliance standards. Finally, we added a SNP-
MOC questionnaire to this collection request. These changes resulted in no change to burden.

As summarized in the 60-day collection request, we estimate the total hourly burden for routine
program audits at 701 hours to reflect the entirety of the audit process. The total number of routine
program audits is estimated at 25 and the corresponding total burden is 17,525 hours.

The total hourly burden for the industry wide timeliness monitoring project remains at 120.5 hours
per respondent. As described above, the number of respondents for this timeliness monitoring project
is 182 sponsoring organizations per year (201 total sponsoring organizations minus an estimated 19
organizations that underwent a program audit in the prior year and successfully submitted all
applicable universes). Consequently, the total burden for the industry wide monitoring effort is
21,931 hours.

16. Publication/Tabulation Dates

The information collected during audits will be compiled and CMS may detail the information at an
aggregate level in an annual audit report.

17. Expiration Date

The expiration date will be displayed on the following twenty-one documents:

• Attachment_I_CPE_AuditProcess_DataRequest;
• Attachment_I-A_CPE_Compliance _Officer_Questionnaire_CO-Q;
• Attachment_I-B_CPE_Organizational_Structure_Governance _PPT_ Template;
• Attachment_I-C_CPE_FDR_Oversight_Questionnaire_FDR-Q;
• Attachment_I-D_CPE_SIU_FWA_Questionnaire_FWA-Q;
• Attachment_II_FA_AuditProcess_DataRequest;
• Attachment_III_CDAG_AuditProcess_DataRequest;
• Attachment_IV_ODAG_AuditProcess_DataRequest;
• Attachment_V_SNP-MOC_AuditProcess_DataRequest;
• Pre-AuditIssueSummary;
• FA_ImpactAnalysis;
• CDAG_CDM_Impact;
• CDAG_GRV_Impact;
• ODAG_CDM_Impact;
• ODAG_DIS_Impact;
• ODAG_GRV_Impact;
• ODAG_PMNT_Impact;
• SNP-MOC_HRA_ICP_ICT_Impact;

17
• SNP-MOC_Impact;
• SNP-MOC_Training_Impact; and
• SNP-MOC Questionnaire

18. Certification Statement

There are no exceptions.

B. Collections of Information Employing Statistical Methods

No statistical methods are applied to any of the audit information.

18