A CMS program audit is CMS's review of whether a Medicare Advantage organization or Part D sponsor complies with its CMS contract, with emphasis on enrollee access to services and drugs. It runs in the phases set out in the CMS Routine Program Audit Process Overview and tests operations against the CMS-10717 audit protocols. Integral Healthcare Solutions (IHS) prepares sponsors for it: a readiness gap assessment against the protocols, universe preparation checks, drafted templates and a mock audit, all for your compliance officer and counsel to approve.
Last reviewed: October 2026.
What is a CMS program audit?
CMS states the purpose this way: "These program audits measure a Sponsoring organization's compliance with the terms of its contract with CMS, in particular, the requirements associated with access to medical services, drugs, and other enrollee protections required by Medicare" (Routine Program Audit Process Overview, section II). The Process Overview is published by the Medicare Parts C and D Oversight and Enforcement Group and is marked "Updated November 2025."
What CMS tests is set out in the Medicare Part C and Part D Program Audit Protocols, CMS-10717. The Paperwork Reduction Act listing for CMS-10717 shows a date of July 6, 2026 (CMS PRA listing), and the protocols download as a single file (CMS-10717 ZIP). The set includes a Compliance Program Effectiveness (CPE) protocol, a Part D Formulary and Benefit Administration (FA) protocol, and protocol files labeled CDAG, ODAG and SNPCC. The CMS Program Audits page, last modified July 27, 2026, lists the Process Overview, the protocols, the audit submission checklist and CMS's annual audit and enforcement reports (CMS Program Audits).
The protocols do not replace the rules behind them. CMS says: "Please note, these protocols are not a substitute for a review of the applicable statutes or regulations" (CMS Program Audits). The underlying obligations are in 42 CFR Parts 422 and 423 and the sponsor's contract.
Who needs it and what triggers it
Medicare Advantage organizations and Part D sponsors are the audited parties. The Process Overview notes that the same CMS group also audits Programs of All-Inclusive Care for the Elderly (PACE) organizations; PACE audits are a separate program not covered on this page. The documents we reviewed do not describe how CMS selects a sponsor for audit, so this page does not.
The timeline is the reason to prepare early. "The Audit Engagement and Universe Submission phase is the six-week period prior to the field work portion of the audit" (Process Overview, Phase I). In that window the sponsor must produce universes, the data sponsors submit for CMS to test, and "Sponsoring organizations will have a maximum of three attempts to provide complete and accurate universes" (Phase I). CMS qualifies this: "three attempts may not always be feasible" depending on when data issues are found and the impact on the audit schedule, resubmission is not allowed after CMS shares timeliness test results, and a sponsor that fails twice is documented as an observation in the audit report (Phase I). Reasons to start readiness work include an expected audit, a change in systems or delegated vendors, or an internal audit that finds data problems. These are IHS's reading, not a CMS statement.
How IHS helps
- Readiness gap assessment. IHS sends questionnaires to the owner of each program area you expect to be audited and compares operations to the CMS-10717 protocol for that area.
- Document and evidence mapping. Each protocol element is mapped to your policy, desk-level procedure and evidence. IHS builds a universe preparation checklist and reviews your record layouts against the protocol data requests.
- Drafting. IHS drafts compliance officer interview preparation, root cause and impact analysis templates and a corrective action plan outline, for your compliance officer and counsel to approve.
- Mock audit. IHS runs sample testing the way the protocols describe and closes with a mock exit conference.
- Readiness support. IHS turns mock audit results into a remediation list with owners.
What your organization supplies: program area owners' time, policies and desk procedures, system extracts for practice universes, and your compliance officer and counsel for approvals.
The limit: your organization submits its own universes, comments, impact analyses and corrective action plans to CMS. IHS drafts; your organization submits. IHS does not interpret CMS policy beyond what the protocols and regulations state, and gives no legal advice.
Related IHS pages: Compliance Services, Medicare Advantage and Part D compliance program and Exclusion screening program.
What to have ready
These items shorten the readiness assessment. Each ties to the Process Overview (updated November 2025) or the CMS-10717 protocols.
- A list of the program areas you expect CMS to audit and the owner of each, matched to the CMS-10717 protocol files (CMS-10717).
- For each area, the system and report that would produce the universe, since you will have at most three attempts to submit complete and accurate universes, and CMS says three "may not always be feasible" (Phase I).
- A sample universe pulled from your systems now, to test against the protocol record layout.
- Your compliance oversight activities for the year. The CPE protocol says "CMS will collect a universe of compliance oversight activities" (CPE protocol).
- Your compliance officer's risk assessment and monitoring plan, and FDR oversight records. Both are listed topics for the "Preliminary Compliance Officer Interview" (CPE protocol).
- A named owner and template for impact analyses, which are due "Within 10 business days of the request" (Phase II).
- A process for review and comment on a draft report, since "The Sponsoring organization has 10 business days to respond to the draft audit report" (Phase III).
- A corrective action plan template, since CAPs "are due within 30 calendar days of final audit report issuance" (Process Overview).
To walk through the list with IHS, book the introductory call below.
How it compares
| Approach | What the sources say |
|---|---|
| Waiting for the engagement letter, with no mock audit | The sponsor then has the six-week Phase I window and three universe attempts to work with (Phase I). The sources we reviewed do not show how sponsors fare without preparation. |
| The plan's own internal audit department as the only readiness check | A workable route. No source we reviewed compares it with an outside mock audit. |
| An outside mock audit, such as IHS's | Tests universes, procedures and interview readiness against the protocols before CMS does. It does not replace the sponsor's own submissions or legal review. |
What it costs
CMS charges no audit fee in the documents we reviewed. CMS does not publish a fee schedule for audit preparation on the pages we reviewed; costs depend on scope, such as the number of program areas and contracts. IHS scopes each engagement after a free introductory call.
What this is not
- This page is not legal advice. IHS is a consulting firm, not a law firm.
- A mock audit does not predict or guarantee CMS's findings.
- IHS does not contact CMS, attend the audit for you or submit anything to CMS. IHS drafts; your organization submits.
Frequently asked questions
What happens in the six weeks before field work?
CMS calls this the Audit Engagement and Universe Submission phase, the six-week period before field work. The sponsor prepares and submits universes of cases for the program areas under audit. Preparation done before the engagement letter arrives leaves more of those six weeks for checking data.
What is a universe, and what happens if ours fails?
A universe is the data a sponsor submits for CMS to test. CMS sets a maximum of three attempts to provide complete and accurate universes, and says three may not always be feasible, for example once CMS has shared timeliness test results. If a sponsor fails twice, CMS documents an observation in the audit report. After the third failed attempt, or earlier if the sponsor determines it cannot provide an accurate universe in the time allowed, CMS cites an Invalid Data Submission condition for each element that cannot be tested.
Which program areas are audited?
The CMS-10717 protocol set includes a Compliance Program Effectiveness protocol, a Part D Formulary and Benefit Administration protocol and protocol files labeled CDAG, ODAG and SNPCC. IHS reads the current protocol for each area you expect to be audited and builds the readiness assessment from it.
What does the compliance program effectiveness review look like now?
The CPE protocol says there is no longer a standalone program area evaluation of compliance program effectiveness. CMS collects a universe of compliance oversight activities and reviews the compliance program together with its impact on the other audited areas. CMS compliance staff also interview the compliance officer before field work, on topics that include risk assessment and FDR oversight.
What is the difference between an Observation and a Corrective Action Required finding?
The Process Overview defines an Observation as a finding of noncompliance that does not require a corrective action plan. A Corrective Action Required finding is noncompliance that requires correction to strengthen internal controls, prevent future noncompliance or resolve enrollee impact. An Invalid Data Submission condition is cited when a universe cannot be produced accurately.
How fast is an impact analysis due?
The Process Overview says sponsors must upload an impact analysis to HPMS within 10 business days of CMS's request. IHS drafts the root cause and impact analysis templates in advance so your team is not building them during the audit.
How long do we have to respond to the draft report and submit corrective action plans?
The sponsor has 10 business days to respond to the draft audit report with comments. Corrective action plans for findings that require them are due within 30 calendar days of the final audit report. IHS can draft the CAP outline; your organization writes and submits the final CAP.
Do the audit protocols replace the regulations?
No. CMS states on its Program Audits page that the protocols are not a substitute for a review of the applicable statutes or regulations. IHS uses the protocols for readiness and reads the underlying rules in 42 CFR Parts 422 and 423 where a protocol element depends on them.
Who on our team needs to be ready?
The compliance officer, because CMS interviews the compliance officer before field work. Then the owner of each audited program area and the people who produce its universe. The mock audit gives each of them a practice run against the protocol.