CMS Pub. 100-06, ch. 7, § 30.5

The CPIC Report of Internal Control Deficiencies is an internal report and it shall include

control deficiencies, significant deficiencies, and SSAE 18 Section III/IV exceptions. The

CPIC report of Internal Control Deficiencies shall not be submitted as part of the annual

CPIC submission. However, you are required to report in the Executive Summary the

number of control deficiencies and significant deficiencies identified during the period

covered by the CPIC. The CPIC Report of Internal Control Deficiencies should be

prepared as a spreadsheet and include the following columns of information:

1. The original source of the finding.

2. The type of control deficiency (control deficiency or significant deficiency).

3. Whether it is a design deficiency or operating deficiency.

4. The control objective numbers impacted (from Section 50).

5. The corrective action plan.

6. A summary of the control deficiency and significant deficiencies including when

the condition was observed and if a corrective action plan was implemented (or

the status if not corrected).

Each control deficiency and significant deficiency shall be listed, and the total number of

control deficiencies and significant deficiencies shall be included in the report. The

contractors are required to prepare and maintain this report and update this report as new

control deficiencies are identified. When CPIC control deficiencies are identified,

evaluate internal corrective actions for each of the deficiencies and correct each problem.

While you are required to document, track, and correct problems identified as control

deficiencies, significant deficiencies and material weaknesses, CPIC CAPs are not

required to be submitted to CMS for control deficiencies and significant deficiencies.

End Section 30.5 – Report of Internal Control Deficiencies: Back to Table of Contents