CMS Pub. 100-06, ch. 7, § 40.2

The Initial or Quarterly CAP Report shall include the data explained below using the

excel template located in Section 40.6; in addition to a Field Legend providing field

completion instructions. Findings should be grouped by type of review (i.e. CFO, SSAE

18, A-123 Appendix A, CPIC, etc.). Definitions of CAP report data fields:

A. Contractor – The abbreviated name assigned to the Medicare Administrative

Contractor (MAC), Shared System Maintainer (SSM), Data Center (DC), RDS or

MSPRC see tables 2, 3, and 4 in Section 40.3.

B. Fiscal Year (XX) – The last two digits of the fiscal year reviewed/audited (e.g.,

FY 2020 would be entered as 20).

C. Review/Audit Type – Refer to Section 40.3 Table 1 to identify the code for the

review or audit type performed.

D. CAP No. – Sequential three digit number (starting with 001) issued by the

auditor/reviewer (or assigned by the contractor if it is a CPIC material weakness) for each

finding type.

E. Jurisdiction Identifier – Applicable to MACs only-refer to Section 40.3 Table 2

for jurisdiction code.

F. Repeat CAP – Indicate if original CAP has any repeat CAPs (“Yes”/”No”).

G. CAP Repeat Number – For Quarterly CAP reporting, if a finding is repeated or

duplicated in subsequent years or reported in more than one type of review, provide all

other CAP ID Nos. for that issue. Repeat finding numbers listed for a particular finding

shall be an identical issue, not a related or similar issue and have been identified as a

repeat by the auditors in their audit report.

Findings with a repeat finding number shall only be listed once on the CAP report.

Repeat finding numbers shall only be reported in the “CAP ID Number” column in the

Initial CAP Report for new repeat findings identified. For the Quarterly CAP Report, the

“CAP ID Number” column will be populated with the primary (original) finding number

only. The primary finding number is the finding number that was identified first. If in

subsequent audit/review, the same finding is identified by the auditors, the auditors will

assign a finding number applicable to the type of audit/review being conducted, and also

note in the audit report that it is a repeat finding of a prior audit. The auditor should also

note the primary (original) finding number so that the findings can be easily linked.

H. Control objective(s) impacted – Required only for SSAE 18 findings, A-123

Appendix A findings, and CPIC material weaknesses. This represents the control

objective number(s) impacted by an identified finding. More than one control objective

may be impacted for each finding but you need to prioritize and limit the control

objectives impacted to no more than five. Note the CMSR number should not be reported

in this field.

I. Deficiency Description – A detailed description of the finding as identified by the

auditor/reviewer in their final report or the material weakness as reported in the CPIC.

J. Deficiency Classification – This column is reserved for use by the CMS internal

control team.

1. CAP ID No. – This field represents the unique identification number assigned to each

deficiency requiring a CAP (formula driven).

2. CAP Description – A description of the planned remediation strategy to eliminate or

mitigate the deficiency identified. The CAP should address the root cause of the

deficiency.

3. Progress Milestones – Sequentially numbered specific action-oriented steps that

facilitates the CAP progress for each deficiency being remediated. Progress

milestones shall not change once established. Any revision to an original progress

milestone shall be documented in the “2. CAP Description” column and considered

an amendment to the original progress milestone. Any changes to the original CAP

shall be submitted to CMS for approval by the Business Owner. All steps

(milestones) shall be included in one cell.

4. Original Target Completion Date – A target completion date must be assigned to

every CAP and progress milestone within the CAP to include (MM/DD/YYYY). The

target date shall not change once it is recorded.

5. Revised Target Completion Date – If the original target completion date is revised;

the revised date should be included in this column and the reason for the revision

should be documented in column “2. CAP Description” (MM/DD/YYYY). Note all

changes in the original target completion date shall be submitted to CMS for approval

by the Business owner.

6. Actual Completion Date – An actual completion date shall be recorded for every CAP

and progress milestone within the CAP to include (MM/DD/YYYY) the remediation

of the deficiency was validated as effective.

7. CAP Status – A status reflecting the disposition of the CAP must be assigned and

updated as necessary for each deficiency being remediated. Status options for

deficiencies assessment include:

i. Open – Remediation efforts are in progress and the target completion date

has not passed;

ii. Delayed – Remediation efforts are in progress after the original target

completion date has passed. Explanations/justifications for delayed status

must be documented in the CAP;

iii. Closed – Pending – Verification and validation efforts have been completed

and the CAP is awaiting closure by the issuing party (e.g., SSAE 18

Auditor, A-123 Assessor).

iv. Closed – Validation and verification procedures demonstrate remediation

efforts were adequately addressed, proven effective, and remediation efforts

have been closed by parties authorized to close CAPs (i.e. SSAE 18

auditors, A-123 contractor); and

v. Cancelled – Remediation efforts have ceased because the remediation was

recorded inadvertently or erroneously, or it can be demonstrated that the

remediation effort is no longer relevant. Explanations/justifications for

cancelled statuses must be document in the CAP and approved by the

Business Owner.

8. CAP Lead 1 – Individual responsible for managing corrective action efforts must be

assigned and documented for each deficiency being remediated.

9. CAP Lead 2 – Not applicable to Medicare Contractors.

10. CAP Lead 3 – Not applicable to Medicare Contractors.

11. Executive Sponsor 1 – The senior executive official accountable for the deficiency

and the associated CAP must be documented for each deficiency requiring a CAP.

12. Executive Sponsor 2 – Not applicable to Medicare Contractors.

13. Executive Sponsor 3 – Not applicable to Medicare Contractors.

14. Testing Document Reference – Not applicable to Medicare Contractors.

15. Sport/Prosight Identifier – Not applicable to Medicare Contractors.

16. Root Cause Analysis (RCA) Methodology – RCA is the examination process used to

determine the underlying events(s) that cause the deficiency; the approach technique

used to uncover causes of problems. Also, RCA can be seen as the process utilized to

help identify what, how, and why an event occurred so that steps can be taken to

prevent future occurrences. RCA documentation should be available upon request

from the CAP Lead and include the decision process used to determine the RCA

approach, and all supporting documentation (e.g. walk through documentation,

meeting minutes, various dates analysis, emails, etc.).

17. Not for use by contractor

18. Progress Milestone Status – Each progress milestone must have an assigned status

reflecting its disposition. Status options for deficiencies include:

i. Open – Remediation efforts are in progress and the target completion date

has not passed;

ii. Delayed – Remediation efforts are in progress and after the original target

completion date has passed. Explanations/justifications for delayed status

must be documented in the CAP;

iii. Closed – Pending – Verification and validation efforts have been completed

and the CAP is awaiting closure by the issuing party (e.g., SSAE 18

Auditor, A-123 Assessor).

iv. Closed – Validation and verification procedures demonstrate remediation

efforts were adequately addressed, proven effective, and remediation efforts

have been closed by parties authorized to close CAPs (i.e. SSAE 18

auditors, A-123 contractor); and

v. Cancelled – Remediation efforts have ceased because the remediation was

recorded inadvertently or erroneously, or it can be demonstrated that the

remediation effort is no longer relevant. Explanations/justifications for

cancelled statuses must be document in the CAP and approved by the

Business Owner.

End Section 40.2 – Corrective Action Plan (CAP) Reports: Back to Table of Contents