US · guidance
CMS Pub. 100-06, ch. 7, § 40.3
CMS Finding Numbers
Finding Numbers should be assigned using the following instructions. Each section of
digits should be separated by a dash.
A. The first three, four, or five digits are letters, which identify the name of the
contractor. Each contractor is assigned a unique set of letters listed below. Finding
numbers ending with D & J are defined as follows:
• End letter “D” represents a DME MAC (e.g. ZZZD or ZZZZD)
• End letter “J” represents a A/B MAC (e.g. ZZZJ or ZZZZJ)
B. The second two digits are the last two numbers of the year of the review.
C. The next one digit is a letter to identify the review/audit type.
D. The last three digits are three numbers assigned sequentially to each finding type
beginning with 001.
Table 1 – REVIEW/AUDIT TYPE
Findings resulting from the following types of audits or reviews should be reported using
the Initial and Quarterly CAP Reports. Choose one from the following list:
Review /
Audit Letter
Review / Audit
Description
A A-123 Appendix A Non-IT
C CPIC (Your Annual Self Certification Package)
E CFO EDP Audit
F CFO Financial Audit
G GAO Review (Financial Reviews)
I A-123 Appendix A IT
M CMS’ CPIC Reviews
O OIG Review HHS / OIG / IT Controls Assessment
P CMS’ 1522 and CMBRW Reviews
S SSAE 18 Audit
V CFO Related NVA / ST
W IFM Review
Table 2 – A/B, DME, AND SPECIALTY MAC CONTRACTOR
ABBREVIATIONS
A/B, DME, and Specialty MAC
Contractor Name and Jurisdiction
A/B / DME / SMAC
Abbreviation
Noridian Healthcare Solutions, LLC,
Durable Medical Equipment (DME) MAC JA & JD
NORD
CGS Administrators, LLC,
DME MAC, JB & JC
CGSD
Wisconsin Physicians Service Insurance Corporation,
A/B MAC, J5 & J8
WPSJ
National Government Services, Inc.,
A/B MAC, J6 & JK
NGSJ
CGS Administrators, LLC,
A/B MAC, J15
CGSJ
Noridian Healthcare Solutions, LLC,
A/B MAC, JE & JF
NORJ
Novitas Solutions, Inc.,
A/B MAC, JH & JL
NOVJ
Palmetto GBA, LLC,
A/B MAC, JJ & JM
PGBAJ
First Coast Service Options, Inc.,
A/B MAC, JN
FCSOJ
Palmetto GBA, LLC,
Railroad Retirement Board (RRB) Specialty MAC (SMAC)
PGBAR
Table 3 – CONTRACTOR ABBREVIATIONS
Contractor Name and Area Contractor
Abbreviation
Novitas Solutions, Inc.,
Affordable Care Act Exchange Oversight Contractor
NOVA
General Dynamics Information Technology (GDIT),
Benefits Coordination and Recovery Center (BCRC),
Medicare Secondary Payer Recovery Contractor (MSPRC)
BCRC
Palmetto GBA, LLC,
Pricing, Data Analysis, and Coding (PDAC)
PDAC
Performant,
Commercial Repayment Center (CRC), MSPRC
CRC
General Dynamics Information Technology (GDIT),
Retiree Drug Subsidy (Part D Contractor)
RDS
National Government Services Financial Solutions,
Innovation Payment Contractors (IPC)
IPC
Table 4 – SHARED SYSTEM MAINTAINER ABBREVIATIONS
Shared System Maintainer Name and Area SSM
Abbreviation
Common Working File Maintainer (CWF) CWF
Shared System Maintainer Name and Area SSM
Abbreviation
Fiscal Intermediary Standard System (FISS) FISS
Multi-Carrier System (MCS) MCS
Viable Information Processing Systems (ViPS) Medicare System
(VMS), DME Claims Processing System
VMS
Table 5 – DATA CENTER ABBREVIATIONS
Data Center Name and Area DC
Abbreviation
Amazon Web Services (AWS) AWS
Companion Data Services (CDS),
Virtual Data Center (VDC)
CDS
Disaster Recovery as a Service (DRaaS)
General Support System (GSS)
DRaaS
Leidos Managed Data Center (LMDC) – Culpepper, VA,
Healthcare Integrated General Ledger Accounting System (HIGLAS)
LMDC
Workload A (Managed by CDS) WKLDA
Workload B (Managed by CDS) WKLDB
End Section 40.3 – CMS Finding Numbers: Back to Table of Contents
History
(Rev. 13001, Issued: 12-13-24, Effective: 10-01-24, Implementation: 01-15-25)
Provenance
- Source
- cms.gov
- Retrieved
- 2026-08-25
- Edition
- iom-2026-08-25
- Content hash
7564875152cea1ddfb6af766e23b7d4b21ee7765d438c0c73262db18a3bb4c6b
The link goes to the issuing authority’s own document — the one we read to produce this record. Where a source publishes whole titles rather than sections, your browser may need a moment to jump to the provision.
Unofficial copy of government-published law, reproduced from official sources with full provenance. Not an official publication; verify against official sources before relying on it in a filing. Records in the 'guidance' corpus, and only that corpus, are sub-regulatory (interpretive guidelines, survey procedures) and are not binding law. Validity bounds follow each jurisdiction's declared temporalBasis.