CMS Pub. 100-16, ch. 21, § 50.6.2

42 C.F.R. §§ 422.503(b)(4)(vi)(F), 423.504(b)(4)(vi)(F)

Sponsors must establish and implement policies and procedures to conduct a formal

baseline assessment of the sponsor’s major compliance and FWA risk areas, such as

through a risk assessment. The sponsor’s assessment must take into account all Medicare

business operational areas. Each operational area must be assessed for the types and

levels of risks the area presents to the Medicare program and to the sponsor. Factors that

sponsors may consider in determining the risks associated with each area include, but are

not limited to:

• Size of department;

• Complexity of work;

• Amount of training that has taken place;

• Past compliance issues; and

• Budget.

Areas of particular concern for Medicare Parts C and D sponsors include, but are not

limited to, marketing and enrollment violations, agent/broker misrepresentation, selective

marketing, enrollment/disenrollment noncompliance, credentialing, quality assessment,

appeals and grievance procedures, benefit/formulary administration, transition policy,

protected classes policy, utilization management, accuracy of claims processing,

detection of potentially fraudulent claims, and FDR oversight and monitoring.

Risks identified by the risk assessment must be ranked to determine which risk areas will

have the greatest impact on the sponsor, and the sponsor must prioritize the monitoring

and auditing strategy accordingly. Risks change and evolve with changes in the law,

regulations, CMS requirements and operational matters. Therefore, there must be

ongoing review of potential risks of noncompliance and FWA and a periodic re-evaluation of the accuracy of the sponsor’s baseline assessments. Risk areas identified

through CMS audits and oversight, as well as through the sponsor’s own monitoring,

audits and investigations are priority risks. The results of the risk assessment inform the

development of the monitoring and audit work plan.