CMS Contractor Internal Control Review Process and Timeline

20 - CMS Contractor Internal Control Review Process and Timeline (Rev. 11133, Issued:11-30-21, Effective: 10-01-21, Implementation: 12-31-21) NOTE: The following CMS Fiscal Year Calendar of Events and Activities timeline is provided as a guide and is not considered absolute. Contractors may use the guideline as a reference. Fiscal Year Calendar of Events and Activities Month Activity IOM Section October 1. Incorporate updated IOM changes 2. Updated Certification Package for Internal Controls (CPIC) Report Due: Five (5) business days after September 30th Reporting Period: July 1st – September 30th 3. Submit SSAE-18 Bridge Letters Due: 5 Business Days after September 30th Reporting Period: April 1st – September 30th 4. Begin the Risk Assessment Process 5. Begin updating Standard Operating Procedures - Section 20.1 – Risk Assessment - Section 30.1 – Certification Package for Internal Controls (CPIC) Requirements - Section 30.2 – Certification Statement - Section 30.8 –Statement on Standards for Attestation Engagements (SSAE) Number 18, (SSAE 18) Reporting on Controls at Service Providers January 6. SSAE 18 Examinations (A/B, DME, & Specialty MACs) Start 7. Update and Submit A-123 Cycle Memos to CMS Central Office Due: 15 Business Days after December 31st - Section 30.8 –Statement on Standards for Attestation Engagements (SSAE) Number 18, (SSAE 18) Reporting on Controls at Service Providers February 8. Prepare for A-123 or SSAE 18 audit onsite reviews June 9. Begin preparing CPIC for all geographical locations. 10. Update CPIC Report of Internal Control Deficiencies 11. Draft SSAE-18 and CAP Follow Up Reports Issued Due: June 1st Reporting Period: October 1st - March 31st 12. Prepare to Draft CPIC and SSAE 18 Corrective Action Plans CAPs Month Activity IOM Section July 1. Final SSAE-18 and CAP Follow Up Reports Issued Due: July 1st Reporting Period: October 1st - March 31st 2. Submit CPIC Report - Certification Statement - Executive Summary - Description/Documentation of the Risk Assessment Process - Report of Material Weaknesses Due: 15 Business Days after June 30th Reporting Period: October 1st - June 30th - Section 30.8 –Statement on Standards for Attestation Engagements (SSAE) Number 18, (SSAE 18) Reporting on Controls at Service Providers - Section 30.1 – Certification Package for Internal Controls (CPIC) Requirements - Section 30.2 – Certification Statement - Section 30.3 – Executive Summary - Section 20.1 – Risk Assessment - Section 30.4 – CPIC – Report of Material Weaknesses August 3. Review updated IOM to evaluate changes required to your system of operations 4. Submit SSAE 18 CAPs Due: 45 Days after Final SSAE 18 Reports 5. Submit CPIC CAPs Due: 45 Days after CPIC Reports - Section 40.1 – Submission, Review, and Approval of Corrective Action Plans September 6. Determine if any new material weaknesses were identified since the CPIC Report in July