CPIC- Report of Material Weaknesses

30.4 - CPIC- Report of Material Weaknesses (Rev. 331, Issued: 11-15-19, Effective: 10-01-19, Implementation: 12-17- 19) The CPIC Report of Material Weaknesses (MW) shall include all initial MW identified during the CPIC period and not yet corrected and approved by a CAP closing letter. This report shall be updated as new findings are identified. It shall be prepared as a spreadsheet and include the following columns of information: 1. CMS Finding Number. The contractor shall use the CMS finding number assigned in the final audit report for all external findings. Assign a CMS finding number (see Section 40.3) to all internally-identified MWs. This shall be done as soon as the determination is made that the finding is a MW. Note: Information related to each MW should be on only one row of the spreadsheet; the “wrap text” function in Excel should be used. 2. Control Objective Impacted (see Section 50). Each MW shall have at least one control objective associated with it. However, a MW could have more than one control objective associated with it. If more than one control objective is impacted by the MW, the finding shall be listed only once with multiple control objectives listed with it. Prioritize the control objectives impacted by each finding and limit them to no more than five. 3. Summary of the material weakness. 4. Corrective action plan (CAP). 5. Date the MW was first identified at the contractor level. 6. Date initial CAP submitted to CMS. 7. CAP target completion date. 8. Actual completion date. 9. Original source of the finding. If the original source is a Contractor Performance Evaluation review, you shall include the report date and site location of the review. If the original source is an internal control review to support your CPIC certification, identify the MW either FMFIA or financial reporting (FR). Example Report of Material Weaknesses CMS Contractor XYZ CPIC Report of Material Weaknesses 1. CMS Finding Number 2. Control Objective(s) Impacted 3. Summary of the MW 4.Corrective Action Plan (CAP) 5. Date MW Identified at the contractor level 6. Date Initial CAP Submitted to CMS 7. CA Targe Comp Date XYZ-XX-S-001 A.1 No Entity Wide Security Plan Create an entity Wide Security Plan 03/01/20YY 03/10/20YY 6/30/2 XYZ-XX-C-001 J.4 One individual opens Medicare checks and records them in the cash receipts log. This indicates inadequate separation of duties for this process. Duties of opening mail and logging in cash receipts are being assigned to separate individuals. 02/03/20YY 02/27/20YY 03/15/ XYZ-XX-C-002 J.3 There is no integrated general ledger accounting system to adequately track all Medicare financial data. The services of a consulting firm have been obtained to develop an integrated general ledger system for reporting Medicare financial data. 02/20/20YY 02/27/20YY 04/30/ Reporting Period FY 20YY End Section 30.4 – Report of Material Weaknesses: Back to Table of Contents