CPIC- Report of Internal Control Deficiencies

30.5 - CPIC- Report of Internal Control Deficiencies (Rev. 11133, Issued:11-30-21, Effective: 10-01-21, Implementation: 12-31-21) The CPIC Report of Internal Control Deficiencies is an internal report and it shall include control deficiencies, significant deficiencies, and SSAE 18 Section III/IV exceptions. The CPIC report of Internal Control Deficiencies shall not be submitted as part of the annual CPIC submission. However, you are required to report in the Executive Summary the number of control deficiencies and significant deficiencies identified during the period covered by the CPIC. The CPIC Report of Internal Control Deficiencies should be prepared as a spreadsheet and include the following columns of information: 1. The original source of the finding. 2. The type of control deficiency (control deficiency or significant deficiency). 3. Whether it is a design deficiency or operating deficiency. 4. The control objective numbers impacted (from Section 50). 5. The corrective action plan. 6. A summary of the control deficiency and significant deficiencies including when the condition was observed and if a corrective action plan was implemented (or the status if not corrected). Each control deficiency and significant deficiency shall be listed, and the total number of control deficiencies and significant deficiencies shall be included in the report. The contractors are required to prepare and maintain this report and update this report as new control deficiencies are identified. When CPIC control deficiencies are identified, evaluate internal corrective actions for each of the deficiencies and correct each problem. While you are required to document, track, and correct problems identified as control deficiencies, significant deficiencies and material weaknesses, CPIC CAPs are not required to be submitted to CMS for control deficiencies and significant deficiencies. End Section 30.5 – Report of Internal Control Deficiencies: Back to Table of Contents