Statement on Standards for Attestation Engagements (SSAE)

30.8 –Statement on Standards for Attestation Engagements (SSAE) Number 18, (SSAE 18) Reporting on Controls at Service Providers (Rev. 11133, Issued:11-30-21, Effective: 10-01-21, Implementation: 12-31-21) NOTE: This section is only applicable to the following listed A/B, DME, and Specialty MACs: # MAC Type & Jurisdiction/Workload 1 DME MAC Jurisdiction A 2 DME MAC Jurisdiction B 3 DME MAC Jurisdiction C 4 DME MAC Jurisdiction D 5 Parts A & B MAC Jurisdiction 5 6 Parts A & B MAC Jurisdiction 6 7 Parts A & B MAC Jurisdiction 8 8 Parts A & B MAC Jurisdiction 15 9 Parts A & B MAC Jurisdiction E 10 Parts A & B MAC Jurisdiction F 11 Parts A & B MAC Jurisdiction H 12 Parts A & B MAC Jurisdiction J 13 Parts A & B MAC Jurisdiction K 14 Parts A & B MAC Jurisdiction L 15 Parts A & B MAC Jurisdiction M # MAC Type & Jurisdiction/Workload 16 Parts A & B MAC Jurisdiction N 17 Specialty MAC Railroad Board (RRB) In lieu of receiving an A-123 Appendix A review, A/B, DME, and Specialty MACs are required to undergo a SSAE 18 SOC 1, Type II audit. CMS shall contract with an independent certified public accounting (CPA) firm to perform the SSAE 18 audit. The A/B, DME, and Specialty MACs shall cooperate with the audit which may include, but is not limited to, providing all documentation requested, CPIC results, management assertions, coordinating interviews with key personnel, participating in entrance and exit conferences, providing workspace, and internet connectivity, etc. The A/B, DME, and SMACs shall ensure that all subcontractors are properly identified as inclusive and/or carved out. Based on the subcontractors’ impact on the MAC’s financial statement, the subcontractor may be in scope (i.e. inclusive method) for the SSAE 18 audit. The scope of the SSAE 18 audit begins October 1st of each federal fiscal year and ends no earlier than March 31st (6 months) (e.g. For Federal Fiscal Year 2020, the scope of the audit begins October 1st, 2019, and ends March 31st, 2020). Initial SSAE 18 Control Objectives: For new A/B, DME, and Specialty MACs, excluding cases where incumbent MACs transition to a new MAC jurisdiction, initial SSAE 18 audit shall include the following thirteen (13) listed CMS Control Objectives as described under Section 50 of this IOM: # CMS Control Objective Areas for Initial SSAE 18 Audit Testing 1 50.1 – A Controls – Information Systems 2 50.2 – B Controls – Claims Processing 3 50.3 – C Controls – Appeals 4 50.4 – D Controls – Beneficiary / Provider Services 5 50.5 – E Controls – Complementary Credits 6 50.6 – F Controls – Medical Review (MR) 7 50.7 – G Controls – Medicare Secondary Payer (MSP) 8 50.8 – H Controls – Administrative 9 50.9 – I Controls – Provider Audit 10 50.10 – J Controls – Financial Reporting Review Requirements 11 50.11 – K Controls – Debt Referral (MSP and Non-MSP) 12 50.12 – L Controls – Non-MSP Debt Collection 13 50.13 – M Controls – Provider Enrollment Recurring SSAE 18 Control Objectives: In subsequent years, A/B, DME, and Specialty MACs SSAE 18 audits shall include the following eight (8) control objectives: # CMS Control Objective Areas for Recurring SSAE 18 Audit Testing 1 50.1 – A Controls – Information Systems 2 50.2 – B Controls – Claims Processing 3 50.6 – F Controls – Medical Review (MR) 4 50.7 – G Controls – Medicare Secondary Payer (MSP) 5 50.9 – I Controls – Provider Audit 6 50.10 – J Controls – Financial Reporting Review Requirements 7 50.11 – K Controls – Debt Referral (MSP and Non-MSP) 8 50.12 – L Controls – Non-MSP Debt Collection The remaining Control Objectives may be audited based on professional judgment and/or based on the risk identified from the annual CPIC assessment. Points of Contact (POC) – The A/B, DME, and Specialty MACs shall assign a POC that will assist to ensure that all required parties are invited to the following scheduled events. Entrance Conference – The A/B, DME, and Specialty MACs shall participate in the SSAE 18 entrance conference. The entrance conference is the start of each engagement to discuss the scope, timeframe, and any other issues relating to the engagement. Status Meetings – The A/B, DME, and Specialty MACs shall participate in the SSAE 18 status meetings. The status meetings will include discussion of the audit activities performed to date. The meeting will including a status of CAPs, potential findings and/or exceptions and any issues that may affect the completion of the work. Preliminary Exit Conference – The A/B, DME, and Specialty MACs shall participate in the SSAE 18 preliminary exit conference. The preliminary exit conference will include a status of the engagement, any outstanding issues, additional documentation requests, potential findings and/or exceptions to date, estimated exit conference date, and other topics to be addressed. Exit Conference Report – Prior to the exit conference, the A/B, DME, and Specialty MACs will receive the SSAE 18 exit conference report from the CPA firm. The exit conference report shall include any outstanding issues, summary of findings and/or exceptions, and any other items that requires the MAC’s attention. The A/B, DME, and Specialty MACs shall review the exit conference report in preparation of the exit conference. Exit Conference – The A/B, DME, and Specialty MAC shall participate in the SSAE 18 exit conference. The exit conference will include items such as the status of the examination, outstanding issues, any findings and/or exceptions, agree disagree letter, management representation letter, estimated draft report issuance date, etc. Draft SSAE-18 and CAP Follow up Reports – The A/B, DME, and Specialty MACs should receive the draft SSAE-18 and CAP Follow up reports no later than June 1st. The A/B, DME, and Specialty MACs shall review the draft reports for accuracy and provide any comments back to the CPA firm and CMS no later than ten (10) business days after June 1st. Final SSAE-18 and CAP Follow Up Reports – The A/B, DME, and Specialty MACs will receive final SSAE 18 and CAP Follow Up reports no later than July 1st. SSAE 18 Bridge Letters – The A/B, DME, and Specialty MACs shall submit a bridge letter attesting to the internal controls environment for the period of April 1st to September 30th. This bridge letter is critically important to the maintenance and demonstration of a strong internal control environment that supports the CMS internal control objectives: effective and efficient operations, reliable reporting, and compliance with applicable laws and regulations. The bridge letter is due within five (5) business days after September 30th and should be submitted via email to InternalControls@cms.hhs.gov. The contractor shall complete/submit a separate bridge letter for each jurisdiction. The bridge letter shall be signed by the Chief Financial Officer (or designee). A/B, DME, and Specialty MACs may use the attached sample language as the basis for their bridge letter or they may submit original language. At a minimum, the bridge letter shall have these key points addressed: • Name of CPA firm who prepared the latest SSAE 18 report; • Date the SSAE 18 report was issued; • Audit period covered by the most recent SSAE 18 report; • The date the service organization is providing this assertion (through the date of the bridge letter or the as of date provided in the request for the bridge letter); • Any material changes to the internal control environment (if applicable); • Statement that the service organization is not aware of any material changes to the control environment; • Statement that user entities are responsible for adhering to complementary user entity control from SSAE 18 report; • Disclaimer that the bridge letter is not a substitute for the actual SSAE 18 report. The bridge letter will be reviewed by the CMS A-123 Technical Team (ATT) for compliance. If there are any questions regarding the letter, the ATT will contact the A/B, DME, and Specialty MAC’s POC. [This letter should go on the A/B, DME, or Specialty MAC’s letter head] Sample Bridge Letter – No Material Changes: [Current Date] Bridge Letter Centers for Medicare & Medicaid Services Office of Financial Management 7500 Security Boulevard, Mailstop C3-13-08 Baltimore, MD 21244-1850 Attn: Internal Control Team Dear CMS Internal Controls Team: We have received your request for information regarding material changes in internal control related to the [list services here (A/B, DME, or Specialty MAC)]. [CPA firm name] prepared the latest Type II SSAE 18 for these services and the report is dated [report date]. This report includes tests of operating effectiveness for the period ending [period end date]. [Name of A/B, DME, or Specialty MAC] recognizes the need to maintain an appropriate internal control environment and report upon the effectiveness, as well as material changes to its internal controls. As of [current date], I am not aware of any material changes in our control environment that would adversely affect the Auditor’s Opinion reached in the [report end date (not the same as the report date)] report for the above named SSAE 18. You should also be aware that [A/B, DME, or Specialty MAC name], as a normal part of its operations, continually updates its services and technology as appropriate. In addition, the controls for all of [A/B, DME, or Specialty MAC name] services were designed with certain responsibilities required of the system users (See Complimentary User Entity Control in the SSAE 18 report). [A/B, DME, or Specialty MAC name] controls must always be evaluated in conjunction with an assessment of the strength of these user controls. Finally, in order to conclude upon the design and effectiveness of internal controls for [A/B, DME, or Specialty MAC name], you must read the current SSAE 18 report. This letter is not intended to be a substitute for the SSAE 18 report. Sincerely, [Name of Member of Management1] [Title] 1 Should be a signature from one of the same persons that signed the letter of representations. Sample Bridge Letter – Material Changes: [Current Date] Bridge Letter Centers for Medicare & Medicaid Services Office of Financial Management 7500 Security Boulevard, Mailstop C3-13-08 Baltimore, MD 21244-1850 Attn: Internal Control Team Dear CMS Internal Controls Team: We have received your request for information regarding material changes in internal control related to the [list services here (A/B, DME, or Specialty MAC)]. [CPA firm name] prepared the latest Type II SSAE 18 for these services and the report is dated [report date]. This report includes tests of operating effectiveness for the period ending [period end date]. [A/B, DME, or Specialty MAC name] recognizes the need to maintain an appropriate internal control environment and report upon the effectiveness, as well as material changes to its internal controls. On [date or approximate date material change happened], [describe the control add/change/removal that was made. Two sentences is sufficient]. As of [current date], I am not aware of any other material changes in our control environment that would adversely affect the Auditor’s Opinion reached in the [report end date (not the same as the report date)] report for the above named SSAE 18. You should also be aware that [A/B, DME, or Specialty MAC name], as a normal part of its operations, continually updates its services and technology as appropriate. In addition, the controls for all of [A/B, DME, or Specialty MAC name] services were designed with certain responsibilities required of the system users (See Complimentary User Entity Control in the SSAE 18 report). [A/B, DME, or Specialty MAC name] controls must always be evaluated in conjunction with an assessment of the strength of these user controls. Finally, in order to conclude upon the design and effectiveness of internal controls for [A/B, DME, or Specialty MAC name], you must read the current SSAE 18 report. This letter is not intended to be a substitute for the SSAE 18 report. Sincerely, [Name of Member of Management2] [Title] 2 Should be a signature from one of the same person(s) that signed the letter of representations. End Section 30.8 – Statement on Standards for Attestation Engagements (SSAE) Number 18, (SSAE 18) Reporting on Controls at Service Providers: Back to Table of Contents