Corrective Action Plan (CAP) Reports

40.2 - Corrective Action Plan (CAP) Reports (Rev. 10614, Issued: 03-23-21, Effective: 10-01-20, Implementation: 04-22-21) The Initial or Quarterly CAP Report shall include the data explained below using the excel template located in Section 40.6; in addition to a Field Legend providing field completion instructions. Findings should be grouped by type of review (i.e. CFO, SSAE 18, A-123 Appendix A, CPIC, etc.). Definitions of CAP report data fields: A. Contractor – The abbreviated name assigned to the Medicare Administrative Contractor (MAC), Shared System Maintainer (SSM), Data Center (DC), RDS or MSPRC see tables 2, 3, and 4 in Section 40.3. B. Fiscal Year (XX) – The last two digits of the fiscal year reviewed/audited (e.g., FY 2020 would be entered as 20). C. Review/Audit Type – Refer to Section 40.3 Table 1 to identify the code for the review or audit type performed. D. CAP No. – Sequential three digit number (starting with 001) issued by the auditor/reviewer (or assigned by the contractor if it is a CPIC material weakness) for each finding type. E. Jurisdiction Identifier – Applicable to MACs only-refer to Section 40.3 Table 2 for jurisdiction code. F. Repeat CAP – Indicate if original CAP has any repeat CAPs (“Yes”/”No”). G. CAP Repeat Number – For Quarterly CAP reporting, if a finding is repeated or duplicated in subsequent years or reported in more than one type of review, provide all other CAP ID Nos. for that issue. Repeat finding numbers listed for a particular finding shall be an identical issue, not a related or similar issue and have been identified as a repeat by the auditors in their audit report. Findings with a repeat finding number shall only be listed once on the CAP report. Repeat finding numbers shall only be reported in the “CAP ID Number” column in the Initial CAP Report for new repeat findings identified. For the Quarterly CAP Report, the “CAP ID Number” column will be populated with the primary (original) finding number only. The primary finding number is the finding number that was identified first. If in subsequent audit/review, the same finding is identified by the auditors, the auditors will assign a finding number applicable to the type of audit/review being conducted, and also note in the audit report that it is a repeat finding of a prior audit. The auditor should also note the primary (original) finding number so that the findings can be easily linked. H. Control objective(s) impacted – Required only for SSAE 18 findings, A-123 Appendix A findings, and CPIC material weaknesses. This represents the control objective number(s) impacted by an identified finding. More than one control objective may be impacted for each finding but you need to prioritize and limit the control objectives impacted to no more than five. Note the CMSR number should not be reported in this field. I. Deficiency Description – A detailed description of the finding as identified by the auditor/reviewer in their final report or the material weakness as reported in the CPIC. J. Deficiency Classification – This column is reserved for use by the CMS internal control team. 1. CAP ID No. – This field represents the unique identification number assigned to each deficiency requiring a CAP (formula driven). 2. CAP Description – A description of the planned remediation strategy to eliminate or mitigate the deficiency identified. The CAP should address the root cause of the deficiency. 3. Progress Milestones – Sequentially numbered specific action-oriented steps that facilitates the CAP progress for each deficiency being remediated. Progress milestones shall not change once established. Any revision to an original progress milestone shall be documented in the “2. CAP Description” column and considered an amendment to the original progress milestone. Any changes to the original CAP shall be submitted to CMS for approval by the Business Owner. All steps (milestones) shall be included in one cell. 4. Original Target Completion Date – A target completion date must be assigned to every CAP and progress milestone within the CAP to include (MM/DD/YYYY). The target date shall not change once it is recorded. 5. Revised Target Completion Date – If the original target completion date is revised; the revised date should be included in this column and the reason for the revision should be documented in column “2. CAP Description” (MM/DD/YYYY). Note all changes in the original target completion date shall be submitted to CMS for approval by the Business owner. 6. Actual Completion Date – An actual completion date shall be recorded for every CAP and progress milestone within the CAP to include (MM/DD/YYYY) the remediation of the deficiency was validated as effective. 7. CAP Status – A status reflecting the disposition of the CAP must be assigned and updated as necessary for each deficiency being remediated. Status options for deficiencies assessment include: i. Open – Remediation efforts are in progress and the target completion date has not passed; ii. Delayed – Remediation efforts are in progress after the original target completion date has passed. Explanations/justifications for delayed status must be documented in the CAP; iii. Closed – Pending – Verification and validation efforts have been completed and the CAP is awaiting closure by the issuing party (e.g., SSAE 18 Auditor, A-123 Assessor). iv. Closed – Validation and verification procedures demonstrate remediation efforts were adequately addressed, proven effective, and remediation efforts have been closed by parties authorized to close CAPs (i.e. SSAE 18 auditors, A-123 contractor); and v. Cancelled – Remediation efforts have ceased because the remediation was recorded inadvertently or erroneously, or it can be demonstrated that the remediation effort is no longer relevant. Explanations/justifications for cancelled statuses must be document in the CAP and approved by the Business Owner. 8. CAP Lead 1 – Individual responsible for managing corrective action efforts must be assigned and documented for each deficiency being remediated. 9. CAP Lead 2 – Not applicable to Medicare Contractors. 10. CAP Lead 3 – Not applicable to Medicare Contractors. 11. Executive Sponsor 1 – The senior executive official accountable for the deficiency and the associated CAP must be documented for each deficiency requiring a CAP. 12. Executive Sponsor 2 – Not applicable to Medicare Contractors. 13. Executive Sponsor 3 – Not applicable to Medicare Contractors. 14. Testing Document Reference – Not applicable to Medicare Contractors. 15. Sport/Prosight Identifier – Not applicable to Medicare Contractors. 16. Root Cause Analysis (RCA) Methodology – RCA is the examination process used to determine the underlying events(s) that cause the deficiency; the approach technique used to uncover causes of problems. Also, RCA can be seen as the process utilized to help identify what, how, and why an event occurred so that steps can be taken to prevent future occurrences. RCA documentation should be available upon request from the CAP Lead and include the decision process used to determine the RCA approach, and all supporting documentation (e.g. walk through documentation, meeting minutes, various dates analysis, emails, etc.). 17. Not for use by contractor 18. Progress Milestone Status – Each progress milestone must have an assigned status reflecting its disposition. Status options for deficiencies include: i. Open – Remediation efforts are in progress and the target completion date has not passed; ii. Delayed – Remediation efforts are in progress and after the original target completion date has passed. Explanations/justifications for delayed status must be documented in the CAP; iii. Closed – Pending – Verification and validation efforts have been completed and the CAP is awaiting closure by the issuing party (e.g., SSAE 18 Auditor, A-123 Assessor). iv. Closed – Validation and verification procedures demonstrate remediation efforts were adequately addressed, proven effective, and remediation efforts have been closed by parties authorized to close CAPs (i.e. SSAE 18 auditors, A-123 contractor); and v. Cancelled – Remediation efforts have ceased because the remediation was recorded inadvertently or erroneously, or it can be demonstrated that the remediation effort is no longer relevant. Explanations/justifications for cancelled statuses must be document in the CAP and approved by the Business Owner. End Section 40.2 – Corrective Action Plan (CAP) Reports: Back to Table of Contents