A Centers for Medicare and Medicaid Services (CMS) One-Third Financial Audit (OFA) is when financial records of at least one-third (1/3) of Medicare Advantage (MA) and Prescription Drug Plans (PDPs) are audited each year. The purpose of the audit is to perform a review of internal controls as well as test the accuracy and allocation of Medicare Part C and D costs. The audit also includes a solvency review to evaluate the Plan’s ability to bear the risk of potential financial losses. Section 1860D-12(b)(3)(C) of the Social Security Act and 42 CFR § 423.504(d)(1) governs these audits and CMS’s Office of Financial Management (OFM) is responsible for conducting these audits via contracted Certified Public Accounting (CPA) firms.
Undergoing a CMS OFA can be surprisingly far reaching for plans as the CPA firms are digging into processes and internal controls to ensure accuracy and consistency by plans. The list of items firms will request can be long and include general documentation requests for items such as loans, leases, contracts, policies, and procedures. For Part C, be prepared to have medical claims data, bid information, enrollment data, Medicare Secondary Payer (MSP), capitated arrangements and benefit schedules reviewed in detail.
Part D focus items include areas such as MSP, bid information, Plan-to-Plan (P2P), Prescription Drug Events (PDE), member prescriptions (copy of script), Pharmacy Contracts, Low Income Subsidy (LIS) and Late Enrollment Penalty (LEP). In addition to those areas, the CPA firm will often do an onsite audit with the plans’ Pharmacy Benefit Manager (PBM) and potentially the plan. The audit itself will last months.
Best practices tips
for a successful One-Third Financial Audit are strategies such as:
Utilizing a project manager to track all deliverables and run meetings
There are many deliverables requested during an OFA and it will be important to have a primary person responsible for collecting and inventorying those documents. In addition, because the audit spans over a large period, requests may be iterative and require careful tracking for follow up and final disposition. The OFA also intersects multiple operational and financial functions where there are often handoffs. Having a project manager can help bridge these handoffs.
Meet frequently with delegates for any deliverables related to their scope of services
Depending on plan structure and number of delegated entities, there will likely be multiple deliverables that delegates will be responsible for, especially if it is your PBM. Holding regular meetings with those delegates allow visibility into what items are requested, the status of those items and gives an opportunity to avoid any pitfalls. An additional tip is to make sure you, as the plan are aware of any deliverables requested of the delegated entity, especially the PBM from the firm directly. Since this does happen, request that your PBM and other delegates inform you of any requests sent to them directly.
Review all documentation submitted by a delegate prior to submission to the CPA firm (if possible)
Reviewing deliverables and documentation from the delegates prior to submission allows the plan to quality check and approve of any submissions. The plan has the most interaction with the auditor and this process allows for an additional level of oversight and the ability to ensure the submission will align with the auditor expectations.
Use a formal escalation process if issues are identified or deadlines are in jeopardy
Deadlines are set by the auditor and typically held firm. If a deliverable is not going to be ready for submission by the deadline, escalating the issue up the leadership chain either internally or with a delegate can assist in providing additional resources to try and make the deadline. If that is not a possibility, contacting the auditor as early as possible to ask for an extension is the next option.
Communication with all staff and entities involved is key
You cannot overcommunicate during an OFA. Good strategies are weekly calls, check-ins, or e-mails to make sure everyone is on the same page.
