100-06 Medicare Financial Management Manual: Chapter 8 - Contractor Procedures for Provider Audits

Medicare Financial Management Manual
Chapter 8 – Contractor Procedures for Provider Audits
Table of Contents
(Rev. 13891; Issued: 07-30-2026)
Transmittals for Chapter 8
Introduction
10 – Receipt and Acceptance of Cost Reports
10.1 – Contractor’s Responsibility Prior to Submission of Cost Reports
10.2 – Contractor’s Responsibility If the Provider Fails to File a Cost Report Timely or
the Cost Report is Rejected
10.3 – Acceptance of Medicare Cost Report
10.4 – Submission of Cost Report Data to CMS
10.5 – Initial/Tentative Retroactive Adjustments (a.k.a. Tentative Settlements)
10.6 – Autoload Program in STAR, System Tracking for Audit and
Reimbursement
20 – Desk Reviews
20.1 – Guidelines for Completion of the Desk Review (Including the Exception
Resolution Process)
20.2 – Components of the Uniform Desk Review (UDR)
20.3 – Desk Review Exceptions Resolution Process
20.4 – Wage Index Review
30 – Field and In-House Audits
30.1 – Definition of Field and In-House Audits
30.2 – Purpose of Field and In-House Audits
40 – Field Audit Planning and Management (Global Scoping) Field and In-House Audits
40.1 – Cost Reports and Auditing Multiple Provider Institution
40.2 – Audit Priority Considerations
50 – Scoping/Planning of Individual Field and In-House Audits
50.1 – Establishing the Objective/Scope of the Field and In-House Audit
50.2 – Tailoring of the Audit Program
60 – Documentation and Review Standards for all Medicare Audit Activities
60.1 – Audit Confirmation Letter (a.k.a. Engagement Letter)
60.1.1-Audit Confirmation Letter for Field Audit
60.1.2-Audit Confirmation Letter for In-House Audit
60.2 – Entrance Conference
60.2.1-Entrance Conference for Field Audit
60.2.2-Entrance Conference for In-House Audit
60.3 – Tests of Internal Control
60.4 – Reliance on Work Done by Other Auditors
60.5 – Coordination of Activities During Field and In-House Audits
60.6 – Designing Tests/Sampling

60.7 – Evidence
60.8 – Working Papers
60.9 – Documentation Standards
60.10 – Pre-Exit Conference
60.11 – Finalization of Audit Adjustments
60.12 – Exit Conference
60.13 – Supervision During the Audit Process
70 –Reporting Standards
70.1 – Content and Structure of the Medicare Cost Report Audit Report
70.2 – Form of Report if Medicare Cost Report Was Not Audited
70.3 – Reporting of Indication of Illegal Acts
70.4 – Audit Adjustment Report
70.5 – Medicare Cost Report and All Related Documents
80 – Standards for Performing Medicare Audits
80.1 – Professional Judgment
80.2 – Competence
80.3 – Continuing Education and Training (CET)
80.4 – Distribution of the Finalized Home Office Cost Statement
90 – Final Settlement of the Cost Report
90.1 – Submission of Settled Cost Report Data to CMS
100 – Cost Report Reopenings
110 – Audit Responsibility When Provider Changes Contractors
120 – Audits of Home Offices
120.1 – Home Office Cost Statement Responsibility When Designated Contractor
Changes
120.2 – Revisions to a Finalized Home Office Cost Statement
120.3 – Planning/Scoping the Home Office Audit
120.4 – Timing and Completion of Home Office Audits
120.5 – Distribution of the Audited Home Office Cost Statement and Results of
the Audit
120.6 – Standards for Issuance of an Audit Report for a Home Office
120.7 – Audit Responsibility When Responsible/Designated Contractor Changes
120.8 – Acceptance of Home Office Cost Statements
130 – Provider Permanent File
140 – Fraud & Abuse
140.1 – Definitions
140.2 – Contractor Responsibility in Suspected Fraud or Abuse Cases
150 – Access to Books, Documents, and Records of Provider’s Subcontractors
150.1 – General
150.2 – Definitions
150.3 – Types of Contracts Covered by Access Provisions
150.4 – Monetary Criteria
150.5 – Access Clause not in Contract
150.6 – Reasons for Seeking Access
150.7 – Access Request Procedures
150.8 – Subcontractor Response Requirements

150.9 – Refusal of Subcontractor to Furnish Access
150.10 – Freedom of Information Act (FOIA) Requests
160 – Audit Subcontracts
160.1 – Routing of Audit Subcontracts
160.2 – Required Documentation
160.3 – Competition
170 – Exhibits
Exhibit I – Cost Report Acceptability Checklists
Exhibit II a – Audit Confirmation Letter – Field Audit
Exhibit II b – Audit Confirmation Letter – In-House Audit
Exhibit III – Entrance Conference Agenda
Exhibit IV – Internal Control Questionnaire
Exhibit V – Pre-Exit Conference Format
Exhibit VI – Audit Adjustment Report
Exhibit VII – Form of Report on Audit of Medicare Cost Report
Exhibit VIII – Exit Conference Format
Exhibit IX – Personal Impairments Statement
Exhibit X - Model Audit Subcontract Form
Exhibit XI - addendum to Subcontract
Exhibit IX.A – Form of Report on Audit of Medicare Cost Report (Provider)
Exhibit IX.B – Form of Report on Audit of Medicare Home Office Cost Statement

Introduction
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
A Medicare-certified institutional provider (provider) receives Medicare Part A
(Medicare or Program) payments throughout its fiscal year based on submission of
Medicare claims and the receipt of pass-through and lump-sum payments. These
payments are estimates and provide Medicare reimbursement until the total Medicare
liability to the provider is determined after the end of the provider’s fiscal year end.
A provider is required to submit a Medicare Cost Report (MCR) on or before the last day
of the fifth month following the close of their cost reporting fiscal year end to its
Medicare Administrative Contractor (MAC), also referred to as the contractor. The
Medicare Cost Report contains provider specific information including facility
characteristics, utilization data, total expenses, overhead allocation, total charges,
Medicare charges, in addition to various other financial data. The MCR determines the
total Medicare liability to the provider for its fiscal year end. This total Medicare
liability, less Medicare interim payments received throughout the cost reporting year,
determines if the provider was underpaid or overpaid for the cost reporting period. In
addition to determining the Medicare liability, the MCR is also used by other
government agencies for payment and policy determination.
This Chapter explains the MCR life cycle from prior to submission through reopening
and the contractor requirements for completing each phase of the cost report life cycle.
For purposes of Chapter 8, “Medicare Audit Activities” is defined as receipt and
acceptance of MCRs, tentative retroactive adjustments (tentative settlements), desk
reviews, wage index desk reviews, desk review exception resolutions, audits, including
Worksheet S-10 audits, final settlements, reopenings, and special reimbursement issues.
Additionally, this Chapter explains the procedures to be applied/implemented by
contractors to ensure that acceptable MCRs are submitted by providers in a timely
manner, that they are appropriately reviewed, and are properly settled.
This Chapter applies to all CMS contractors and their subcontractors.
NOTE: In this Chapter, “days” means calendar days unless stated otherwise.
10 – Receipt and Acceptance of Cost Reports
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
In accordance with 1815(a) of the Social Security Act and 42 CFR 413.20(b), all
Medicare-certified institutional providers (i.e. hospitals, skilled nursing facilities, home
health agencies, etc.) are required to submit an annual MCR to their MAC which serves
to determine the facility’s status, cost structure, and to achieve settlement of costs
relating to health care services rendered to Medicare beneficiaries.

In accordance with 42 CFR 413.24(f)(2) and Provider Reimbursement Manual
(PRM)15-2, Chapter 1, §104.A, providers that continue to participate in the
Medicare Program are required to submit an MCR on or before the last day of the
fifth month following the close of their cost reporting fiscal year end. If the cost report
ends on a day other than the last day of the month, the provider is required to submit
such MCR within 150 days after the last day of the cost reporting period. A full
utilization MCR must be filed unless the provider qualifies for a low or no Medicare
Utilization Cost Report as defined in the PRM 15-2 Chapter 1, §110.
A No Medicare Utilization Cost Statement and Certification for a provider that has
not furnished any covered services to Medicare beneficiaries during the entire cost
reporting period must be submitted within 150 days following the close of the
reporting period (see CFR 413.24(g) and PRM 15-2, §110.A.).
In accordance with PRM 15-2, Chapter 1, §104.B, providers that terminate their
agreement to participate in the Medicare program or change ownership, are required
to submit an MCR within five months following the effective date of the termination of
the provider agreement or the change of ownership (CHOW), respectively. From the
time a provider files a CMS Form 855A for a CHOW until official notice of approval
(pending CHOW), MCRs must continue to be submitted for the period(s) up to the
effective date of the CHOW and for all subsequent fiscal year ends. Contractors shall
continue to receive and review for acceptability all MCRs for periods that overlap the
potential CHOW effective date, but all further work will be held until the CHOW
approval is received (i.e. tentative settlement, desk review, and final settlement).
10.1 – Contractor’s Responsibility Prior to Submission of Cost Reports
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
If the provider fails to file its MCR by the last calendar day of the third month following
the close of the provider’s cost reporting period, the contractor is required to send a
reminder letter to the provider using the Reminder Letter Template (see System for
Tracking Audit and Reimbursement (STAR) User Manual) to help ensure that the MCR
will be filed timely. The reminder letter informs the provider of the due date for filing the
MCR and the penalty for not filing the MCR timely. If the contractor receives a late and
retroactive tie-in notice where the five month cost report due date has passed,
contractors shall send a reminder letter to the provider and calculate a due date 30 days
from the date of the reminder letter. Contractors may allow an additional seven days for
mail.
Furthermore, the reminder letter shall include a statement that if the MCR cannot be

submitted by the due date, the provider may request a reduced payment suspension
rate during a grace period of 60 days. The reminder letter shall specify that this
request should be submitted before the due date of the cost report. Also, the reminder
letter shall notify each provider that all submitted MCRs are subject to a desk review
and/or an audit.
If the contractor receives a request for a reduction in the rate of suspension either
because the MCR will not be filed timely or because the submitted MCR was rejected
and the contractor believes that the request should be approved, the contractor shall
recommend to CMS that the provider’s suspension rate be reduced for a 60-day grace
period. The contractor shall maintain a copy of the provider’s request and CMS’
approval/disapproval of this request in the provider’s Permanent File (PF).
The PS&R system shall be utilized for all cost reports with fiscal years ending
January 31, 2009 and later. The PS&R system allows providers to obtain their own
PS&R reports needed to file the cost report. The contractor is not required to send the
provider their PS&R reports, unless the provider cannot access the system, and
informs the contractor of the issue.
If the provider is unable to obtain access to the PS&R system, or cannot obtain their
PS&R reports, and they contact their contractor for assistance, the contractor shall
instruct the provider how to obtain their reports. The contractor may assist the
provider by supplying them with the needed reports. Note that failure by the provider
to contact the contractor in a timely manner does not warrant an automatic extension
of the cost report due dates and could result in the provider’s inability to file the cost
report timely and thus be subjected to payment suspension.
The provider may also request detailed PS&R data (e.g. payment reconciliation
report) to reconcile their records. The request is input by the provider using the PS&R
system, but due to the sensitive data contained within these reports, the contractor
must approve the request and send the reports to the provider via secure or encrypted
data transfer. The contractor shall furnish a requested detailed PS&R report annually
at no cost to the provider. If a provider requests interim (other than annual) detailed
PS&R report data, provide the detailed data at intervals requested by the provider as
long as they are reasonable. The contractor may charge the provider a fee for this
extra service. The fee should be reasonably related to costs the contractor incurs for
the added service and be commensurate with the contractor’s charge to all other
providers for similar data.

10.2 – Contractor’s Responsibility If the Provider Fails to File a Cost
Report Timely or the Cost Report is Rejected
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
If the provider fails to timely file their MCR to the MAC by the seventh day after the MCR
due date (including extensions), the MAC shall issue a first demand letter per IOM 100-
06, Chapter 3, §30.1 and Chapter 4, §20. The MAC shall also initiate 100% suspension
of all Medicare payments on the seventh day if the cost report has not been received, an
extension request has not been received and approved, or a provider’s request for a
reduction in the rate of suspension has not been approved.
NOTE: If the seventh day falls on a weekend or holiday, then the first demand letter shall
be issued, and payments will be suspended on the subsequent business day.
If the MAC determines that the provider’s as-submitted MCR is not acceptable, the
contractor shall initiate 100% suspension of all Medicare payments immediately, if there
is no grace period, until an MCR is filed and determined by the contractor to be acceptable
in accordance with 42 CFR 405.371. (See PRM 15-2, Chapter 1, §130.4 for explanation
of a grace period for suspension of payments applicable to cost reports that were filed
early but were subsequently rejected.) The contractor shall issue a formal cost report
rejection letter notifying the provider of the reason for rejection and the payment
suspension.
If the contractor determines that the initial submitted MCR is rejected, the contractor
shall contact the provider via telephone or email/secure portal with read receipt within
24 hours of cost report rejection to notify the provider of the rejection and payment
suspension, if applicable. The contractor shall initiate contact with the same provider
contact in which the cost report rejection letter is mailed. A formal rejection letter is
required to be issued to the provider explaining the reason(s) for the rejection and
payment suspension, if applicable, upon determination that the cost report is not
acceptable. A Letter of Rejection will not be issued, and payment suspension will not
occur if the reason for rejection is due to a duplicate MCR submission or is rejected at
the request of the provider.
Terminated providers shall immediately have 100 percent of their payments suspended
for failure to file an MCR in a timely manner. If other than a terminated provider
submitted a request for reduction in the rate of suspension and it was approved, the
contractor shall suspend the provider’s payment at the percentage approved by CMS for
the first 60 days that the cost report is late. If an acceptable MCR has not been filed on
the 61 st day after the due date, the contractor shall change the rate of suspension to 100
percent. If the provider did not request a reduction in the rate of suspension or the

contractor did not concur with the request for a reduced suspension rate, then 100 percent
of the provider’s payments shall be suspended if an acceptable MCR is not filed by the
due date.
If system limitations preclude the contractor from suspending payments based on a
reduced percentage rate, base the suspension on the dollar amount that results from
applying the applicable percentage rate to the average payment for the six months prior
to the suspension.
All interim and lump-sum payments made for the fiscal period ending [month/day/year]
and all interim and lump-sum payments made in a subsequent period will be deemed an
overpayment and will be immediately due in accordance with CMS Pub. 100-06,
Chapter 4, §20. The contractor shall prepare and issue an initial demand letter(s) for all
previous payments in accordance with CMS Pub. 100-06, Chapter 4, §20. Payment due
dates and interest assessments are still based on the due date of the cost report.
10.3 – Acceptance of the Medicare Cost Report
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
The contractor is required to make a determination of acceptability within 30 days of
receipt of the provider’s: (1) initially submitted MCR; (2) refiled MCR due to rejection;
or (3) amended MCR (see 42 CFR 413.24(f)(5)(iii)). Contractors shall use the latest
version of CMS’ Acceptability Checklist to determine if the provider’s MCR is acceptable
(see Exhibit I in §170 of this Chapter.) No changes shall be made to the CMS’
Acceptability Checklist unless approved by CMS.
The CMS’ Acceptability Checklist (see Exhibit I in §170 of this Chapter), requires
providers to submit supporting documentation, where applicable, as enumerated in the
checklist. Failure to supply all the items in the CMS Acceptability Checklist will cause
the MCR to be rejected. Once the contractor completes the CMS Acceptability Checklist
and decides the MCR is acceptable, the contractor is required to complete a tentative or
final settlement within 90 days of the acceptance date. If the MCR is deemed
unacceptable, the contractor shall follow §10.2 of this Chapter.
Generally, each provider must perform the following steps to properly submit an MCR to
their designated MAC:
• 	Generate an MCR consisting of an Electronic Cost Report (ECR) file and a
Print Image (PI) file of the ECR (PDF or equivalent), using CMS-approved
MCR vendor software.
• 	Submit the Worksheet S (Certification Page) signed by an officer or

administrator of the provider. A “wet” signature is required for cost reports
ending before December 31, 2017; an electronic signature is allowed for cost
reports ending on or after December 31, 2017.
• 	Provide supporting cost report documentation including, but not limited to,
the working trial balance, financial statements, Medicare Bad Debt Listing,
Interns and Residents Information System data, etc.
Providers may submit their Medicare Cost Report submission package to their MAC
electronically using the CMS Medicare Cost Report e-Filing (MCReF) system, via mail,
or hand delivery to their designated MAC. Effective July 2, 2018 and with cost report
Fiscal Year Ends (FYEs) from 1/1/2010 to the present, MCReF is the only allowable
electronic cost report filing portal. In addition to facilitating the file transfer of MCRs and
their supporting files to the provider’s MAC, MCReF also evaluates what files are
required for a valid submission, and whether the attached files fulfill the requirements to
be a valid submission in accordance with PRM 15-2. If any issues with the submitted
materials are identified by MCReF, they are communicated back to the user immediately
for correction. MCReF does not fully evaluate all aspects of submissions, which remain
subject to the subsequent application of CMS’ acceptability criteria by the contractor.
Additional information regarding MCReF can be located on the CMS Website:
https://www.cms.gov/medicare/audits-compliance/part-a-cost-report/medicare-cost-
report-electronic-filing-mcref
Per 42 CFR 413.24(f) and PRM 15-1, Chapter 29, §2931.2.A., providers may be permitted
under limited circumstances, or as required by CMS, to submit an amended cost report to
revise a cost report that has been previously submitted and accepted by the contractor.
Acceptance of amended cost reports are at the discretion of the contractors unless
otherwise directed by CMS.
In accordance with the Federal Register, Vol. 80 dated November 13, 2015 at 70563-
70564, for cost reporting periods beginning on or after January 1, 2016, contractors shall
accept one amended MCR submitted within 12 months after the due date for the hospital’s
cost report solely for the specific purpose of revising the number of Medicaid-eligible
patient days (after a hospital receives updated Medicaid-eligible patient days from the
State) in order for the hospital to make an appropriate cost report claim for a
disproportionate share hospital (DSH) payment adjustment. In submitting such an
amended MCR, the hospital must include: (1) The number of additional Medicaid-eligible
patient days that the hospital is seeking to include in the DSH calculation; (2) A
description of the process that the hospital used to identify and accumulate the Medicaid-
eligible patient days that were reported and filed in the hospital’s MCR at issue; and (3)
An explanation of why the additional Medicaid-eligible patient days at issue could not be

verified by the State by the time the hospital’s initial MCR was submitted.
10.4 – Submission of Cost Report Data to CMS
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
Contractors are required to submit an extract of the following MCRs to CMS in
accordance with the Healthcare Cost Report Information System (HCRIS) specifications
within 210 days of the cost reporting period ending date or 60 days after receipt of as-
submitted cost reports, whichever is later (60 days after receipt of amended cost reports).
Contractors load HCRIS files into STAR to fulfill this requirement. If an electronic
HCRIS file is not available, the contractor shall manually enter the cost report
information into STAR. Contractors are responsible for ensuring all MCRs and cost
statements are loaded or entered into STAR. Submissions shall pass all level one
electronic cost report edits and all STAR HCRIS Load Control edits.
NOTE: The electronic CMS Form 287-22 is effective for home office cost statement
periods beginning on or after October 1, 2022.
• 	CMS Form 2552-10, Hospital Cost Report, for cost report periods beginning
on or after May 1, 2010
• 	CMS Form 2552-96, Hospital Cost Report, for cost reporting periods ending
on or after September 30, 1996 and beginning before May 1, 2010
• 	CMS Form 2540-24, Skilled Nursing Facility Cost Report, for cost reporting
periods ending on or after September 30, 2025
• 	CMS Form 2540-10, Skilled Nursing Facility Cost Report, for cost reporting
periods beginning on or after December 1, 2010 and ending before September
30, 2025
• 	CMS Form 2540-96, Skilled Nursing Facility Cost Report, for cost reporting
periods ending on or after September 30, 1996 and beginning before
December 1, 2010
• 	CMS Form 1728-20, Home Health Agency Cost Report, for cost reporting
periods beginning on or after January 1, 2020 and ending on or after
December 31, 2020

• 	CMS Form 1728-94, Home Health Agency Cost Report, for cost reporting
periods ending on or after December 31, 1994 and ending before December
31, 2020
• 	CMS Form 265-11, Renal Dialysis Cost Report, for cost reporting periods
ending on or after January 1, 2011
• 	CMS Form 265-94, Renal Dialysis Cost Report, for cost reporting periods
ending on or after December 31, 1994 and beginning before January 1, 2011
• 	CMS Form CMS 1984-14, Hospice Cost Report, for cost reporting periods
beginning on or after October 1, 2014
• 	CMS Form 1984-99, Hospice Cost Report, for cost reporting periods
beginning on or after April 1, 1999 and beginning before October 1, 2014
• 	CMS Form 2088-17, Community Mental Health Center Cost Report, for cost
reporting periods ending on or after September 30, 2018
• 	CMS Form CMS 2088-92, Outpatient Rehabilitation Cost Report, Community
Mental Health Centers only, for cost reporting periods ending on or after
March 31, 2010 and on or before September 29, 2018
• 	CMS Form CMS 222-17, Rural Health Clinic (RHC) Cost Report, for cost
reporting periods ending on or after September 30, 2018
• 	CMS Form 222-92, Independent Rural Health Clinic Cost Report, for cost
reporting periods ending on or after May 31, 2009 and ending before
September 30, 2018
• 	CMS Form 224-14, Federally Qualified Health Center Cost Report, for cost
reporting periods beginning on or after October 1, 2014
• 	CMS Form 222-92, Federally Qualified Health Center Cost Report, for cost
reporting periods ending on or after May 31, 2009 and beginning before
October 1, 2014
• 	CMS Form 216-94, Organ Procurement Organization and Tissue Typing
Laboratory, for cost reporting periods beginning on or after October 1, 2018

Consult the following HCRIS website link regarding the cost report submission
requirements for any other CMS cost report form not listed above:
https://www.cms.gov/Research-Statistics-Data-and-Systems/Downloadable-Public-
Use-Files/Cost-Reports/?redirect=/CostReports/. If the cost report is deemed to be
“Low Medicare utilization” or “No Medicare utilization,” a HCRIS extract of the “as-
submitted” cost report is not required.
10.5 – Initial/Tentative Retroactive Adjustments (a.k.a. Tentative
Settlements)
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
42 CFR 413.64(f)(2) and the PRM 15-1, Chapter 24, §2408.2, stipulate that an
initial/tentative retroactive adjustment (tentative settlement) must be made as quickly as
possible after the receipt of a cost report from the provider. Therefore, contractors shall
complete a tentative settlement within 90 days of acceptance of the provider’s: (1)
Originally as-submitted accepted cost report and/or (2) An amended accepted cost
report. Prompt initial/tentative retroactive adjustments are essential to ensure proper
cash flow to providers. Reducing or delaying tentative settlements until a final
determination could jeopardize the financial viability of some providers.
Note: If the contractor receives and accepts an amended cost report prior to the due date
for and issuance of a tentative settlement for an earlier accepted submission, the
contractor shall issue one tentative settlement based on the most current accepted cost
report submission within the greater of the tentative settlement due date of the earlier
accepted cost report or 30 days of the acceptance of the amended cost report.
A tentative settlement is considered complete once the tentative settlement determination
has been issued to the provider within 90 days of acceptance as noted above. The
determination to the provider shall include the following:
• 	Initial Demand Letter, if applicable (See CMS Pub. 100-06, Chapter 3 and 4);
• 	Tentative settlement determination letter; and
• 	Explanation of Tentative Settlement (calculation support for provider).
MACs shall upload the above information, where applicable, into the STAR system
within 30 days of issuing the tentative settlement determination to the provider.

Contractors are not required to make tentative settlement adjustments where one of the
conditions listed in §2408.2 of PRM 15-1 applies. Contractors are also not required to
make tentative settlements for: (1) Hospice cost reports; (2) Cost reports final settled
within 90 days from acceptance of the cost report; (3) Low or no Medicare Utilization
cost reports which are ineligible for a tentative settlement; (4) Terminated providers,
and (5) As directed by CMS (i.e. bankruptcy, fraud and abuse, etc.).
Contractors shall use STAR automation, where applicable, to calculate and issue cost
report tentative settlements for as-submitted and amended MCRs. The STAR automation
of the tentative settlement standardizes the tentative settlement process for the
contractors and improves timely reimbursement of the amount due to providers based on
the as-submitted and amended MCRs.
For the purpose of a tentative settlement adjustment, accept costs as reported unless
previous experience with the cost report and provider documentation warrants a
reduction in costs. However, to avoid creating an overpayment, reduce the payment by
any amounts attributable to obvious errors or inconsistencies in the cost report and
documentation requested during the acceptability process, but not submitted by the
provider. Also, give consideration to amounts owed the program by the provider (e.g.,
possible adjustments for prior periods and current period for unresolved issues,
unrecovered overpayment). The following areas may be considered during the tentative
settlement process:
• 	Correct SSI for acute care and rehabilitation providers (if applicable).
• 	Correct Per Resident Amounts (PRA) for teaching facilities that receive direct
graduate medical education (DGME).
• 	The submitted bad debt listings contain the required information and
reconcile to the cost report.
• 	Total interim payments reported on W/S E-1, Line 1 appear accurate when
compared to PS&R payments or the PIP ledger.
• 	Lump-sum adjustments are accurately reported on W/S E-1.
• 	“Other Adjustments” on the W/S E schedules contain $0 or the provider has
provided adequate documentation to support such amounts.
• 	Settlement data included on the W/S E series appears to accurately reflect
PS&R data.

• 	The number of Interns and Residents are consistent with prior year.
If the current year’s tentative settlement results in an underpayment and the provider
has existing Medicare overpayments, follow the instructions in CMS Pub. 100-06,
Chapter 3. In instances where a provider is in bankruptcy or is part of bankruptcy
proceedings, bankruptcy procedures will supersede these instructions.
Cost-to-charge ratios (CCRs) are used in determining outlier payments, payments for
pass-through devices, and monthly interim transitional corridor payments under the
outpatient prospective payment system (OPPS). CCRs are also used to determine
payments for extraordinarily high cost cases (cost outliers) under the inpatient acute
care hospitals, inpatient rehabilitation facilities, inpatient psychiatric facilities, long
term care hospitals, and community mental health center prospective payment
systems (IPPS, IRF PPS, IPF PPS, LTCH PPS, and CMHC PPS, respectively).
The contractor is required to update the CCRs for providers reimbursed under the
IPPS, OPPS, IRF PPS, IPF PPS, LTCH PPS, and CMHC PPS to reflect cost and
charge information from a provider’s most recent cost reporting period, whether
tentative or final settled. Therefore, immediately after completion of the tentative
settlement, calculate the updated CCRs in a manner described in the applicable
Chapter of CMS Pub. 100-04 and input the CCR into the Outpatient Provider Specific
File (OPSF) and Provider Specific File (PSF) no later than 30 days after the date of
issuance of the tentative settlement.
• 	If the contractor made adjustments during the tentative settlement for prior
year audit adjustments or other changes and these adjustments have an impact
of more than 20% (plus/minus) on the CCRs from the “as-submitted” cost
report, calculate the updated CCRs using the tentative settlement data.
• 	If the tentative settlement adjustments have an impact of 20% or less on the
CCRs from the “as-submitted” cost report, or if no adjustments to the tentative
settlement were made, calculate the updated CCRs using the hospital’s “as-
submitted” cost report.
MACs shall upload the above information, where applicable, into the STAR system
within 30 days of issuing the final cost report settlement determination to the
provider.
10.6 - Autoload Program in STAR, System Tracking for Audit and
Reimbursement
(Rev. 89; Issued: 01-13-06; Effective Date: 10-01-05; Implementation Date: 02-13-
06)

Effective October 1, 2005, contractors shall use the STAR Autoload Program (See
Chapter 10 of the STAR Manual on how to use this program.) to update screens 6 and 9
in STAR for any as filed, finalized, or reopened cost reports entered into STAR on or
after October 1, 2005. Contractors must ensure that accurate cost report data appears on
those screens for filed cost reports, the initial Notice of Program Reimbursement (NPR)
and all revised NPRs, as this information is utilized to estimate audit savings.
When issuing an initial NPR on or after October 1, 2005, contractors must use the
Autoload Program to update screens 6 and 9 for the filed cost report and for the initial
NPR. (Note: If Version 8.40 of the Autoload Program was previously used to input
screens 6 and 9 for the filed cost report, this information does not have to be reloaded.)
When issuing a revised NPR after on or after October 1, 2005 contractors must use the
Autoload Program to update screens 6 and 9 for the prior NPR and for the revised NPR
being issued. (NOTE: If Version 8.40 of the Autoload Program was previously used to
input screens 6 and 9 for the prior NPR, this information does not have to be reloaded.)
The reimbursement amounts previously reported on screen 5 prior to running Autoload
Version 8.40 should not change. If a Version of the STAR Autoload Program 8.40 or
higher was not used to populate STAR, it will be necessary to re-create a HCRIS file to
determine if information needs to be re-posted or re-entered on STAR screens 6 and 9.
When recreating a HCRIS file to update STAR screens 6 and 9, you must verify that the
previous amounts reported on screen 5 have not changed after creating the new HCRIS
file. The new HCRIS file may not match the prior as filed, initial NPR, or all revised
NPRs on screen 5, because cost reporting vendors may have changed their cost reporting
software. Contractors must ensure that the amounts on screen 5 do not change from these
previous postings. If after running the Autoload Program the amounts on screen 5
change, contractors must manually re-enter the previously reported amounts on screen 5.
(Screen 6 and 9 shall reflect the revised amounts based on the Autoload Program but
screen 5 will not reflect any adjustments.) This is necessary to ensure that screen 5
reflects the correct as submitted, NPR, or revised NPR amounts. Re-entering data on
screens 6 and 9 will ensure that CMS can compare accurate and consistent cost data to
estimate audit savings.
20 – Desk Reviews
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
20.1 – Definition
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
The desk review is an analysis of the provider’s MCR to determine its adequacy,
completeness, accuracy, and reasonableness of the data contained therein. It is a process
of reviewing information pertaining to the MCR and is designed to identify problems
warranting additional review and, where appropriate, to resolve some of those
problems/exceptions. The objective of the desk review is to determine whether the MCR

can be settled without an audit or whether an in-house or field audit is necessary. For this
purpose, every desk review shall contain a summary of the review results (see Exhibit II
in §170 of this Chapter) and a decision as to the next step (e.g., settle without additional
review, complete desk review exception resolution, perform in-house/field audit). If a
decision is made to audit the MCR, a properly completed desk review is essential for
planning the audit and establishing the audit objectives.
Desk reviews are required for all providers filing an MCR except for Hospice and low/no
Medicare utilization providers. However, if the contractor’s professional judgment
dictates, the contractor may perform an appropriate desk review on a low Medicare
utilization cost report.
A desk review is comprised of (1) the applicable Uniform Desk Review program, and (2)
the desk review exception resolution (if applicable). The contractor shall use the specific
CMS Uniform Desk Review program that is in effect at the time the contractor begins
the desk review for each provider. The following information, as appropriate, shall be
used in completing the specific desk review steps and later in planning the audit.
• 	Permanent File;
• 	Correspondence Files;
• 	PS&R;
• 	Current and Prior Year MCRs;
• 	Working Trial Balance;
• 	Financial Statements;
• 	The responses and necessary supporting documents per the specific “Cost
Report Reimbursement Questionnaire” cost report worksheet (e.g., Form
CMS-2552-10, Worksheet S-2, Part II for hospitals);
• 	Applicable documentation (e.g., supporting documentation for
reclassifications, adjustments, related organizations, and protested items)
required to be submitted per the instructions in the specific provider-type cost
reports;
• 	Prior Years Management Letter Comments (MLC);
• 	Points for Next Year (PFNY);

• 	Prior Year Adjustment Report; and
• 	Prior Year Desk Review and Audit (if applicable) Workpapers.
20.2 – Components of the Uniform Desk Review (UDR )
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
The UDR is comprised of a clerical review, selection of desk review type (either a
modified desk review, limited desk review, or a full desk review), summary of UDR
exceptions, and the desk review exception resolution (if applicable).
NOTE: The UDR is issued by CMS separately and is not included in this manual.
Additionally, the UDR program is a confidential document and released only to the
Medicare Administrative Contractors.
I. 	Clerical Review
A clerical desk review consists of creating a comparative analysis of the MCR data
between the prior and current year when needed for a modified, limited, or full desk
review. Identify the steps in the related desk review program to determine which
comparative analyses are needed for the specific cost report.
II. 	Selection of Desk Review Type
Selection of the appropriate type of desk review is critical in making the desk
review/audit process more efficient and economical. Accordingly, select the appropriate
desk review (modified, limited, or full) based on provider type and pertinent UDR
materiality thresholds in accordance with the instructions contained in the desk review
programs.
The materiality thresholds are published in the Modified Desk Review (MDR) and the
Medicare Audit and Reimbursement Protocol (MARP) Section 3. If the contractor
believes that the published thresholds are inappropriate to a specific situation or to a
provider group, the contractor may request an exception from their Division of Provider
Audit Operations (DPAO) Business Function Lead (BFL) (through the MAC’s
Contracting Officer Representative (COR)). The request shall contain a justification for
the change. The DPAO BFL (through the COR) will either approve or deny the request
in writing. (For the purpose of this Chapter, the terms “DPAO BFL (through the COR)
assigned to the contractor” and “CMS” are synonymous and will be used
interchangeably.)

NOTE: The MARP Section 3 materiality thresholds and any revisions to materiality
thresholds approved by CMS are confidential and are not to be included on any
Medicare Audit Activity workpaper that is distributed to any source outside of the
contractor organization unless prior approval is obtained by CMS.
A. Modified Desk Review
The contractor shall complete the Modified Desk Review (MDR) specific to the
provider type for MCRs that meet the modified desk review thresholds established by
CMS. However, the contractor is not prohibited from completing a limited/full desk
review on an MCR even if it falls below the limited/full desk review threshold if the
contractor’s professional judgment dictates. In this situation, the contractor shall
document the reason for performing a limited/full desk review.
The Modified Desk Review program and/or STAR MDR program shall be included as
a workpaper and easily identifiable in the modified desk review package. The
contractor shall address all steps in this program either by inserting “Not Applicable
(N/A)” or a workpaper reference in the “Desk Review W/P Ref” column. All “N/A”
annotations shall be explained (e.g., provider did not claim reimbursement for that
particular issue).
The modified desk review programs shall not be modified or reordered by the
contractor unless the contractor receives advance approval for such
revision/modification from CMS. The contractor shall clearly identify the approved
changed/added steps in its programs and maintain copies of the CMS approvals as
documentation.
B. Limited Desk Review
The contractor shall complete the limited desk review specific to the provider type for
MCRs that meet the limited desk review thresholds established by CMS. However, the
contractor is not prohibited from completing a full desk review on an MCR even if it
falls below the full desk review threshold if the contractor’s professional judgment
dictates. In this situation, the contractor shall document the reason for performing a
full desk review.
The limited desk review program shall be included as a workpaper and easily
identifiable in the limited desk review package. The contractor shall address all steps
in this program either by inserting “Not Applicable (N/A)” or a workpaper reference
in the “Desk Review W/P Ref” column. All “N/A” annotations shall be explained
(e.g., provider did not claim reimbursement for that particular issue).
The limited desk review programs shall not be modified or reordered by the

contractor unless the contractor receives advance approval for such
revision/modification from CMS. The contractor shall clearly identify the approved
changed/added steps in its programs and maintain copies of the CMS approvals as
documentation.
C. Full Desk Review
The contractor shall complete a full desk review specific to the provider type for
MCRs that meet the full desk review thresholds established by CMS.
The full desk review program shall be included as a workpaper and easily identifiable
in the full desk review package. The contractor shall address all steps in this program
either by inserting “Not Applicable (N/A)” or a workpaper reference in the “Desk
Review W/P Ref” column. All “N/A” annotations shall be explained (e.g., provider
did not claim reimbursement for that particular issue).
The full desk review programs shall not be modified or reordered by the contractor
unless the contractor receives advance approval for such revision/modification from
CMS. The contractor shall clearly identify the approved changed/added steps in its
programs and maintain copies of the CMS approvals as documentation.
III. 	Summary of UDR Issues/Exceptions
Contractors shall use the “Uniform Desk Review - Summary of UDR
Issues/Exceptions” worksheet (see Exhibit II in §170 of this Chapter) to list the
exceptions identified through the UDR process and describe their disposition.
Contractors may use an alternative format if it contains, at a minimum, the
information in Exhibit II. This worksheet also serves as the “audit scoping” and/or
desk review exception resolution support.
Column 1 (No.) – Number each exception as the exception is identified on the desk
review workpaper. This facilitates future cross-referencing of issues flowing through
the desk review, desk review exception resolution, audit, settlement, and if applicable,
the reopening and appeals process. If, in the contractor’s judgment, there are other
issues that did not surface as desk review exceptions but need to be considered as
possible exception resolution, audit issues, or for possible further review, list them at
the bottom of this column starting with the next number after the last desk review
exception.
Column 2 (UDR Reference) – Identify the UDR Module and the step that generated
the specific exception and desk review workpaper (if applicable) for each exception
related to the desk review. Identify exceptions which were not generated during the
desk review process as “Other”.

Column 3 (Description) – Write a brief, specific description of the issue/exception for
each item listed in Column 1 (both desk review exceptions and other exceptions).
Some examples are: (1) instead of stating that “bad debts” is the exception noted,
specify that the issue/exception pertains to the “bad debts collection effort,” or “bad
debt indigency determination,” (2) instead of stating that “Nursing/Allied Health
programs” is the exception noted, specify that the exception pertains to the
“determination of provider operator status of Nursing/Allied Health programs, or
“the allowability of direct costs for the program(s) reported on Worksheet A.” For
“Other” exceptions, also describe how the issue/exception was identified.
Column 4 (Units/$s) – Where applicable, insert the units and/or dollar amounts
pertaining to each exception. Leave the column blank in situations where the amounts
cannot be established at the time of the desk review.
Column 5 (No Further Action) – Check this column if the exception was satisfactorily
resolved during the desk review, or, if not, there is a valid reason for not deferring or
scoping it for desk review exception resolution or audit. If the exception was
satisfactorily resolved during the desk review process, state this in Column 10;
reference the UDR workpaper which supports this conclusion in Column 11; and, if
applicable, enter the adjustment number in Column 9. Record this adjustment in the
Adjustment Report (see Exhibit VII in §170 of this Chapter).
Column 6 (Exception Resolution) – Check this column if a desk review exception
resolution will be completed to fully address the exception. The decision to scope the
exception for desk review exception resolution shall be based on the related
explanation stated in the “Remarks/Comments” column of the UDR. Enter this
explanation in Column 10 and reference the workpapers supporting the decision in
Column 11. For exceptions identified as “Other,” explain the reason for the decision
to further review the issue in Column 10 and reference the workpaper supporting this
decision in Column 11.
Column 7 (Scoped for Audit) – Check this column if an audit will be completed to
fully address the issue. The decision to scope the issue for audit shall be based on the
related explanation stated in the “Remarks/Comments” column of the UDR. Enter
this explanation in Column 10 and reference the workpapers supporting the decision
in Column 11. For issues identified as “Other,” explain the reason for the decision to
further review the issue in Column 10 and reference the workpaper supporting this
decision in Column 11.
Column 8 (Exception/Audit Deferred) – Check this column if the desk review
exception resolution or audit of the exception is necessary but there are
circumstances which prevent the contractor from scoping it for the current year’s

desk review exception resolution or audit. Specify in Column 10 the reason for this
decision and reference the UDR workpapers which document the process used to
arrive at that decision in Column 11.
• 	Prepare a “Point for Next Year” which contains the date, FYE of the MCR,
and a description of the deferred exception(s) and place it in the PF. In
Column 11, reference the PF section where this Point for Next Year was
placed. The contractor shall conduct the review or audit of this deferred
issue(s) within two years from the date of the deferral.
Column 9 (Adjusted for Settlement) – Identify in this column the adjustment number
for exceptions resolved during the desk review which resulted in an adjustment. (See
instructions for Column 4.) Also, reference the UDR workpaper which contains the
proposed adjustment in Column 11.
Column 10 (Comments) – Include in this column the explanations/reasons as
described in the instructions for each column.
• 	Also, include in this column an explanation which supports the decision to
review during desk review exception resolution or audit the exception and
describe the specific audit requirements, objectives, and related audit step(s)
for exceptions identified in Columns 6 & 7. If the contractor expands the
scope of the audit for the “issue/area” beyond that of the specific exception
related to that issue/area, the contractor shall also explain in this column the
reason for doing so and describe the additional audit steps that will be
performed. For example, if the desk review only generated an exception for
“caps” applicable to direct Graduate Medical Education (DGME) but the
contractor decides to expand the audit to encompass various other aspects of
DGME, the contractor shall explain in this column the reason for the
expansion and describe all the other audit steps that will be completed during
the audit.
Column 11 (UDR, Resolution, Audit, or PF W/P Ref.) – Enter in this column the desk
review, desk review exception resolution, audit, or PF workpaper references related
to each exception. These references shall specifically identify whether they represent
a desk review, desk review exception resolution, audit, or PF workpaper. For
exceptions that will be reviewed during desk review exception resolution or audit,
there generally will be references to the desk review workpaper(s), desk review
exception resolution, and audit workpaper(s).
Indicate in the designated boxes at the top of the "Summary of UDR
Issues/Exceptions" the decision regarding the next step for the MCR (e.g., settlement

without further review, desk review exception resolution, field audit, and in-house
audit).
The Summary of Issues/Exceptions shall be included in any desk review and audit
package.
20.3 – Guidelines for Completion of the Desk Review (Including the
Exception Resolution Process)
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
When completing the UDR (including resolving UDR exceptions during the desk review
process) the contractors shall adhere to the standards outlined in this Chapter to: (1) use
evidence that meets the standards required by CMS, (2) document the conclusion in
accordance with the standards for documentation required by CMS, (3) prepare the desk
review workpapers, and (4) follow the standards for supervisory review responsibilities
pertaining to the desk review process.
The contractor shall complete all the applicable steps in the relevant CMS UDR program
during the desk review process, as well as any steps added by the contractor which were
approved by CMS. That is, the contractor shall not complete the UDR steps during the
in-house or field audit because the results of the desk review are intended to assist in
setting the scope of the audit. PS&R reconciliation and settlement verification steps can
be referred to audit to ensure timeliness and accuracy. If issues/exceptions are identified
during the completion of the desk review steps, and the MCR is not scoped for audit, the
contractor shall attempt to resolve these issues/exceptions or variances during the desk
review exception resolution.
It is not appropriate for the contractor to deem the issue/exception or variance to be fully
resolved during the desk review without the need for further review if the review leading
to such conclusion was limited in nature (i.e., touched only the surface of the issue),
whereas a “full” resolution of the exception or variance requires: (1) additional
documentation; (2) amount of review effort required; and (3) adherence to specific
review steps contained in the CMS’ desk review program.
The following is an example of an exception inappropriately deemed by the contractor as
fully resolved during the desk review: “The UDR comparative analysis identified a
significant increase in the direct costs of the CAH’s Clinic. The provider explained that
the reason for the significant increase during the current year was due to reporting the
costs for the Clinic cost center for a full year in the current MCR while this cost center
was first established in the middle of the prior year and the cost reported in that MCR
was not for a full year. During the desk review, the contractor accepted this explanation
and concluded that no additional review was required. However, since the CAH is
reimbursed on a reasonable cost basis and a full year’s cost was first reported for this
newly established cost center in the year under review, this cost will serve as the “base”
for future UDR comparisons. Therefore, it was crucial for the contractor to determine

whether the costs reported during the current year were reasonable, necessary, proper,
and accurate. For this example, an appropriate review by the contractor could consist of
reviewing the detailed trial balance for nonallowable or questionable accounts and
requesting additional documentation from the provider to support these accounts. CMS
expects the contractors to perform a thorough review of issues related to “cost-
reimbursed items” (e.g., the costs of a CAH; pass-through payments for Nursing/Allied
Health and Organ Acquisition of an acute care hospital) at the time the provider claims
these costs/payments for the first time.
If it appears that the exception identified when completing a desk review step requires an
adjustment, but further review is necessary to make an adjustment, the contractor shall
either request the information from the provider before making the adjustment or consider
scoping the issue for further review. For example, do not prepare an adjustment during the
desk review if the provider claimed bad debts for Medicare deductible and coinsurance
sooner than 120 days from the date of the first bill without first determining if the provider
deemed the patient indigent prior to 120 days from the first bill (for cost reporting periods
beginning before October 1, 2020).
When requesting additional documentation to resolve a desk review exception during the
desk review exception resolution process, the contractor shall be considerate of the amount
of information being requested and shall ensure that the request does not violate the
provisions of the Paperwork Reduction Act (PRA) of 1980. Requests for additional
documentation in connection with desk reviews are generally not subject to PRA
requirements if the contractor adheres to the following procedures:
• 	A specific request for documentation shall be made to only one entity, (i.e.,
the provider whose MCR is under review), and
• 	Questions shall be specific to that provider's particular MCR.
The contractor shall request that the provider furnish this information/documentation
within two weeks of the date of the initial request; the due date for subsequent requests
are determined by the MAC. Additionally, timeframes for the initial and subsequent
requests may be extended at the MAC discretion. If the provider does not furnish the
documentation within that time period, either make an adjustment or consider scoping the
issue for audit.
For MCRs that will not proceed to audit, the contractor shall send any adjustments made
during the desk review process to the provider and request that, within two weeks of
receipt of the adjustments, the provider respond in writing with either their agreement with
the adjustments or describe any concerns with the adjustments. Also, the contractor shall

inform the provider in writing that these adjustments will become final after any necessary
modifications based on the written concerns and documentation supporting them are
reviewed. This adjustment report incorporates adjustments to the provider's as-submitted
cost report so that the MCR reflects costs and data in conformity with the Medicare
principles of payment. (See Exhibit VII in §170 of this Chapter.)
If the exception or variance cannot be “fully” resolved during the desk review which
includes desk review exception resolution, and the MCR is not scheduled for audit, the
contractor shall consider scheduling the MCR for audit or create a point for next year to
include in the permanent file. (See §130 of this Chapter for more information on the
permanent file.)
20.4 – Wage Index Review
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
Section 1886 (d)(3)(E) of the Social Security Act, “Adjusting for Different Area Wage
Levels,” requires the Secretary to adjust the proportion of hospital costs attributable to
wages and wage-related costs for area differences in hospital wage levels. This
adjustment factor, the wage index, reflects the relative hospital wage level in the
geographic area of the hospital compared to the national average hospital wage level.
Wage Index reviews shall be completed when directed by the CMS Division of Acute Care.
Use the latest wage index desk review program released by CMS in STAR prior to the due
date of the wage index reviews.
Wage index periods follow the federal fiscal period of October 1 – September 30. If a
hospital has more than one MCR beginning during the wage index period (for example,
a hospital has two short period MCRs beginning on or after October 1, through
September 30 of a given year), conduct a desk review on only one of the reporting
periods. Select the longest period. If there is more than one period of that length, select
the latest period.
All wage index adjustments will be included in the Adjustment Report for the provider’s
cost reporting period. This adjustment report incorporates adjustments to the provider's
as-submitted cost report so that the MCR reflects costs and data in conformity with the
Medicare principles of payment (see Exhibit VII in §170 of this Chapter).
Contractors are required to track wage index revisions in STAR and submit revised
HCRIS files, where applicable, to STAR and CMS by the due date(s) established by CMS.

30 – Field and In-House Audits
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
Providers receiving payments under Part A and B of Title XVIII of the Act, as amended,
are subject to audit of payments applicable to services rendered to Medicare
beneficiaries. An audit may be done as a field audit or, if appropriate, as an in-house
audit based on the discretion of the contractor and as approved by CMS.
30.1 – Definition of Field and In-House Audits
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
A field audit is an on-site examination of financial transactions, accounts, and reports as
they relate to the MCR in order to test the provider’s compliance with applicable
Medicare laws, regulations, manual instructions, and directives. The contractor shall use
the latest CMS-approved audit program during a field audit applicable to the provider
type in effect at the time when its audit program is tailored (see §50.2 of this Chapter).
The CMS approved Audit Program shall not be altered or reordered by the contractor
unless the contractor receives advance approval for such revision/modification from
CMS. The contractor shall clearly identify the approved changed/added steps in its
programs and maintain copies of the CMS approvals as documentation.
An in-house audit is an examination of financial transactions, accounts, and reports as
they relate to the MCR to test the provider’s compliance with applicable Medicare laws,
regulations, manual instructions, and directives that is performed at a non-provider
location. An in-house audit is subject to the same standards/processes as a field audit. The
contractor shall use the latest CMS approved audit program during an in-house audit
applicable to the provider type at the time when its audit program is tailored (see §50.2
of this Chapter). In general, an in-house audit is the same as a field audit except all work
is performed at a non-provider location.
In performing Medicare in-house and field audits, the contractor shall comply with the
general, field work, and reporting standards of the Government Auditing Standards (GAS)
issued by the Comptroller General of the United States as these standards are applicable to
all audits performed by or for any Federal agency. If the contractor engages auditors on its
own initiative under a subcontract (see §160 of this Chapter) to perform or assist on any
Medicare Audit Activity, the subcontractor’s auditors shall follow the same GAS and other
standards that the contractor is required to follow. However, as specified in §61.6.D. of
this Chapter, the contractor cannot delegate the performance of a supervisory review of

workpapers to a subcontractor. CMS holds the contractor responsible for the subcontract
work in the same manner as if its own employees performed the work.
NOTE: For the purpose of this Chapter, unless otherwise noted, any reference to GAS is
the 2018 Revision.
Contractors may limit the scope of both in-house and field audits to a review of selected
parts of a provider's MCR and related financial records. In addition, the audit procedures
performed on selected areas of the MCR may be limited. However, both the selected cost
report areas and the related procedures to be applied shall be sufficient to meet the audit
objectives established from the desk review. When in-house and field audits are being
performed and additional audit procedures are required, or additional findings are
discovered which may require additional audit procedures, the contractor shall make a
prompt evaluation of the Medicare impact of the related issues in light of its current audit
plan. If the Medicare impact of the new issues outweighs the Medicare impact of other
issues included in the current audit plan, the contractor shall seek CMS’ approval to
change its audit plan to address those additional issues.
The required steps for addressing desk review and audit adjustments during an in-house
and field audit are included in §60.0ff of this Chapter. All audit adjustments shall be
included in the final Adjustment Report issued with the Notice of Program Reimbursement
(NPR) package to the provider (see §70.5 of this Chapter). This report includes all desk
review (including desk review exception resolution), wage index, Worksheet S-10, and
audit adjustments that will be incorporated into the provider's as-submitted cost report so
that the audited MCR reflects costs and data in conformity with the Medicare principles of
payment (see Exhibit VII in §170 of this Chapter).
30.2 – Purpose of Field and In-House Audits
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
Medicare in-house and field audits are conducted in order to: (1) provide reasonable
assurance that program payments are based on Medicare reimbursement principles, and (2)
develop other information that CMS needs to fulfill its responsibilities.
In carrying out the audit responsibilities, the contractors’ primary goal is to arrive at a
correct settlement of the MCR. In so doing, the contractor shall preserve the provider’s
interest and rights but at the same time apply program policies to specific situations to
assure compliance with these policies. The contractor’s authority does not extend to
determining whether program policies and procedures are appropriate or shall be applied

in a given circumstance. Rather, the contractors’ responsibility is to enforce such policies
and procedures and take corrective action where noncompliance exists.
40 – Planning and Management (Global Scoping)-Field and In-House
Audits
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
The contractor shall develop an audit plan to identify cost reports to be audited and
resources to be expended, taking into consideration the guidance that CMS gives the
contractor in §§40.1 and 40.2 of this Chapter about the types of providers or potential
issues to be audited. However, contractors shall not use these priorities as the sole factor
in determining the planning process. The planning process is based on the results of the
desk review and the contractor’s empirical knowledge, past performance of the provider,
last time audited, and the relative risk associated with the settlement amount calculated
from the MCR. Generally, the contractor selects providers for audit based on their
professional judgment and those that represent the greatest risk for incorrect payment.
Effective management of audit resources requires a continual decision-making process. As
events occur throughout the MAC’s contract year and circumstances come to light, the
audit plan shall be continually evaluated, and priorities reassessed. If a greater audit
requirement becomes evident, the contractor shall not automatically defer that audit work.
Rather, the contractor shall seek guidance from their BFL, through their COR, to determine
if the audit work should be deferred or if an audit on the current audit plan can be replaced
with this new audit.
Contractors shall apply the appropriate level of resources for each audit to assure that
payments made to a provider are not more or less than required under applicable law and
regulations to achieve CMS's audit objectives.
40.1 – Cost Reports and Auditing of Multiple Provider Institution
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
Where an institution certified as a certain type (e.g., hospital, SNF, HHA) has a distinct
unit certified as another provider type (e.g., a hospital has a SNF, HHA, or a unit
excluded from inpatient prospective payment system), each such distinct unit or
subprovider is, in effect, another department of the provider. Cost finding in such an
institution involves allocation of the institution's costs between the main provider and
subproviders (e.g., between the hospital and the SNF, HHA, or excluded unit). Thus,
provider complexes with subproviders must file one MCR on the CMS cost reporting

forms designated for the main provider (e.g., Form CMS-2552 for hospitals). Separate
cost reports may not be filed for the provider-based components (subproviders).
Therefore, in the contractor’s audit plan, the contractor shall consider the audit of a
multiple provider institution as one workload unit but, as appropriate, include audit
procedures to review the provider-based component(s).
40.2 – Audit Priority Considerations
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
One or more of the following audit priority considerations may enter into the process of
formulating the contractor’s audit plan.
A – Significance of Total Medicare Program Payments
In a PPS and cost reimbursed environment, specific attention should be directed to the
following reimbursement areas or issues (as applicable based on the provider type),
including but not limited to:
• 	Bad debts
• 	Graduate medical education (GME)
• 	Indirect medical education (IME) IPPS hospitals and “Teaching Hospital
Adjustment” for IPF-PPS hospitals and units and IRF-PPS hospitals and
units
• 	Organ acquisition costs
• 	Disproportionate share hospital (DSH) payments for IPPS hospitals and Low-
Income Payment (LIP) for IRF-PPS hospitals and units
• 	RHC Special Payment Issues
• 	Uncompensated Care
• 	Nursing/Allied Health pass-through payments
• 	Outlier payments

B – Types of Providers
Special attention may be required for certain types of providers because of known or
anticipated problems or circumstances. The contractor shall consider the following in
formulating the audit plan.
• 	New providers.
• 	Providers reimbursed on a cost basis (e.g., critical access hospitals, federally
qualified health centers, rural health centers, organ procurement
organizations, etc.) or the Tax Equity and Fiscal Responsibility Act (TEFRA)
basis (e.g., cancer hospitals, children’s hospitals, and hospitals located in the
U.S. Virgin Islands, Guam, Northern Mariana Islands, and American Samoa).
• 	End Stage Renal Disease (ESRD) Facilities need to be audited in accordance
with the Balanced Budget Act of 1997 requirements. The review of ESRD
facilities selected for the three-year-cycle can be either an in-house (desk
audit) or field audit. Additionally, the ESRD three-year cyclical audits are not
to be included on the contractor’s CMS approved audit plan.
• 	Providers receiving significant non-PPS payments.
• 	Providers that were not audited recently.
C – Conditions and Occurrences at the Provider
• 	Change of ownership, termination, or change of provider type (e.g., acute to
critical access hospital).
• 	Cost report filed late without a satisfactory explanation.
• 	Fraud and abuse investigations as directed by the Office of Inspector General
(OIG) or Department of Justice (DOJ).
50 – Scoping/Planning of Individual Field and In-House Audits
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)

50.1 – Establishing the Objective/Scope of the Field and In-House
Audits
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
Once a decision is made to perform an in-house or field audit on a given cost report by
considering the Medicare priorities, the contractor shall use the results of the desk
review, and its empirical knowledge of the provider to define the audit’s objectives and
the scope and methodology to achieve those objectives. The objectives are what the audit
is to accomplish. They identify the audit subjects and performance aspects to be included,
as well as the potential finding and reporting elements that the auditors expect. Scope is
the boundary of the audit. It addresses such things as the depth of review of the
issues/areas selected for audit. The methodology comprises the work in data gathering
and in analytical methods auditors will use to achieve the objectives. Auditors shall
design the methodology to provide sufficient, competent, and relevant evidence to
achieve the objectives of the audit. Methodology includes not only the nature of the
auditor’s procedures, but also their extent (for example, sample size).
The desk review process and the contractor’s knowledge of the provider help the
contractor to determine the issues/areas to be addressed for each audit. If budget
limitations or other factors prevent the contractor from including all the exceptions in the
scope of the audit for that MCR, the contractor shall consider expanding the hours
assigned to the audit. If expanding the hours is not possible, the contractor shall rank the
exceptions based on their significance. Significance generally relates to the Medicare
dollars at risk if the provider reports the issue/area incorrectly. This dollar impact shall be
estimated using appropriate factors (e.g., expense amount, Medicare utilization, number
of residents and associated per-FTE- resident amount, number of beds for indirect
medical education) that pertain to the computation of the Medicare payment for that
exception. If this cannot be accomplished, use the total Medicare dollar payment for the
issue/area (e.g., amount of graduate medical education (GME) payment). Significance
can also pertain to a present or future risk if the issue is not investigated.
If the contractor has determined to rank the issues/exceptions, the contractor shall use
this ranking to determine which exceptions can be eliminated from the scope if it is not
possible to audit them all. This elimination consists of excluding issues/areas starting
from the issue ranked the lowest until reaching a level of audit resources that can be
devoted to this specific audit. The contractor shall document and support the decision to
not audit these issues/areas in separate desk review workpapers supporting the ranking.
However, if in the contractor’s professional judgment, all the issues/areas are significant,
consider adjusting the audit plan by deferring or canceling other audit work (i.e., audits of
other providers) of a lesser urgency. If there is no work of lesser urgency, seek guidance
from CMS. Any changes to the contactor’s approved audit plan shall be approved in
advance by the DPAO BFL as required by the contractor’s Statement of Work.

The contractor shall be specific in documenting the issues/areas that are scoped for audit.
For example, instead of including the generic audit scope of “bad debts”, specify that
traditional bad debts will be audited for timely billing and collection efforts. The
contractor shall draft the audit program as outlined in §50.2 below to determine the
extent of review to be performed on each issue scoped for further review.
50.2 – Tailoring of the Audit Program
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
An audit program provides the audit procedures that auditors shall follow to achieve the
audit objectives. The contractor shall prepare a specific audit program for each in-house
or field audit that the contractor performs. This audit program shall reflect the steps to
be completed in order to review the issues/areas contained in the scoping document
(e.g., the Summary of UDR Issues/Exceptions described in §20.2.III. of this Chapter).
The contractor shall use the steps from the latest approved CMS Audit Program
applicable for the provider type in effect at the time when its audit program is being
tailored. Additionally, unless directed by CMS, the contractor shall not alter or
renumber the CMS approved Audit Program steps.
NOTE: The audit program is issued by CMS separately and is not included in this
manual.
Additionally, the audit program is a confidential document and released only to the
contractors.
The contractor’s audit program shall:
• 	Identify the audit objectives;
• 	Identify the issues, transactions or cost report entries to be audited, reviewed
or verified;
• 	Identify the audit steps to be performed;
• 	Describe the tests to be applied.
60 – Field or In-House Audit Process
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
60.1 – Audit Confirmation Letter (a.k.a. Engagement Letter)
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)

The contractor shall send the provider an audit confirmation letter for all in-house or field
audits. This letter will identify the major areas the contractor intends to review during its
audit and advise the provider of the documentation that is required prior to starting the
audit.
The field audit confirmation letter shall give a minimum of four weeks and a maximum of
six weeks’ notice of the contractor’s intent to make an onsite visit for the purpose of
conducting a field audit (see Exhibit III.A in §170 of this Chapter for a sample letter).
The in-house audit confirmation letter shall give a minimum of four weeks and a
maximum of six weeks’ notice of the contractor’s intent to conduct an in-house audit (see
Exhibit III.B in §170 of this Chapter for a sample letter). The engagement letter shall be
provider-specific and include the following:
• 	Identification of the major areas the contractor plans to review.
• 	For a field audit, a list of the required documents that are to be made available
by the provider on the first day of the audit. For an in-house audit, a list of the
required documents and the due date that the provider must send copies of the
documentation to the contractor by. The documentation due date shall be at
least one week prior to the telephone entrance conference.
• 	Date and time of the entrance conference. (See the entrance conference
agenda – Exhibit IV in §170 of this Chapter.)
• 	A request that the provider assign a contact person to be the audit liaison.
• 	A tentative pre-exit conference date set for the last day of fieldwork for a field
audit or date set within one week of the anticipated completion date of all
audit review work for an in-house audit. (See the pre-exit conference format –
Exhibit VI in §170 of this Chapter.)
• 	For a field audit, notice that an exit conference will be tentatively scheduled
during the pre-exit conference to occur within eight weeks (or longer if
extenuating circumstances arise) after all the outstanding documentation is
furnished by the provider. For an in-house audit, notice that a telephone exit
conference will be conducted once all adjustments are finalized. (See the exit
conference format – Exhibit VIII in §170 of this Chapter.)
• 	Notice to the provider that all documentation and records requested prior to
and during the audit must be given to the contractor in a timely manner and
that failure to produce documentation will result in non-negotiable
adjustments.

• 	Notice to the provider that, as a general rule, the contractor will not honor any
reopening requests for the “lack of documentation” adjustments. This policy
has no impact on the normal provider appeal rights with the Provider
Reimbursement Review Board.
60.1.1 – Audit Confirmation Letter (a.k.a. Engagement Letter) - Field
Audit
(Rev. 107, Issued: 09-22-06; Effective: 10-01-06; Implementation: 10-02-06)
The field audit confirmation letter should give a minimum of 4 weeks and a maximum of
6 weeks notice of the contractor’s intent to make an onsite visit for the purpose of
conducting a field audit (see Exhibit II in §170 of this chapter for a sample letter). The
engagement letter should be provider-specific and must include the following:
• 	A list of the required documents that are to be made available by the provider on
the first day of the audit.
• 	Date of the entrance conference. (Enclose the entrance conference agenda –
Exhibit III in §170 of this chapter.)
• 	A request that the provider assign a contact person to be the audit liaison.
• 	A tentative pre-exit conference date set for the last day of fieldwork. (Enclose the
pre-exit conference format – Exhibit V in §170 of this chapter.)
• 	Notice that an exit conference will be tentatively scheduled during the pre-exit
conference to occur within 8 weeks (or longer if extenuating circumstances arise)
after all the outstanding documentation is furnished by the provider.
• 	Notice to the provider that all documentation and records requested prior to and
during the fieldwork time must be given to you in a timely manner and that failure
to produce documentation will result in non-negotiable audit adjustments.
• 	Notice to the provider that, as a general rule, you will not honor any reopening
requests for the “lack of documentation” adjustments. This policy has no impact
on the normal provider appeal rights with the Provider Reimbursement Review
Board.
60.1.2 – Audit Confirmation Letter (a.k.a. Engagement Letter) - In-
House Audit
(Rev. 107, Issued: 09-22-06; Effective: 10-01-06; Implementation: 10-02-06)
The in-house audit confirmation letter should give a minimum of 4 weeks and a
maximum of 6 weeks notice of the contractor’s intent to conduct an in-house audit (see

Exhibit II in §170 of this chapter for a sample letter). The engagement letter should be
provider-specific and must include the following:
• 	Identification of the major areas the contractor will review.
• 	A list of the required documents and the due date that provider must send copies
of the documentation to the contractor. The provider should be given at least 3
weeks to provide the requested documents, and the due date should be at least a
week prior to the telephone entrance conference.
• 	Date and time of the telephone entrance conference. (Enclose the telephone
entrance conference agenda – Exhibit III in §170 of this chapter).
• 	A request that the provider assign a contact person to be the audit liaison.
• 	A tentative pre-exit telephone conference date should be set within a week of the
anticipated completion date of all audit review work. (Enclose the pre-exit
conference format – Exhibit V in §170 of this chapter).
• 	Notice that a telephone exit conference will be conducted once all audit
adjustments are finalized.
• 	Notice to the provider that all documentation and records requested must be given
to you in a timely manner and that failure to produce documentation will result in
non-negotiable audit adjustments.
Notice to the provider that, as a general rule, you will not honor any reopening requests
for the “lack of documentation” adjustments. This policy has no impact on the normal
provider appeal rights with the Provider Reimbursement Review Board.
60.2 – Entrance Conference
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
The entrance conference is an important step in the audit process as it sets the tone for the
entire audit. The entrance conference serves to enhance communications between the
contractor and the provider by covering a wide variety of issues. At a minimum, the
participants at the entrance conference shall consist of the Medicare auditors who will
perform the audit, all appropriate provider personnel (controller, provider liaison,
accountants, cost report preparers), and provider consultants (if provider desires). See
Exhibit IV in §170 of this Chapter for a sample of the Entrance Conference Agenda.
During the on-site entrance conference for a field audit or telephone entrance conference
for an in-house audit, explain the purpose of the review and stress the need for
cooperation especially concerning the release of documentation by the provider. Also,

the contractor shall inform the provider that if supporting documentation is not received,
as a general rule, the associated Medicare payment will be disallowed, and a reopening
request will not be honored due to “lack of documentation.” However, all reopenings are
at the discretion of the contractor. Additionally, address the following during the
entrance conference.
• 	Discuss timeframes for conducting the on-site or in-house audit and schedule
the pre-exit conference;
• 	Discuss the scope of the on-site or in-house audit areas to be reviewed, and
the fact that the audit may turn up other issues not discussed at the entrance
conference;
• 	Discuss all of the proposed desk review adjustments with the provider;
• 	Identify the provider’s liaison and fully discuss the liaison's role to ensure full
cooperation during the audit;
• 	For on-site audits, discuss administrative issues such as location of working
space for the auditors, the hours during which the auditors will have access to
this working space, use of copiers/scanners, access to files, etc.;
• 	Encourage the third-party cost report preparer to be available during the
course of the audit and exit conference; and
• 	Discuss timeframes for additional documentation that is requested during the
audit. All requests shall be in writing and submitted to the designated
provider’s liaison. In general, the provider shall be given two to three
working days to supply the requested additional documentation.
At the start of the audit (generally after the entrance conference), inventory the provider
prepared documentation noting any items missing from the initial engagement request.
Notify the provider in writing of all missing items and request that the items be made
available as soon as possible. Follow the same notification policy for any additional
documentation that is requested during the audit.
NOTE: All contractor requests and provider responses shall follow PHI/HIPAA
requirements when emailing or faxing information.
60.2.1 – Entrance Conference for Field Audit
(Rev. 107, Issued: 09-22-06; Effective: 10-01-06; Implementation: 10-02-06)

During the on-site entrance conference, explain the purpose of the field review and stress
the need for cooperation especially concerning the release of documentation by the
provider. Also, you must inform the provider that if supporting documentation is not
received, as a general rule, you will disallow the costs and not reopen the cost report after
the notice of program reimbursement (NPR) is issued. Additionally, address the
following during the entrance conference.
• 	Discuss timeframes for conducting the on-site audit and schedule the pre-exit
conference.
• 	Discuss the scope of the on-site audit areas to be reviewed, and the fact that the
audit may turn up other issues not discussed at the entrance conference;
• 	Discuss all of the proposed desk review adjustments with the provider;
• 	Identify the provider’s liaison and fully discuss the liaison's role to ensure full
cooperation during the audit;
• 	Discuss administrative issues such as location of working space for the auditors,
the hours during which the auditors will have access to this working space, use of
copiers, need to make long distance telephone calls, if necessary, and access to
fax machines and files; and
• 	Encourage the third party cost report preparer to be available during the course of
the audit and exit conference.
See Exhibit III in §170 of this chapter for a sample of the Entrance Conference agenda.
At the start of the visit (generally after the entrance conference), inventory the provider-
prepared documentation noting any items missing from the initial engagement request.
Notify the provider in writing of all missing items and request that the items be made
available as soon as possible. Follow the same notification policy for any additional
documentation that is requested during the audit.
60.2.2 – Entrance Conference for In-House Audit
(Rev. 107, Issued: 09-22-06; Effective: 10-01-06; Implementation: 10-02-06)
During the telephone entrance conference, explain the purpose of the in-house review and
stress the need for cooperation especially concerning the release of documentation by the
provider. Also, you must inform the provider that if supporting documentation is not
received, as a general rule, you will disallow the costs and not reopen the cost report after
the notice of program reimbursement (NPR) is issued. However all reopenings are at the
discretion of the contractor. Additionally, address the following during the entrance
conference.

• 	Discuss timeframes for conducting the in-house audit and schedule the pre-exit
conference.
• 	Discuss the scope of the in-house audit areas to be reviewed, and the fact that the
audit may turn up other issues not discussed at the entrance conference;
• 	Discuss all of the proposed desk review adjustments with the provider;
• 	Identify the provider’s liaison and fully discuss the liaison’s role to ensure full
cooperation during the audit;
• 	Encourage the third party cost report preparer to be available by telephone during
the course of the audit and exit conference.
• 	Discuss timeframes for additional documentation that is requested during the
audit. All requests should be in writing, which could either be e-mailed or faxed
to the designated provider’s liaison. In general, the provider should be given
three (3) to five (5) working days to supply the requested additional
documentation.
NOTE: All contractor requests and provider responses must follow PHI/HIPAA
requirements when emailing or faxing information.
See Exhibit III in § 170 of this chapter for a sample of the Entrance Conference agenda.
60.3 – Tests of Internal Control
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
A. 	Provider’s Internal Control Structure
A provider’s internal control structure consists of the policies and procedures established
to provide reasonable assurance that the provider’s objectives are achieved. The internal
control structure consists of three elements:
• 	Control Environment: The collective effect of various factors on
establishing, enhancing, or mitigating the effectiveness of specific policies
and procedures.
• 	Accounting System: The methods and records established to identify,
assemble, analyze, classify, record, and report an entity's transactions and
to maintain accountability for the related assets and liabilities.
• 	Control Procedures: The policies and procedures in addition to the control
environment and accounting system that management has established to

provide reasonable assurance that specific entity objectives will be
achieved.
A provider generally has internal control structure policies and procedures that are not
relevant to a particular audit and therefore need not be considered for that audit. For
example, policies and procedures concerning the effectiveness, economy, and efficiency
of certain management decision-making processes, while important to the provider, do
not ordinarily relate to a Medicare audit.
B. 	Medicare’s Policy Regarding Review of Internal Controls
In the Medicare audit environment, a review of and reporting on a provider’s system of
internal control is generally not warranted or cost effective. The auditor may conclude
that it would be inefficient to evaluate the effectiveness of internal control policies and
procedures and that the audit can be conducted more efficiently by expanding substantive
tests.
The contractor may wish to gain an understanding of the provider’s internal control
structure when, in the contractor’s professional judgment, this understanding and
assessment of the internal controls would significantly affect the scoping of the Medicare
audit. This does not mean or require that the internal controls need to be reviewed in
every instance. The contractor’s understanding can be obtained through sources such as
the previous period's completed Internal Control Questionnaire (see Exhibit V in §170 of
this Chapter), current year’s management letter prepared by the provider’s financial
auditors (e.g., CPA firm), previous Medicare audit history, and empirical knowledge of
the provider.
It is not necessary to test the provider’s system of internal control for audits of
specifically selected areas such as intern/resident counts or wage index reviews, or for
reopenings. Furthermore, where CMS directs the contractor to perform a special audit,
CMS may limit, or require no work, in the area of internal controls.
If internal controls are not reviewed, the decision shall be stated in the scope section of
the audit report. In this situation, preparation of a report on internal controls is not
required.
C. 	Obtaining an Understanding of the Internal Control Structure
If the contractor determines that it is necessary to review internal controls in a given
situation (e.g., new providers, first audit by the contractor), complete the Internal Control
Questionnaire (see Exhibit V in §170 of this Chapter). Since all the aspects of the
provider’s internal control structure are not relevant to a Medicare audit, this questionnaire
is designed to allow the contractor to obtain an understanding of the provider's internal

control structure as it applies to Medicare audits. Medicare auditors are concerned with the
allowability, reasonableness, classification, and accumulation of cost report data that shall
be reported in accordance with Medicare principles of payment. Therefore, the Medicare
auditor shall obtain an understanding of those aspects of the provider's internal control
structure that affect the reliability of the cost report data that is being audited within the
parameters of the Medicare audit in accordance with CMS' audit instructions. This
understanding is ordinarily obtained by:
• 	Previous experience with the provider;
• 	Inquiries of appropriate personnel;
• 	Observation of the provider's activities and operations; and
• 	Inspection of the provider's documents and records.
Once the information required by the questionnaire has been obtained, the contractor shall
obtain the provider’s written concurrence to the answers and documentation as a whole
or on a question-by-question basis, as appropriate. If in the contractor’s professional
judgment there is a need to test the internal control structure in subsequent years, the
contractor may review and update the questionnaire answers and documentation during
subsequent audits.
The contractor shall maintain the internal control questionnaire with all related
documentation in a separate section of the permanent file and cross reference to supporting
audit workpapers, if necessary.
60.4 – Reliance on Work Done by Other Auditors
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
In order to ensure that the in-house or field audit will accomplish its objectives, it is
important to have the provider designate a staff person to serve in the role of the audit
liaison. This person ensures that issues are addressed as they arise rather than at the
completion of the audit. The provider liaison performs an active role during the audit.
This person either provides requested information or ensures that the appropriate and
responsible individual(s) on the provider's staff is made aware of the request for
additional information.

The contractor’s principal goal in carrying out the audit responsibilities is to arrive at a
correct settlement of the MCR. In doing so, preserve both the provider's and
government's interest. If during the audit the contractor uncovers circumstances in
which a provider disadvantaged itself, advise the provider liaison of the issue(s). Also,
maintain ongoing communications during the audit by discussing regularly with the
provider liaison to handle the following:
• 	Requests for documentation that was neither mentioned in the audit
confirmation letter nor requested during the entrance conference;
• 	The contractor shall follow up on their requests for additional information.
The provider should respond in writing if its staff cannot comply with the
agreed upon response date;
• 	Open audit issues, proposed adjustments and/or the general progress of the
audit. Provide the audit liaison with the adjustments, including those being
proposed due to lack of documentation, and the related workpapers (if
requested by the provider) during the course of the audit.
60.5 – Coordination of Activities During the Field and In-House Audits
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
The contractor shall conduct a pre-exit conference on the last day that the audit team is
conducting the fieldwork (for field audits) or the date established at the entrance
conference (for in-house audits). The contractor shall give the provider a copy of all
proposed adjustments and workpapers (where requested by the provider) including those
proposed due to lack of documentation and discuss all the proposed adjustments that the
provider wishes to review. Also, the contractor shall give the provider a written list of
any outstanding documentation that the contractor requested but has not received to date.
The contractor shall inform the provider to supply the additional documentation within
four weeks. The contractor shall establish an exit conference date that will allow up to
eight weeks from the end of the four-week period given to the provider to provide
additional documentation. The exit conference shall be scheduled and held within 12
weeks (84 days) from the pre-exit conference. If there are extenuating circumstances that
prevent the exit conference from being held in 12 weeks (84 days), the contractor shall
document the situation in their workpapers and inform their DPAO BFL, through their
COR.
See Exhibit VI in §170 of this Chapter for a sample Pre-Exit Conference Format.

60.6 – Designing Tests/Sampling
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
Use the time period between the pre-exit conference and exit conference to review any
additional documentation submitted by the provider in response to the contractor’s
request at the pre-exit conference or in support of the proposed adjustments that the
provider did not agree with. CMS encourages continuing dialogue during this period
between the contractor and the provider for issues where agreement was not reached at
the pre-exit conference. However, it is not necessary to consider any documentation that
is received after the timetable provided at the pre-exit conference unless prior
arrangements with the provider have been made.
While the contractor shall not refuse to accept documentation submitted after the
established timeframes, the contractor does not need to consider it in the initial NPR
issuance. If a reopening is later granted or a timely appeal is made, the late
documentation may be considered at that time.
At the conclusion of the contractor’s review of the provider’s documentation, prepare an
Adjustment Report (see Exhibit VII in §170 of this Chapter) and clearly identify all new
or modified adjustments that the provider did not see previously by indicating the date of
the change. Send this Adjustment Report to the provider with a request to notify the
contractor in writing within two weeks of any concerns with the new or modified
adjustments. Also, inform the provider in writing that the adjustments will become final
after the contractor makes any necessary modification based on those written concerns
and documentation supporting them. Therefore, any documentation submitted later (e.g.,
at the exit conference) will not be considered for the purpose of issuing the NPR.
Unless the contractor can document extenuating circumstances and has communicated
these to their DPAO BFL through their COR, the contractor has up to 12 weeks (84
days) from the pre-exit conference for the finalization of the adjustments. This period
includes the four weeks given to the provider to submit additional documentation and the
two weeks that the contractor shall give the provider to review and comment on any
adjustments not presented at the time of the pre-exit conference.
60.7 – Evidence
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
Each provider is entitled to an exit conference regardless of whether the audit was
completed at the provider site or remote location. The contractor shall make the provider
aware that if it wishes to waive a formal exit conference, it must notify the contractor of
this decision in writing (e-mail note will suffice) at any time before the scheduled date of

the exit conference. (See Exhibit III.A or III.B in §170 of this Chapter.)
The people participating in the exit conference should be those parties authorized to make
final decisions with respect to the audit. In addition, CMS encourages third-party
preparers of the MCR to participate.
The exit conference shall be held within 12 weeks (84 days) from the pre-exit conference.
If there are extenuating circumstances that prevent the exit conference from being held in
12 weeks (84 days), the contractor shall document the situation in their workpapers and
inform their DPAO BFL, through their COR.
At the start of the exit conference, the contractor shall give the provider all the
adjustments (including those made due to lack of documentation) that were finalized in
the manner described in §60.6 of this Chapter. Also, the contractor shall ensure the
provider has received copies of requested workpapers if they were not previously given to
the provider. Since the provider had an opportunity to comment on all the adjustments
during the pre-exit conference and during the finalization period, there shall be no need
to change them during the exit conference.
If additional documentation is submitted during the exit conference, the contractor shall
not refuse it. Rather, inform the provider that the contractor does not need to consider
this documentation in the initial NPR since the documentation was not submitted within
the established timeframes. If a reopening is later granted or a timely appeal is made, the
late documentation may be considered at that time.
Also, the contractor shall explain during the exit conference that the provider may still
appeal any lack of documentation or other issues to the Provider Reimbursement Review
Board (PRRB).
The exit conference for audits can be performed telephonically or virtually unless waived
by the provider. Additionally, the exit conference for field audits may be held at the
provider site. The contractor shall include a written record of the issues discussed,
including the explanation pertaining to the lack of documentation adjustments in the
workpapers.
See Exhibit VIII in §170 of this Chapter for a sample Exit Conference Format.
60.8 – Working Papers
(Rev. 27, 12-19-03)
AICPA Standards and GAS require that "a record of the auditors' work should be retained
in the form of working papers." An additional working paper standard requires that
"working papers should contain sufficient information to enable an experienced auditor

having no previous connection with the audit to ascertain from them the evidence that
supports the auditors’ significant conclusions and judgments."
A. 	Definition
Working papers contain evidence accumulated throughout the audit to support the work
performed, the results of the audit, including adjustments made, and the judgment of the
auditors. They must stand on their own without the need for supplemental explanation or
documentation.
Working papers are the records kept by the auditor of the procedures applied, the tests
performed, the information obtained, and the pertinent conclusions (findings, no findings,
dollar adjustments) established during the audit. Examples of working papers are audit
programs, analyses, memoranda, letters of confirmation and representation, abstracts of
provider documents, and schedules or commentaries prepared or obtained by the auditor.
Working papers may be in the form of data stored on tapes, film, or other media.
Prepare and maintain working papers, the form and content of which should be designed
to meet the circumstances of a particular audit. The information contained in working
papers constitutes the principal record of the work that the auditor has done and the
conclusions that the auditor reached concerning significant matters.
B. 	General Content of Working Papers
Working papers should ordinarily include documentation showing that:
• 	The work has been adequately planned and supervised. This includes
consideration of the audit requirements of Medicare and any other payers, which
are part of a common audit with Medicare.
• 	The audit evidence obtained, the auditing procedures applied, and the testing
performed have provided sufficient, competent evidential matter to support the
auditor's conclusions.
C. 	Format of Working Papers
Ensure that the working papers are prepared using the following standards.
Start each individual working paper with the basic mechanical foundation containing:
• 	Provider name, number, and cost reporting period.
• 	Preparer's signature or initials.
• 	Date the work was performed.

• 	Proper heading, giving basic content of the working paper.
• 	Working paper number or reference.
• 	Purpose–A brief description of the work to be done on the working paper and the
objective to be achieved (e.g., a comparison of the contractor’s PS&R with the as-
filed settlement data to validate the provider's claimed Medicare statistics).
• 	Source of Information–This informs the reviewer where the information used on
the working paper was obtained. The source can be a description of the
particulars, e.g., Medical Records Admission Register, or it can be in the form of
cross-referencing to the cost report, financial statements, or other working papers.
Cross-referencing is especially important because it enables the reviewer to see at
a glance exactly where an amount, number etc. comes from. Copies, or if
appropriate samples, of the information/ documents examined must be retained in
the working papers.
• 	Scope of Work–The stated scope of work should enable a reviewer to determine if
an adequate test was performed to meet the scope of the audit purpose.
• 	Explanation of Tick Marks– Use tick marks to explain and cross-reference the
work performed.
• 	Conclusion–When a working paper is complete, the contractor shall state
conclusions covering the results of the audit activity.
− 	EXAMPLE: No exceptions were noted in the test; therefore, the as-filed
number of full time equivalent (FTE) residents used for GME payment is
accepted.
− 	EXAMPLE: Exceptions were noted in the number of FTE residents used for
GME payment. An adjustment is proposed to correct the as-filed GME FTE
statistic.
Furthermore, the working papers should:
• 	Be legible, complete, and accurate in order to provide proper support for findings,
judgments, conclusions, and to document the nature and scope of the work
conducted
• 	Contain sufficient information so that supplementary oral explanations are not
required;
• 	Include summaries and lead schedules, as appropriate;

• 	Contain adequate indexing and cross-referencing to the audit program, lead
summaries, and adjustment report. (Each audit step that is initialed on the audit
program should contain a reference to the “specific” working paper on which this
step was addressed. It is not acceptable to just reference the general working
paper series for an area under each audit step for that area. For example, include a
reference to W/P 13-1(a) instead of W/P 13 series. Also, if you reference a
specific working paper under the first audit step pertaining to an area/issue, do not
draw a vertical line from that reference through all other audit steps for that area
unless all the audit work for all those audit steps was actually detailed on that
working paper.
• 	Restrict information to matters that are materially important and relevant to the
objectives of the audit;
• 	Contain evidence of supervisory review of the work including initials.
• 	Include an index to working papers for ease of reference.
• 	Include the audit program. However, do not retain pages of a standard audit
program that are not applicable to the audit. If in the audit program for a specific
provider you retain audit steps from the standard audit program that were not
scoped, mark them “N/A” instead of leaving them unmarked.
D. 	Ownership and Custody of the Working Papers
Working papers are the property of the auditor. The auditor's rights of ownership,
however, are subject to ethical limitations relating to the confidential relationship with
providers.
Adopt reasonable procedures for safe custody of working papers in the field as well as in
your office in accordance with the Health Insurance Portability and Accountability Act
(HIPAA) and retain them for a sufficient period of time to meet the needs of your
operation and to satisfy legal requirements of record retention.
When requested, send original working papers to the appropriate CMS component or
CMS’ designated agent for review.
60.9 – Documentation Standards
(Rev. 107, Issued: 09-22-06; Effective: 10-01-06; Implementation: 10-02-06)
Documentation that the evidence obtained, procedures applied, and tests performed
provide sufficient, competent, and relevant evidence to support the auditor’s opinions,
judgments, conclusions, or recommendations is essential. After obtaining and testing the
various types of evidence (e.g., invoices, bills, contracts, statistics such as the FTE
number of interns and residents) considered necessary in the circumstances, retain at least
a representative sample of such evidence. If only a sample of the evidence for each area

of in-house or field audit is retained, refer to evidence not retained and its relationship to
the basis for the opinions, judgments, conclusions, or examinations.
Where audit adjustments were made, auditors should include in the working papers,
copies of provider documents that were reviewed. For those documents not copied,
auditors may meet GAS requirements by listing voucher numbers or check numbers. As
an example, if voucher numbers or check numbers are used as a means of identification,
sufficient documentation should consist of also listing the respective dates paid, amounts
paid, and descriptions of the items for which the vouchers or checks were issued. Where
audit adjustments were not made, auditors must include in the working papers copies of a
representative sample of documents examined. Where materiality is a factor, define
"materiality" within the scope and objective of your review/audit.
These documentation standards apply to both the desk review, in-house and field audits.
60.10 – Pre-Exit Conference
(Rev. 107, Issued: 09-22-06; Effective: 10-01-06; Implementation: 10-02-06)
Conduct a pre-exit conference on the last day that the audit team is conducting the
fieldwork or the date established at the entrance conference. Give the provider a copy of
all the tentative audit adjustments and working papers (where requested by the provider)
including those being proposed due to lack of documentation and discuss all the tentative
adjustments that the provider wishes to go over. Also, give the provider a written list of
any outstanding documentation that you requested but have not received to date. Inform
the provider to furnish your audit staff with the additional documentation within 4 weeks.
Establish an exit conference date that will allow up to 8 weeks (or longer if you can
document extenuating circumstances) from the end of the 4 week period given to the
provider to provide additional documentation.
See Exhibit V in §170 of this chapter for a sample pre-exit conference format.
60.11 – Finalization of Audit Adjustments
(Rev. 84, Issued: 11-16-05; Effective Date: 12-05-05; Implementation Date: 12-05-
05)
Use the time period between the pre-exit conference and exit conference to review any
additional documentation submitted by the provider in response to your request at the
pre-exit conference or in support of the proposed audit adjustments that the provider did
not agree with. CMS encourages continuing dialogue during this period between you and
the provider for issues where agreement was not reached at the pre-exit conference.
However, it is not necessary to consider any documentation that is received after the
timetable provided at the pre-exit conference unless prior arrangements with the provider
have been made.
While you should not refuse to accept documentation submitted after the established
timeframes, you do not need to consider it in the initial NPR issuance. If a reopening is

later granted (see §100ff of this chapter) or a timely appeal is made, the late
documentation may be considered at that time.
At the conclusion of your review of the provider’s documentation, prepare an audit
adjustment report (see Exhibit VI in §170 of this chapter) and clearly identify all new or
modified adjustments that the provider did not see previously by indicating the date of the
change. Send this audit adjustment report to the provider with a request to notify you in
writing, within 2 weeks, of any concerns with the new or modified adjustments. Also,
inform the provider in writing that the audit adjustments will become final after you make
any necessary modification based on those written concerns and documentation
supporting them. Therefore, any documentation submitted later (e.g., at the exit
conference) will not be considered for the purpose of issuing the Notice of Amount of
Program Reimbursement (NPR).
Unless you can document extenuating circumstances, you have up to 12 weeks from the
pre-exit conference for the finalization of the audit adjustments. This period include the 4
weeks given to the provider to submit additional documentation and the “2 weeks” that
you must give the provider to review and comment on any audit adjustments not
presented at the time of the pre-exit conference.
60.12 – Exit Conference
(Rev. 107, Issued: 09-22-06; Effective: 10-01-06; Implementation: 10-02-06)
Each provider is entitled to an exit conference. Make the provider aware that if it wishes
to waive a formal exit conference, it must notify you of this decision in writing (e-mail
note will suffice) at any time before the scheduled date of the exit conference. (See
Exhibit II in §170 of this chapter.)
Persons participating in the exit conference should be those parties authorized to make
final decisions with respect to the audit. In addition, CMS encourages third party
preparers of the cost report to participate.
At the start of the exit conference, give the provider all the audit adjustments (including
those made due to “lack of documentation) that were finalized in a manner described in
§60.11 of this chapter. Also, give the provider copies of requested working papers if they
were not previously given to the provider. Since the provider had an opportunity to
comment on all the audit adjustments during the pre-exit conference and during the
finalization period, there should be no need to change them during the exit conference.
If additional documentation is submitted during the exit conference, do not refuse it.
Rather, inform the provider that you do not need to consider this documentation in the
initial NPR since the documentation was not submitted within the established timeframes
(see §§ 60.10 and 60.11 of this chapter). If a reopening is later granted (see §100ff) or a
timely appeal is made, the late documentation may be considered at that time.

Also, explain during the exit conference that the provider may still appeal “any lack of
documentation” or other issues to the Provider Reimbursement Review Board (PRRB).
The exit conference can be performed telephonically. However, include a written record
of the issues discussed (either telephonically or onsite), including the explanation
pertaining to the “lack of documentation adjustments” in your working papers.
60.13 – Supervision During the Audit Process
(Rev. 107, Issued: 09-22-06; Effective: 10-01-06; Implementation: 10-02-06)
The Government Auditing Standards related to performance of audits state that: "Staff
are to be properly supervised." and "Supervision involves directing the efforts of auditors
and others who are involved in the audit to determine whether the audit objectives are
being accomplished. Elements of supervision include instructing staff members, keeping
informed of significant problems encountered, reviewing the work performed, and
providing effective on-the-job training."
A. 	Staff Supervision
Direct supervision of staff during the audit by a qualified supervisor is necessary to
ensure that the audit is completed in accordance with the audit work plan. Proper
supervision must be a constant activity during the desk review process, planning and
completion of the audit, preparation of the audit report, and settlement of the cost report.
Supervision is required so that each member of the audit team understands the objective
of each desk review/audit procedure, how to perform and document the completion of the
audit procedure in the working papers, and how to evaluate the audit evidence. Establish
procedures for supervision that are distinct from responsibilities of individuals to
adequately plan and supervise the work on a particular audit.
Assure that the policies and procedures for planning, performance, and supervision of
audits meet the GAS standards of quality. You must provide procedures for planning
individual audits in accordance with Medicare instructions, such as:
• 	The development of proposed audit programs;
• 	The determination of staffing requirements and the need for specialized
knowledge; and
• 	The development of estimates of time required to complete the audit.
You must also provide guidelines for maintaining standards of quality for work, such as:
• 	Guidelines for the form and content of working papers;
• 	Procedures for resolving differences of professional judgment among members of
an audit team; and

• 	Standard forms, checklists, and questionnaires appropriate to assist in the
performance of audits.
Furthermore, you must provide procedures for reviewing audit working papers and
reports.
B. 	Hiring
Prepare staff job descriptions and policies and procedures for hiring to provide reasonable
assurance that those employed are able to perform audits competently. You must:
• 	Plan for staffing needs at all levels;
• 	Establish quantified hiring objectives based on current workload, anticipated
changes in workload, staff turnover, individual advancement and retirement, and
current Medicare budget; and
• 	Establish qualifications and guidelines for evaluating potential hires at each
professional level.
C. 	Supervisory Review Standards for Working Papers
The audit working papers and associated files (e.g., permanent file) are the only evidence
of the audit procedures you performed to support your decision on the accuracy of the
final settled Medicare cost report.
An element of supervision is a thorough supervisory review of the audit working papers.
This may require several levels of review, depending on the size and configuration of the
audit organization. For example, in a larger organization, the in-charge auditor is
responsible for reviewing the work of other auditors on the team, and an independent
supervisor reviews all work performed during the audit. While the ideal situation would
have this second level review performed by an audit supervisor, the individual
performing that function need not have that title. Rather, the individual may be a highly
qualified senior auditor who is not part of the team performing the audit. In addition, a
manager may also perform a subsequent higher- level review of the completed work.
Your responsibility to review the audit working papers includes audits performed by all
your employees and by individuals who are not your employees (i.e., subcontractors)
regardless of the arrangements under which they perform the audits. You cannot delegate
the responsibility to perform independent review of a subcontractor even if the
subcontractor is another fiscal intermediary.
The supervisory review also satisfies the audit standards requirement for due professional
care in performing the audit. The first level of defense to ensure the quality of the
working papers is the on-site supervision of the audit staff. The second level of defense

to ensure the quality of the working papers is the supervisory review. No improvement in
the quality of the audit work will occur unless management recognizes the importance of
the working paper review, as the second most important line of defense in maintaining
quality working papers. Proper supervisory review:
• 	Ensures that the audit is completed in accordance with the audit plan;
• 	Minimizes contradictions within the audit working papers;
• 	Minimizes inappropriate or inaccurate interpretation of Medicare policies; and
• 	Assists in the evaluation and development of staff.
Give the supervisory reviewer adequate time to complete a competent review. No matter
how knowledgeable the reviewer is, the effectiveness of the review is directly
proportionate to the time spent on the review. The reviewing supervisor must have
sufficient knowledge and understanding of the following:
• 	Medicare laws, regulations, and payment policies;
• 	Medicare cost reporting requirements;
• 	GAS and the AICPA SAS; and
• 	Provider accounting procedures.
D. 	General Approach to Supervisory Review of Audit Working Papers
The reviewing supervisor must:
• 	Be critical and not perfunctory;
• 	Be methodical, careful, and thorough;
• 	Ensure that the working papers support the audit objectives;
• 	Question the stated conclusions and be able to arrive at the same conclusions,
based on the evidence presented on the working papers; and
• 	Have a clear understanding of materiality and spend proportionately more time on
material issues.
E. 	Specific Points in the Supervisory Review of Audit Working Papers
While the following points are not all-inclusive, the reviewing supervisor should:

• 	Obtain an overall understanding of the provider by reviewing its
correspondence file, permanent file, financial statements, and as-filed cost
report;
• 	Understand the audit work plan as determined by the desk review and the
resulting scope of audit, as detailed in the audit program;
• 	Discuss the in-house or field audit with the in-charge auditor to determine
areas in which the auditors had problems;
• 	Ensure that the audit work plan is completed;
• 	Ensure that decisions to defer audit steps identified in the initial audit scope
are adequately documented;
• 	Ensure that the working papers meet the mechanical and analytical
requirements for quality working papers (see §60.8 of this chapter);
• 	Ensure that Medicare payment policies are properly interpreted;
• 	Ensure that conclusions are supported by sufficient, competent, and relevant
evidential matter;
• 	Ensure that conclusions drawn from the audit procedures are supported by the
work performed;
• 	Ensure that the provider has been advised of proposed adjustments and given
sufficient time to respond;
• 	Ensure that all the retained adjustments are incorporated in the adjustment
report;
• 	Ensure that the aggregate of all adjustments passed as immaterial do not have
a significant impact on Medicare payment;
• 	Test calculations which have a direct impact on Medicare payment;
• 	Look for areas which require more in-depth audit in subsequent audits and
determine how they were addressed;
• 	Ensure that notes for future audits are prepared and included in the permanent
reference file;
• 	Prepare review notes;

• 	Make a final check of the working papers after the review notes are cleared;
• 	Ensure that unnecessary papers are deleted from the working paper file;
Retain supervisory review notes in the working papers.
61 – Documentation and Review Standards for All Medicare Audit
Activities
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
61.1– Reliance on Work Done by Other Auditors
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
A. General Guidelines
Medicare Audit Activities are generally limited to tests of compliance with Medicare
reimbursement policies and procedures. In performing these activities, contractors
generally rely on the financial statements prepared by independent auditors. This includes
the independent auditors’ review of providers’ accounting systems.
To the extent that an independent auditor issued an unqualified opinion on a provider’s
financial statement and has not identified any material weaknesses in the provider’s
internal control structure, rely on the provider’s system of accounting, including related
computer systems. This does not include reliance on records or systems that are
maintained solely for purposes of completing a MCR. As mentioned in §60.3 of this
Chapter, the contractor may wish to perform substantive tests of the records maintained
solely for Medicare reimbursement purposes.
If an independent auditor issued a qualified opinion, an adverse opinion, or has identified
material weaknesses in the internal control structure, evaluate the effect of the auditor’s
actions on the contractor’s audit objective. If there has been no audit by an independent
auditor, consider the audit resources available, the audit risk, and the audit objectives in
deciding if there is a need to review the accounting systems.
Furthermore, the contractor may rely on work of other auditors (i.e., provider’s internal
or independent auditors and audit organizations established by the Federal and State
Governments for programs other than Medicare) in situations where the scope of this
work relates to issues that the contractor scoped for the Medicare audit. However, in this
situation, the contractor must still satisfy itself with the quality of the other auditors’
work by performing appropriate tests or by other acceptable methods.
B. Obtaining Management Letter and/or Documentation Prepared by Provider's

Independent Auditors
If the contractor determines that it is necessary to gain an understanding of a provider's
internal control structure or any other aspect of the accounting system, the contractor
may request that the provider furnish the management letter or other documentation
relevant to the Medicare audit that was prepared by an independent auditor or certified
public accounting (CPA) firm.
Under §§1815(a) and 1833(e) of the Social Security Act, the contractor or CMS may
review any documentation it deems necessary to determine whether payment for
reasonable cost to a particular provider is appropriate. The implementing regulations at
42 CFR 413.20, 413.24, and 413.52 explain this further. 42 CFR 413.20(e) specifically
allows suspension of payment if the contractor determines that the provider does not
maintain adequate records for the determination of reasonable costs. Additionally, 42
CFR 405.372(a)(2) provides for suspension of payment for failure to provide specifically
requested information. However, when the documentation is maintained by an
independent auditor or certified public accounting (CPA) firm rather than by a provider,
the contractor or CMS shall insist that the provider obtain the information from that audit
entity. Since the law and regulations are directed to providers, not their auditors or CPA
firms, CMS requires the provider to have the independent auditor release the
documentation to CMS or the contractor. The independent auditor is at a minimum a de
facto agent of the provider and should comply with the request. If the provider is not able
to produce the documentation from the independent auditor/CPA firm, the contractor
may disallow all the provider’s cost/reimbursement associated with the cost report(s)
under review or at least suspend payment until the documentation is provided if an
appropriate determination of payment cannot be made without the documentation. CMS
has limited recourse against the independent auditor or CPA firm if it refuses to comply.
Contractors shall keep independent auditors’ management letters or other documentation
obtained from a provider or the independent auditors in a secure place. Disclose the
contents only to those directly involved with the audit.
61.2 	– Designing Tests/Sampling
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
The contractor shall design such tests as are necessary to accomplish their objectives and
aid the contractor in reaching conclusions necessary to complete the Medicare Audit
Activity. The contractor shall use sampling when this would be more efficient in testing
the universe of transactions, entries, or statistical data within an area of consideration.
Sampling is the application of a procedure to less than 100 percent of the items within an

account balance, class of transactions, or statistics (e.g., an expense account with over
1,000 transactions) to evaluate some characteristic of such balance, class, or statistics.
On the basis of facts known to the contractor, the contractor shall decide if all
transactions, balances, or statistics that pertain to the issue/area being tested need to be
reviewed in order to obtain sufficient evidence. In most cases, an auditor will test at a
level less than 100 percent.
There are two general sampling approaches, nonstatistical and statistical. Either
approach, when properly applied, can provide sufficient evidential data related to the
design and size of a sample, among other factors. A nonstatistical sample may support
acceptance of findings, but findings must be scientifically established to support
adjustments.
Some degree of uncertainty is inherent in applying Medicare Audit Activity procedures
and is referred to as ultimate risk. Ultimate risk includes uncertainties due both to
sampling and other factors. Sampling risk arises from the possibility that when a
compliance or a substantive test is restricted to a sample, the auditor's conclusions may be
different had the test been applied in the same way to all items in the account balance,
class of transactions, or statistics.
If the contractor uses a sample(s) to test certain issues scoped for analysis, the contractor
shall include a description of the sampling technique, all parameters used to select the
sample, and confidence level in the audit workpapers. By using statistical theory, the
contractor shall quantify the sampling risk in limiting it to an acceptable level.
A. Planning Samples
When developing a strategy and planning the selection of an appropriate sample,
consider:
• 	The relationship of the sample to the review objective.
For example, the following shall be considered, respectively, in the decision whether it is
feasible to just use one sample for the review of Medicare bad debts:
- 	the contractor’s review procedures for “regular Medicare-only
Traditional bad debts,” “dual eligible (Medicare and Medicaid) bad debts,”
and “Medicare-only indigent bad debts” is different.
Therefore, using only one sample creates a risk that the number of sample
items selected may not be sufficient to test some of the different attributes;

• 	Preliminary estimates of materiality levels;
• 	The allowable risk of incorrect acceptance; and
• 	Characteristics of the population, i.e., the items comprising the universe may
not be homogenous.
B. Selecting a Sampling Approach
Where the review objective would be best accomplished by stratifying the
universe/population into categories (“regular Medicare-only Traditional bad debts,”
“dual eligible (Medicare and Medicaid) bad debts,” and “Medicare-only indigent
bad debts”) and high and low strata (e.g., where Medicare bad debts are being
tested), the contractor shall use its judgment in designating the threshold for this
stratification and include the justification on the workpaper. Once determined, review
100% of the items in the high strata population and use statistical or non-statistical
sampling to test the low strata. Because either nonstatistical or statistical sampling
can provide sufficient evidence, choose between them after considering their relative
cost and effectiveness. Statistical sampling helps to:
• 	Design an efficient sample;
• 	Measure the sufficiency of the evidential matter obtained; and
• 	Evaluate the results.
However, statistical sampling involves additional costs of designing individual
samples to meet the statistical requirements and selecting items to be examined.
On the other hand, using a non-statistical sampling method may prove to be more
time-consuming and costly because any resulting findings shall be scientifically
established to support adjustments of the universe. Thus, if findings are identified, the
contractor shall redesign the sample using a statistical method.
In some situations, regardless of the sampling method used (i.e., statistical or non-
statistical), the review objective would be best accomplished by stratifying the
universe according to the attributes of the data to be reviewed. For example, when
reviewing Medicare bad debts, it is beneficial to stratify the bad debts into “regular
Medicare-only Traditional bade debts,” “dual eligible (Medicare and Medicaid) bad
debts,” and “Medicare-only indigent bad debts,” because the primary emphasis of
review for each of those bad debt types (i.e., collection effort; receipt of
documentation to support the State’s adjudication of the claim; and provider’s
adherence to 42 CFR 413.89(e)(2)(ii) and the Provider Reimbursement Manual 15-1,

Chapter 3, §312 when determining “indigence,” respectively) is different. Therefore,
such stratification ensures that a sufficient number of bad debts in each of those
categories is included in the sample(s).
C. Sampling Risk
In performing substantive tests of details, the contractor shall consider:
• 	The risk of incorrect acceptance that the sample supports the conclusion that
the items are not materially misstated when they are; and
• 	The risk of incorrect rejection that the sample supports the conclusion that the
items are materially misstated when they are not.
D. Using the Test Results
If the results of testing a sample that was selected using a non-statistical method
indicate probable errors in the universe of transactions, entries, or statistics, the
contractor shall redesign the sample using a statistical method and document the
decision. If the results of testing a sample that was selected using a statistical method
indicate probable errors in the universe, the contractor shall use the output generated
from the sampling methodology utilized and document the decision.
The contractor shall not make an adjustment that consists solely of the error(s)
identified in the review of the sample without documenting the reason for not
considering the effect of the error(s) on the universe.
There are some transactions that could be sampled where a current year error also
affects subsequent cost reporting periods. For example, the auditor has a review step
to test asset additions by comparing the useful life of the asset included on the
provider’s Plant, Property, and Equipment (PPE) log to the American Hospital
Association’s (AHA) Estimated Useful Lives of Depreciable Assets (AHA Useful Life).
The provider has over 100 asset additions, so the contractor selects a statistical
sample of assets to review. A few of the assets in the statistical sample have a longer
useful life based on the AHA Useful Life when compared to the useful life used in the
provider’s PPE. The auditor writes an adjustment based on the output generated
from the statistical sampling methodology used in its testing. The auditor would
create a lapsing schedule for each asset that was in error to show the depreciation
expense based on the provider’s PPE compared to the depreciation expense based on
the AHA Useful Life; the difference would be adjusted each year until the asset is
fully depreciated based on the asset’s lapsing schedule. The auditor would also write
a PFNY to inform the subsequent auditor of the assets requiring adjustment. The
auditor would include the lapsing schedule and the PFNY in the Permanent File. In

addition, the assets that were in error and adjusted each year would be removed from
future asset testing since it was already determined that the assets were in error and
thus, are adjusted each year until fully depreciated. (See §130 of this Chapter for
more information on the permanent file.)
61.3 	– Evidence
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
The American Institute of Certified Public Accountants (AICPA) defines audit as: "The
evaluation of information to be used as audit evidence informs the auditor’s conclusion
whether sufficient appropriate audit evidence has been obtained. As technology
progresses, new techniques, including audit data analytics, remote auditing and the use of
additional computer assisted auditing techniques are being employed. Along with this
advancement also comes risk. This is your source of news, resources and learning relative
to audit evidence and remote work.”
The Generally Accepted Audit Standards (GAAS) standard on audit documentation states
that: “Auditors support the conclusions in their reports with a work product called audit
documentation, also referred to as working papers or work papers. Audit documentation
supports the basis for the conclusions in the auditor's report. Audit documentation also
facilitates the planning, performance, and supervision of the engagement and provides the
basis for the review of the quality of the work by providing the reviewer with written
documentation of the evidence supporting the auditor's significant conclusions. Examples
of audit documentation include memoranda, confirmations, correspondence, schedules,
audit programs, and letters of representation. Audit documentation may be in the form of
paper, electronic files, or other media.”
While the Medicare auditor does not express an opinion on financial statements, they are
responsible for collecting sufficient and competent evidential data as a basis for drawing
conclusions about the Medicare Cost Report. Contractors shall ensure that evidence
obtained during the course of the cost report review is sufficient to enable the auditor to
support conclusions, adjustments, and recommendations. Additionally, contractors shall
ensure that there is enough factual and convincing evidence so that a prudent person can
arrive at the same conclusion as the auditor. Evidence shall be competent and relevant.
That is, evidence shall be valid and reliable and have a logical relationship to the
issue/subject under review.
Sources and Categories of Evidence
The contractor shall review all evidence, no matter from what source, with appropriate
professional skepticism. The auditor shall keep an open mind but must question the

validity of all evidence and determine its application to the situation under review. In
addition, evidence uncovered by an auditor that the provider used for purposes other than
the preparation of the MCR, such as a bank loan application, public stock filing,
insurance claim, other government reports (e.g., tax returns, SEC filings), or reports from
an outside agency have greater credibility than conflicting or self-serving evidence
offered by the provider related to a similar issue being reviewed for Medicare.
The contactor shall obtain sufficient, appropriate evidence to ensure the propriety of
costs claimed by the provider on its submitted MCR in order to determine that proper
payment is made for services provided to Medicare beneficiaries. The evidence consists
of physical inspection or observation and corroborating documents such as checks,
invoices, contracts, vouchers, assignment/rotation schedules for interns and residents,
Medicaid remittance advices to support payment or non-payment of Medicare
coinsurance and deductibles for dual eligible Medicare beneficiaries, minutes of
meetings, and written and/or oral testimony of provider employees.
The contractor shall base its tests on the best evidence available and shall consider the
probative value of evidence offered in context of the hierarchy of order and types of
evidence. The auditors shall not rely on evidence of a lower order or type if they can
reasonably conclude that evidence of a higher order or type is available. The contractor
shall insist that providers produce evidence of the highest order and type that the
contractor believes is available.
Categories of evidence include the following per GAS, Chapter 8 “Fieldwork Standards
for Performance Audits,” Paragraph 8.104 “Evidence”:
• 	Physical Evidence – This is obtained by auditors from direct inspection or
observation of people, property, or events. This evidence may be documented
in summary memos, photographs, videos, drawings, charts, maps, or physical
samples. However, in certain circumstances, physical evidence may not be
sufficient, especially if the auditor has to rely on personal knowledge to
determine the propriety or value.
• 	Documentary Evidence – This type of evidence is the most commonly used
and referred to by an auditor. This is already existing information. It is
information such as letters, contracts, accounting records, invoices, checks,
interns’ and residents’ rotation schedules, remittance advices, etc.
• 	Testimonial Evidence – This is probably the least reliable type of evidence as
it is obtained by inquiry or inspection from others, both inside and outside the
provider's organization. For example, through responses to inquiries and
interviews. By itself, this category of evidence is unacceptable for Medicare

purposes. Therefore, the contractor shall evaluate all such information and
corroborate with additional evidence.
Auditors often use analytical processes, including computations, and comparisons to
analyze any evidence gathered to determine whether it is sufficient and appropriate. In
evaluating the effectiveness and usefulness of evidence, the contractor shall consider
whether the objectives have been achieved. If the objectives were not achieved, the
evidence was either not sufficient or was only sufficient to establish that there was a
problem. In this situation, the contractor shall obtain additional evidence in order to
reach a valid conclusion and achieve the objective.
If there is sufficient and reliable evidence that supports the conclusion that the provider’s
reported reimbursement amount for a specific area is incorrect, make an appropriate
adjustment and document it in the workpapers. Likewise, if the provider does not furnish
sufficient and reliable evidence to support the reported reimbursement amount for a
specific area, make an adjustment to disallow the reimbursement in question. (See 42
CFR 413.20(a) and 42 CFR 413.24(a))
61.4 	– Workpapers
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
AICPA U.S. Audit Standards defines audit documentation as the following:
• 	“The record of audit procedures performed, audit evidence obtained, and
conclusions the auditor reached (terms such as working papers or workpapers
are also sometimes used).”
• 	“The record of the work performed, results obtained, and conclusions that the
practitioner reached (also known as working papers or workpapers).”
\Per GAS, Chapter 8 “Fieldwork Standards for Performance Audits,” Paragraphs 8.132
through 8.134 “Audit Documentation” include the following requirements:
• 	“Auditors must prepare audit documentation related to planning, conducting,
and reporting for each audit. Auditors should prepare audit documentation in
sufficient detail to enable an experienced auditor, having no previous
connection to the audit, to understand from the audit documentation the
nature, timing, extent, and results of audit procedures performed; the
evidence obtained; and its source and the conclusions reached, including
evidence that supports the auditors’ significant judgments and conclusions.”

• 	“Auditors should prepare audit documentation that contains evidence that
supports the findings, conclusions, and recommendations before they issue
their report.”
• 	“Auditors should design the form and content of audit documentation to meet
the circumstances of the particular audit. The audit documentation constitutes
the principal record of the work that the auditors have performed in
accordance with standards and the conclusions that the auditors have
reached. The quantity, type, and content of audit documentation are a matter
of the auditors’ professional judgment.”
A. Definition
Workpapers contain evidence accumulated throughout the Medicare Audit Activities
to support the work performed, the overall results, including adjustments made, and
the judgment of the auditors. Workpapers shall stand on their own without the need
for supplemental explanation or documentation.
Workpapers are the records kept by the auditor of the procedures applied, the tests
performed, the information obtained, and the pertinent conclusions (findings, no
findings, dollar adjustments) established during the audit. Examples of workpapers
are review programs, analyses, memoranda, letters of confirmation and
representation, abstracts of provider documents, and schedules or commentaries
prepared or obtained by the auditor. Workpapers may be in the form of data stored on
various types of media.
Prepare and maintain workpapers, the form and content of which should be designed
to meet the circumstances of a particular Medicare Audit Activity. The information
contained in workpapers constitutes the principal record of the work that the auditor
has done and the conclusions that the auditor reached concerning significant matters.
B. General Content of Workpapers
Workpapers should ordinarily include documentation showing that:
• 	The work has been adequately planned and supervised. This includes
consideration of Medicare regulatory requirements and any other payers,
which are standard practice for Medicare Audit Activities.
• 	The evidence obtained, the procedures applied, and the testing performed have
provided sufficient, competent evidential matter to support the auditor's
conclusions.

C. Format of Workpapers
Ensure that the workpapers are prepared using the following standards.
Lead Workpaper:
The lead workpaper is the first workpaper in a group of supporting workpapers and
is a summary and results of the work that was completed. It provides support for the
conclusion that was reached on the issue being reviewed. Each group of supporting
workpapers shall have a lead workpaper.
Start each lead workpaper, whether manually or electronically prepared, with the
basic mechanical foundation containing:
• 	Provider name, number, and cost reporting period.
• 	Preparer's signature or initials (once the workpaper is complete).
• 	Date the work was performed (once the workpaper is complete).
• 	Proper heading (title of workpaper), giving basic content of the workpaper.
• 	Contain evidence of supervisory review of the work including initials and date
the supervisory review was completed;
• 	Workpaper Number, Index, or Reference – Where the workpapers are
prepared electronically and the summary (lead) workpaper file includes tabs
which contain supporting workpapers, each supporting workpaper included in
each tab shall also contain a workpaper number or reference. For example, if
the summary/lead workpaper is M-1, and there are supporting workpapers M-
1a and M-1b, those two supporting workpapers and tabs shall display the M-
1a and M-1b references. Additionally, because paper copies of the
workpapers are used for various purposes (e.g., appeals, court cases, external
reviews), the workpaper numbers or references shall be visible on each hard
copy of a workpaper (including all tabs) printed from the electronic files.
• 	Purpose – A brief description of the work to be done on the workpaper and the
objective to be achieved (e.g., a comparison of the contractor’s PS&R with the
as-submitted settlement data to validate the provider's claimed Medicare
statistics).
• 	Source of Information – This informs the reviewer where the information used
on the workpaper was obtained. The source shall:

- 	Include the exact name of the document used during the review such as
“Revenue & Usage Report.”
- 	Include if the document was prepared by the provider (PBP-Prepared by
Provider or PWP-Provider Workpaper) or contractor including a MAC’s
subcontractor (PBM-Prepared by MAC).
- 	If the source is an interview, the workpaper shall include the name,
department, title, phone number and email address of the person being
interviewed along with the date, time, and location of the interview.
- 	The source can be in the form of cross-referencing to the MCR, financial
statements, Permanent File, or other workpapers. Cross-referencing is
especially important because it enables the reviewer to see at a glance
exactly where an amount, number etc. comes from. Cross-referencing
requires both a “to” and “from” for the item, workpaper, or amount
referenced and must be obvious and easily noticeable to anyone reviewing
the workpaper. Copies, or if appropriate samples, of the information/
documents examined shall be retained in the workpapers.
• 	Scope of Work – The scope is a listing/description of each step to be
completed on the workpaper and allows a reviewer to determine if an
adequate test was performed to meet the objectives of the purpose as stated on
the workpaper.
• 	Findings – Findings are a detailed explanation of steps that were taken to
arrive at the conclusion. Findings are based on the scope of the workpaper
and are in logical sequence from start to finish. Findings are often in
paragraph form.
• 	Explanation of Tick Marks – Use tick marks to explain and cross-reference
the work performed.
• 	Conclusion – When a workpaper is complete, the contractor shall state
conclusions covering the results of the findings.
- 	Example 1 – No exceptions were noted in the test; therefore, the as-
submitted number of full time equivalent (FTE) residents used for GME
payment is accepted.
- 	Example 2 – Exceptions were noted in the number of FTE residents used
for the GME payment. Adjustment 3 is proposed to correct the as-

submitted GME number of FTEs.
Supporting Workpapers:
Supporting Workpapers supplement the lead workpaper and often include narrative
or a document supporting a finding on the lead workpaper. The workpaper number,
index, or reference of a supporting workpaper is an extension of the lead workpaper
index.
Furthermore, all workpapers shall include:
• 	Provider name, number, and cost reporting period.
• 	Preparer's signature or initials (once the workpaper is complete).
• 	Date the work was performed (once the workpaper is complete).
• 	Proper heading (title of workpaper), giving basic content of the workpaper.
• 	Contain evidence of supervisory review of the work including initials and the
date the supervisory review was completed.
• 	Contain sufficient information so that supplementary oral explanations are not
required.
• 	Be legible, complete, and accurate in order to provide proper support for
findings, judgments, conclusions, and to document the nature and scope of the
work conducted. When the workpapers are prepared electronically, the
contractor shall use font size which will be readable when the workpapers are
printed.
• 	Include summaries and lead schedules, as appropriate.
• 	Contain adequate indexing and cross-referencing to the review program, lead
summaries, and Adjustment Report. Each desk review and/or audit step that is
initialed on the applicable program shall contain a reference to the “specific”
workpaper on which this step was addressed. It is not acceptable to just
reference the general workpaper series for an area under each audit step for
that area. For example, include a reference to a specific workpaper under the
review step pertaining to an area/issue, do not draw a vertical line from that
reference through all other audit steps for that area unless all the audit work
for all those audit steps was actually detailed on that workpaper.

• 	Restrict information to matters that are materially important and relevant to
the stated objectives of the review.
• 	Include an index to workpapers for ease of reference. The contractor shall
ensure that the references on the “listing” of electronic files (which also
serves as the Index) match the references on the related workpapers contained
in the file(s).
• 	Include the review program. However, do not retain pages of a standard
review program that are not applicable to the specific review. If, for some
reason, the review steps from the standard review program that were not
applicable are included in the contractor’s specific review program, mark
them “N/A” with an explanation instead of leaving them unmarked. For
example, if the bad debt review program is included in the workpapers but the
provider did not claim bad debts, the auditor could include “N/A-Provider did
not claim Medicare bad debts.”
D. Ownership and Custody of the Workpapers:
Workpapers are the property of CMS and the contractor. The rights of ownership,
however, are subject to ethical limitations relating to the confidential relationship
with providers.
The contractor shall adopt reasonable procedures for safe custody of workpapers in
the field as well as in the contractor’s office in accordance with the Health Insurance
Portability and Accountability Act (HIPAA) and retain them for a sufficient period of
time to meet the needs of the contractor’s operation and to satisfy legal requirements
of record retention.
When requested, the contractor shall send original hardcopy or electronic
workpapers to the appropriate CMS component or CMS’ designated agent for review.
E. Digitized (Electronic) Workpapers and Electronic Document Management
Systems
In today’s environment, workpapers are typically prepared electronically and stored
in an electronic document system. The contractors have a wide variety of digitized
electronic workpaper vendors and electronic document systems to choose from.
Workpapers sent to CMS shall be capable of being opened in one of the following:
Adobe Portable Document Format (PDF), Microsoft Word, or Microsoft Excel.
Hyperlinks included in electronic workpapers shall include a cross reference to the
applicable workpaper.

61.5 	– Documentation Standards
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
Documentation that the evidence obtained, procedures applied, and tests performed
provide sufficient, competent, and relevant evidence to support the auditor’s opinions,
judgments, conclusions, or recommendations is essential. After obtaining and testing the
various types of evidence (e.g., invoices, bills, contracts, statistics such as the FTE
number of interns and residents) considered necessary in the circumstances, retain at least
a representative sample of such evidence. If only a sample of the evidence for each area
is retained, refer to the evidence not retained and its relationship to the basis for the
opinions, judgments, conclusions, or examinations.
Where adjustments are made, auditors should include copies of the provider documents
that were reviewed in the workpapers in determining the amount of adjustment. For those
documents where copies are not available, auditors may meet GAAS requirements by
documenting the means of identification. Where adjustments were not made, auditors
shall include in the workpapers copies of a representative sample of documents
examined. Where materiality is a factor, define "materiality" within the scope and
objective of the contractor’s review.
61.6 	– Supervision During the Review Process
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
GAS, Chapter 8 “Fieldwork Standards for Performance Audits,” Paragraph 8.88
“Supervision” states: "Audit supervision involves providing sufficient guidance and
direction to auditors assigned to the audit to address the audit objectives and follow
applicable requirements, while staying informed about significant problems encountered,
reviewing the work performed, and providing effective on-the-job training."
A. Staff Supervision
The contractor shall provide constant direct supervision of staff by a qualified supervisor
to ensure that the Medicare Audit Activity is completed in accordance with the audit work
plan. Supervision is required so that each team member understands the objective of each
activity, how to perform and document the completion of the procedure in the
workpapers, and how to evaluate the audit evidence. The contractor shall establish
procedures to ensure the staff supervision activities are distinct from the responsibilities
of individuals who plan and manage the work.

Also, the contractor shall establish policies and procedures to provide reasonable
assurance that persons who are assigned to perform Medicare Audit Activities have the
degree of technical training and competence required for the circumstances.
Assure that the policies and procedures for planning, performance, and supervision of
Medicare Audit Activities meet audit standards of quality.
The contractor shall assure that the policies and procedures for planning, performance,
and supervision meet the GAS standards of quality. The contractor shall provide
procedures for planning individual Medicare Audit Activities in accordance with
Medicare instructions, such as:
• 	The determination of staffing requirements and the need for specialized
knowledge; and
• 	The development of estimates of time required to complete each activity.
The contractor shall also provide guidelines for maintaining standards of quality for
work, such as:
• 	Guidelines for the form and content of workpapers;
• 	Procedures for resolving differences of professional judgment among team
members; and
• 	Standard forms, checklists, and questionnaires appropriate to assist in the
performance of the activities.
Furthermore, the contractor shall provide procedures for reviewing workpapers and
reports.
B. Hiring
The contractor shall prepare staff job descriptions and policies and procedures for hiring
to provide reasonable assurance that those employed are able to perform Medicare Audit
Activities competently. The contractor shall:
• 	Plan for staffing needs at all levels;
• 	Establish quantified hiring objectives based on current workload, anticipated
changes in workload, staff turnover, individual advancement and retirement,
and current Medicare budget; and
• 	Establish qualifications and guidelines for evaluating potential hires at each

professional level.
C. Advancement
The contractor shall establish policies and procedures for advancing staff to provide
reasonable assurance that those selected for advancement have the qualifications
necessary for fulfillment of the responsibilities assigned. The contractor shall:
• 	Specify qualifications deemed necessary for the various levels of
responsibility within its Medicare Audit and Reimbursement department; and
• 	Evaluate the performance of personnel and periodically advise staff of their
progress. Maintain personnel files containing documentation relating to the
evaluation process.
D. Supervisory Review Standards for Workpapers
The workpapers and associated files (e.g., permanent file) are the only evidence of the
procedures the contractor performed to support the decision on the accuracy of the final
settled MCR.
An element of supervision is a thorough supervisory review of the workpapers. This may
require several levels of review, depending on the size and configuration of the
organization. For example, in a larger organization, the in-charge auditor may be
responsible for reviewing the work of other auditors on the team, and an independent
supervisor reviews all work performed. While the ideal situation would have this second
level review performed by an audit supervisor, the individual performing that function
need not have that title. Rather, the individual may be a highly qualified senior auditor
who is not part of the team performing the audit. In addition, a manager may also perform
a subsequent higher- level review of the completed work.
The contractor’s responsibility to review the workpapers includes work performed by all
the contractor’s employees and subcontractors, if applicable, regardless of the
arrangements under which the work is performed. The contractor cannot delegate the
responsibility to perform independent review of a subcontractor even if the subcontractor
is another MAC.
The supervisory review also satisfies the audit standards requirement for due professional
care in performing the Medicare Audit Activity. The first level of defense to ensure the
quality of the workpapers is the supervision of the Medicare Audit and Reimbursement
staff. The second level of defense to ensure the quality of the workpapers is the
supervisory review. No improvement in the quality of the work will occur unless
management recognizes the importance of the workpaper review, as the second most

important line of defense in maintaining quality workpapers. Proper supervisory review:
• 	Ensures that the Medicare Audit Activity is completed in accordance with the
work plan;
• 	Minimizes contradictions within the workpapers;
• 	Minimizes inappropriate or inaccurate interpretation of Medicare policies; and
• 	Assists in the evaluation and development of staff.
The contractor shall give the supervisory reviewer adequate time to complete a
competent review. No matter how knowledgeable the reviewer is, the effectiveness of the
review is directly proportionate to the time spent on the review. The reviewing supervisor
must have sufficient knowledge and understanding of the following:
• 	Medicare laws, regulations, and payment policies;
• 	Medicare cost reporting requirements;
• 	GAS and the AICPA Statements on Auditing Standards (SAS); and
• 	Provider accounting procedures.
E. General Approach to Supervisory Review of Workpapers
The reviewing supervisor shall:
• 	Be critical and not perfunctory;
• 	Be methodical, careful, and thorough;
• 	Ensure that the workpapers support the objectives previously defined;
• 	Question the stated conclusions and be able to arrive at the same conclusions,
based on the evidence presented on the workpapers; and
• 	Have a clear understanding of the requirement that all information on the
MCR be accurate even if there may not be a current reimbursement impact.
F. 	Specific Points in the Supervisory Review of Workpapers
While the following points are not all-inclusive, the reviewing supervisor shall:
• 	Obtain an overall understanding of the provider by reviewing its

correspondence file, permanent file, financial statements, and as-submitted
MCR;
• 	Understand the work plan as determined by the review program and the
resulting scope of review, as detailed in the review program;
• 	Discuss the review with the in-charge auditor to determine areas in which the
auditors had problems;
• 	Ensure that the work plan is completed;
• 	Ensure that decisions to defer review steps identified in the initial audit scope
are adequately documented;
• 	Ensure that the workpapers meet the mechanical and analytical requirements
for quality workpapers;
• 	Ensure that Medicare payment policies are properly interpreted;
• 	Ensure that conclusions are supported by sufficient, competent, and relevant
evidential matter;
• 	Ensure that conclusions drawn from the review procedures are supported by
the work performed;
• 	Ensure that the provider has been advised of proposed adjustments and given
sufficient time to respond;
• 	Ensure that all the retained adjustments are incorporated in the Adjustment
Report;
• 	Ensure that all adjustments included in the Adjustment Report trace to the
NPR or Revised Notice of Program Reimbursement (RNPR);
• 	Ensure that the aggregate of all adjustments passed as immaterial do not have
a significant impact on Medicare payment;
• 	Test calculations which have a direct impact on Medicare payment;
• 	Ensure areas which require more in-depth review in the subsequent year are
adequately documented;
• 	Ensure that notes for future audits are prepared and included in the permanent

reference file;
• 	Prepare review notes;
• 	Make a final check of the workpapers after the review notes are cleared;
• 	Confirm that unnecessary papers are deleted from the workpaper file;
• 	Retain supervisory review notes in the workpapers; and
• 	Every workpaper shall include evidence of supervisory review by inclusion of
the reviewer’s name or initials and date the workpaper was reviewed.
70 – Reporting Standards
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
70.1 – Content and Structure of the Medicare Cost Report Audit Report
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
Complete the audit report on the contractor’s letterhead specifying the name of the
provider or provider complex whose MCR was audited. Include the provider and
subprovider numbers for all components reported on the MCR for the provider complex.
Also, include one NPR for the entire complex, identifying the provider/subprovider
component name, number, and cost reporting period.
In preparing the Medicare Cost Report audit report, the contractor shall:
• 	Ensure that the audit report complies with GAS, Chapter 6, Paragraphs 6.50
through 6.52 entitled “Presenting Findings in the Audit Report”;
• 	Incorporate statements of positive and negative assurance for compliance with
Medicare laws, regulations and instructions;
• 	Designate those individuals authorized to sign such reports;
• 	Incorporate statements referring to the contractor’s consideration of the
provider's internal control structure in planning substantive audit tests;
• 	Ensure that the audit report contains the following elements:
- 	A statement that the contractor audited the provider's Medicare Cost
Report;

- 	A statement that the audit was conducted in accordance with GAS;
- 	A statement that those standards require the contractor to plan and perform
the audit to obtain reasonable assurance about whether the MCR reflects
payment amounts and financial data in accordance with Medicare laws,
regulations, and instructions;
- 	A statement that the Medicare provider is responsible for compliance with
Medicare laws, regulations, and instructions.
- 	Reference the Medicare Cost Report Adjustment Report.
• 	Refer to areas selected for audit. Any area selected for in-house or field audit
shall be listed.
• 	Include a listing of the applicable internal control policy and procedure
categories, as they affect Medicare payment.
Use Exhibits VIX.A and VIX.B in §170 of this Chapter as an example of a Medicare audit
report, including the report on the consideration of the internal control structure of the
provider.
Edit the audit report to fit the particular circumstances of the audit. For example, if the
contractor decided that a review of a provider's system of internal control was not
applicable, use one of the alternative paragraphs to explain the basis for this decision. In
this situation, the language pertaining to a review of internal control would not be
applicable and shall not be included in the contractor’s audit report to the provider.
Conversely, if the contractor did perform a review of internal control, do not use the
alternative paragraphs. Instead, use the language pertaining to the review of internal
control system as appropriate.
70.2 – Form of Report if Medicare Cost Report was not Audited
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
If the MCR has been settled without audit, issue a report as part of the Medicare Cost
Report final settlement. Use Exhibit X in §170 of this Chapter as a sample.

70.3 – Reporting of Indications of Illegal Acts
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
Illegal acts would consist of fraud or abuse against the Medicare program. Unless
instructed by CMS, do not issue a report for any Medicare Audit Activity where illegal
acts or indications of illegal acts are discovered, and a fraud or abuse referral is made to
CMS. Office of the Inspector General (OIG) will notify the contractor in writing of the
content of the report to be used. However, issue a report in situations where for several
years the contractor has made recurring adjustments, notified the provider, and has
referred the situation to OIG.
70.4 - Audit Adjustment Report
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
The Adjustment Report is a complete listing, presented in a logical order (e.g., Worksheet
S, A, B, etc.), of adjustments arising from the contractor’s examination of the MCR. It
contains the description of each adjustment in sufficient detail to explain the provider’s
noncompliance, the adjustment amount, the workpaper on which the adjustment was
proposed, the Regulation and/or CMS Manual reference supporting the adjustment, and
the MCR reference where the adjustment is to be applied to the revised MCR.
Ensure that the Adjustment Report is prepared in the format of the sample report shown in
Exhibit VII in §170 of this Chapter.
70.5 – NPR/RNPR Package –Medicare Cost Report and All Related
Documents
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
The contractor shall issue a Notice of Program Reimbursement or Revised Notice of
Program Reimbursement Letter to the provider that includes the following information
per 42 CFR 405.1803 and PRM 15-1, §2905:
• 	The contractor's determination of total program reimbursement due to or
from the provider for the reporting period covered by the as-submitted or
amended cost report.
• 	This determination is based on the provider's claimed total program
reimbursement due the provider for this period, amounts arrived at in the
settlement determination, and any underpayment or overpayment made to the
provider.

• 	The contractor's final determination of the total amount of reimbursement due
to or from the provider.
• 	The contractor’s final determination for purposes of any future appeal rights.
Maintain the following documents (as applicable) related to the MCR and Medicare
audit/no audit report(s) in the contractor’s files. Also, send the NPR and RNPR
packages that includes all the relevant documents detailed below to the provider at
the time the contractor settles the MCR.
• 	Transmittal letter to the provider;
• 	Initial Demand Letter, if applicable (See CMS Pub. 100-06, Chapter 3 and 4);
• 	NPR or RNPR Letter;
• 	Auditor's report(s) for the audit and, if applicable, for internal control structure
or a form of report where the MCR was settled without audit;
• 	Listing of areas selected for audit for initial NPR, as applicable;
• 	Listing of the relevant internal control policy and procedure categories, as
they affect Medicare payment, if applicable;
• 	Listing of reportable conditions and material weaknesses (only if reportable
conditions or material weaknesses were found);
• 	Management letter, if applicable;
• 	Cost report Adjustment Report;
• 	Audited or settled without audit MCR for an NPR; and
• 	Revised MCR for an RNPR.
The MACs shall upload the above information, if applicable, into the STAR system
within 30 days of issuing a final or revised final cost report settlement.
80 – Standards for Performing Medicare Audits Activities
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
When performing Medicare Audit Activities, comply with the standards outlined in this

Chapter. Although not exact, these standards reflect the GAS, Chapters 1 through 9.
These standards apply to all audit organizations, both government and nongovernmental
(e.g., public accounting firms), that conduct government audits, unless specifically
excluded. Specifically, the standards for performing Medicare Audit Activities apply to
both MACs and their subcontractors. The general standards applicable to Medicare Audit
Activities are:
• 	Ethics;
• 	Independence;
• 	Professional Judgment;
• 	Competence;
• 	Continuing Education and Training (CET);
• 	Due Professional Care; and
• 	Internal Quality Control.
80.1 – Ethics
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
GAS, Chapter 3 “Ethics, Independence, and Professional Judgment,” Paragraph 3.04
“Ethical Principles” states: “Performing audit work in accordance with ethical
principles is a matter of personal and organizational responsibility. Ethical principles
apply in preserving auditor independence, taking on only work that the audit
organization is competent to perform, performing high-quality work…"
In addition, Paragraph 3.06 “Ethical Principles” states: “The ethical principles that
guide the work of auditors who conduct engagements in accordance with GAGAS are
• 	the public interest;
• 	integrity;
• 	objectivity;
• 	proper use of government information, resources, and positions; and

• 	professional behavior.”
80.2 – Independence
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
Auditors must maintain both independence of mind and independence in appearance.
Independence ensures that auditors’ conclusions are impartial and not influenced by
personal or external interests. GAS, Chapter 3 “Ethics, Independence, and Professional
Judgment,” Paragraphs 3.18 and 3.19 “Independence” includes the following general
requirements of independence:
• 	“In all matters relating to the GAGAS engagement, auditors and audit
organizations must be independent from an audited entity.”
• 	“Auditors and audit organizations should avoid situations that could lead
reasonable and informed third parties to conclude that the auditors and audit
organizations are not independent and thus are not capable of exercising
objective and impartial judgment on all issues associated with conducting the
engagement and reporting on the work.”
Paragraph 3.22 “Independence” states: “Auditors and audit organizations maintain their
independence so that their opinions, findings, conclusions, judgments, and
recommendations will be impartial and will be viewed as impartial by reasonable and
informed third parties.”
The contractor shall establish policies and procedures to provide reasonable assurance
that all Medicare Audit Activities and reimbursement professional staff maintains their
independence so as not to impair, or appear to impair, the contractor’s independence in
carrying out its Medicare Audit Activity responsibilities.
See Exhibit XI in §170 of this Chapter for a sample of the Personal Impairments
Statement to be completed by each individual involved in the Medicare Audit Activities
to ensure that they are free of personal impairments. This statement can be completed by
each individual on an annual basis and be updated during the year if circumstances that
need to be disclosed arise.
80.3 – Professional Judgment
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
GAS, Chapter 3 “Ethics, Independence, and Professional Judgment,” Paragraph 3.109
“Professional Judgment” states: “Auditors must use professional judgment in planning

and conducting the engagement and in reporting the results.” Furthermore, Paragraph
3.110 includes: “Professional judgment includes exercising reasonable care and
professional skepticism.”
Professional skepticism includes:
• 	A questioning mind;
• 	A critical assessment of evidence (documentation); and
• 	Being alert to evidence (documentation) that contradicts other evidence
obtained or information that brings into question the reliability of documents
or responses.
80.4 – Competence
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
GAS, Chapter 4 “Competence and Continuing Professional Education,” Paragraph 4.03
“Competence,” states: “The audit organization’s management must assign auditors who
before beginning work on the engagement possess the competence needed for their
assigned roles.” In addition, Paragraph 4.04 includes “The audit organization should
have a process for recruitment, hiring, continuous development, assignment, and
evaluation of personnel so that the workforce has the essential knowledge, skills, and
abilities necessary to conduct the engagement.”
Competence includes the knowledge, skills, and abilities obtained from education and
experience and enables auditors to make sound professional judgments. It also includes
possessing the technical knowledge and skills necessary for the type of work being done.
80.1 – Continuing Education and Training (CET)
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
The contractor shall establish a program to ensure that its staff maintains professional
proficiency through CET.
The following represent the continuing education responsibilities of an audit
organization and also reflect additional guidance from CMS to help the contractor.
A. Education Required
CMS and GAS, Chapter 4 “Competence and Continuing Professional Education,”

Paragraph 4.16 “Continuing Professional Education” require that all persons
responsible for planning, directing, performing Medicare cost report engagement
procedures, or reporting on an engagement conducted in accordance with Generally
Accepted Government Auditing Standards (GAGAS) should develop and maintain their
professional competence by completing at least 80 hours of continuing education and
training (CET) every two years. For example, auditors who first start conducting
Medicare Audit Activities on January 1, 2026, shall complete the CET requirements
as follows:
• 	The first 80 hours shall be completed by December 31, 2027. Any excess over
the 80-hour requirement does not carry forward to the next two-year cycle.
• 	After CET requirements for the first two-year period (i.e., January 1, 2026, to
December 31, 2027 in the example) have been satisfied, a rolling count is
permissible for measuring compliance with the requirements. Under a rolling
count, compliance with the CET requirements is measured annually using the
two most recent years.
• 	At least 20 hours shall be completed in each year of the two-year cycle.
• 	At least 24 of the 80 hours shall be in subjects directly related to government
environment, to government auditing, or the specific or unique environment in
which the audited entity operates. Since the contractor operates in a specific
or unique environment, i.e., Medicare, it shall schedule the 24 hours of
training in subjects related to the Medicare government environment and
associated activities.
• 	Appropriate courses on Medicare and other health care related issues include,
but are not limited to, GAS, Medicare policy development (how it affects
Medicare Cost Report reviews), preparation and review of Medicare
workpapers, current Medicare audit and payment issues, the AICPA Audit and
Accounting Guide: Providers of Health Care Services, and CMS Medicare
Audit and Reimbursement training and webinars.
• 	For purposes of the 80-hour and the 24-hour requirements, CMS interprets the
term "conducting" and the phrase "conducting substantial portions of the field
work" as referring to those individuals who perform substantial portions of the
tests and procedures necessary to accomplish the audit objectives. An
individual is considered to be responsible for "conducting substantial portions
of the field work," for purposes of the CET requirements, when the following
conditions are met:

• 	On a given Medicare Audit Activity, the individual performs 20 percent or
more of the total work; or
• 	In a given year, the individual's chargeable time to government Medicare Audit
Activities is 20 percent or more of the individual's total chargeable time.
Staff who are involved in performing Medicare Cost Report engagement procedures,
but not involved in planning, directing, or reporting on an engagement conducted in
accordance with GAGAS and who charge less than 20 percent of their time to these
activities, are required to take 24 hours of government related CET in each two year
period. They are not required to comply with the 80-hour CET requirement.
Auditors who have been employed by the audit organization for less than one year of
a given two-year period are not required to complete a minimum number of CET
hours. However, entry-level auditors with less than one year with the audit
organization shall receive appropriate training during their first year with the audit
organization. Auditors employed by the audit organization for one year, but less than
two years, in a given two- year period, shall complete a minimum of 20 hours of CET
in the full calendar year. All auditors to whom the CET requirements for 80 hours
and 24 hours apply have two years to meet the requirements.
Terminated employees shall have been trained in accordance with the contractor’s
plan of training, at least until a formal notice of termination is received or issued.
Auditors who have not completed the required number of CET hours for any two-
year period for a legitimate reason will have the two months immediately following
the two-year period to make up the deficiency. Auditors shall make up any
deficiency in the 24-hour requirement first. The contractor shall not count any CET
hours completed towards a deficiency toward either the 20-hour requirement in the
year in which they are taken, or the 80-hour and the 24-hour requirements for the two-
year period in which they are taken.
B. Employees Covered Under the CET Requirement
Any auditor who is responsible for planning, directing, performing engagement
procedures for, or reporting on an engagement conducted in accordance with
GAGAS, including Medicare Audit Activities, is subject to the CET requirements. Also,
anyone whose decisions affect the outcome of government audits (Medicare Audit
Activities) is covered by CET requirements.
Since the contractor may use various types of employees to complete activities, the
following is CMS's interpretation of the applicability of CET requirements to certain

types of employees:
• 	Auditors (Including Audit Management) – CET requirements extend to
auditors and management who plan, direct, and/or perform portions of the
Medicare Audit Activities.
• 	Contract Auditors –When the contractor contracts with external firms for
Medicare Audit Activities or to provide audit staff to work under its
supervision, they are subject to the same requirements as the contractor. The
contractor shall require compliance with the CET requirements as a specific
condition of the subcontract. The contractor shall obtain written assurance
that each subcontractor employee meets the CET requirements prior to the
start of each Medicare Audit Activity.
• 	Temporary Auditing Staff – A temporary auditor who is hired for a very
limited timeframe, not to exceed one quarter at a time or in one year, under
the contractor’s direct supervision, is not subject to CET requirements.
• 	Crossover Staff – Staff members used in multiple functions shall meet the
CET requirements when their decisions could affect the outcome of Medicare
Audit Activities. For CET purposes, employees who are transferred to the
Medicare Audit and Reimbursement department are considered new hires, as
are employees who are promoted to a professional staff level.
• 	External Consultants and Internal Consultants and Specialists – External
consultants and internal consultants and specialists shall be qualified and shall
maintain their professional proficiency in their area of expertise and
specialization, but they are not required to meet CET requirements. For
example, attorneys the contractor employs, who work in the provider appeals
area, are not subject to the CET requirements, but they shall maintain their
professional proficiency.
• 	Clerical and Paraprofessional Staff – Clerical and paraprofessional staff,
including student interns, are not subject to the CET requirements.
The contractor shall review all position descriptions to ensure that they accurately
reflect the employees' duties and responsibilities. If the contractor has concerns or
questions on certain position descriptions, the contractor shall submit questions to
their BFL through their COR for a determination. These position descriptions will be
reviewed by CMS and the Office of the Inspector General (OIG) to determine the
need for compliance with the CET requirements.

C. Contractor Responsibility
The contractor shall establish and implement a program to ensure that the auditors
meet the CET requirements. The contractor shall:
• 	Prepare a general plan for training. Review and revise the plan, as appropriate,
and allocate resources to ensure that all staff subject to CET requirements
receive training.
• 	Implement the CET program to ensure that for every two-year period the 80-
hour and 24-hour requirements are met, and that at least 20 CET hours are
completed in each year of the two-year period.
• 	Retain course information for the contractor’s employees receiving CET
credit for contractor sponsored courses. Maintain records for a five-year
period from the completion of the two-year period. Maintain a record for each
employee which reflects:
- 	Record of participation;
- 	Course agenda;
- 	Course date(s);
- 	Location at which the course was given;
- 	Name(s) of instructor(s) and related training, education, and experience;
- 	Number of CET credit hours with field of study or subject matter; and
- 	Copy of course material presented.
• 	Retain course information for employees receiving CET credit for outside
courses. Maintain records for a five-year period from the completion of the
two-year period. Obtain a letter of completion or certificate, and retain a
record for each employee which reflects:
- 	Name of course;
- 	Course date(s);
- 	Location at which the course was given;
- 	Course sponsor; and

- 	Number of CET credit hours with field of study or subject matter.
• 	Submit to the contractor’s COR, an annual certification by January 31
following the close of any calendar year, stating that it was compliant with the
CET requirements.
D. General Guidelines for Training Courses
Continuing education and training may include such topics as current developments
in audit methodology, accounting, assessment of internal controls, principles of
management and supervision, financial management, statistical sampling, evaluation
design, and data analysis. It also includes subjects related to the auditors' specific
field of work. The contractor shall consider the following sources when developing a
training program for auditors:
• 	Recognition for Courses Needed for CPA Licensing – In meeting the overall
80-hour requirement, courses approved or recognized by the AICPA or the
respective state licensing board that contribute to the auditors' professional
proficiency are recognized for purposes of meeting the CET requirements.
• 	CMS-Sponsored Training – From time to time, CMS may contract with
vendors to provide training courses and will notify the contractor of their
availability. In addition, CMS may offer training in settings such as
conferences or webinar.
• 	Contractor-Sponsored Training – The contractor should obtain sponsorship
status for its training courses through its respective state CPA licensing board.
This will help to ensure that the courses will meet the CET requirements.
Also, the courses will be recognized for CPAs on the contractor’s staff that is
required to obtain continuing professional education credits for CPA
licensure. In the development of in-house training, the contractor shall
consider the AICPA's Statement on Standards for Continuing Professional
Education (CPE) Programs. While in-house training is recognized as the most
cost-efficient method of training, the contractor shall not rely solely on this
method.
• 	Credit Hours – A CET credit hour may be given for each 50 minutes of
participation in programs and activities that qualify. One-half CET hour
increments (equal to 25 minutes) may also be given after the first CET hour
has been earned in a given program or activity. For example, two 90-minute,
two 50- minute, and three 40-minute presentations equal 400 minutes or eight
CET hours. When the total minutes of a presentation are more than 50, but not

equally divisible by 50, the CET hours shall be rounded down to the nearest
one-half hour.
A conference in which individual segments may be less than 50 minutes is
counted as one program, rather than several short programs. The total minutes
of all segments will be divided by 50 minutes in order to determine the CET
hours for the program.
For a college or university course, each unit of credit earned on a semester
system will equal 15 CET hours. Each unit of credit earned on a quarterly
system will equal 10 CET hours.
• 	Credit for Instructor Preparation Time – When an instructor or discussion
leader serves at a program for which participants receive CET credit, and is at
a level that increases professional competence, the contractor shall give CET
credit for preparation and presentation time measured in terms of credit hours.
For the first time a program is presented, CET hours will be received for
actual preparation time, up to two times the class hours. For example, if a
course is rated as eight CET hours, the instructor shall receive up to 24 hours
of CET credit (16 hours for preparation and eight hours for class time). For
repeated presentations, the instructor shall receive no credit unless the subject
matter has changed sufficiently to require additional study or research. In
addition, the maximum credit for preparation shall not exceed 50 percent of
the total CET credit an instructor or discussion leader accumulates in a two-
year CET reporting period.
• 	Self-Study Programs – Self-study programs that may receive CET credit must
include instructional strategies that clearly define learning objectives, guide
the participant through a program of learning, and provide evidence of a
participant’s satisfactory completion of the program.
E. Staff Qualifications
Qualifications for staff members conducting Medicare Audit Activities include:
• 	A knowledge of the methods and techniques applicable to Medicare Audit
Activities, and the education, skills, and experience to apply such knowledge
to the review being conducted;
• 	A knowledge of the Medicare program;
• 	Skills to communicate clearly and effectively, both orally and in writing; and

• 	Skills appropriate for the Medicare Audit Activity work being conducted.
80.2 – Due Professional Care
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
In addition to the standards included in GAS, CMS also requires that the audit
organization use due professional care when conducting Medicare Audit Activities
and preparing related reports.
CMS places responsibility on the contractor and its auditors to follow all applicable
standards in conducting Medicare Audit Activities.
Exercising due professional care means using sound professional judgment in
establishing the scope, selecting the methodology, and choosing tests and procedures
for the Medicare Audit Activities. Follow the same judgment in conducting the tests
and procedures for the Medicare Audit Activities and in evaluating and reporting on
the results from these activities.
A. Materiality and Significance
In planning Medicare Audit Activities, selecting the methodology, and designing audit
tests and procedures, consider materiality and significance. Communicate to the
contractor’s audit staff the contractor’s quantifiable parameters for materiality and
significance.
B. Relying on the Work of Others
See §61.1 of this Chapter for discussion on reliance on the work of other auditors.
C. Audit Follow-Up
Due professional care also includes follow-up on findings and recommendations from
previous audits that could have an impact on the current objectives. Determine
whether prompt and appropriate actions have been taken on findings and
recommendations by provider officials or other appropriate organizations. Pay special
attention to how the provider implemented recommendations the contractor may have
given in a prior year regarding nonallowable costs or items.
D. Audit Scope Impairments
For all Medicare Audit Activities, auditors shall consider whether audit scope
impairments adversely affect their ability to conduct the Medicare Audit Activity in
accordance with standards outlined within this Chapter. Audit scope impairments are
factors external to the audit organization that can restrict the auditor's ability to render

objective opinions and conclusions.
80.3 – Internal Quality Control
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
CMS also requires the audit organization to have an appropriate internal quality
control system in place and to participate in an external quality control review
program.
CMS requires that contractors shall establish an internal quality control program and
provide reasonable assurance that the contractor’s Medicare Audit and
Reimbursement department:
• 	Has established, and is following, adequate audit and reimbursement policies
and procedures; and
• 	Has adopted, and is following, applicable auditing standards.
A. External Quality Control Review (Review of the Internal Quality Control
System)
In accordance with §30.8A in Chapter 7 of this manual, the Contractor shall contract
with an independent certified public accounting (CPA) firm to perform a SSAE 18
SOC 1, Type II audit which includes a review of the internal control process. (Also,
see Pub. 100-06, Chapter 7, §50.9, Control Objective I.10 (Provider Audit - Internal
Control Process).) Any tests of the contractor’s internal quality control system shall
evaluate:
• 	The existence of such a system;
• 	Compliance with the system; and
• 	The effectiveness of the system.
B. Establishment of an Internal Quality Control System
Establish internal quality control policies and procedures for the contractor’s
Medicare Audit and Reimbursement department (i.e., all Medicare audit and
reimbursement related activities). Communicate these policies and procedures to
Medicare Audit and Reimbursement personnel. While the objective of internal quality
control systems is always the same, the nature and extent of such systems can vary
based on a number of factors. Normally, documentation of internal quality control
policies and procedures would be expected to be more extensive in a larger contractor

than a smaller contractor, and more extensive in a multi-office contractor than in a
single- office contractor. Therefore, in developing such a system, the contractor shall
consider the following factors:
• 	The size of its Medicare Audit and Reimbursement department;
• 	The degree of operating autonomy allowed to its personnel and audit offices;
• 	The nature of its work;
• 	Its organizational structure; and
• 	The cost effectiveness of an internal quality control system.
C. Elements and Application of Elements of Internal Quality Control
In addition to the other elements of GAS included in §80.0 of this Chapter, consider
each of the elements of internal quality control policies and procedure that are
included in the AICPA Statements of Quality Management Standards, to the extent
applicable to the contractor’s operating environment, and in establishing the
contractor’s internal quality control policies and procedures.
The following elements of internal quality control relate and shall be applied to the
Medicare environment:
1) Acceptance and Continuance (Fraud and Abuse)
The usual considerations for acceptance and continuance of clients of CPA firms are
not applicable to the Medicare Audit Activity environment. Although the nature of the
relationship with the Medicare Audit Activity subject is materially different from that
experienced by a CPA firm, there is equivalent concern with a Medicare Audit
Activity in which fraud and abuse is suspected.
Accordingly, make a full and immediate disclosure in accordance with the MAC’s
Statement of Work (SOW) Section C.5.13 of suspected or detected fraud, abuse, illegal
acts, or material misstatements or misrepresentations on the part of any provider,
other organization or individual.
2) Inspection
Establish policies and procedures for inspection to provide reasonable assurance that
the procedures relating to the other elements of internal quality control are being
effectively applied. Monitor the effectiveness of inspection policies and

procedures.Develop the procedures for inspection and ensure that inspections are
performed by individuals acting on behalf of the contractor’s management. The
contractor shall:
• 	Prepare instructions and review programs for use in conducting inspection
activities;
• 	Establish frequency and timing of inspection activities and criteria for
selection of engagements; and
• 	Provide for reporting inspection findings to the appropriate management
levels and for monitoring actions taken or planned.
80.4 – Competence
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
GAS, Chapter 4 “Competence and Continuing Professional Education,” Paragraph
4.03 “Competence,” states: “The audit organization’s management must assign
auditors who before beginning work on the engagement possess the competence
needed for their assigned roles.” In addition, Paragraph 4.04 includes “The audit
organization should have a process for recruitment, hiring, continuous development,
assignment, and evaluation of personnel so that the workforce has the essential
knowledge, skills, and abilities necessary to conduct the engagement.”
Competence includes the knowledge, skills, and abilities obtained from education and
experience and enables auditors to make sound professional judgments. It also
includes possessing the technical knowledge and skills necessary for the type of work
being done.
80.5 – Continuing Education and Training (CET)
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
The contractor shall establish a program to ensure that its staff maintains professional
proficiency through CET.
The following represent the continuing education responsibilities of an audit
organization and also reflect additional guidance from CMS to help the contractor.
F. 	Education Required
CMS and GAS, Chapter 4 “Competence and Continuing Professional Education,”

Paragraph 4.16 “Continuing Professional Education” require that all persons
responsible for planning, directing, performing Medicare cost report engagement
procedures, or reporting on an engagement conducted in accordance with Generally
Accepted Government Auditing Standards (GAGAS) should develop and maintain their
professional competence by completing at least 80 hours of continuing education and
training (CET) every two years. For example, auditors who first start conducting
Medicare Audit Activities on January 1, 2026, shall complete the CET requirements
as follows:
• 	The first 80 hours shall be completed by December 31, 2027. Any excess over
the 80-hour requirement does not carry forward to the next two-year cycle.
• 	After CET requirements for the first two-year period (i.e., January 1, 2026, to
December 31, 2027 in the example) have been satisfied, a rolling count is
permissible for measuring compliance with the requirements. Under a rolling
count, compliance with the CET requirements is measured annually using the
two most recent years.
• 	At least 20 hours shall be completed in each year of the two-year cycle.
• 	At least 24 of the 80 hours shall be in subjects directly related to government
environment, to government auditing, or the specific or unique environment in
which the audited entity operates. Since the contractor operates in a specific
or unique environment, i.e., Medicare, it shall schedule the 24 hours of
training in subjects related to the Medicare government environment and
associated activities.
• 	Appropriate courses on Medicare and other health care related issues include,
but are not limited to, GAS, Medicare policy development (how it affects
Medicare Cost Report reviews), preparation and review of Medicare
workpapers, current Medicare audit and payment issues, the AICPA Audit and
Accounting Guide: Providers of Health Care Services, and CMS Medicare
Audit and Reimbursement training and webinars.
• 	For purposes of the 80-hour and the 24-hour requirements, CMS interprets the
term "conducting" and the phrase "conducting substantial portions of the field
work" as referring to those individuals who perform substantial portions of the
tests and procedures necessary to accomplish the audit objectives. An
individual is considered to be responsible for "conducting substantial portions
of the field work," for purposes of the CET requirements, when the following
conditions are met:

• 	On a given Medicare Audit Activity, the individual performs 20 percent or
more of the total work; or
• 	In a given year, the individual's chargeable time to government Medicare Audit
Activities is 20 percent or more of the individual's total chargeable time.
Staff who are involved in performing Medicare Cost Report engagement procedures, but
not involved in planning, directing, or reporting on an engagement conducted in
accordance with GAGAS and who charge less than 20 percent of their time to these
activities, are required to take 24 hours of government related CET in each two year
period. They are not required to comply with the 80-hour CET requirement.
Auditors who have been employed by the audit organization for less than one year of a
given two-year period are not required to complete a minimum number of CET hours.
However, entry-level auditors with less than one year with the audit organization shall
receive appropriate training during their first year with the audit organization. Auditors
employed by the audit organization for one year, but less than two years, in a given two-
year period, shall complete a minimum of 20 hours of CET in the full calendar year. All
auditors to whom the CET requirements for 80 hours and 24 hours apply have two years
to meet the requirements.
Terminated employees shall have been trained in accordance with the contractor’s plan of
training, at least until a formal notice of termination is received or issued.
Auditors who have not completed the required number of CET hours for any two-year
period for a legitimate reason will have the two months immediately following the two-
year period to make up the deficiency. Auditors shall make up any deficiency in the 24-
hour requirement first. The contractor shall not count any CET hours completed towards
a deficiency toward either the 20-hour requirement in the year in which they are taken, or
the 80-hour and the 24-hour requirements for the two-year period in which they are taken.
G. Employees Covered Under the CET Requirement
Any auditor who is responsible for planning, directing, performing engagement
procedures for, or reporting on an engagement conducted in accordance with GAGAS,
including Medicare Audit Activities, is subject to the CET requirements. Also, anyone
whose decisions affect the outcome of government audits (Medicare Audit Activities) is
covered by CET requirements.
Since the contractor may use various types of employees to complete activities, the
following is CMS's interpretation of the applicability of CET requirements to certain
types of employees:

• 	Auditors (Including Audit Management) – CET requirements extend to
auditors and management who plan, direct, and/or perform portions of the
Medicare Audit Activities.
• 	Contract Auditors –When the contractor contracts with external firms for
Medicare Audit Activities or to provide audit staff to work under its
supervision, they are subject to the same requirements as the contractor. The
contractor shall require compliance with the CET requirements as a specific
condition of the subcontract. The contractor shall obtain written assurance
that each subcontractor employee meets the CET requirements prior to the
start of each Medicare Audit Activity.
• 	Temporary Auditing Staff – A temporary auditor who is hired for a very
limited timeframe, not to exceed one quarter at a time or in one year, under
the contractor’s direct supervision, is not subject to CET requirements.
• 	Crossover Staff – Staff members used in multiple functions shall meet the
CET requirements when their decisions could affect the outcome of Medicare
Audit Activities. For CET purposes, employees who are transferred to the
Medicare Audit and Reimbursement department are considered new hires, as
are employees who are promoted to a professional staff level.
• 	External Consultants and Internal Consultants and Specialists – External
consultants and internal consultants and specialists shall be qualified and shall
maintain their professional proficiency in their area of expertise and
specialization, but they are not required to meet CET requirements. For
example, attorneys the contractor employs, who work in the provider appeals
area, are not subject to the CET requirements, but they shall maintain their
professional proficiency.
• 	Clerical and Paraprofessional Staff – Clerical and paraprofessional staff,
including student interns, are not subject to the CET requirements.
The contractor shall review all position descriptions to ensure that they accurately reflect
the employees' duties and responsibilities. If the contractor has concerns or questions on
certain position descriptions, the contractor shall submit questions to their BFL through
their COR for a determination. These position descriptions will be reviewed by CMS and
the Office of the Inspector General (OIG) to determine the need for compliance with the
CET requirements.
H. Contractor Responsibility

The contractor shall establish and implement a program to ensure that the auditors
meet the CET requirements. The contractor shall:
• 	Prepare a general plan for training. Review and revise the plan, as appropriate,
and allocate resources to ensure that all staff subject to CET requirements
receive training.
• 	Implement the CET program to ensure that for every two-year period the 80-
hour and 24-hour requirements are met, and that at least 20 CET hours are
completed in each year of the two-year period.
• 	Retain course information for the contractor’s employees receiving CET
credit for contractor sponsored courses. Maintain records for a five-year
period from the completion of the two-year period. Maintain a record for each
employee which reflects:
- 	Record of participation;
- 	Course agenda;
- 	Course date(s);
- 	Location at which the course was given;
- 	Name(s) of instructor(s) and related training, education, and experience;
- 	Number of CET credit hours with field of study or subject matter; and
- 	Copy of course material presented.
• 	Retain course information for employees receiving CET credit for outside
courses. Maintain records for a five-year period from the completion of the
two-year period. Obtain a letter of completion or certificate, and retain a
record for each employee which reflects:
- 	Name of course;
- 	Course date(s);
- 	Location at which the course was given;
- 	Course sponsor; and
- 	Number of CET credit hours with field of study or subject matter.

• 	Submit to the contractor’s COR, an annual certification by January 31
following the close of any calendar year, stating that it was compliant with the
CET requirements.
I. 	General Guidelines for Training Courses
Continuing education and training may include such topics as current developments in
audit methodology, accounting, assessment of internal controls, principles of
management and supervision, financial management, statistical sampling, evaluation
design, and data analysis. It also includes subjects related to the auditors' specific field of
work. The contractor shall consider the following sources when developing a training
program for auditors:
• 	Recognition for Courses Needed for CPA Licensing – In meeting the overall
80-hour requirement, courses approved or recognized by the AICPA or the
respective state licensing board that contribute to the auditors' professional
proficiency are recognized for purposes of meeting the CET requirements.
• 	CMS-Sponsored Training – From time to time, CMS may contract with
vendors to provide training courses and will notify the contractor of their
availability. In addition, CMS may offer training in settings such as
conferences or webinar.
• 	Contractor-Sponsored Training – The contractor should obtain sponsorship
status for its training courses through its respective state CPA licensing board.
This will help to ensure that the courses will meet the CET requirements.
Also, the courses will be recognized for CPAs on the contractor’s staff that is
required to obtain continuing professional education credits for CPA
licensure. In the development of in-house training, the contractor shall
consider the AICPA's Statement on Standards for Continuing Professional
Education (CPE) Programs. While in-house training is recognized as the most
cost-efficient method of training, the contractor shall not rely solely on this
method.
• 	Credit Hours – A CET credit hour may be given for each 50 minutes of
participation in programs and activities that qualify. One-half CET hour
increments (equal to 25 minutes) may also be given after the first CET hour
has been earned in a given program or activity. For example, two 90-minute,
two 50- minute, and three 40-minute presentations equal 400 minutes or eight
CET hours. When the total minutes of a presentation are more than 50, but not
equally divisible by 50, the CET hours shall be rounded down to the nearest
one-half hour.

A conference in which individual segments may be less than 50 minutes is counted as
one program, rather than several short programs. The total minutes of all segments will
be divided by 50 minutes in order to determine the CET hours for the program.
For a college or university course, each unit of credit earned on a semester system will
equal 15 CET hours. Each unit of credit earned on a quarterly system will equal 10 CET
hours.
• 	Credit for Instructor Preparation Time – When an instructor or discussion
leader serves at a program for which participants receive CET credit, and is at
a level that increases professional competence, the contractor shall give CET
credit for preparation and presentation time measured in terms of credit hours.
For the first time a program is presented, CET hours will be received for
actual preparation time, up to two times the class hours. For example, if a
course is rated as eight CET hours, the instructor shall receive up to 24 hours
of CET credit (16 hours for preparation and eight hours for class time). For
repeated presentations, the instructor shall receive no credit unless the subject
matter has changed sufficiently to require additional study or research. In
addition, the maximum credit for preparation shall not exceed 50 percent of
the total CET credit an instructor or discussion leader accumulates in a two-
year CET reporting period.
• 	Self-Study Programs – Self-study programs that may receive CET credit must
include instructional strategies that clearly define learning objectives, guide
the participant through a program of learning, and provide evidence of a
participant’s satisfactory completion of the program.
J. 	Staff Qualifications
Qualifications for staff members conducting Medicare Audit Activities include:
• 	A knowledge of the methods and techniques applicable to Medicare Audit
Activities, and the education, skills, and experience to apply such knowledge
to the review being conducted;
• 	A knowledge of the Medicare program;
• 	Skills to communicate clearly and effectively, both orally and in writing; and
• 	Skills appropriate for the Medicare Audit Activity work being conducted.

80.6 – Due Professional Care
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
In addition to the standards included in GAS, CMS also requires that the audit
organization use due professional care when conducting Medicare Audit Activities and
preparing related reports.
CMS places responsibility on the contractor and its auditors to follow all applicable
standards in conducting Medicare Audit Activities.
Exercising due professional care means using sound professional judgment in
establishing the scope, selecting the methodology, and choosing tests and procedures for
the Medicare Audit Activities. Follow the same judgment in conducting the tests and
procedures for the Medicare Audit Activities and in evaluating and reporting on the
results from these activities.
E. Materiality and Significance
In planning Medicare Audit Activities, selecting the methodology, and designing audit
tests and procedures, consider materiality and significance. Communicate to the
contractor’s audit staff the contractor’s quantifiable parameters for materiality and
significance.
F. 	Relying on the Work of Others
See §61.1 of this Chapter for discussion on reliance on the work of other auditors.
G. Audit Follow-Up
Due professional care also includes follow-up on findings and recommendations from
previous audits that could have an impact on the current objectives. Determine whether
prompt and appropriate actions have been taken on findings and recommendations by
provider officials or other appropriate organizations. Pay special attention to how the
provider implemented recommendations the contractor may have given in a prior year
regarding nonallowable costs or items.
H. Audit Scope Impairments
For all Medicare Audit Activities, auditors shall consider whether audit scope impairments
adversely affect their ability to conduct the Medicare Audit Activity in accordance with
standards outlined within this Chapter. Audit scope impairments are factors external to

the audit organization that can restrict the auditor's ability to render objective opinions
and conclusions.
80.7 – Internal Quality Control
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
CMS also requires the audit organization to have an appropriate internal quality control
system in place and to participate in an external quality control review program.
CMS requires that contractors shall establish an internal quality control program and
provide reasonable assurance that the contractor’s Medicare Audit and Reimbursement
department:
• 	Has established, and is following, adequate audit and reimbursement policies
and procedures; and
• 	Has adopted, and is following, applicable auditing standards.
D. External Quality Control Review (Review of the Internal Quality Control
System)
In accordance with §30.8A in Chapter 7 of this manual, the Contractor shall contract
with an independent certified public accounting (CPA) firm to perform a SSAE 18 SOC 1,
Type II audit which includes a review of the internal control process. (Also, see Pub. 100-
06, Chapter 7, §50.9, Control Objective I.10 (Provider Audit - Internal Control
Process).) Any tests of the contractor’s internal quality control system shall evaluate:
• 	The existence of such a system;
• 	Compliance with the system; and
• 	The effectiveness of the system.
E. Establishment of an Internal Quality Control System
Establish internal quality control policies and procedures for the contractor’s Medicare
Audit and Reimbursement department (i.e., all Medicare audit and reimbursement related
activities). Communicate these policies and procedures to Medicare Audit and
Reimbursement personnel. While the objective of internal quality control systems is
always the same, the nature and extent of such systems can vary based on a number of
factors. Normally, documentation of internal quality control policies and procedures
would be expected to be more extensive in a larger contractor than a smaller contractor,

and more extensive in a multi-office contractor than in a single- office contractor.
Therefore, in developing such a system, the contractor shall consider the following
factors:
• 	The size of its Medicare Audit and Reimbursement department;
• 	The degree of operating autonomy allowed to its personnel and audit offices;
• 	The nature of its work;
• 	Its organizational structure; and
• 	The cost effectiveness of an internal quality control system.
F. 	Elements and Application of Elements of Internal Quality Control
In addition to the other elements of GAS included in §80.0 of this Chapter, consider each
of the elements of internal quality control policies and procedure that are included in the
AICPA Statements of Quality Management Standards, to the extent applicable to the
contractor’s operating environment, and in establishing the contractor’s internal quality
control policies and procedures.
The following elements of internal quality control relate and shall be applied to the
Medicare environment:
3) Acceptance and Continuance (Fraud and Abuse)
The usual considerations for acceptance and continuance of clients of CPA firms are not
applicable to the Medicare Audit Activity environment. Although the nature of the
relationship with the Medicare Audit Activity subject is materially different from that
experienced by a CPA firm, there is equivalent concern with a Medicare Audit Activity in
which fraud and abuse is suspected.
Accordingly, make a full and immediate disclosure in accordance with the MAC’s
Statement of Work (SOW) Section C.5.13 of suspected or detected fraud, abuse, illegal
acts, or material misstatements or misrepresentations on the part of any provider, other
organization or individual.
4) Inspection
Establish policies and procedures for inspection to provide reasonable assurance that the
procedures relating to the other elements of internal quality control are being effectively
applied. Monitor the effectiveness of inspection policies and procedures. Develop the

procedures for inspection and ensure that inspections are performed by individuals acting
on behalf of the contractor’s management. The contractor shall:
• 	Prepare instructions and review programs for use in conducting inspection
activities;
• 	Establish frequency and timing of inspection activities and criteria for
selection of engagements; and
• 	Provide for reporting inspection findings to the appropriate management
levels and for monitoring actions taken or planned.
90 – Final Settlement of the Cost Report
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
Effective April 1, 2030, CMS requires contractors to settle (i.e., issue a NPR) all MCRs
that are not scheduled for audit within 18 months of acceptance of the original as-
submitted MCR unless there is a CMS approval and documented reason why the MCR
cannot be settled (e.g., bankruptcy, OIG investigation, DOJ investigation). Amended cost
reports that have been accepted by the contractor do not allow additional time for final
settlement; if not scheduled for audit, final settlement of an amended cost report is
considered timely if completed within 18 months after the acceptance date of the original
as-submitted cost report. Additionally, any settlement that has been delayed because a
prior year MCR is being audited, the settlement(s) will be considered timely if completed
within the greater of 18 months from acceptance of the original as-submitted MCR or six
months from the NPR date of the MCR that was audited.
Effective April 1, 2030, CMS requires contractors to settle (i.e., issue an NPR) all MCRs
selected for audit and on a CMS approved audit plan within 12 months after the audit
entrance conference date, and the entrance conference shall be held during the contract
year in which the audit is included on that contract year’s approved audit plan.
Additionally, contractors shall issue the NPR to the provider within 60 days of the exit
conference or within 60 days after the audit adjustments are finalized (using the
timeframes described in §60.6 of this Chapter) if an exit conference is waived.
As a general rule, if proper notification was given to the provider and adjustments were
proposed due to “lack of documentation” as described in 42 CFR 413.20 and 42 CFR
413.24, issue the NPR without considering documentation received from the provider
after the established timeframes unless there are circumstances that the contractor or
CMS has previously approved.

If the provider used the PS&R settlement data to file the MCR or the contractor
decides to use the PS&R data because the provider’s reported settlement data is not
documented properly, settle the MCR using a PS&R with a paid through date no
earlier than 120 days prior to the issuance of the final Adjustment Report. If an
adjustment report is not issued (e.g., there were no desk review exception resolution
process adjustments or field audit adjustments), use a PS&R with a paid through date
that is no earlier than 120 days prior to the NPR date. If the contractor settles the
MCR later than 18 months after the end of the provider’s fiscal year, use a PS&R with
a paid through date that is no earlier than 15 months after the end of the provider’s
fiscal year.
Note: For instances where the MAC utilizes the One-Click PS&R Summary, the
“PS&R Report Run Date” and the “Paid Claims Verified Current As Of” will be the
same. For instances where the “Paid Claims Verified Current As Of” is more recent
than the “PS&R Report Run Date”, this serves to confirm that the system has verified
that no further paid claims or adjustments have been received by PS&R for the
included dates of service, from the date the report was run until the Verified Current
As Of date. This indicates that these reports are still as current as a manual PS&R
report requested with Paid Dates through the date of the “Paid Claims Verified
Current As Of”.
The contractor is required to calculate and update the CCRs at final settlement into
the OPSF and PSF no later than 30 days after the date of issuance of the final
settlement following the steps in §10.5 of this Chapter.
Once the CCRs at final settlement are calculated, the contractor shall determine if an
outlier reconciliation is required prior to issuing the NPR. To determine if an outlier
reconciliation is required, contractors shall ensure all adjustments from Medicare
Audit Activities are included in the cost report and follow the outlier reconciliation
procedures identified in the applicable Chapter of CMS Pub. 100-04. If an outlier
reconciliation is required, the contractor shall place the NPR on hold and follow the
outlier reconciliation adjustment procedures identified in the applicable Chapter of
CMS Pub. 100-04. Effective with outlier reconciliation approvals received from CMS
on after January 1, 2027, the MAC shall complete the remaining steps in CMS Pub.
100-04 and issue the NPR within 90 days from the date the MAC received the outlier
approval from CMS if the settlement timeframes stated above have passed. If the 90-
day standard cannot be met due to extenuating circumstances, the MAC shall provide
an explanation to their DPAO BFL, through their COR, including an estimated
timeframe for settling the cost report.
The final settlement (NPR) package issued to the provider and uploaded to STAR

shall include the items identified in §70.5 of this Chapter. Additionally, MACs shall
include in the final settlement package, or under separate cover, a Notice of
Reopening for Finalized Home Office Costs (if applicable).
NOTE: Once the NPR has been issued, the contractor is prohibited from
revising/amending the date of the original revised NPR letter and revised MCR
without going through the reopening process.
90.1 – Submission of Settled Cost Report Data to CMS
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
Within 30 days after issuance of the NPR to the provider, the contractor shall submit to
CMS, through STAR, an extract of the MCRs identified in §10.4 of this Chapter in
accordance with the HCRIS specifications.
Consult the following HCRIS website link regarding the MCR submission requirements
for any other CMS cost report form not listed in §10.4 of this Chapter:
https://www.cms.gov/Research-Statistics-Data-and-Systems/Downloadable-Public-Use-
Files/Cost-Reports/?redirect=/CostReports/
Contractors are responsible for ensuring all MCRs and cost statements are loaded or
entered in STAR. Submissions shall pass all level one electronic cost report edits and all
STAR HCRIS Load Control reject edits. Home office cost statements are loaded or
manually entered in STAR but are not transmitted to HCRIS.
NOTE: The electronic CMS Form 287-22 is effective for home office cost statement
periods beginning on or after October 1, 2022.
HCRIS requires a submission of the cost report data for “Low” or “No Medicare
Utilization” providers. This submission is due within 30 days of the settlement of the
cost report.
The MCR data is contained in the HCRIS database at CMS and is updated on a quarterly
basis to the public on the CMS Website.
100 – Cost Report Reopenings
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
Instructions that describe the circumstances under which the final determination on an
MCR can be reopened are contained in 42 CFR 405.1885 and PRM 15-1, Chapter 29,
§§2931 and 2932. In accordance with these instructions, the contractor may reopen an
MCR if it receives a written request to reopen from the provider within three years of the

date that the NPR or RNPR was issued. If the reopening relates to a revised NPR, only
those issues adjusted in the revised NPR can be reopened. (See PRM 15-1, Chapter 29,
§2931.1ff for additional information regarding time limits for reopening.)
The contractor may also reopen an MCR within the three-year reopening period based on
the contractor’s own motion or at the request of CMS; the notice of reopening (NOR)
must be issued within three years from the date of the NPR or revised NPR. As stated
above, if the reopening relates to a revised NPR, only those issues adjusted in the revised
NPR can be reopened. However, if fraud or similar fault is involved, the contractor can
reopen the MCR at any time.
Effective with provider requested reopenings received on or after January 1, 2027, the
contractor shall issue an NOR and/or a notice of denial (NOD) to the provider in writing
within 90 days of receipt of a reopening request. If an NOR and/or NOD cannot be issued
within 90 days, the contractor shall document the reasonable justification for the delay.
An NOR does not guarantee that issues will be revised and included in a revised NPR, it
only holds the MCR open for review of those issues included in the NOR.
The following three reasons as to why the MCR is being reopened shall be included in all
NORs issued within the three-year reopening window except where noted:
1. 	To incorporate settlement amounts from the previous cost report settlement(s)
to ensure proper determination of payments, as necessary.
2. 	To ensure that all payments (including lump-sum, bi-weekly, and tentative
payments) to and from the provider are incorporated into the cost report, as
necessary.*
3. 	To address any cost report software updates and edits, mathematical and flow
items and carry forward amounts, as necessary.
*Note: NOR issue 2 above is not required for reopenings resulting from an Appeal
being resolved through Administrative Resolution.
A single or combined letter may be used as a notice of reopening of some issues and a
denial of other issues. However, ensure that all issues that will be reopened and all issues
that will be denied are listed in the written reopening notice. Where the contractor denies
the reopening request for any or all issues, include in the written notification to the
provider detailed reasons for the rejection. Such reasons could include:
• 	Untimely request, with an indication of the dates and documents being used in
the determination.

• 	Incomplete request, with an explanation of why it was determined to be
incomplete.
• 	Criteria for reopening not met, with an explanation of why the criteria were
not met.
During its review of the reopening issues, the contractor, at a minimum, shall complete
the relevant and applicable limited desk review steps and/or audit steps from the latest
CMS-approved Desk Review Program and/or Audit Program (for the provider type) and
document these steps in the scope of the workpaper. In addition, the contractor shall
ensure the relevant and applicable settlement steps are completed and documented in the
reopening workpapers to support any adjustments made for the three issues required to
be included in the NOR as noted above. For example, support for prior settlement
payments that were included as reopening adjustments to W/S E-1.
Where the contractor grants a provider’s reopening request and discovers that additional
information is still needed, whether before or after the three-year reopening period
expires, send a written notice to the provider requesting that the needed
information/documentation be submitted within two weeks of the date of the initial
request; the due date for subsequent requests are determined by the MAC. Additionally,
timeframes for the initial and subsequent requests may be extended beyond two weeks,
not to exceed 60 days, at the MAC discretion. If the provider fails to submit the requested
information, the contractor may close the reopening and issue a letter stating the
reopening is denied.
The contractor shall also send the provider a written reopening notice detailing the issues
when reopening the MCR on the contractor’s own motion or at CMS’ request. When
reopening the MCR at CMS’ request, do not state in the NOR that the reopening issues
generated from a CMS’ Quality Assurance Surveillance Plan (QASP) review; instead,
each issue in the NOR shall be specific to what is being reopened and reviewed. An NOR
shall be issued when resolving issues that are under appeal. The appeal issues resolved
shall be specifically identified in the NOR instead of stating the reopening is to effectuate
an Administrative Resolution. If necessary, the contractor shall send a written notice to
the provider requesting that the needed information be submitted within a specified time
(generally within 60 days of the request). If the provider fails to submit the requested
information, adjust the MCR accordingly.
Whenever the contractor issues an NPR for a provider that is part of a chain before the
HOCS is finalized, include an NOR in the NPR package to adjust to the finalized HOCS.
However, the contractor shall not issue such a reopening notice to a provider that is paid
entirely under PPS. When the HOCS is finalized, close the reopening by issuing either a
revised NPR or a notice that the reopening is being closed without the issuance of an

RNPR.
If issues outside the scope of the NOR are discovered during the course of the reopening
process, the contractor may address such issues only if the provider submits another
reopening request before the expiration of the three-year reopening period or if contractor
initiated, the contractor issues another notice of reopening within the three-year
reopening period. The contractor is prohibited from superseding or amending an NOR;
instead, a separate NOR shall be issued for the new issues within the three-year
reopening period described above. In addition, once an NOR has been closed either with
the issuance of an RNPR or a closure letter for those reopenings that are closed without
an RNPR, the NOR cannot be reinstated by deleting or suspending the closure letter.
Rather, a new NOR letter shall be issued in the three-year reopening period.
It is the expectation of CMS that all reopenings are reviewed and completed by the
contractor in a timely manner and there shall be no large gap in time between requesting
and receiving documentation along with receiving and reviewing documentation. The
contractor shall issue a revised NPR for all reopened MCRs within 180 days of receipt of
all information/documentation necessary to resolve the reopening issues. Review of outlier
reconciliation (if applicable) shall be completed prior to the issuance of a revised NPR.
Discuss with the BFL (through the COR) any situations where unforeseen circumstances
prevent the contractor from meeting these expectations.
If applicable, the contractor is required to calculate and update the CCRs at revised final
settlement into the OPSF and PSF no later than 30 days after the date of issuance of the
revised final settlement following the steps in §10.5 of this Chapter.
Once the CCRs at revised final settlement are calculated, the contractor shall determine
if an outlier reconciliation is required prior to issuing the RNPR. To determine if an
outlier reconciliation is required, contractors shall ensure all adjustments from the
reopening are included in the revised cost report and follow the outlier reconciliation
procedures identified in the applicable Chapter of CMS Pub. 100-04. If an outlier
reconciliation is required, the contractor shall place the RNPR on hold and follow the
outlier reconciliation adjustment procedures identified in the applicable Chapter of CMS
Pub. 100-04. Effective with outlier reconciliation approvals received from CMS on after
January 1, 2027, the MAC shall complete the remaining steps in CMS Pub. 100-04 and
issue the RNPR within 60 days from the date the MAC received the outlier approval from
CMS if the settlement timeframes stated above have passed. If the 90-day standard
cannot be met due to extenuating circumstances, the MAC shall provide an explanation
to their DPAO BFL, through their COR, including an estimated timeframe for settling the
cost report.
The revised final settlement package to the provider and uploaded to STAR shall include

the items identified in §70.5 of this Chapter.
Furthermore, the contractor is required to submit HCRIS extracts to CMS each and every
time that the contractor issues a RNPR following a reopening of an MCR. These
submissions are due within 30 days after the issuance of the revised NPR. (See §§10.4
and 90.1 for details of the type of facility MCRs that are to be submitted.)
Reopening workpapers should include:
• 	The reopening request (if applicable);
• 	The NOR or NOD (if applicable);
• 	Reopening workpapers (by issue);
• 	The original NPR package and previous RNPR(s) packages;
• 	The RNPR package applicable to the reopening; and
• 	Correspondence.
Adjustment Report Guidelines:
• 	Ensure that the Adjustment Report is prepared in the format of the sample
report shown in Exhibit VII in §170 of this Chapter.
110 – Audit Responsibility When Provider Changes Contractors
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
If the provider changes contractors, the outgoing and incoming contractors shall follow
Chapter 3 of this Manual. The outgoing contractor is responsible for finalizing any open
MCRs that the provider filed while still being serviced by that contractor. This is based
upon the contractual functions to be performed by contractors outlined in §1874A of the
Social Security Act and the MAC’s SOW. Contractors are required to make
determinations of the amounts of payments to be made to providers, to account for funds
in making such payments, and to audit their records. This clearly calls for the contractor
servicing the provider to account for all transactions that have taken place while the
relationship existed. This includes a review of the provider's records and determination of
the final settlement as well as finishing any work related to appeals of MCRs that the
contractor was responsible for settling.
Upon request, the outgoing contractor shall forward to the incoming contractor copies of
the last as-submitted and settled MCR that they are responsible for and any other
requested information/documentation. This provides MCR information so the incoming

contractor can review and, if necessary, adjust the interim rate and perform the
subsequent year’s Medicare Audit Activities. If the outgoing contractor needs any of the
workpapers to complete the work on pending appeals that they are responsible for and did
not retain copies of those workpapers, request that the incoming contractor send copies at
the time they are needed.
The incoming contractor shall generally audit the first MCR filed by a provider that is
new to them as a result of changing contractors unless the provider (e.g., SNF or HHA) is
paid entirely under the prospective payment methodology or the amount of Medicare
reimbursement is insignificant. This gives the incoming contractor a basis from which to
review and evaluate subsequent years' MCRs. The audit of an MCR from a provider that
changed contractors is:
• 	Limited to those issues, if any, pending from prior cost report examinations in
the case of the contractor closing its final MCR, or
• 	Performed to the extent necessary to supplement information received from
the prior contractor in the case of the contractor examining the provider's first
MCR.
120 – Audits of Home Offices
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
Where a provider is related within the meaning of 42 CFR 413.17 to a chain organization
and services are furnished to the provider by the home office or other organizational
entity of the chain, the reasonable costs of the services furnished are includable in the
provider's costs for reimbursement. The reasonable costs of home office services are
determined under guidelines in PRM 15-1, Chapter 21, §2150ff. and other sections
relating to specific costs.
120.1 – Audit Responsibility for Home Office Costs of Chain
Organizations
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
A home office can be serviced by one MAC (designated contractor) with its chain
components serviced by numerous MACs (servicing contractors). CMS designates the
contractor that will be responsible for the review and finalization of the HOCS. In making
this determination, CMS Central Office (CO) considers geographical location of the
home office.

When CMS CO determines which contractor will be responsible for the home office, it
communicates its decision in writing to all the contractors servicing the providers in the
chain.
120.2 – Responsible/Designated Contractor’s Responsibility if the Home
Office Fails to File a Cost Statement
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
Home office cost statements (HOCSs) that are prepared in accordance with PRM 15-1,
Chapter 21, §2150ff are to be submitted either: (1) before the last day of the fifth month
following the close of the fiscal year if the home office’s fiscal year ends on the last day
of the month, or (2) on or before 150 days after the last day of the fiscal year if the home
office’s fiscal year ends on a day other than the last day of the month. If the chain home
office fails to submit a cost statement within that time frame, the responsible/designated
contractor for the home office shall notify the chain home office of its failure to submit a
cost statement. For cost reporting periods beginning on or after October 1, 2018, a
HOCS is required to be submitted to each contractor that services a chain component of
the chain home office if costs are allocated from a home office or chain organization. If
the HOCS is not submitted to the servicing contractor, the MCR containing cost allocated
from the home office shall be rejected by the servicing contractor(s). All contractors
servicing the providers in the chain shall verify the receipt of the chain HOCS in STAR.
120.3 – Planning/Scoping the Home Office Audit
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
The responsibility for completing the desk review and scoping the audit of the HOCS
rests with the designated contractor. If more than one contractor services the providers in
the chain, the designated contractor may request any information its auditors need to
scope the audit of the HOCS from other contractors. However, if the designated
contractor does not audit a HOCS if all the providers in the chain are paid entirely under
the prospective payment methodology or the aggregate amount of the related Medicare
reimbursement for all the providers in the chain is immaterial, the contractor may
complete a modified, limited, or full desk review as applicable.
If the HOCS is scoped for audit, the designated contractor shall request any information
from the servicing contractor(s) that they have related to the providers they service which
they consider relevant to the home office audit. This could include aspects of the chain's
operations or the contractor’s experience in their relationship with the chain that the
designated contractor should be aware of or shall consider during the audit.

In determining the scope of the home office audit, the designated contractor considers: (1)
the exceptions identified during the desk review of the HOCS, (2) the servicing
contractors’ requests for audit of provider records maintained at the home office, and (3)
the additional information furnished by the other contractors in response to its requests.
120.4 – Timing and Completion of Home Office Audits
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
Home offices of chain organizations are not providers; thus, their costs are not directly
payable by Medicare. Home office costs are payable only when they are allocated to the
providers in the chain and become part of the providers’ allowable costs. Since the
allocation of home office costs usually affects all providers in the chain, the audit of the
HOCS shall be performed by the designated contractor as soon as possible after the
receipt of the HOCS so that the servicing contractors can expeditiously finalize the
settlement or reopening of provider MCRs pending the results of the home office audit.
CMS expects that if a HOCS is not scheduled for an audit, the cost statements shall be
finalized within 12 months from the date of acceptance effective for all HOCSs received
on or after October 2005 and 18 months from the date of acceptance effective April 1,
2030. A HOCS scheduled for an audit shall be finalized following the requirements in
§90.1 of this Chapter.
The designated contractor shall notify all the other contractors that service the providers
within the chain when the audit of the HOCS begins and keep those contractors informed
of the progress of the audit and any adjustments. The designated contractor shall forward
the adjustments to the other contractors that service providers within the chain prior to the
finalization of the adjustments. Any issues relating to the determination and allocation of
home office costs are to be resolved by the designated contractor. If any of the other
servicing contractors do not agree with the designated contractor’s interpretation and
application of a policy on a certain issue, that contractor(s) may request that the
designated contractor obtain an interpretation from CMS. Where the designated
contractor requests an interpretation of policy from CMS, the resolution of the
issue/adjustment shall be delayed until the receipt of a reply from CMS.
120.5 – Distribution of the Finalized Home Office Cost Statement
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
The designated contractor uploads the finalized HOCS and final settlement package to
STAR (see §70.5 of this Chapter). Contractors that service the providers within the chain
can obtain the status and the finalized HOCS from STAR. The designated contractor shall
also provide adjustments to the servicing contractor(s) as requested or appropriate.

The results of the finalized HOCS are binding and relied upon by the servicing
contractors to identify the allowable portion of the home office costs that can be included
in their providers’ MCRs. The finalized HOCSs are utilized to make any necessary
adjustments to the home office costs claimed by those provider(s) before they make a
final or revised final settlement of the related MCRs. If at the request of the servicing
contractor the designated contractor reviewed the provider’s records that are maintained
at the home office for specific issues outside the general review of the HOCS, forward the
information related to those issues to the servicing contractor:
• 	The scope of the Medicare Audit Activity work performed,
• 	The schedule of audit adjustments with full explanation why they are
necessary and their effect on the provider’s cost report, and
• 	The results of discussions with home office personnel pertaining to the
findings.
All Medicare cost report adjustments proposed by the designated contractor pertaining to
the audit of provider records maintained at the home office are binding upon the servicing
contractor. If the servicing contractor has any questions concerning the adjustments or
their results, it should resolve the issues with the designated contractor before the
settlement of the provider’s cost report. However, when a disagreement cannot be
resolved, the servicing contractor may request the designated contractor to obtain an
interpretation from CMS.
120.6 – Standards for Issuance of an Audit Report for a Home Office
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
The designated contractor will issue a home office audit report if it audits a HOCS (see
Exhibit IX.B in §170 of this Chapter).
• 	If the report relates to a HOCS, a statement that GAS standards require the
contractor to plan and perform the audit to obtain reasonable assurance about
whether the Medicare HOCS is prepared in accordance with Medicare laws,
regulations, and instructions, and
• 	A statement that the Medicare home office is responsible for compliance with
Medicare laws, regulations, and instructions.

120.7 – Home Office Cost Statement Responsibility When Designated
Contractor Change
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
Where the designated contractor for the home office changes, the incoming contractor
becomes responsible for all open HOCSs. The outgoing contractor forwards all previous
home office files including but not limited to the prior years' HOCSs, desk reviews, audit
reports, adjustments, and finalized HOCSs to the incoming contractor.
120.8 – Acceptance of Home Office Cost Statements
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
Contractors are required to make a determination of acceptability within 30 days of
receipt of an as-submitted or amended HOCS.
120.9– Revisions to a Finalized Home Office Cost Statement
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
A HOCS is not a cost report, and as such, the reopening regulations do not apply.
Revisions can be made to a finalized HOCS as long as one of its chain components is
within the three-year reopening window or has a jurisdictionally valid appeal.
An NOR is not required when revising a HOCS. However, the designated contractor
shall follow the timeline in §100 of this Chapter when revising a HOCS. The contractor
shall follow §120.5 of this Chapter when distributing a revised HOCS.
130 – Provider Permanent File
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
The permanent reference files are central files that contain provider information.
Contractors shall maintain a current permanent reference file for each provider and home
office with pertinent information for use during Medicare Audit Activities. Contractors
shall use the latest Permanent File Index from the latest CMS approved desk review
program and ensure each component of the index is completed and maintained where
applicable.
The contractor shall review each management letter comment (MLC) that does not have
a final disposition during the cost reporting year under review; these MLCs shall not be
“passed” to a subsequent cost reporting year without being reviewed during the

applicable year’s Medicare Audit Activity. The contractor shall document in the
Permanent File the steps completed to address the MLC during the applicable year’s
Medicare Audit Activity along with the auditor and reviewing official’s signature or
initials and date reviewed. Typically, when an MLC is first issued to the provider,
adequate time is given to the provider in order to correct the deficiency and the cost
reporting year in which the deficiency is to be corrected is included in the MLC. For
example, if an MLC is issued to the provider on 6/10/25 due to non-approved Worksheet
B-1 basis relating to the 12/31/2023 desk review, the 12/31/2024 MCR would have
already been submitted and would likely include the same non-approved basis. The MLC
would be issued again for the 12/31/2024 MCR if the non-approved basis was used. The
12/31/2025 would be the first MCR in which the provider should have used the correct
basis or requested approval to use an alternative basis.
The contractor shall review each point for next year (PFNY) that does not have a final
disposition during the cost reporting year under review. The contractor shall conduct the
review or audit of this deferred issue(s) within two years from the date of the deferral.
For example, if a PFNY states that inpatient indigent bad debts should be reviewed due
to insufficient documentation from the provider, this issue shall be reviewed within two
years from the initial date of the deferral. The contractor shall document in the
Permanent File the steps completed to address the PFNY during the applicable year’s
Medicare Audit Activity, along with the auditor and reviewing official’s signature or
initials, date reviewed, and the workpaper reference.
140 – Fraud & Abuse
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
140.1 – Definitions
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
A. Abuse
An abuse is the administrative violation of agency regulations, which impair the effective
and efficient execution of the program. Violations may result in Federal monetary losses
or in denial or reduction in lawfully authorized benefits to participants. They do not
involve fraud.
B. Fraud
Fraud is obtaining something of value unlawfully, through willful misrepresentation. It
embraces theft, embezzlement, false statements, illegal commissions, kickbacks,

conspiracies, obtaining contracts through collusive arrangements and similar devices.
The following are examples (not all inclusive) of potential fraud or abuse:
• 	Recording of personal expense items as provider costs for patient care.
• 	Arrangements by providers with employees, independent contractors,
suppliers, and others who appear to be designed primarily to overcharge the
program with various devices, e.g., commissions, fee splitting, to siphon off or
conceal illegal profits.
• 	A pattern of overutilization of services to inflate charges to increase
reimbursement.
• 	Any evidence of payroll entries and disbursements to personnel who provide
little or no services to the provider.
• 	Providers' concealment of business activities, which would affect eligibility
for, or amount of, program reimbursement, e.g., undisclosed change of
ownership or relationship with a supplying organization.
• 	Falsifying provider records in order to appear to meet the conditions of
participation.
• 	Charging to the program costs not incurred, or which are attributable to
nonchargeable services or nonprogram activities.
• 	Billing for supplies or equipment that are clearly unsuitable for the patient's
needs or are so lacking in quality or sufficiency as to be virtually worthless.
• 	Duplicate billing which appears to be deliberate. This includes billing
Medicare twice or billing both Medicare and the beneficiary for the same
services.
• 	Deliberately providing or receiving Medicare payments on the account of
other than the proper individual.
• 	Persistently and deliberately billing beneficiaries rather than Medicare for
covered services.
• 	Soliciting, offering, or receiving a kickback, bribe, or rebate.
• 	An ineffective board of directors and/or audit committee.

• 	Abuse of internal accounting controls by administrative personnel.
• 	Indications of personal financial problems of administrators.
• 	Significant changes in business practices.
• 	Inadequate working capital or lack of flexibility in debt restrictions such as
working capital ratios and limitations on additional borrowing.
• 	A complex corporate structure that does not appear to be warranted by the
provider's size.
• 	Frequent changes of legal counsel or of key financial officers such as treasurer
or controller.
• 	Premature announcement of profit or loss or of future expectations.
• 	Significant fluctuations in material account balances, financial
interrelationships, inventory variances, or inventory turnover rates.
• 	Unusually large payments in relation to services rendered by lawyers,
consultants, agents, and others.
• 	Difficulty in obtaining audit evidence with respect to unusual or unexplained
entries, incomplete or missing documentation, or alterations in documentation
or accounts.
• 	Delays in responses or evasive responses by management to audit inquiries.
• 	Deliberately including cost, without disclosing the fact, in the provider
Medicare Cost Report that specifically is nonreimbursable under the
regulations. This excludes instances where the provider discloses that the
Medicare Cost Report is filed under protest and where the protested issues and
their reimbursement effect are disclosed.
140.2 – Contractor Responsibility In Suspected Fraud or Abuse Cases
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
It is the contractor’s responsibility to provide necessary guidance to providers in
preparing their Medicare Cost Reports. If during the contractor’s Medicare Audit
Activities, the contractor discovers certain items (e.g., expenses or allocation statistics for

cost-reimbursed providers or cost-reimbursed areas of prospective payment system (PPS)
providers, count of residents for graduate medical education or indirect medical education
payments, bad debts, etc.) that are not allowable, make the necessary adjustments and
inform the provider. Document all such adjustments made to the MCR and issue a
Management Letter Comment (MLC) allowing enough time for the issue to be properly
stated in a subsequent submitted MCR.
If these same nonallowable items appear on a subsequent MCR, inform the provider again
why they are disallowed. Confirm this notification in a subsequent MLC. In this letter,
advise the provider that further insistence on including the same nonallowable items in
the next cost reporting period in which an MCR has not yet been submitted could result in
referral to the U. S. Attorney General for consideration of criminal and/or civil
prosecution. (If the provider’s payment system changes in the current year (e.g., from
cost-reimbursed to PPS and the item(s) disallowed in the prior year no longer has any
reimbursement impact in the current year, do not issue this letter.)
Use the following model language.
On our review for the period __________ to __________ certain items for which you
receive reimbursement through the cost report were disallowed because they were
determined by our auditors to be nonallowable. When we reviewed your cost report for
the period __________ to __________ we found the following items which were
disallowed in the prior period that were again included in the computation of your cost
report reimbursement:
In our last meeting or conversation held on __________, we advised you which specific
items were not allowed and the reason for the disallowance. Your further insistence on
including these nonallowable items in future cost reports without disclosure as protested
items could result in the referral of this situation to the U. S. Attorney General for
consideration of criminal and/or civil prosecution.
Should you have any questions, please contact (contractor name).
If the provider continues to include these nonallowable items after receipt of the letter,
follow the contractor’s policies and procedures on fraud and abuse to refer the case.
However, if the contractor has some support that even the initial insertion of a
nonallowable item on the MCR was intended by the provider to defraud the United States
government, no warning to the provider is required before referring the matter to the
Office of the Inspector General (OIG) for investigation and possible prosecution.
Where a contractor refers a questionable situation to the OIG, it is generally appropriate

to continue the Medicare Audit Activity while the situation is investigated by the OIG.
Occasionally, circumstances may require a Medicare Audit Activity to be discontinued
pending the results of the investigation. These questions are resolved by CMS and the
OIG.
The contractor shall not, under any circumstances, discuss a possible fraud or abuse
situation with the provider or take any action to disallow or resolve such
questionable situation prior to receiving instructions from the OIG.
These instructions do not apply in situations where the provider disputes the allowability
of an item and clearly indicates on the subsequent Medicare Cost Report that the
particular item is still claimed as a protested item to establish the basis for an appeal.
150 – Access to Books, Documents, and Records of Provider’s
Subcontractors
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
150.1 – General
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
Section 952 of the Omnibus Reconciliation Act of 1980, enacted December 5, 1980,
amended §1861(v)(1)(I) of the Social Security Act to require that a contract (if its cost or
value over a 12-month period is $10,000 or more) between a provider and a subcontractor
shall contain a clause allowing the Department of Health and Human Services' (HHS)
Secretary and the U.S. Comptroller General (or their representatives) access to the
subcontractor's books, documents, and records that are necessary to verify the nature and
extent of costs of services furnished under the contract. This clause shall be included in
the contract in order for the costs of services furnished under the contract to be included
as costs for Medicare reimbursement. In addition, the contract shall allow access to
contracts of a similar nature between subcontractors and related organizations of the
subcontractor, and to their books, documents, and records. The authorized
representatives of the HHS Secretary are CMS, CMS’ Medicare contractors, and the HHS
Inspector General. In most instances, a contractor will be the entity requesting access.
This legislation (at 42 CFR 420.300 through 304) applies to contracts entered into or
renewed after December 5, 1980; hence, contracts renewed after December 5, 1980 shall
be amended to include the clause. The clause shall provide for access to the
subcontractor's contract and books, documents, and records until four years have elapsed
after the services are furnished under the contract or subcontract.
NOTE: A provider's cost of renegotiation with a subcontractor to include the access

clause in their contract, if it is not excessive and can be adequately justified, is an
allowable Medicare cost and therefore may be included in the Administrative and
General cost center.
150.2 – Definitions
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
A. 	Books, Documents, and Records
All writings, recordings, transcriptions, and tapes of any description necessary to verify
the nature and extent of the costs of services provided by a subcontractor. (NOTE: For
the sake of brevity, the term "books, documents, and records" is hereinafter shortened to
"books.")
B. 	Common Ownership
An individual(s) who possesses significant ownership or equity in the subcontractor and
the entity providing the services under the contract.
C. 	Control
An individual, organization, or institution thar has the power, directly or indirectly, to
significantly influence or direct the action or policies of an organization.
D. 	Provider
A hospital, skilled nursing facility, home health agency, hospice, comprehensive
outpatient rehabilitation facility, or a related organization (as defined in 42 CFR 413.17)
of any of these providers. CMS subsequently defined “institutional providers” in 42 CFR
424.502 as any provider that submits a paper Medicare enrollment application using the
CMS-855A or an associated internet-based PECOS enrollment application. See CMS
Pub. 100-08, Chapter 10 for the current list of institutional providers.
E. 	Subcontractor
Any entity, including an individual(s), that contracts with a provider to supply a service,
either to the provider or directly to a beneficiary, for which Medicare reimburses the
provider the cost of the service. This includes organizations related to the subcontractor
that have a contract with the subcontractor for which the cost or value is $10,000 or more
in a 12-month period.
F. 	Related to the Subcontractor
A subcontractor that is, to a significant extent, associated (or affiliated) with, owns (or

is owned by), or has control of (or is controlled by), the organization furnishing the
services, facilities, or supplies.
NOTE: If a provider contracts for services with a subcontractor, and the
subcontractor thereafter contracts with a related organization (which will actually
furnish the services), both contracts shall contain the access clause if one of the
monetary criteria described in §150.4, is met.
G. Contract for Services
A contract through which a provider obtains the performance of an act(s), as
distinguished from supplies or equipment. It includes any contract for both goods and
services to the extent the value or cost of the service component is $10,000 or more
within a 12-month period.
150.3 – Types of Contracts Covered by Access Provisions
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
The access regulation applies to contracts concerning the purchase of services such as:
• 	Consultations, management, medical care provided by physician groups or
hospital-based physicians (for which Medicare may reimburse providers on a
cost basis);
• 	Linen services (rental of linens);
• 	Furnishing of meals (as opposed to the direct purchase of food);
• 	Legal and accounting services;
• 	Provider management and provider management information systems; and
• 	Insurance and leases for buildings and equipment.
Subcontracts for public utility services at rates established for uniform applicability to the
general public are not subject to the regulation because the rates are already a matter of
public record and are not negotiable. Similarly, contracts for workers compensation
insurance are not subject to the regulation since the rates are non-negotiable and are also
a matter of public record. Contracts concerning construction of buildings (including
services of architects, painters, and interior decorators) need not contain the access
clause; however, if a provider contracts with an interior decorator, painter, or other
individual/company to perform service work on an existing building, the contract shall

contain the access clause. When a provider contracts to purchase a product that includes
a warranty of the product in the price, the contract is not subject to the regulation;
however, a separately purchased warranty or service-maintenance contract shall contain
the subject clause.
150.4 – Monetary Criteria
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
There are also monetary criteria to be considered in determining if a contract shall
contain the access clause. If a contract is subject to the regulation as described in the
preceding paragraph and one of the following criteria is met, the clause shall be included
in the contract:
• 	Any contract for services for 12 months or less that is valued at $10,000 or
more (e.g., a $12,000 contract for services that are completed in two months);
• 	Any series of contracts with a subcontractor for a service(s) that total $10,000
or more over a consecutive 12-month period (e.g., two contracts for six
months each that are valued at $8,000 each, or 12 contracts for one month
each valued at $1,000 each, or a series of contracts costing $1,000 each for 10
months);
• 	Any contract that runs for more than 12 months, the apportioned value of
which is $10,000 or more for a 12-month period (e.g., a contract for 18
months valued at $18,000 (the 12-month value is $12,000) or a contract for 24
months valued at $20,000, the 12-month value of which is $10,000); or,
• 	Any contract in which the cost or value of the services or service component
is not specified, but the provider-projected services' value is $10,000 or more.
(If a contract does not contain the cost or value of the services and does not
include the access clause, and it is subsequently determined by a contractor
(or other representative of the HHS Secretary) that the contract is subject to
the statute, the provider risks not being reimbursed for the cost of the services
under Medicare unless a good faith showing is made that would permit
modification of the contract.)
These contracts between providers and subcontractors may be written or oral. With
respect to a written contract, the access clause shall be made a part of the contract.
Regarding an oral contract, a provider is required to have a written agreement (with a
subcontractor) in the form of a letter of understanding that allows access to the
pertinent books.

Providers are advised in PRM 15-1, Chapter 24, §2440.4 that the following sample access
clause language (which complies with the regulation) may be used:
"Until the expiration of four years after the furnishing of the services provided under this
contract, (Name of Subcontractor) will make available to the Secretary, U.S.
Department of Health and Human Services, and the U.S. Comptroller General, and their
representatives, this contract and all books, documents, and records necessary to certify
the nature and extent of the costs of those services. If (Name of Subcontractor) carries
out the duties of the contract through a subcontract worth $10,000 or more over a 12-
month period with a related organization, the subcontract will also contain an access
clause to permit access by the Secretary, Comptroller General, and their representatives
to the related organization's books and records."
This language may not be suitable to all contracts. Therefore, contracting parties may use
other clause language provided it contains the elements required in the regulation with
respect to the nature of their contractual arrangement. Also, in those cases where the
access provision is contained in a document other than the contract to which it applies,
the sample clause will have to be modified accordingly.
150.5 – Access Clause Not in Contract
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
There may be situations where a provider, after applying the criteria of the regulation to a
contract, erroneously decides that the contract does not require an access clause. In such
unusual situations, if the provider demonstrates satisfactorily that the decision not to
include the clause was made in good faith with a reasonable basis(es), and the provider
and subcontractor amends its contract to include an access clause within an acceptable (to
the contractor) period of time after being advised that such amendment is required, the
contractor shall treat the contract as meeting the requirements of the regulation. An
example of a provider response demonstrating good faith with a reasonable basis is a
situation where the provider honestly concluded that the cost or value of the service
component of a goods and services contract was less than $10,000. With respect to
contracts where services or services and goods are still being provided, any such
amendment shall make clear that the access clause applies to books, documents, and
records for the full term of the contract and not just for the period following the date of
amendment. If a provider demonstrates satisfactorily that the decision not to include the
clause was made in good faith with a reasonable basis but cannot amend the contract
because the subcontractor is no longer in business, the contractor shall make a
determination as to the reasonableness of the costs of the subcontractor's services using
available information. The contractor shall take appropriate disallowance and/or
recoupment action with respect to the cost of the services of the subcontractor if either

the provider or subcontractor refuses to amend the contract, or the provider does not
demonstrate satisfactorily that the decision not to include the clause was made in good
faith with a reasonable basis.
There may also be situations in which an individual subcontractor refuses to enter into a
contract containing the required access clause or will not agree to the addition of the
access clause to an existing contract, which becomes necessary because of a contract
modification. Providers are instructed in PRM 15-1, Chapter 24, §2441 to contact the
CMS Regional Administrator in their area if they have difficulty in finding another
organization that will agree to the clause and offer the needed services at a cost at least as
competitive as that of the original organization. (A provider that does not notify the
Regional Administrator but instead, on its own initiative, contracts with a more expensive
subcontractor or omits the access clause, risks not being reimbursed for the full cost of
the services furnished under the contract.) If the Regional Administrator's efforts to
persuade a subcontractor to include the required clause are unsuccessful, and no other
subcontractor is available that will furnish the services at a competitive price and agree to
the access provision, a provider may find it necessary to contract with another
organization willing to accept the access clause, even though the cost of the services may
be greater. In this situation, providers are requested to contact their contractor before
entering into a contract to assure that the greater cost incurred will be considered during
the Medicare Cost Report settlement process; this is not intended to be a pre-approval
requirement.
150.6 – Reasons for Seeking Access
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
If a written accusation (from an HHS or non-HHS party) with suitable evidence against a
provider or subcontractor of kickbacks, bribes, rebates, or other illegal activities is
received, the contractor shall prepare a report of the situation and forward it to the
regional Office of the Inspector General, HHS. However, if there is reason to believe that
the costs claimed by a provider for services of a subcontractor are excessive or
inappropriate, or evidence of possible nondisclosure of the existence of a related
organization is discovered, or it is determined that there is insufficient information to
judge the appropriateness of the cost(s) claimed by a provider for services of a
subcontractor, it may be necessary to examine the books of the subcontractor. Before
requesting the subcontractor's books, the contractor shall determine if there is a more
efficient, practical, or economical method of obtaining the necessary information. If
there is such a method or other source (e.g., the provider is able to furnish substantiation
for the cost of the services), the contractor shall obtain the needed information by that
means before seeking to gain access to the subcontractor's books. If there is no alternate

method or source, the contractor shall seek access but shall limit the access request to
those books germane to the item(s) in question. It shall not make any unnecessarily
burdensome or overly intrusive demands on a subcontractor or go on "fishing
expeditions."
150.7 – Access Request Procedures
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
Requests for access shall be in writing and contain all of the following elements:
• 	Reasonable identification of the books to which access is being requested;
• 	Identification of the subject contract or subcontract;
• 	Reason(s) why the appropriateness of the costs or value of the services of the
subcontractor in question cannot be adequately or efficiently determined
without access to the subcontractor's books;
• 	Authority in the statute and regulations for the access requested;
• 	If possible, identification of the individual(s) who will visit the subcontractor
to obtain access to the books;
• 	Time and date of the scheduled visit; and
• 	Name of the duly authorized contractor staff member to contact if there are
any questions.
150.8 – Subcontractor Response Requirements
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
• 	A subcontractor has 30 days from the date of a written request for access to books
to make them available in accordance with the request.
• 	If a subcontractor believes a request is inadequate because it does not fully meet
one or more of the required elements listed in §150.7 of this Chapter, it shall
advise the contractor of the additional information needed within 20 days from
the date of the request. Within 20 days from the date of the contractor’s response
(providing the additional information), the subcontractor shall make the books
available.

• 	A subcontractor shall request (in writing) an extension of time within which to
comply with an access request if it believes, for good cause, that the requested
material cannot be made available within the 30 day period (e.g., the requested
material is located at a home office or in storage and there will be a delay due to
retrieval time). If such a request is made, the contractor shall either grant an
extension for good cause shown or, if no date can be mutually agreed upon for
making the books available, initiate a delay or denial of reimbursement for the
cost of the services.
• 	A subcontractor shall make requested material available for inspection and audit
during its regular business hours.
NOTE: Since subcontractor books subject to access will contain both information
germane to the cost item(s) in question as well as other business records (which could be
sensitive in nature), CMS recommends that these books, or portions thereof, not be
photocopied or otherwise reproduced. Instead, the contractor shall extract the germane
information needed and record it in written workpapers. If absolutely necessary, the
contractor shall photocopy/reproduce only the germane information.
If a subcontractor is asked to reproduce books, the contractor shall reimburse the
subcontractor for the reasonable costs of reproduction from Medicare funds. However, if
a subcontractor reproduces books as a means of making them available, the contractor
shall not reimburse the subcontractor for this reproduction.
A subcontractor shall, at the request of a contractor, make the originals of any requested
books available for inspection.
150.9 – Refusal of Subcontractor to Furnish Access
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
If it is determined that a subcontractor's books are necessary for a reimbursement
determination and, despite all efforts, a subcontractor refuses to make them available, the
contractor shall immediately notify the CMS Regional Administrator. If a subcontractor
continues to refuse access, legal action may be initiated by CMS against that
subcontractor. Also, the Regional Administrator will advise the subject provider that its
subcontractor has refused access so that the provider may take whatever action it
considers necessary for its financial protection (e.g., withholding of any balances due to
the subcontractor under the contract).

150.10 – Freedom of Information Act (FOIA) Requests
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
If a contractor receives a request for release of information under the FOIA, the
contractor shall immediately refer the FOIA request to:
Centers for Medicare & Medicaid Services
Freedom of Information Act Office
7500 Security Boulevard
Mail Stop C5-11-06
Baltimore, MD 21244
NOTE: The FOIA allows CMS to exempt from mandatory disclosure to requestors
certain classes of records (see 5 United States Code 552(b).), such as:
• 	trade secrets;
• 	commercial or financial information obtained from a person;
• 	personnel and medical files; and
• 	privileged or confidential information.
160 – Audit Subcontracts
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
In accordance with the Contract between the Secretary of Health and Human Services
and the contractor, any subcontract involving a function or duty requires disclosure to
CMS. Accordingly, the subcontract for Medicare Audit Activities requires that the
notification shall be submitted to the MAC’s COR.
160.1 – Routing of Audit Subcontract
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
The MAC shall submit proposed audit subcontracts directly to the MAC’s COR. If its
contract responsibilities extend beyond regional boundaries, it shall submit the proposed
subcontracts to the MAC’s COR in which its home office is located.
160.2 – Required Documentation
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)

The provisions of the prime contract require the use of competitive proposals to the
maximum practical extent in the award of subcontracts. The contractor shall obtain
proposals from small and minority audit firms and consider their proposals in light of the
factors listed below, to the extent that it finds it to be consistent with the efficient
performance of the audit function.
The lowest price or lowest cost is the primary deciding factor in source selection, and the
contractor shall justify a selection other than the low bidder. However, award of an audit
subcontract may properly be influenced by the proposal that promises the greatest value
in terms of:
• 	Anticipated performance – compliance with Medicare regulations and procedures.
• 	Ultimate productivity – compliance with terms of the contract.
• 	Consideration of the existing and potential workload of the prospective audit firm.
• 	Qualified staff capable of performing Medicare audit.
• 	Prior performance in Medicare audits.
• 	Reputation of the audit firm.
• 	Location of offices.
• 	third parties.
160.3 – Competition
(Rev. 27, 12-19-03)
The provisions of the prime contract require the use of competitive proposals to the
maximum practical extent in the award of subcontracts. The contractor shall obtain
proposals from small and minority audit firms and consider their proposals in light of the
factors listed below, to the extent that it finds it to be consistent with the efficient
performance of the audit function.
The lowest price or lowest cost is the primary deciding factor in source selection, and the
intermediary must justify a selection other than the low bidder. However, award of an
audit subcontract may properly be influenced by the proposal that promises the greatest
value in terms of:
• 	Anticipated performance – compliance with Medicare regulations and procedures.
• 	Ultimate productivity – compliance with terms of the contract.

• 	Consideration of the existing and potential workload of the prospective audit firm.
• 	Qualified staff capable of performing Medicare audit.
• 	Prior performance in Medicare audits.
• 	Reputation of the audit firm.
• 	Location of offices.

170 – EXHIBITS
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
Exhibit I – Cost Report Acceptability Checklists
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
HOSPITAL ACCEPTABILITY CHECKLIST
Cost Report Form CMS-2552-10
Page 1
Provider Name: 	CCN:
Subunits: 	CCN:
Period Covered: From: 	To:
Postmark Date: 	Receipt Date:
Review to ensure the following is correctly completed and/or submitted with the cost report.
Part I - In order to ACCEPT the cost report,
Questions 1 through 5, 8 and, if applicable,
Questions 6 & 7 must have a "YES" response:
YES 	NO 	N/A 	COMMENTS
1. Has the provider submitted the Electronic
Cost Report (ECR) utilizing a CMS
approved vendor with current
specification date via a CD, a flash drive,
or MCReF electronic submission
transmission?
2. Does the ECR pass ALL Level 1 edits?
3. Has the provider submitted a Print Image
(PI) file of the cost report?
4. Does the Certification Page (Worksheet S)
of the ECR file include a valid
electronic/digital signature with the
checkbox marked or an original signature
signed in ink by the provider’s
administrator or chief financial officer?
5. Does the ECR encryption code printed on
the signed certification page match
exactly the encryption code in the ECR
file Type 4?

Hospital Acceptability Checklist
Cost Report Form CMS-2552-10
Page 2
Part I - In order to ACCEPT the cost report,
Questions 1 through 5, 8 and, if applicable,
Questions 6 & 7 must have a "YES" response:
YES 	NO 	N/A 	COMMENTS
6. Has the provider submitted the following
required supporting documentation that must be
submitted for applicable areas of the cost
report for cost reporting periods beginning on
or after October 1, 2018?
a. 	Bad Debt: Detailed bad debt listing
that corresponds to the amount of bad
debt claimed in the provider’s cost
report.
b. 	Disproportionate Share Hospital (DSH):
Detailed listing of the hospital’s Medicaid
eligible days claimed in the provider’s cost
report. For an amended cost report that
changes its Medicaid eligible days: an
amended listing or an addendum to the
original listing of the hospital’s Medicaid
eligible days that corresponds to the
Medicaid eligible days claimed in the
provider’s amended cost report.
c. 	Charity Care and Uninsured Discounts for
DSH eligible hospitals: Detailed listing of
charity care and/or uninsured discounts
that corresponds to the amounts claimed in
the DSH eligible provider’s cost report.
d. 	Home Office Cost Allocations: For costs
allocated from a home office or chain
organization – a Home Office Cost
Statement (HOCS) submitted to the chain
provider’s servicing contractor.

Hospital Acceptability Checklist
Cost Report Form CMS-2552-10
Page 3
Part I - In order to ACCEPT the cost report,
Questions 1 through 5, 8 and, if applicable,
Questions 6 & 7 must have a "YES" response:
YES 	NO 	N/A 	COMMENTS
7. If this is a teaching hospital, (i.e., hospital
engaged in approved GME program in
medicine, osteopathy, dentistry, or podiatry –
42 CFR 415.152), did the hospital submit an
electronic file of the IRIS which passes all
IRIS data edits and contains all the interns
and residents information for this cost
reporting period? An electronic file of the
IRIS must be submitted for all teaching
hospitals including those providers that file a
no-Medicare utilization or low-Medicare
utilization cost report.
a. 	For cost reports with fiscal years
beginning on or after October 1, 2021,
did the provider file their IRIS data
using the XML format?
b. 	For cost reports with fiscal years
beginning on or after October 1, 2022,
do the XML IRIS GME and IME FTEs
correspond to the total GME and IME
FTEs reported on the as-filed cost
report?
NOTE: CAHs are excluded from this
requirement because they are reimbursed
on cost. LTCHs are excluded from the IME
FTE requirement because it is not reported
on the LTCH Medicare cost report
settlement worksheet.
8. Does the settlement summary on the signed
certification page agree with the settlement
summary on the Medicare Cost Report (MCR)
produced from the ECR file by the contractor?
(NOTE: If the settlement summary on the
signed certification page does not agree with
the settlement summary on the MCR produced
from the ECR file by the contractor, ascertain
the nature of the error prior to rejection to
ensure that the error was not caused by the
contractor’s vendor software. If the MCR is
rejected, include an explanation to the
provider of the reason for the rejection.)
9. If the cost report is deemed unacceptable,
contact the provider within 24 hours of cost
report rejection to notify of rejection and
payment suspension, if applicable.

Hospital Acceptability Checklist
Cost Report Form CMS-2552-10
Page 4
Problem Areas Noted During Acceptance Process:
Provider Contact:
Telephone Number: 	Date of Contact:
Deadline for Resolution: 	Mail:
Prepared By: 	Date: 	Accepted [] Rejected []
(check one)
Reviewed By: 	Date: 	Accepted [] Rejected []
(check one)

SKILLED NURSING FACILITY ACCEPTABILITY CHECKLIST
Cost Report Form CMS-2540-24
Page 1
Provider Name: 	CCN:
Subunits: 	CCN:
Period Covered: From: 	To:
Postmark Date: 	Receipt Date:
Review to ensure the following is correctly completed and/or submitted with the cost report.
Part I - In order to ACCEPT the cost report,
Questions 1 through 5, 7 and, if applicable,
Question 6 must have a "YES" response:
YES 	NO 	N/A 	COMMENTS
1. Has the provider submitted the Electronic Cost
Report (ECR) utilizing a CMS approved
vendor with current specification date via a
CD, a flash drive, or MCReF electronic
submission transmission?
2. Does the ECR pass ALL Level 1 edits?
3. Has the provider submitted a Print Image(PI)
file of the cost report?
4. Does the Certification Page (Worksheet S) of
the ECR file include a valid electronic/digital
signature with the checkbox marked or an
original signature signed in ink by the
provider’s administrator or chief financial
officer?
5. Does the ECR encryption code printed on the
signed certification page match exactly the
encryption code in the ECR file Type 4?

Skilled Nursing Facility Acceptability Checklist
Cost Report Form CMS-2540-24
Page 2
Part I - In order to ACCEPT the cost report,
Questions 1 through 5, 7 and, if applicable,
Question 6 must have a "YES" response:
YES 	NO 	N/A 	COMMENTS
6. Has the provider submitted the following
required supporting documentation that must
be submitted for applicable areas of the cost
report for cost reporting periods beginning on
or after October 1, 2018?
a. 	Bad Debt: Detailed bad debt listing
that corresponds to the amount of bad
debt claimed in the provider’s cost
report.
b. 	Home Office Cost Allocations: For costs
allocated from a home office or chain
organization – a Home Office Cost
Statement (HOCS) submitted to the chain
provider’s servicing contractor.
7. Does the settlement summary on the signed
certification page agree with the settlement
summary on the Medicare Cost Report (MCR)
produced from the ECR file by the contractor?
(NOTE: If the settlement summary on the
signed certification page does not agree with
the settlement summary on the MCR produced
from the ECR file by the contractor, ascertain
the nature of the error prior to rejection to
ensure that the error was not caused by the
contractor’s vendor software. If the MCR is
rejected, include an explanation to the
provider of the reason for the rejection.)
8. If the cost report is deemed unacceptable,
contact the provider within 24 hours of cost
report rejection to notify of rejection and
payment suspension, if applicable.

Skilled Nursing Facility Acceptability Checklist
Cost Report Form CMS-2540-24
Page 3
Problem Areas Noted During Acceptance Process:
Provider Contact:
Telephone Number: 	Date of Contact:
Deadline for Resolution: 	Mail:
Prepared By: 	Date: 	Accepted [] Rejected []
(check one)
Reviewed By: 	Date: 	Accepted [] Rejected []
(check one)

HOME HEALTH AGENCY/HOSPICE ACCEPTABILITY CHECKLIST
Cost Report Forms: CMS-1728-94 (HHA); CMS-1984-14 (Hospice)
Page 1
Provider Name: 	CCN:
Subunits: 	CCN:
Period Covered: From: 	To:
Postmark Date: 	Receipt Date:
Review to ensure the following is correctly completed and/or submitted with the cost report.
Part I - In order to ACCEPT the cost report,
Questions 1 through 6 and, if applicable, Question
7 must have a "YES" response:
YES 	NO 	N/A 	COMMENTS
1. Has the provider submitted the Electronic Cost
Report (ECR) utilizing a CMS approved
vendor with current specification date via a
CD, a flash drive, or MCReF electronic
submission transmission?
2. Does the ECR pass ALL Level 1 edits?
3. Has the provider submitted a Print Image (PI)
file of the cost report?
4. Does the Certification Page (Worksheet S) of
the ECR file include a valid electronic/digital
signature with the checkbox marked or an
original signature signed in ink by the
provider’s administrator or chief financial
officer?
5. Does the ECR encryption code printed on the
signed certification page match exactly the
encryption code in the ECR file Type 4?

Home Health Agency/Hospice Acceptability Checklist
Cost Report Forms: CMS-1728-94 (HHA); CMS-1984-14 (Hospice)
Page 2
Part I - In order to ACCEPT the cost report,
Questions 1 through 6 and, if applicable, Question
7 must have a "YES" response:
YES 	NO 	N/A 	COMMENTS
6. Does the settlement summary on the signed
certification page agree with the settlement
summary on the Medicare Cost Report (MCR)
produced from the ECR file by the contractor?
(NOTE: If the settlement summary on the
signed certification page does not agree with
the settlement summary on the MCR produced
from the ECR file by the contractor, ascertain
the nature of the error prior to rejection to
ensure that the error was not caused by the
contractor’s vendor software. If the MCR is
rejected, include an explanation to the
provider of the reason for the rejection.)
7. Has the provider submitted the following
required supporting documentation that must
be submitted for applicable areas of the cost
report for cost reporting periods beginning on
or after October 1, 2018?
a. 	Bad Debt: Detailed bad debt listing
that corresponds to the amount of bad
debt claimed in the provider’s cost
report.
b. 	Home Office Cost Allocations: For costs
allocated from a home office or chain
organization – a Home Office Cost
Statement (HOCS) submitted to the chain
provider’s servicing contractor.
8. If the cost report is deemed unacceptable,
contact the provider within 24 hours of cost
report rejection to notify of rejection and
payment suspension, if applicable.

Home Health Agency/Hospice Acceptability Checklist
Cost Report Forms: CMS-1728-94 (HHA); CMS-1984-14 (Hospice)
Page 3
Problem Areas Noted During Acceptance Process:
Provider Contact:
Telephone Number: 	Date of Contact:
Deadline for Resolution: 	Mail:
Prepared By: 	Date: 	Accepted [] Rejected []
(check one)
Reviewed By: 	Date: 	Accepted [] Rejected []
(check one)

OUTPATIENT FACILITIES ACCEPTABILITY CHECKLIST
Cost Report Forms: CMS 2088-17 (CMHC); CMS 216-94 (OPO and Histo Lab); CMS 222-17
(RHC/FQHC); CMS 265-11 (ESRD); CMS 224-14 (FQHC PPS)
Page 1
Provider Name: 	CCN:
Period Covered: From: 	To:
Postmark Date: 	Receipt Date:
Review to ensure the following is correctly completed and/or submitted with the cost report.
Part I - In order to ACCEPT the cost report,
Questions 1 through 6 and, if applicable, Question
7 must have a "YES" response:
YES 	NO 	N/A 	COMMENTS
1. Has the provider submitted the Electronic Cost
Report (ECR) utilizing a CMS approved
vendor with current specification date via a
CD, a flash drive, or MCReF electronic
submission transmission?
2. Does the ECR pass ALL Level 1 edits?
3. Has the provider submitted a Print Image (PI)
file of the cost report?
4. Does the Certification Page (Worksheet S) of
the ECR file include a valid electronic/digital
signature with the checkbox marked or an
original signature signed in ink by the
provider’s administrator or chief financial
officer?
5. Does the ECR encryption code printed on the
signed certification page match exactly the
encryption code in the ECR file Type 4?

Outpatient Facilities Acceptability Checklist
Cost Report Form CMS-1728-20/CMS-1984-14
Page 2
Part I - In order to ACCEPT the cost report,
Questions 1 through 6 and, if applicable, Question
7 must have a "YES" response:
YES 	NO 	N/A 	COMMENTS
6. Does the settlement summary on the signed
certification page agree with the settlement
summary on the Medicare Cost Report (MCR)
produced from the ECR file by the contractor?
(NOTE: If the settlement summary on the
signed certification page does not agree with
the settlement summary on the MCR produced
from the ECR file by the contractor, ascertain
the nature of the error prior to rejection to
ensure that the error was not caused by the
contractor’s vendor software. If the MCR is
rejected, include an explanation to the
provider of the reason for the rejection.)
7. Has the provider submitted the following
required supporting documentation that must be
submitted for applicable areas of the cost report
for cost reporting periods beginning on or after
October 1, 2018?
a. Bad Debt: Detailed bad debt listing that
corresponds to the amount of bad debt
claimed in the provider’s cost report.
8. If the cost report is deemed unacceptable,
contact the provider within 24 hours of cost
report rejection to notify of rejection and
payment suspension, if applicable.

Outpatient Facilities Acceptability Checklist
Cost Report Form CMS-1728-20/CMS-1984-14
Page 3
Problem Areas Noted During Acceptance Process:
Provider Contact:
Telephone Number: 	Date of Contact:
Deadline for Resolution: 	Mail:
Prepared By: 	Date: 	Accepted [] Rejected []
(check one)
Reviewed By: 	Date: 	Accepted [] Rejected []
(check one)

HOME OFFICE ACCEPTABILITY CHECKLIST
Cost Statement Form CMS-287-05
Page 1
Home Office Name: 	Home Office No
Period Covered: From: 	To:
Postmark Date: 	Receipt Date:
Review to ensure the following is correctly completed and/or submitted with the cost report.
Part I - In order to ACCEPT the cost report,
Questions 1 through 3 must have a "YES"
response:
YES 	NO 	N/A 	COMMENTS
1. Is the filed cost statement completed on Form
CMS-287-05 or an appropriate substitute form
that has been approved by CMS?
2. Are the cost statements legible enough to be
reproduced?
3. Does the certification page of the ECR file
include a valid electronic/digital signature with
the checkbox marked or an original signature
signed in ink by an officer of the home office?
Problem Areas Noted During Acceptance Process:
Provider Contact:
Telephone Number: 	Date of Contact:
Deadline for Resolution: 	Mail:
Prepared By: 	Date: 	Accepted [] Rejected []
(check one)
Reviewed By: 	Date: 	Accepted [] Rejected []
(check one)

HOME OFFICE ACCEPTABILITY CHECKLIST
Cost Statement Form CMS-287-22
Page 1
Home Office Name: 	Home Office No
Period Covered: From: 	To:
Postmark Date: 	Receipt Date:
Review to ensure the following is correctly completed and/or submitted with the cost report.
Part I - In order to ACCEPT the cost report,
Questions 1 through 4 and, if applicable, Question
5 must have a "YES" response:
YES 	NO 	N/A 	COMMENTS
1. Has the provider submitted the Electronic Cost
Report (ECR) utilizing a CMS approved
vendor with current specification date via a
CD, a flash drive, or MCReF electronic
submission transmission?
2. Does the ECR pass ALL Level 1 edits?
3. Has the provider submitted a Print Image (PI)
file of the cost report?
4. Does the Certification Page (Worksheet S) of
the ECR file include a valid electronic/digital
signature with the checkbox marked or an
original signature signed in ink by an officer
of the home office?
5. Does the ECR encryption code printed on the
signed certification page match exactly the
encryption code in the ECR file Type 4?
6. If the cost Statement is deemed unacceptable,
contact the home office within 24 hours of the
cost statement rejection to notify of rejection
and payment suspension, if applicable.

Home Office Acceptability Checklist
Cost Report Form CMS-287-22
Page 2
Problem Areas Noted During Acceptance Process:
Provider Contact: 	Telephone Number: 	Date of Contact: 	Deadline for Resolution: 	Mail:
Prepared By: 	Date: 	Accepted [] Rejected []
(check one) Reviewed By: 	Date: Accepted [] Rejected []
(check one)

Exhibit II – Summary of Uniform Desk Review Issues/Exceptions
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
Summary of Uniform Desk Review Issues/Exceptions
(Instructions are contained in §20.2.III. of this Chapter.)
Provider Name: 	Settlement
without Further
Review:
Provider
Number:
Desk Review
Exception
Resolution:
Period From: 	Field Audit:
To: 	In-House Audit:
No.
UDR
Reference 	Description 	Units/$s
No
Further
Action
Exception
Resolution
Scoped
for
Audit
Exception/
Audit
Deferred
Adjusted
for
Settlement 	Comments
UDR,
Resolution,
Audit, or
PF W/P
Ref.
1 	2 	3 	4 	5 	6 	7 	8 	9 	10 	11

Exhibit II a– Audit Confirmation Letter – Field Audit
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
Date
Addressee
Address
City, State Zip Code
Provider Name:
Provider Number:
FYE:
Dear 	:
This is to inform you that your facility has been selected by (contractor name) for a field audit of
your MM/DD/YYYY cost report. The audit will commence on MM/DD/YYYY, (four to six weeks
from the date of the letter) with an entrance conference to be held the day we arrive on site. Please
arrange for a conference room or adequate space for this meeting. We ask that at the least the chief
financial officer, the person who prepared the cost report, and anyone designated as your liaison for
the audit is present at the entrance conference. In addition, we ask that the information listed on the
attached schedule be available on the date we arrive. This list will enable you to accumulate the
necessary documentation we will need to begin the audit prior to the entrance conference.
If you need to postpone the audit entrance date, please notify us two weeks prior to the scheduled
audit and we will attempt to accommodate your request. This is necessary as our audit work plan has
been set, and we will need time to reschedule the audit staff. Again, all documentation found on the
attached list must be available at the entrance conference. This will enable us to review the
information and expedite our audit process while minimizing the impact on your personnel. Be
aware that this list is not all- inclusive and that we may request additional documentation necessary
to conduct and complete our audit. If the information is not provided, we will make audit
adjustments to disallow the costs associated with the requests.
Any proposed audit adjustments will be given to you during the course of the audit. You may
request the workpapers that support the adjustments at any time. A pre-exit conference will be held
on the last day of the audit fieldwork which is tentatively planned to be on MM/DD/YYYY. In this
meeting we will go over outstanding information requests and all of the audit adjustments available
at that time. You will have four weeks to provide any outstanding information or information to
refute any previously proposed audit adjustment. (We do not need to consider any additional
documentation that you furnish after the expiration of the four week period in the Notice of Program
Reimbursement (NPR)). We will schedule an exit conference within 12 weeks following the pre-
exit conference. Prior to the exit conference, we will provide you with new or modified audit
adjustments that we propose after the pre-exit conference and allow you two weeks to comment on

them. If you wish to waive a formal exit conference, please notify (name of contractor) of this
decision in writing (e-mail note will suffice).
The Notice of Program Reimbursement will be issued to you within 60 days from the exit
conference or within 60 days from the date that we finalize the audit adjustments if an exit
conference is waived.
We believe these time frames and requirements will help expedite the completion of the field audit
and settlement of your cost report. These provisions will be uniformly applied to all providers. We
believe that with your cooperation we will have better field audits and more accurate settlements of
cost reports.
If you wish to discuss this matter, please contact 	at 	.
Sincerely,
Signature, Title
Enclosures
cc:

Exhibit II b – Audit Confirmation Letter – In-House Audit
(Rev. 107, Issued: 09-22-06; Effective: 10-01-06; Implementation: 10-02-06)
Date
Addressee
Address
City, State Zip Code
Provider____________________________________________________________
Provider No._________________________________________________________
F.Y.E_______________________________________________________________
Dear_________________:
This is to inform you that your facility has been selected by (contractor name) for an 	in-house audit of
your YYYY cost report. The audit will commence on MM, DD, YYYY, (4 to 6 weeks from the date of
the letter) with a telephone entrance conference to be held (the date and time of the telephone
conference). We ask that at the least the chief financial officer, the person who prepared the cost report
and anyone designated as your liaison for the audit participates during the entrance conference. 	In
addition, we ask that the information listed on the attached schedule be sent to the contractor’s location
one week prior to (the date of the telephone entrance conference).
If you need to reschedule the entrance conference, please notify us 2 weeks prior to scheduled audit, and
we will attempt to accommodate your request. Again all documentation found on the attached list must
be sent one week prior to the telephone conference. 	This will enable us to review the information and
expedite our audit process while minimizing the impact on your personnel. Be aware that this list is not
all-inclusive and that we may request additional documentation necessary to conduct and complete our
audit. 	If the information is not provided, we will make audit adjustments to disallow the costs
associated with the requests.
Any proposed audit adjustments will be sent to you during the course of the audit. You may request the
work papers that support the adjustments at any time. 	A pre-exit telephone conference will be
tentatively planned to be on MMDDYYYY. 	During this telephone conference, we will go over
outstanding information requests and all of the audit adjustments available at that time. You will have 4
weeks to provide any outstanding information or information to refute any previously proposed audit
adjustment. 	(We do not need to consider any additional documentation that you furnish after the
expiration of the 4-week period in the Notice of Amount of Program Reimbursement (NPR)). We will
schedule a telephone exit conference within twelve (12) weeks following the pre-exit conference. Prior
to the exit conference, we will provide you with new or modified audit adjustments that we propose after
the pre-exit conference and allow you two (2) weeks to comment on them. 	If you wish to waive a
formal exit conference, please notify (name of contractor) of this decision in writing (e-mail note will
suffice).
The Notice of the Amount of Program Reimbursement will be issued to you within 60 days from the exit
conference or within 60 days from the date that we finalize the audit adjustments if an exit conference is
waived.

We believe these time frames and requirements will help expedite the completion of the in-house audit
and settlement of your cost report. 	These provisions will be uniformly applied to all providers. 	We
believe that with your cooperation we will have better in-house audits and more accurate settlements of
cost reports.
If you wish to discuss this matter please contact ______________at________________.
Sincerely,
Signature, Title
Enclosures
cc:

Exhibit III – Entrance Conference Agenda
(Rev. 27, 12-19-03)
Contractor Name:
Provider Name:
________________________________________________________________________
Provider No.: ___________________ FYE ___________________
Auditor: _______________________ Date: __________________
Time: ___________________ 	Location _____________________
Provider Representative:
________________________________________________________________________
________________________________________________________________________
________________________________________________________________________
________________________________________________________________________
________________________________________________________________________
Contractor Representative:
________________________________________________________________________
________________________________________________________________________
________________________________________________________________________
________________________________________________________________________
________________________________________________________________________
Other:
________________________________________________________________________
________________________________________________________________________
________________________________________________________________________
________________________________________________________________________
1. Staff Introductions.

2. Provider designation of "Contact" or "Liaison" person for auditors to work with on daily basis.
________________________________________________________________________
3. Establish a schedule for ongoing communication during the audit to update provider on audit
progress, possible audit adjustments, documentation still required, and to share other information.
________________________________________________________________________
________________________________________________________________________
 	Establish administrative procedures for such things as:
Use of copy machine__________________________
Telephone calls ______________________________
Use of fax machine ____________________________
Work hours _________________________________
Parking _____________________________________
Working space _______________________________
Other ______________________________________
 	Establish procedures for obtaining documents and records and their return when the auditors
have completed their review.
__________________________________________________________________
__________________________________________________________________
6. Review last year's audit adjustments as they relate to or affect the current year's cost report/audit.
________________________________________________________________________
________________________________________________________________________
7. Discussion of proposed adjustments, if any, to current year's cost report identified during the desk
review performed by the contractor.
________________________________________________________________________
________________________________________________________________________
8. Discussion of areas to be audited, steps to be performed and documentation needed as requested in the
audit confirmation letter.
________________________________________________________________________
________________________________________________________________________

9. Discuss the availability of third parties (CPAs, consultants, and other outside parties) and their records
related to the cost report, for the auditors.
________________________________________________________________________
________________________________________________________________________
10. Arranging for tour of provider facility.
________________________________________________________________________
________________________________________________________________________
11. Establish a tentative date and time for the pre-exit and exit conferences and discuss the proposed
agendas for these conferences.
________________________________________________________________________
________________________________________________________________________
12. Discuss changes in organization ownership, new sub-units, ambulatory care ambulatory care, CORF,
SNF, HHA, and Swing Bed.
________________________________________________________________________
________________________________________________________________________
13. Discuss and update the Internal control Questionnaire, if appropriate.
________________________________________________________________________
________________________________________________________________________
14. Other questions asked during the entrance conference.
________________________________________________________________________
________________________________________________________________________
15. Agenda items from provider (if any).
________________________________________________________________________
________________________________________________________________________

Exhibit III.B – Audit Confirmation Letter – In-House Audit
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
Date
Addressee
Address
City, State Zip Code
Provider Name:
Provider Number:
FYE:

Dear 	:
This is to inform you that your facility has been selected by (contractor name) for an in-house audit
of your MM/DD/YYYY cost report. The audit will commence on MM/DD/YYYY, (four to six weeks
from the date of the letter) with a telephone entrance conference to be held (the date and time of the
telephone conference). We ask that at the least the chief financial officer, the person who prepared the
cost report and anyone designated as your liaison for the audit participates during the entrance
conference. In addition, we ask that the information listed on the attached schedule be sent to the
contractor’s location one week prior to (the date of the telephone entrance conference).
If you need to reschedule the entrance conference, please notify us two weeks prior to scheduled audit,
and we will attempt to accommodate your request. Again, all documentation found on the attached list
must be sent one week prior to the telephone conference. This will enable us to review the information
and expedite our audit process while minimizing the impact on your personnel. Be aware that this list is
not all- inclusive and that we may request additional documentation necessary to conduct and complete
our audit. If the information is not provided, we will make audit adjustments to disallow the costs
associated with the requests.
Any proposed audit adjustments will be sent to you during the course of the audit. You may request the
workpapers that support the adjustments at any time. A pre-exit telephone conference will be tentatively
planned to be on MM/DD/YYYY. During this telephone conference, we will go over outstanding
information requests and all of the audit adjustments available at that time. You will have four weeks to
provide any outstanding information or information to refute any previously proposed audit adjustment.
(We do not need to consider any additional documentation that you furnish after the expiration of the
four-week period in the Notice of Program Reimbursement (NPR)).
We will schedule a telephone exit conference within 12 weeks following the pre-exit conference.
Prior to the exit conference, we will provide you with new or modified audit adjustments that we
propose after the pre-exit conference and allow you two weeks to comment on them. 	If you wish to
waive a formal exit conference, please notify (name of contractor) of this decision in writing (e- mail
note will suffice).
The Notice of Program Reimbursement will be issued to you within 60 days from the exit conference or
within 60 days from the date that we finalize the audit adjustments if an exit conference is waived.
We believe these time frames and requirements will help expedite the completion of the in-house audit
and settlement of your cost report. These provisions will be uniformly applied to all providers. We
believe that with your cooperation we will have better in- house audits and more accurate settlements of
cost reports.
If you wish to discuss this matter, please contact 	at 	.

Sincerely,
Signature, Title
Enclosures
cc:

Exhibit IV – Entrance Conference Agenda
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
Entrance Conference Agenda:
MAC Name:
Provider Name:
Provider Number:
FYE:
Auditor Name:
Entrance Conference Date:
Entrance Conference Time:
Entrance Conference Location:
Provider Representative(s)*:
MAC Representative(s)*:
Others in Attendance*:
*Include title/position, email address, phone number, and any other applicable contact information.

Entrance Conference Agenda Items:
1. 	Staff Introductions:
2. 	Provider Liaison(s): 	• 	Obtain the provider designation of “contact” or “liaison” for
auditors to work with on a daily basis.
o 	Obtain the liaison’s contact information*.
o 	Fully discuss the liaison’s role to ensure full cooperation
during the audit.
3. 	Third-Party Cost
Report Preparer:
• 	Encourage the third-party cost report preparer to be available
by telephone/email during the course of the audit and exit
conference. Include third-party cost report preparer’s name and
contact information below.
4. 	Audit Areas: 	• 	Discuss areas to be audited and that the audit may discover
other issues that were not discussed at the entrance conference.
5. 	Audit Schedule: 	• 	Discuss timeframes for conducting the audit and schedule a
tentative date for the pre-exit conference.
• 	Discuss timeframes for additional documentation that is
requested during the audit. All requests should be in writing,
which will be emailed to the provider’s liaison. In general, the
provider should be given three to five working days to supply the
requested documentation.
• 	Inform the provider that if requested documentation is not
received, as a general rule, the MAC will disallow the costs and
not reopen the cost report, due to lack of documentation, after
the Notice of Program Reimbursement (NPR) is issued.
• 	Establish a schedule of ongoing communication during the audit
to update the provider on audit progress, possible audit
adjustments, and documentation still required.
6. 	Proposed Adjustments: 	• 	Discussion of proposed adjustments, if any, to the current year’s
cost report identified during the review.
7. 	On-Site Audit
Procedures:
On-Site Audit Only:
• 	Establish administrative procedures for such things as:
o 	Use of copy machine
o 	Work hours
o 	Access to Working Space (i.e. identification, access badge,
entry code(s), etc.)
o 	Parking
o 	Overnight Document Storage
o 	Provider documentation received during field audit
8. 	Other Items: 	• 	Discuss any other questions from the MAC or provider arising
during the Entrance Conference.
*Include title/position, email address, phone number, and any other applicable contact information.

EXHIBIT V – Internal Control Questionnaire
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
This questionnaire is effective for Medicare Audit Activities and reflects those elements of an internal
control structure that are more relevant to the outcome of a Medicare cost report audit. (See §20.2.III. of
this Chapter for additional information.)
Answer all questions on the questionnaire "Yes," "No," or "Not Applicable," as appropriate and indicate
whether the answer was obtained by inquiry, investigation, or both. Provide both name and title of the
person supplying the information. Answers requiring support must include proper documentation or
explanation or be cross- referenced to the appropriate workpaper in the current audit file. If a brief
explanation is sufficient to adequately support the answer, it is not necessary to write an overly detailed
description of the procedures.
The questionnaire is not all-inclusive and may be supplemented according to the needs of the provider
being audited. If some internal control procedures other than those stated or implied by the questionnaire
exist and affect the Medicare audit, include a description or explanation on a supporting workpaper.
Internal Control Questionnaire
Provider Name:
Provider Number:
Cost Report
Reporting Period
To:
Cost Report
Reporting Period
From:
Related Parties: Home Office
Number:
Management
Group:
Applicable
Period(s) of
Report(s)
Person Responding: 	(Name and Title)
a. 	Question
b. 	Source (a = Inquiry, b =Observation, c = Tests)
c. 	Initials of person supplying information. (Initials shall be explained and the appropriate
title supplied in a supporting workpaper)
d. 	Response (Yes, No, N/A)
e. 	W/P Reference
Question 	Source 	Initials 	Response 	WP Ref

Question 	Source 	Initials 	Response 	WP Ref
I. 	Control Environment
1. 	Was an independent audit of the provider's financial
statements for this cost reporting period performed?
A. 	If yes, was a copy of the reviewed financial statements
filed with the as-submitted cost report?
B. 	If yes, were the independent auditor’s adjustments
incorporated into the as-submitted cost report?
2. 	If so, what was the audit opinion of the independent
auditors?
A. 	Unqualified opinion.
B. 	If opinion is qualified, describe the reason why.
3. 	Has the provider made a written representation on whether
it received an SSAE 18 SOC 1, Type II Audit report on
reportable conditions of internal control (whether given on a
written or oral basis to the provider by the financial
auditors)?
4. 	Describe any reportable conditions in the SSAE 18 SOC 1,
Type II Audit report that are applicable to the Medicare
audit.
5. 	Does the provider have a current organization chart
defining lines of responsibility?
If yes, obtain a copy.
6. 	What general ledger accounting system is used by the
hospital?
A. 	Does the provider have an established chart of
accounts?
B. 	If yes, is it the same as the prior year?
C. 	If not the same as the prior year or not received in the
prior year, obtain a copy.
7. 	Are the Board of Directors' meeting minutes available for
review?
If yes, obtain a copy.
8. 	Does the provider have a policy on bonding its employees
in positions of financial trust?
9. 	Does the provider have a policy regarding treatment of
employees who violate control policies?
10. 	List the names of employees exercising the following
functions:
President
Administrator
CFO
Controller
Medicare Reimbursement Manager

Question 	Source 	Initials 	Response 	WP Ref
Internal Auditor
Director of Nursing
A. 	Are any of the above related to each other or others
working in the organization?
B. 	If the answer to A. is “yes,” list the positions,
incumbents, etc., who are related and state the
relationships:
11. 	Does the provider have an internal audit function?
A. 	If so, does the internal audit function report to an
executive other than the chief accounting officer?
B. 	If other than the CEO, specify to whom the internal
auditor reports:
II. 	Accounting System
1. 	Does the provider have adequate written statements and
explanations of its accounting policies and procedures? Do
the policies require that:
A. 	Accounting transactions are recorded in accordance
with generally accepted accounting principles
(GAAP)?
B. 	Journal entries are approved by a designated
individual at an appropriate level. Specify the
individual and title:
C. 	Journal entries require an adequate explanation and
supporting documentation?
D. 	Monthly reconciliations and timely closings are made
to the accounting records.
2. 	Does the provider have a policy to ensure the person who
prepares checks is restricted from signature authority?
A. 	Are funds transferred between bank accounts
questioned/reviewed?
B. 	Are checks completely filled out (vendor, amount)
before they are signed?
C. 	Is original supporting documentation required before
checks are signed?
3. 	Does the provider maintain a policy manual covering:
D. 	Approval for financial transactions?
E. 	Guidelines for controlling expenditure functions, such
as purchasing and travel authorization?
F. 	Safekeeping, maintenance, and storage of accounting
records?
4. 	Are the provider's accounting and policies and procedures
adequately communicated to employees?

Question 	Source 	Initials 	Response 	WP Ref
5. 	Does the provider use a computer system in its accounting
operations?
6. 	Does the provider have policies and procedures that govern
the use and operation of the computer system?
7. 	Have accounting principles been consistent with those
maintained in the preceding year?
8. 	Are periodic interim financial statements prepared and
submitted to management?
9. 	Does the provider's accounting system have suitable
account classifications?
10. 	Does the general ledger include accounts of related
organizations?
If so, identify the accounts and the related organizations.
III. 	Control Procedures
1. 	Statistics – Worksheet S-3 (or equivalent worksheet):
A. 	Does the provider have policies and procedures for
accumulating the following census statistics?
If yes, obtain a copy.
1. 	Patient days (including observation bed days).
2. 	Patient visits
3. 	Number of beds by unit.
B. 	Does the provider have written policies and
procedures for counting its interns and residents for
both indirect medical education and graduate medical
education? If so, obtain a copy.
2. 	Expenses – Worksheet A:
A. 	What is the source document for the expenses filed on
Worksheet A of the cost report?
B. 	Are credits and refunds from vendors properly
controlled and recorded to ensure that expenses are
not overstated?
C. 	Payroll expenses:
1. 	Are employees required to punch a time clock or
equivalent time logging system?
2. 	Is the payroll periodically checked against
personnel records for:
a. 	Continuing employment?
b. 	Rate of pay?
3. 	Is the payroll checked for departmental allocation
and time worked?
4. 	What documentation does the provider have to

Question 	Source 	Initials 	Response 	WP Ref
support its physicians' salary allocations to the
provider component, the professional component,
and the teaching component?
5. 	If an employee works in two departments, how is
the time split supported?
3. 	Cost allocation statistics – Worksheet B-1:
A. 	List each cost allocation statistic.
1. 	Obtain a written description from the provider
describing how each type of statistic is
accumulated and maintained.
2. 	If the method for accumulating any statistic is
different from that of prior cost reporting periods,
obtain a description and explanation of the change.
This includes changing from time records to time
studies.
B. 	What are the provider's procedures for requisitioning
drugs and medical supplies from inventory and
allocating them to departments?
4. 	Patient Care Charges – Worksheet C:
A. 	What is the source document for reporting charges on
Worksheet C of the cost report?
B. 	Obtain a copy of the written procedures describing
how routine, intensive care, ancillary, outpatient, and
other patient care charges are recorded and
accumulated by the provider.
1. 	Does the provider have procedures to ensure that
the same charge is recorded for all classes of
payers for the same service?
2. 	Does the provider have procedures in place to
ensure that all charges are properly recorded:
a. 	In accordance with the provider's charge
schedule?
b. 	In the correct department? As inpatient or
outpatient?
3. 	Does the provider have procedures in place to
ensure that adjustments to billed charges are
properly credited to the correct department?
5. 	Billing and Collection:
A. 	Medicare as Secondary Payer – Does the provider
have procedures in place to:
1. 	Obtain information on primary and secondary
payers from patients on admission or at time of
outpatient service?

Question 	Source 	Initials 	Response 	WP Ref
2. 	Revise the billing where the primary payer is
identified subsequent to the original billing?
B. 	What is the provider's collection policy for unpaid
patient bills?
1. 	Does the provider have the same collection policy
and procedures for both Medicare and non-
Medicare patients?
2. 	Does the provider use a collection agency?
C. 	What is the provider's policy in writing off Medicare
bad debts as uncollectible?
Obtain a copy.
1. 	Does the provider have policies in place to
determine indigence?
2. 	Are the amounts written off as Medicare bad
debts related only to covered deductible and
coinsurance amounts?
D. 	Does the provider have procedures in place to identify
recoveries of bad debts previously written off and
charged to the Medicare program?
6. 	Capital-related costs:
A. What are the provider's formal capitalization and
depreciation policies?
Obtain a copy.
B. 	Does the hospital directly assign capital-related costs
to departments? If so, what are the provider's policies
and procedures on directly assigned capital costs?
C. 	How does the provider record additions, transfers, and
retirements?
D. What follow-up procedures exist which ensure the
proper handling of the gain or loss from the sales of
assets?
E. 	How are records maintained for equipment and
facilities used by the hospital, but owned by others?
F. 	At what level does the provider require normal
authorization for new or renewed loans?
G. How does the provider ensure that all investment
income, profits (and losses to the extent applicable)
arising from funds diverted from patient care are
properly offset against interest expense?
Exhibit VI – Pre-Exit Conference Format
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)

Contractor Name:
Provider Name:
Provider Number: 	FYE:
Auditor: 	Date:
Location: 	Time:
Provider
Representative(s):
Contractor
Representative(s):
Other:
Pre-Exit Conference Agenda Items
1. 	Discussion of proposed agenda items.
2. 	Discussion of documentation that is still needed by the auditor to complete their review.
3. 	Define responsibilities for all open items.
4. 	Establish timeframes for:
a. 	Providing documentation to auditors.
b. 	Provider responding to proposed audit adjustments.
c. 	Response by contractor to provider once documentation is received.
d. 	Receipt of final adjustments.
e. 	Contractor to provide adjustment workpapers as requested by provider.
5. 	Ensure all provider records are returned.
Exhibit VII – Adjustment Report
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
• 	Instructions for Completion of the Adjustment Report
•
A. Heading

• 	Complete as indicated.
•
B. Adjustment Numbers
• 	Include a complete list of adjustments, presented in a logical order (e.g., Worksheet S, A, B,
etc.), of adjustments arising from the contractor’s examination of the MCR. Adjustments should be
numbered consecutively as they are recorded in the Adjustment Report.
•
C. Cost Report Form References
• 	Identify the CMS form, worksheet, line number, and column number to which the adjustment
applies. For example, reference to Form CMS-2552-10, Worksheet C, Part I, line 50, column 6,
Operating Room (the cost center affected by the application of the adjustment), would indicate an
adjustment to revise/remove total inpatient charges reported for the Operating Room.
•
D. Explanation of Adjustments
• 	Provide a narrative description of the adjustment. The description shall be adequate enough to
identify the item being adjusted and the reason (e.g., decreasing the GME FTE count of interns and
residents due to nonallowable rotations, removing nonallowable cost, reclassifying cost or other data
due to incorrect grouping on Worksheet A). The narrative description of the audit adjustment shall
also include appropriate reference to law, regulations, or program policy and procedures, and the
contractor’s workpaper where the adjustment was first proposed.
•
E. Worksheet A Line Number
• 	For adjustments pertaining to Worksheet A-6 and Worksheet A-8, indicate in this column the
Worksheet A lines that are affected by the adjustment. For example, if vending machines expenses
were included on Line 10 of Worksheet A, any Worksheet A-8 adjustments increasing or reducing
those expenses will affect Worksheet A, Line 10. Thus, in the Worksheet A Line column insert
“10.”
•
F. 	Worksheet A-6 Letters
• 	Indicate in this column the letters that are used to identify the Worksheet A-6 reclassification
adjustments. For example, the first Worksheet A-6 reclassification adjustment shall be annotated
with the letter that follows the last letter used for reclassifications on the “submitted” Worksheet A-
6. All the subsequent reclassification adjustments shall follow the letters in the alphabet. If all the
letters of the alphabet are used up and there are other reclassification adjustments to be made, double
the letters starting with “A.” For example, use “AA” as the adjustment that follows “Z.”
•
G. Basis
• 	Insert in this column the type of Worksheet A-8 adjustment. For “cost’ adjustments use “A” and
for “income offsets” use “B.”

•
H. As Reported or As Adjusted
• 	As Reported – Show the amount included in the unaudited cost report for the cost center that
will be affected by the adjustment. For example, where the proposed adjustment will change
the employee benefits statistical allocation of the Administrative & General (A&G) cost
center as reported by the provider, the amount shown will be the statistic as reported for this
cost center on Form CMS- 2552-10, Worksheet B-1, line 5, column 4.
• 	As Adjusted – Where the A&G cost center has previously been adjusted by the audit
capability, the contractor shall insert in this column the amount shown "As Adjusted" for the
previous adjustment. Reference shall be made to this previous adjustment, e.g., (see
adjustment no. 1).
•
I. 	Increase or Decrease
• 	Insert the amount of the adjustment. The adjustment amount should be indicated by brackets if it
represents a (decrease) of the amount in the "As Reported or As Adjusted" column.
•
J. 	As Adjusted
• 	This column is the result of adding or subtracting the adjustment amount from the previously
reported amount.

Adjustment Report - Sample Format
These adjustments will be incorporated in our revised Statement of Reimbursable Cost
for the period ending 	.
Adjustment Report
Provider Name:
Provider Number:
Cost Report Reporting Period
To: Cost Report Reporting Period From:
(B)
Adj
#
(C)
Form
(C)
Page
or
Schedule
(C)
Line
(C)
Col.
(D)
Explanation of Adjustments
(E)
W/S A
Line #
(F)
A-6
Lette
r
(G)
Basis
(H)
As
Reported
or As
Adjusted
(I)
Increase
or
Decrease
(J)
As
Adjusted
1 	2552-10 	A-8 	20 	2 	Vending Machines 	10 	B 	$0 	$(11,690
)
$(11,690
)
W/P 4-4B. To offset income
earned from vending
machines. 42 CFR 413.9 &
CMS 15-1, §2102.3
2 	2552-10 	B-1 	5 	4 	Administrative & General 	$5,659,25
5
$(252,00
0)
$5,407,2
55
194.0
1
4 	Nonallowable Marketing 	0 	252,000 	252,000
W/P 11-6. To reflect
adjustments made to
salaries for the Employee
Benefits statistics, the stat
is based on Gross salaries.
42 CFR 413.24 & CMS 15-
1, §2306
3 	2552-10 	C, Part I 	50 	6 	Operating Room 	$2,875,96
5
$342,105 	$3,218,0
70
W/P 2-1. To revise
Inpatient Operating Room
charges to agree to the
provider's trial balance. 42
CFR 413.24 & CMS 15-1,
§2304

Exhibit VIII – Exit Conference Format
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
Contractor Name:
Provider Name:
Provider Number: 	FYE:
Auditor: 	Date:
Location: 	Time:
Exit Conference
Waived:
Provider
Representative(s):
Contractor
Representative(s):
Other:
(NOTE: If the exit conference is waived, include support for the waiver.)
Exit Conference Agenda Items
1. 	Discussion of proposed agenda items:
2. 	Distribution and review of all finalized adjustments to be covered during the exit
conference:
3. 	Summary of Provider’s response to the adjustments from pre-exit conference:
4. 	Requested workpapers sent to provider (include date):
5. 	Notice of Program Reimbursement will be issued on or before:
(NOTE: A copy of the appeal rights and procedures will be included with the Notice
of Program Reimbursement)

Exhibit IX – Personal Impairments Statement
(Rev. 27, 12-19-03)
I certify that I am free of personal or financial impairments on this assignment/the
assignments that I will be involved during the fiscal year*. These personal impairments
may include, but are not limited to the following:
 	Official, professional, personal, or financial relationships that might cause me to
limit the extent of the inquiry, to limit disclosure, or to weaken or slant audit
findings in any way.
 	Preconceived ideas toward individuals, groups, organizations, or objectives of a
particular program that could bias the audit.
 	Previous responsibility for decision-making or managing the entity that would
affect current operations of the entity or program being audited.
 	Biases 	that 	result 	from 	employment 	in, 	or 	loyalty 	to, 	a 	particular 	group,
organization, or level of government.
 	Subsequent performance of an audit by myself if, for example, I have previously
approved invoices, payrolls, claims and other proposed payments of the entity or
program being audited.
 	Concurrent or subsequent performance of an audit by myself, if I had previously
maintained the official accounting records.
 	Financial interest, direct or substantial indirect, in the audited entity or program.
 	Job offer received during the engagement.
Signature: 	______________________
Date: ______________________
Approval: 	______________________
Date: ______________________
* (Underline the applicable phrase depending whether the impairment statement applies
to a single assignment or represents an annual impairment statement.)

Exhibit IX.A – Form of Report on Audit of Medicare Cost Report
(Provider)
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
CONTRACTOR LETTERHEAD
Provider Name:
Provider Number(s):
Cost Reporting Period:
We have audited the provider(s) Medicare cost report for the cost reporting period stated
above.
We conducted our audit in accordance with the directives in CMS Pub. 100-06, Chapter
8. They require that we plan and perform the audit to obtain reasonable assurance that the
cost report settlement reflects payment amounts and financial data in accordance with
Medicare laws, regulations, and instructions.
A less than full scope audit was made of this cost report in accordance with CMS's audit
instructions. The examination was confined to the specific areas selected for audit as
indicated on the attached listing.
Preparation of the cost report and compliance with Medicare laws, regulations, and
instructions is the responsibility of the provider(s) management. As part of obtaining
reasonable assurance about whether the cost report settlement reflects payment amounts
and financial data in accordance with Medicare laws, regulations, and instructions, we
performed tests of compliance with certain provisions of the Medicare laws, regulations,
and instructions.
In planning and performing our audit of the provider's cost report for the period, we
considered its internal control structure, as it pertained to those items in the scope of our
audit of the Medicare cost report, to determine auditing procedures for the purpose of
expressing our opinion on the cost report and not to provide assurance on the internal
control structure.
(Select one of the following alternative paragraphs on the consideration of the
internal control structure, if applicable.)
We have concluded that it would be inefficient to evaluate the effectiveness of internal

control structure policies and procedures and, in accordance with the Government
Auditing Standards (GAS), we conducted the audit more efficiently by expanding
substantive audit tests, thus placing little reliance on the internal control structure.
or
The objectives of this financial related audit did not require an understanding of the
internal control structure.
or
The existing internal control structure contained so many weaknesses we had no choice
but to rely on substantive testing, thus virtually ignoring the internal control structure.
NOTE: The following will not be included if the contractor uses one of the alternative
paragraph above.
The provider(s) management is responsible for establishing and maintaining an internal
control structure. In fulfilling this responsibility, estimates and judgments by
management are required to assess the expected benefits and related costs of internal
control policies and procedures. The objectives of an internal control structure provide
management with reasonable, but not absolute assurance that assets are safeguarded
against loss from unauthorized use or disposition, and that transactions are executed in
accordance with generally accepted accounting principles. Because of inherent
limitations in any internal control structure, errors or irregularities may occur and not be
detected. Also, projections of any evaluation of the internal control structure to future
periods is subject to risk that procedures may become inadequate because of changes in
conditions or that the effectiveness of the design and operation of policies and procedures
may deteriorate.
For purposes of this report, we have classified the significant internal control structure
policies and procedures, as they affect the Medicare audit in the categories listed in the
attached report.
For the internal control structure categories listed, we obtained an understanding of the
design of relevant policies and procedures and whether they have been placed in
operation, and we have assessed control risk.
(If reportable conditions were noted, the contractor incorporates the following statement,
along with paragraphs describing the reportable conditions.)

We noted certain matters involving the internal control structure and its operation that
we consider to be reportable conditions under standards established by the American
Institute of Certified Public Accountants. Reportable conditions involve matters
coming to our attention relating to significant deficiencies in the design or operation
of the internal control structure that, in our judgment, could adversely affect the
entity's ability to record, process, summarize, and report financial-related data
consistent with the assertions of management in the Medicare cost report.
Our consideration of the internal control structure would not necessarily disclose all
matters in the internal control structure that might be material weaknesses under
standards established by the American Institute of Certified Public Accountants. A
material weakness is a reportable condition in which the design or operation of the
specific internal control structure elements does not reduce to a relatively low risk
that errors or irregularities in amounts that would be material in relation to the cost
report being audited may occur and not be detected within a timely period by
employees in the normal course of performing their assigned functions.
(If no material conditions or reportable conditions were noted, the contractor
incorporates the following statement.)
We noted no matters involving the internal control structure and its operation that we
consider to be material weaknesses as defined above.
(The following paragraph is an optional paragraph under either consideration for
items that are less than reportable conditions and for general comments.)
However, we noted certain matters involving the internal control structure and its
operation that we have reported to the provider's management in a separate letter
dated (the contractor inserts the date of the letter).
The results of our tests indicate that, with respect to the items tested, the provider(s)
complied in all material respects with Medicare laws, regulations, and instructions,
except for the items listed in the attached Adjustment Report. With respect to items
not tested, nothing came to our attention that caused us to believe that the provider(s)
has not complied in all material respects with these provisions.
The attached Medicare cost report has been adjusted for these items of
noncompliance in accordance with the attached Adjustment Report.
This report is intended for the information of the provider(s) and CMS. This
restriction is not intended to limit the distribution of the report, which is a matter of

public record, unless otherwise restricted by applicable laws.
(Signature)
Name and Title
NPR Date

Exhibit IX.B – Form of Report on Audit of Medicare Home Office Cost Statement
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
CONTRACTOR LETTERHEAD
Home Office Name:
Home office Number:
Cost Statement Reporting Period:
We have audited the Home Office Medicare cost statement for the period stated above.
We conducted our audit in accordance with the directives in CMS Pub. 100-06,
Chapter 8. They require that we plan and perform the audit to obtain reasonable
assurance that the cost statement reflects financial data in accordance with Medicare
laws, regulations, and instructions.
A less than full scope audit was made of this cost statement in accordance with CMS's
audit instructions. The examination was confined to the specific areas selected for audit
as indicated on the attached listing.
Preparation of the cost statement and compliance with Medicare laws, regulations, and
instructions is the responsibility of the home office(s) management. As part of obtaining
reasonable assurance about whether the cost statement reflects financial data in
accordance with Medicare laws, regulations, and instructions, we performed tests of
compliance with certain provisions of the Medicare laws, regulations, and instructions.
In planning and performing our audit of the home office’s cost statement for the period,
we considered its internal control structure, as it pertained to those items in the scope of
our audit of the Medicare cost statement, to determine auditing procedures for the
purpose of expressing our opinion on the cost statement and not to provide assurance on
the internal control structure.
(Select one of the following alternative paragraphs on the consideration of the internal
control structure, if applicable.)
We have concluded that it would be inefficient to evaluate the effectiveness of internal
control structure policies and procedures and, in accordance with the Government
Auditing Standards (GAS), we conducted the audit more efficiently by expanding
substantive audit tests, thus placing little reliance on the internal control structure.

or
The objectives of this financial related audit did not require an understanding of the
internal control structure.
or
The existing internal control structure contained so many weaknesses we had no choice
but to rely on substantive testing, thus virtually ignoring the internal control structure.
NOTE: The following will not be included if the contractor uses one of the alternative
paragraph above.
The home office(s) management is responsible for establishing and maintaining an
internal control structure. In fulfilling this responsibility, estimates and judgments by
management are required to assess the expected benefits and related costs of internal
control policies and procedures. The objectives of an internal control structure provide
management with reasonable, but not absolute assurance that assets are safeguarded
against loss from unauthorized use or disposition, and that transactions are executed in
accordance with generally accepted accounting principles. Because of inherent
limitations in any internal control structure, errors or irregularities may occur and not
be detected. Also, projections of any evaluation of the internal control structure to future
periods is subject to risk that procedures may become inadequate because of changes in
conditions or that the effectiveness of the design and operation of policies and
procedures may deteriorate.
For purposes of this report, we have classified the significant internal control structure
policies and procedures, as they affect the Medicare audit in the categories listed in the
attached report.
For the internal control structure categories listed, we obtained an understanding of the
design of relevant policies and procedures and whether they have been placed in
operation, and we have assessed control risk.
(If reportable conditions were noted, the contractor incorporates the following statement,
along with paragraphs describing the reportable conditions.)
We noted certain matters involving the internal control structure and its operation that
we consider to be reportable conditions under standards established by the American
Institute of Certified Public Accountants. Reportable conditions involve matters coming

to our attention relating to significant deficiencies in the design or operation of the
internal control structure that, in our judgment, could adversely affect the entity's
ability to record, process, summarize, and report financial-related data consistent with
the assertions of management in the Medicare cost statement.
Our consideration of the internal control structure would not necessarily disclose all
matters in the internal control structure that might be material weaknesses under
standards established by the American Institute of Certified Public Accountants. A
material weakness is a reportable condition in which the design or operation of the
specific internal control structure elements does not reduce to a relatively low risk that
errors or irregularities in amounts that would be material in relation to the cost
statement being audited may occur and not be detected within a timely period by
employees in the normal course of performing their assigned functions.
(If no material conditions or reportable conditions were noted, the contractor
incorporates the following statement.)
We noted no matters involving the internal control structure and its operation that we
consider to be material weaknesses as defined above.
(The following paragraph is an optional paragraph under either consideration for items
that are less than reportable conditions and for general comments.)
However, we noted certain matters involving the internal control structure and its
operation that we have reported to the home office's management in a separate letter
dated (the contractor inserts the date of the letter).
The results of our tests indicate that, with respect to the items tested, the home office(s)
complied in all material respects with Medicare laws, regulations, and instructions,
except for the items listed in the attached Adjustment Report. With respect to items not
tested, nothing came to our attention that caused us to believe that the home office(s) has
not complied in all material respects with these provisions.
The attached Medicare cost statement has been adjusted for these items of
noncompliance in accordance with the attached Adjustment Report.
This report is intended for the information of the home office(s), provider(s) it services,
and CMS. This restriction is not intended to limit the distribution of the report, which is a
matter of public record, unless otherwise restricted by applicable laws.

(Signature)
Name and Title
Home Office Cost Statement Finalization Date

Exhibit X – Form of Report for Medicare Cost Report That Has not
Been Audited
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
CONTRACTOR LETTERHEAD
Provider Name:
Provider Number(s):
Cost Reporting Period:
We have reviewed the provider(s) Medicare cost report for the cost reporting period
stated above.
Preparation of the cost report and compliance with Medicare laws, regulations, and
instructions are the responsibility of the provider(s) management.
We have performed a review of the cost report. The attached Medicare cost report
has been adjusted, where required, for items of noncompliance discovered during our
review, which are listed in the attached Adjustment Report.
This report is intended for the information of the provider(s) and CMS. This
restriction is not intended to limit distribution of this report, which is a matter of
public record, unless otherwise restricted by applicable law.
(Signature)
Name and Title

Exhibit XI – Personal Impairments Statement
(Rev. 13891; Issued: 07-30-26; Effective: 08-28-26; Implementation: 08-28-26)
I certify that I am free of personal or financial impairments on this assignment/the
assignments that I will be involved in during the fiscal year*. These personal
impairments may include, but are not limited to the following:
• 	Official, professional, personal, or financial relationships that might cause me
to limit the extent of the inquiry, to limit disclosure, or to weaken or slant
Medicare Audit Activity findings in any way.
• 	Preconceived ideas toward individuals, groups, organizations, or objectives of
a particular program that could bias the Medicare Audit Activity.
• 	Previous responsibility for decision-making or managing the entity that would
affect current operations of the entity or program being reviewed.
• 	Biases that result from employment in, or loyalty to, a particular group,
organization, or level of government.
• 	Subsequent performance of a Medicare Audit Activity by myself if, for
example, I have previously approved invoices, payrolls, claims and other
proposed payments of the entity or program being reviewed.
• 	Concurrent or subsequent performance of a Medicare Audit Activity by
myself, if I had previously maintained the official accounting records.
• 	Financial interest, direct or substantial indirect, in the reviewed entity or
program.
• 	Job offer received during the engagement.
Signature:
Date:
Approval:
Date:
* (Underline the applicable phrase depending on whether the impairment statement

applies to a single

Transmittals Issued for this Chapter
Rev # 	Issue Date 	Subject 	Impl Date CR#
R13891FM 07/30/2026 	Update to the Internet Only Manual (IOM)
Publication (Pub.) 100-06 Chapter 8,
Contractor Procedures for Provider Audit
08/28/2026 14541
R153FM 	06/12/2009 	Implementation of the Redesigned Provider
Statistical and Reimbursement (PS&R)
System
07/13/2009 6519
R127FM 	07/13/2007 	Instructions for Documenting Scoping
Decision of Provider’s Internal Controls;
Revisions to Continuing Education and
Training and Revision Regarding Time
Frame for Settling Cost Reports
10/01/2007 5661
R107FM 	09/22/2006 	Instructions for Conducting In-House Audits
and Revision to Part II Acceptability
Checklist Requirements
10/02/2006 5262
R89FM 	01/13/2006 	Mandated Use of Autoload Program in
STAR, System Tracking for Audit and
Reimbursement
02/13/2006 4172
R84FM 	11/16/2005 	Revised Instructions on Contractor
Procedures for Provider Audit, and
Clarification of CET Requirements for
Medicare Auditors
12/05/2005 4060
R83FM 	11/04/2005 	Revised Instructions on Contractor
Procedures for Provider Audit, and
Clarification of CET Requirements for
Medicare Auditors - Replaced by Transmittal
84
12/05/2005 4060
R60FM 	11/26/2004 	Revised Instructions on Contractor
Procedures For Provider Audit and the
Provider Statistical & Reimbursement Report
(PSRR)
01/24/2005 3492
R54FM 	09/24/2004 	Notification to Providers of Intent to
Complete a Post-Payment Audit
10/25/2004 3441
R27FM 	12/19/2003 	Elimination of Focused Review Category of
Audits
01/05/2004 2902
R08FM 	08/30/2002 	Initial Publication of Chapter 	N/A 	N/A
Back to top of chapter