At Informa’s recent Transparency, Aggregate Spend & HCP Engagement conference, compliance professionals focused heavily on the CMS audits that began in early 2023. Since data collection began in 2013, the CMS’s decision to perform random audits marks a pivotal shift, signaling a new phase in Sunshine Act reporting. Throughout the conference, valuable insights were shared on the audit process and how best to prepare should your company be selected.
Legal Disclaimer: The information provided in this blog is for educational purposes only. The opinions and recommendations expressed are those of the author and do not constitute legal or other professional advice.
Understanding the CMS Audit Phases
CMS initiates the random audit process through a notice of inquiry, sent to the email and mailing addresses listed in the company’s CMS registration. Ensuring this information is complete and accurate is critical. While the audits appear to be random and there’s no specific information on the companies selected so far, it’s wise to review your historical data trends on the CMS Open Payments website for any anomalies.
Following the notice of inquiry, the auditor schedules an initial kick-off meeting with the company. During this phase, the auditor outlines the scope of the audit, objectives, criteria and process. Companies have the opportunity to present an overview of the types of transfers of value provided to covered recipients and the systems used for tracking and reporting payments. It’s important to carefully select the team for this meeting, leveraging advice from general and/or outside counsel as needed.
Post kick-off meeting, the auditor provides three questionnaires: internal controls, Open Payments program processes and fraud risks. Additionally, the auditor will request documentation such as past submissions during the lookback period, the Company Code of Conduct, written policies and procedures and a chart of accounts and general ledger. During this phase, the auditor is establishing baseline evidence of the company’s program. Companies should be strategic about the documents they provide, ensuring they reflect an appropriate scope while not withholding any relevant information. Consider offering additional documents that demonstrate the seriousness of your response and participation.
Fieldwork is conducted in two parts: reviewing sample transactions and searching for missing transactions. The auditor will request a specific number of transactions and supporting documentation from the lookback period, usually covering three years, which could include data reported from third-party vendors. In the search for missing transactions, the auditor may request a full general ledger to identify any unreported transactions. Given the auditor’s relative lack of familiarity with how life sciences companies operate, this phase is an opportunity to educate them on your data requests (e.g. no-shows, de minimis transactions). Companies should scrutinize all auditor requests, especially those that are outside the audit’s scope or may compromise your business operations.
After the fieldwork is completed, the CMS auditor issues preliminary findings. It’s essential to scrutinize these findings from every angle, as the report sent to CMS could implicate fraud and abuse in other areas. During this phase, companies should emphasize to auditors that while errors can occur, they are committed to making a good-faith effort to accurately report all transfers of value. Given the vast amount of data, spread across multiple systems and reported by various entities, this commitment is critical.
The final phases involve the management representation letter and post-audit company updates. After resolving draft findings, the auditor sends a draft management representation letter, where the company affirms compliance with Open Payments requirements and discloses any known instances of non-compliance during the audited period. Companies should carefully consider any concerns with executive management signing this letter. After the audit, the auditor will send a final report to CMS, and companies should evaluate what corrective actions are needed to prevent future audit findings.
Are you ready to elevate your transparency program to help ensure your organization is audit-ready? Don’t wait for compliance issues to arise—proactively manage your transparency risks and drive informed decision-making through a single repository for all your transparency data. To learn more, contact us.
Stay tuned for Part 2 of this blog series, where we’ll highlight key strategies and best practices for effectively preparing for a CMS audit.
Jay Ward
Director, Life Science Solutions
August 28, 2024