Prepare your data, case files and oversight for 2027 program audits
This paper explains what the revised CMS-10717 protocols change for MA and Part D sponsors from the 2027 audit year, and sets out a readiness roadmap.
- How CMS may audit: desk review case files and, for Part C, Service Level Data as timeliness evidence
- Universes: the universes added and retired, and what to rebuild
- Roadmap and checklist: Assess, Build and Prove phases, and readiness questions with typical owners
Five shifts in how CMS will audit
Desk review becomes a standard option
CMS may review all or part of an audit from case files submitted in advance. When it does, sponsors receive samples five business days before fieldwork and must assemble full or partial case files to CMS cover sheets.
Part C timeliness moves to Service Level Data
CMS intends to assess organization determination and reconsideration timeliness from quarterly Service Level Data (OMB 0938-1489) instead of audit universes, and will ask sponsors to explain cases that appear untimely.
Part C universes get much broader
The organization determination universe now covers every substantive decision, including concurrent reviews and plan-initiated decisions such as post-acute discharges. A new universe captures sponsor-initiated reopenings.
Deeper scrutiny of clinical decision-making
New standards test whether internal coverage criteria are evidence-based and approved, and whether approved services are later denied for medical necessity. CMS now asks for evidence of any AI used in decisions.
Compliance program effectiveness through program areas
Compliance Program Effectiveness (CPE) is no longer evaluated as a standalone program area. CMS will look at how compliance oversight connects to findings in formulary administration, coverage, appeals and grievances, and SNP care coordination.
Watch the 60-second overview
Six actions to start now
These are the paper’s six actions to start now. It advises sponsors to begin data and process work rather than wait for the annual program audit memo or the Service Level Data transition memo.
Universe extracts and record layouts
Rebuild universe extracts against the 2027 record layouts and General Record Layout Instructions, and retire the universes CMS no longer requests.
Desk review case files
Stand up a desk review process that can produce the full or partial case files CMS requests, quality-checked before submission, for any sample within five business days.
Service Level Data accuracy
Reconcile Service Level Data submissions to source systems every quarter, and make sure the timestamps CMS will ask about are retrievable.
Coverage criteria and AI governance
Bring internal coverage criteria, committee approvals and any AI or algorithm used in utilization management under documented governance.
SNP enrollee-level evidence
For SNPs, track HRA and ICP timeliness at the enrollee level and capture the outreach and D-SNP coordination evidence CMS will review.
Compliance oversight and interviews
Tag compliance oversight activities by audited program area and prepare the compliance officer for structured interviews.
A three-phase roadmap to 2027 readiness
Assess and Build follow the paper’s day ranges. Prove runs until the first engagement letter, so it has no fixed length. The paper calls this sequence a practical starting point.
Assess
First 30 days
- Compare universe extracts field by field with the 2027 record layouts
- Inventory desk review documents, internal criteria and AI or algorithms in UM
- Confirm who owns Service Level Data accuracy; check SNP data can be produced per enrollee
Build
Days 30 to 150
- Rebuild universe extracts, retire removed ones, add pre-submission validation
- Capture new fields in A&G, UM and grievance systems; define case file standards and desk review workflow
- Start quarterly Service Level Data reconciliation; document criteria and AI governance
Prove
Before the first engagement letter
- Run a mock audit on the 2027 protocols, with at least one desk review cycle and one RAI exchange
- Produce each universe end to end and run integrity tests on samples
- Rehearse compliance officer interviews, fix gaps, and train staff and delegates
The full paper adds a readiness checklist with a typical owner for each area. Owners vary by organization.
Who the paper is for
Compliance leadership
The most significant 2027 changes in one place, to coordinate operations, clinical and data teams before the audit year.
Audit readiness and program audit leads
Desk review preparation, sponsor response deadlines and a readiness roadmap whose final phase includes a mock audit.
Operations and UM/clinical leaders
What changes for decision-level Part C data, coverage criteria governance, timeliness mitigation and SNP care.
Data and reporting teams
The universes added and retired, the General Record Layout Instructions and quarterly Service Level Data reconciliation.