CMS Made Its Audits Faster. The Findings Didn’t Change.
CMS’s CY2025 Part C and Part D Program Audit and Enforcement Report shows the agency cut average audit closure time by roughly 70 days. The same report’s enforcement data shows why speed matters: delegation failures and system-control breakdowns still account for most of what CMS finds and penalizes.
A lighter audit season, three procedural pilots, and a faster clock
On July 27, 2026, CMS’s Medicare Parts C and D Oversight and Enforcement Group (MOEG) published the CY2025 Part C and Part D Program Audit and Enforcement Report. It is the agency’s annual accounting of program audit findings and enforcement actions against Medicare Advantage (Part C) and Part D sponsors. CMS frames 2025 as an atypical audit year. A bid protest reduced the number of program audits the agency could conduct, and CMS used the resulting time to pilot three procedural changes it now says it intends to keep.
The first change piloted integrating compliance program effectiveness (CPE) review directly into the operational program areas under audit, rather than evaluating CPE through a separate standalone tracer review. Compliance officers were brought into fieldwork discussions for each program area in real time. The second change piloted desk reviews, giving auditors case documentation in advance of live discussions with sponsors. The third piloted a more flexible validation approach: instead of requiring a full validation audit for every finding, CMS evaluated the nature, scope, and root cause of each instance of noncompliance to decide how much validation was actually necessary. CMS reports that 75 percent of findings were validated without a full validation audit, and that average audit closure time fell from 219 days to about 150 days, a reduction of roughly 70 days.
CMS’s own framing: 2025 was “not a typical audit year,” and the agency used the time a bid protest freed up to pilot three changes it now says it intends to keep.
Faster audits found the same delegation and system-control failures
The report also details what CMS found. Six lessons anchor the findings.
On enforcement, CMS imposed 14 civil money penalties (CMPs) in 2025 across 18 violations, totaling $1.54 million. The largest single penalty, $753,805, went to CVS Health Corporation; the second largest, $380,785, to Centene Corporation. Nine of the 18 violations involved beneficiary cost-sharing and provider payment errors; six involved MOOP failures. CMS also names five sponsors sanctioned in 2025 for Dual Eligible Special Needs Plan (D-SNP) integration failures tied to incomplete state Medicaid contracts, and separately details Medical Loss Ratio and financial-solvency enrollment suspensions.
CMS told sponsors exactly what it plans to check next
From the report’s “On the Horizon” section.
- 2026 standardSponsors must issue prior authorization decisions within 72 hours for expedited requests and 7 calendar days for standard requests.
- Audit focusCompliance officers should be ready to show auditors they can monitor and validate these timeframes across internal systems and delegated entities.
- Data shiftCMS is updating audit protocols to make greater use of its own existing data, which the agency says should reduce duplicative data collection.
- OngoingCMS will continue quarterly compliance officer calls to share audit-identified issues and promote best-practice discussion.
This is not just an efficiency story. It is a precision story.
Most coverage of this report will focus on the efficiency story: CMS cut audit closure time by roughly a third. That framing understates what the report actually says to compliance, operations, and delegation oversight leaders. CMS did not find fewer problems by auditing faster. It found the same categories of problems it has been finding for years, just with less time between identification and the point at which a sponsor must demonstrate correction.
What the report means for Medicare Advantage delegation oversight
Lesson 2 restates a principle PCOOB Weekly covered in the May 15, 2026 audit-redesign edition: delegation does not transfer accountability. This report supplies the operational specifics that should reshape how Medicare Advantage delegation oversight programs are actually run, not just documented. Utilization management edits applied inconsistently with approved benefit designs. Delegated entities issuing coverage decisions inconsistent with Medicare requirements or the sponsor’s own plan benefit package. Claims processing vendors contributing to untimely notices and payments. A new 65-day appeal timeframe requirement implemented unevenly across multiple systems and FDRs. These are not edge cases; they are the specific examples CMS chose to publish as illustrative of what auditors are finding across the industry.
The financial-harm data is the sharper signal. CMS states plainly that financial harm to beneficiaries above $100 was present in 89 percent of 2025 CMP violations, and that financial harm was one of the most common factors associated with increased enforcement severity. That is a direct statement that the dollar amount and reach of a system failure, not just its existence, is what moves a finding from a corrective action item to a civil money penalty.
First, oversight of FDRs needs to run continuously, not just ahead of an audit. The report’s own examples, inconsistent UM edit application, notice template defects, uneven rollout of the 65-day appeal timeframe, are gaps that continuous FDR performance monitoring would catch before an enrollee is harmed, but that a periodic audit cycle catches only after the fact.
Second, system change management now carries direct audit exposure. Several of CMS’s Lesson 1 examples trace back to system updates or configuration changes that were not fully tested before or after deployment. Duplicate prior authorization logic failed after an update. Coverage edits made approved requests unavailable for a full plan year. Vendor mailing processes stopped meeting CMS timeliness requirements after a system change. Testing protocols around system changes are now, in effect, an audit control.
CMS didn’t find fewer problems by auditing faster. It found the same problems, with less time between discovery and correction.
One report, five functions carrying real exposure
Compliance
The CY2025 report turns FDR oversight documentation from an annual audit artifact into something CMS now tests in real time, since compliance officers are pulled directly into fieldwork discussions as audits happen.
Operations
Prior authorization timeliness monitoring stops being a project and becomes a standing requirement once CMS confirms it will check sponsor systems and delegated entities, not just sponsor-submitted summaries.
IT / Data
System changes that once only risked a production incident now carry direct audit exposure, since several of CMS’s 2025 examples trace to configuration changes untested before or after deployment.
Finance
Financial harm above $100 drove enforcement severity in 89 percent of 2025 penalty violations, which means MOOP and cost-sharing reconciliation gaps carry more direct financial exposure than most models assume.
Vendor Management
A delegation agreement that doesn’t require FDRs to implement CMS notice and timeframe changes on the sponsor’s own schedule is exactly the kind of gap this report found and penalized.
The report didn’t lower the bar. It sharpened how CMS checks it.
No single function owns this on its own. The table below assigns responsibility; the list after it sequences the work.
| Function | Required response | Evidence to retain |
|---|---|---|
| Compliance | Extend FDR oversight from an annual audit-readiness review to continuous performance monitoring, specifically utilization management (UM) edit application, notice content, and appeal-timeframe compliance across every delegated entity. | FDR monitoring logs, oversight committee minutes, corrective action tracking tied to specific FDR findings. |
| Operations | Build monitoring for the 2026 prior authorization timeliness standards (72-hour expedited, 7-day standard) across every system and delegated entity that touches a PA decision. | Timeliness dashboards, escalation logs for cases approaching CMS deadlines, denial-reason documentation. |
| IT / Data | Test system and configuration changes before and after deployment, with specific attention to prior authorization, appeals, and claims logic; reconcile internal data to CMS-held data sources. | Pre- and post-deployment test records, data reconciliation reports, change management logs. |
| Finance | Review Maximum Out-of-Pocket (MOOP) tracking, cost-sharing calculation, and Low-Income Subsidy (LIS) reprocessing controls for accuracy across systems, given financial harm’s outsized role in enforcement severity. | Cost-sharing reconciliation reports, MOOP accumulator audit trail, refund timeliness records. |
| Vendor Management | Confirm delegation agreements require FDRs to implement CMS notice and timeframe changes on the sponsor’s implementation schedule, not the FDR’s own timeline. | Updated delegation agreement language, FDR implementation confirmation records, joint testing evidence. |
Within 7 days
Confirm whether your organization’s FDR oversight program includes continuous monitoring of UM edit application and notice content, or only an annual audit-readiness check. If it is annual only, flag the gap to your compliance committee this week.
Within 30 days
Audit whether the 65-day Part D appeal timeframe, and any other recent CMS notice or timeframe change, has actually been implemented consistently across every internal system and every delegated entity that processes appeals, not just the sponsor’s primary system. Review MOOP accumulator and cost-sharing reconciliation controls for gaps that could let beneficiaries be charged past their limit, since financial harm above $100 was present in 89 percent of 2025 CMP violations.
Within 60-90 days
Build or validate monitoring capability for the 2026 prior authorization timeliness standards (72-hour expedited, 7-day standard) across internal systems and FDRs, ahead of CMS’s stated intent to examine this in upcoming program audits. Establish a data reconciliation process between internal systems and CMS-held data sources, consistent with CMS’s stated move toward auditing against more of its own existing data rather than sponsor-submitted universes alone.
Most coverage of this report will read the audit-process changes, CPE integration, desk reviews, streamlined validation, as a story about CMS reducing sponsor burden. That is true as far as it goes: a 70-day reduction in average audit closure time is real operational relief for sponsors managing an active audit. But reading the report only that way misses what CMS did with the time it saved.
The forward-looking signal is the more consequential one. CMS states directly that its 2026 audit protocols will make greater use of the agency’s own existing data, and names prior authorization timeliness as the specific area sponsors should be ready to demonstrate monitoring for. Read alongside the delegation findings in this same report, that is a signal CMS intends to check sponsor-reported PA timeliness against its own data rather than take sponsor submissions at face value. This is an operational inference drawn from reading the report’s audit findings and its forward-looking section together, not an explicit CMS statement that FDR-level PA data will be cross-checked; sponsors should treat it as a strong signal to prepare for, not a confirmed audit protocol. Sponsors that have not yet built PA timeliness monitoring reaching into every FDR system, not just their own, are building toward next year’s audit finding today.
Questions payer leaders should ask
- 01Does our FDR oversight program monitor delegated entity performance continuously, or only through periodic audit-readiness reviews?
- 02Can we demonstrate, today, that the 65-day Part D appeal timeframe is implemented consistently across every system and delegated entity we use?
- 03What share of our 2025 internal audit findings involved financial harm to beneficiaries above $100, and did our own monitoring catch those issues before CMS or another external party did?
- 04Are our system change management protocols testing prior authorization, appeals, and claims logic both before and after deployment?
- 05Do our delegation agreements require FDRs to implement CMS notice and timeframe changes on the sponsor’s implementation schedule, not their own?
- 06Is our organization ready to show CMS auditors that we can monitor and validate the 2026 prior authorization timeliness standards across every system that touches a PA decision?
Sources
- CMS: CY 2025 Part C and Part D Program Audit and Enforcement Report (published July 27, 2026)
- CMS: Program Audits (Part C and Part D compliance and audits overview) (published Reviewed September 2026)
Until next week, stay briefed.
Frequently asked questions
What is the CY2025 Part C and Part D Program Audit and Enforcement Report?
It is CMS’s annual report from the Medicare Parts C and D Oversight and Enforcement Group (MOEG) summarizing program audit findings and enforcement actions against Medicare Advantage and Part D sponsors. CMS released the CY2025 edition on July 27, 2026. It covers audit process changes piloted in 2025, six compliance lessons drawn from audit findings, and details on civil money penalties and intermediate sanctions imposed during the year.
How much did CMS reduce average audit closure time in 2025?
CMS reports that average audit closure time fell from 219 days to approximately 150 days, a reduction of roughly 70 days. CMS attributes the reduction to piloting desk reviews, integrating compliance program effectiveness review into operational audits, and a more flexible validation approach that confirmed 75 percent of findings without a full validation audit.
What civil money penalties did CMS impose in 2025?
CMS imposed 14 civil money penalties across 18 violations, totaling approximately $1.54 million. The largest was $753,805 against CVS Health Corporation, followed by $380,785 against Centene Corporation. Most violations involved beneficiary cost-sharing and provider payment errors or Maximum Out-of-Pocket (MOOP) tracking failures, and 89 percent involved financial harm to beneficiaries greater than $100.
Does delegating a function to an FDR reduce a health plan’s compliance liability?
No. CMS’s report states this directly in its second lesson: delegation does not transfer accountability. Sponsors remain responsible for ensuring first-tier, downstream, and related entities (FDRs) administer benefits consistently with Medicare requirements and the sponsor’s approved plan benefit package, regardless of which entity actually performs the function.
What prior authorization requirement takes effect in 2026?
Beginning in 2026, Medicare Advantage and Part D sponsors must issue prior authorization decisions within 72 hours for expedited requests and within 7 calendar days for standard requests. CMS’s report states that compliance officers should be prepared to show auditors that their organizations can monitor and validate these timeframes across internal systems and delegated entities.
Will CMS check prior authorization timeliness using its own data instead of sponsor-submitted information?
CMS states it is updating audit protocols to make greater use of existing CMS data, which the agency says should reduce duplicative data collection. CMS has not stated publicly that it will specifically cross-check FDR-level prior authorization data against sponsor submissions; PCOOB Weekly’s assessment is that this is a reasonable operational inference from the report’s stated direction, not a confirmed audit protocol.