J-03_RequirementsForPerformingSAS70Audit.doc

RFP-CMS-2007-0013

Requirements for Performing a Statement on Auditing Standards No. 70 (SAS 70) Audit

Requirements for Performing a SAS 70 Type II Audit

· An independent and certified public accounting (CPA) firm must be contracted to perform the audit.

· The CPA firm must have experience in Medicare operations.

· The CPA firm must have experience in SAS 70 Type II audits.

· The scope of the audit begins October 1st of each fiscal year and ends no earlier than March 31 (6 months).

· During the first period of award, the contractor must conduct an audit of all CMS Control Objective areas. In subsequent years the control objectives for financial, MSP, non-MSP, information systems, debt referral, medical review, and provider audit must be audited. In addition, the contractor will conduct a risk assessment regarding the six other Control Objectives and have them audited if the risk assessment warrants such a conclusion.

· The CPA firm must number the exceptions in accordance with IOM Pub. 100-6, Chapter 7, section 40.3.

· A final SAS 70 report must be issued by July 1 of each fiscal year.

· The CPA firm(s) must deliver to the contractor a matrix in the form of a Microsoft Excel spreadsheet or Microsoft Word table to report all SAS 70 exceptions in Section I of the report. The matrix must include:

· Exception Number

· Description of the Exception

· Control Objective Number Impacted (limited to 5)

· Contractor must supply all requested internal working papers to the CPA firm.

Deliverables

· Final SAS 70 Report and the Microsoft Word or Excel matrix is due to CMS by July 1 of each fiscal year.

· Final SAS 70 Report is due to the CMS Internal Control Team in hardcopy and electronic copy.

· Email the electronic copy to internalcontrols@cms.hhs.gov

· Mail hardcopy to:

Centers for Medicare and Medicaid Services

Internal Control Team

7500 Security Blvd.

M/S: N3-11-17

Baltimore, MD 21244

· Working papers and supporting documentation must be made available upon request to any party designated by CMS.

· Corrective Action Plans are required for exceptions found in Section I of the SAS 70 report must be submitted to CMS in accordance with IOM Pub. 100.6, Chapter 7, section 40.1.

Attachment J-3