Your Departments Submitted Their Risks. What Happens Next?

The annual risk assessment responses are coming in.

Enrollment has flagged a manual reconciliation process. Appeals is worried about staffing coverage. Pharmacy has found a gap in its oversight of a first tier, downstream, or related entity (FDR). Three departments have each described what might be the same reporting problem, each from its own angle.

Now compliance has to make sense of it.

Which concerns are distinct risks? Which submissions overlap? Are the proposed ratings reasonable? Who should own the response? And what happens to the risks that don't make the final register?

Collecting responses gives compliance information. The review that follows decides whether that information becomes a basis for oversight that you can defend.

Be ready to explain the decisions

CMS's CY 2025 Audit and Enforcement Report describes a pilot, run in one 2025 program audit, that added compliance discussions to the operational audit reviews. Those discussions looked at how the organization identified, monitored, and corrected compliance risks. For risk assessments, the practical takeaway is that a final register is not enough on its own. Be ready to show how each submitted concern was evaluated, and why it did or did not end up on the list.

Start with enough context to understand the risk

"Please list your department's top risks" sounds simple. It also asks every respondent to decide alone what a risk looks like and how much detail to give.

One department submits broad concerns about regulatory change. Another describes a specific system limitation. A third reports an existing issue without saying whether the underlying exposure is still there.

Structured questions give reviewers the context behind those submissions:

• •Are policies and procedures current?
• •Have audits found control deficiencies?
• •Have staffing changes affected oversight?
• •Are teams relying on workarounds?
• •What has changed in FDR operations?

A concern about processing delays means something different when the same department also reports an empty supervisor position and a manual workaround.

Give each risk a consistent structure

Once a concern becomes an individual risk, reviewers need comparable information. A useful record identifies:

• •The risk and the business process it affects.
• •Its potential impact and likelihood.
• •The proposed mitigation.
• •The responsible owner.
• •Whether the activity involves an FDR.

That structure makes review productive. Compliance can test the assumptions behind a rating, clarify a vague description, and judge whether the proposed mitigation addresses the exposure.

The organization still needs shared scoring definitions. A rating is only useful when departments understand what it means and reviewers apply it the same way every time.

Where the review usually breaks down

Two common failure modes illustrate the problem.

Risks disappear during consolidation. Someone merges twelve department spreadsheets into one register. The final list is shorter, but nothing records why the missing items were dropped. A year later, nobody can say whether a concern was reviewed and rejected or simply lost.

The same issue gets counted twice. Enrollment and Member Services both report problems with the same data exchange and rate them differently. Kept as two separate risks, the issue can look like two mid-level problems instead of one significant shared cause. It also ends up with two owners and two mitigation plans that don't reference each other.

The fix starts in the same place for both: make every review decision explicit.

Make the review decision explicit

Every submitted risk should have a documented outcome. Some belong in the register. Others duplicate another submission, need more consideration, or don't warrant inclusion based on the information available.

In Sevana Health's Risk Assessment module, reviewers record one of four dispositions for each risk submitted for final review, with a written reason:

The reason matters as much as the label. A merge should explain how the two submissions relate. A deferral should say what is still unresolved and who will revisit it. A rejection should be something a reviewer can read next year and understand.

For the data exchange example above, a usable merge reason might read: "Same eligibility file exchange reported by Enrollment. Consolidated under the Enrollment submission, with Member Services added as a contributing department."

Those reasons are what usually get lost when spreadsheets are consolidated.

Be precise about what "accepted" means

In this workflow, accepting a risk means accepting it into the risk register.

It does not mean leadership has agreed to tolerate the exposure without further action.

The difference matters when reports reach the compliance committee or the board. A risk is usually accepted into the register because it needs attention, and it comes with an owner and a mitigation plan. If committee materials describe a list of "accepted risks" without that context, executives can come away with the wrong conclusion.

Connect the assessment to the work plan

CMS's Compliance Program Guidelines expect sponsors to:

• •Conduct a formal baseline assessment of their major compliance and FWA risk areas.
• •Rank the risks they identify.
• •Review and update the assessment on an ongoing basis.

The guidelines tie that assessment directly to the monitoring and auditing work plan. See sections 50.6.2 and 50.6.3 of the Compliance Program Guidelines, which CMS publishes as both Medicare Managed Care Manual Chapter 21 and Prescription Drug Benefit Manual Chapter 9.

That leaves a practical question: what did the assessment change about the work ahead?

A high-priority risk should lead to a considered response, such as:

• •Targeted monitoring.
• •An audit.
• •More FDR oversight.
• •A change to an existing mitigation.

The assessment should explain why the monitoring and auditing work plan remains appropriate, and where priorities need to change. The same logic carries into a CMS Program Audit, where the Compliance Program Effectiveness review looks at the oversight activities that work plan produced.

Close the assessment with a record of the decisions

A completed assessment should let someone see how departmental input became the final set of risks. That includes what was accepted, and what happened to everything else.

Completing the assessment marks the end of the review cycle. Mitigation and monitoring keep going after it. When the next cycle starts, the documented decisions give the team a clear starting point: what was identified, how it was evaluated, who owns the response, and what needs another look.

Sevana Health's Risk Assessment module requires a recorded disposition for every risk submitted for final review before an assessment can be marked complete, which helps teams account for everything that was submitted.