How CMS Ensures Medicare Advantage Plans Stay Compliant

CMS oversees Medicare Advantage and Part D plans through three connected mechanisms: program audits, ongoing data submissions, and enforcement actions when something goes wrong. For compliance teams at MA plans, knowing the actual tools CMS uses, and the data CMS requires, shapes everything from monthly oversight cadence to how you respond when the engagement letter lands.

The picture changed materially with the November 2025 Program Audit memo. Scoring is gone, the old ICAR and ORCA finding classifications are retired, and the new CAR, Observation, and IDS framework took effect for the 2026 audit cycle. This guide walks through how CMS actually monitors and enforces compliance, what each universe protocol captures, and what audit-ready looks like under the new rules.

The CMS enforcement toolkit

CMS oversight of MA and Part D sponsors falls into three categories that operate year-round:

Program audits. Periodic, deep reviews of specific protocols (ODAG, CDAG, FA, SNPCC, CPE). Triggered by an engagement letter and run on a multi-year cycle. The main mechanism for findings that show up on a sponsor's audit record.
Ongoing data submissions. Encounter data, monthly enrollment files, bid submissions, HPMS attestations, Star Ratings measures, and Complaints Tracking Module entries. CMS evaluates these continuously, not just during audit windows.
Enforcement actions. Civil money penalties, corrective actions, intermediate sanctions, and (rarely) contract termination. Most enforcement traces back to issues surfaced through audits or data submissions.

The 2026 framework changed how audit findings are classified and how CPE is evaluated, but the underlying enforcement mechanisms are unchanged.

CMS Program Audits in 2026

Program audits are the most consequential oversight mechanism CMS uses. The basic cadence: an engagement letter arrives, the sponsor has a tight production window to deliver universe data for the requested protocols, and fieldwork weeks follow with case file reviews, webinars, and discussions.

The November 2025 memo reset key parts of the framework. Audit scoring is eliminated. The ICAR and ORCA classifications that compliance teams had used since 2012 are retired. The new finding framework has three classes:

CAR

Corrective Action Required. Noncompliance that needs a documented corrective action plan to strengthen controls or resolve enrollee impact.

Observation

Noncompliance that does not require a CAP. The sponsor should monitor to ensure it does not recur.

IDS

Invalid Data Submission. Cited when the sponsor cannot produce an accurate or complete universe after three submission attempts.

IDS is the standalone fail state for universe data quality. A sponsor can pass the substantive parts of an audit and still walk away with an IDS finding if the underlying universe files were inaccurate or incomplete. For the full breakdown of the changes, see our post on the 2026 CMS Program Audit changes and the deeper look at Invalid Data Submission in 2026.

The five universe protocols

Universe data is the technical core of every CMS Program Audit. Each protocol covers a different operational area of the plan and carries its own set of tables, field requirements, and timeliness rules. CMS publishes the record layouts and field-level specs (via OMB-approved form CMS-10717). Sevana's platform translates those specs into 1,600+ discrete validation rules and runs them row by row across all five protocols.

ODAG (Organization Determinations, Appeals, Grievances): the Part C protocol, covering coverage decisions, appeals, payments, effectuations, and grievances across five active tables. See the ODAG universe guide.
CDAG (Coverage Determinations, Appeals, Grievances): the Part D mirror of ODAG with tighter timeframes and a separate table for exception requests (CDER). See the CDAG universe guide.
FA (Formulary Administration): four tables capturing pharmacy point-of-sale rejections, transition fills, prescription drug events, and related operations. See the FA universe guide.
SNPCC (Special Needs Plan Care Coordination): captures HRA, ICP, and ICT activities for D-SNP and other SNP products. See the SNPCC compliance guide.
CPE (Compliance Program Effectiveness): the program area covering the sponsor's overall compliance program. Driven by the COA (Compliance Oversight Activities) universe, which now anchors the new discussion-based CPE review. See the CPE COA deep dive.

Pre-submission validation is the practical defense against IDS findings. The CMS Universe Scrubber validates all five protocols row by row against the current specs. The free Universe Header Check tool handles the most common pre-flight check.

CPE evaluation under the new discussion-based pilot

The old Compliance Program Effectiveness model was punitive. Findings, three-business-day corrective action plans, back-and-forth on remediation. The 2026 memo replaces that with a new discussion-based CPE review (a pilot sometimes referred to as "Collaborating on Compliance"), grounded in the sponsor's COA universe data.

On paper the new model is friendlier. In practice it raises the bar. Auditors now expect to see real oversight evidence and a plausible story about how compliance issues are identified, escalated, and resolved. A thin COA universe makes for a short, defensive conversation. A well-populated COA universe with documented oversight activities makes for a productive one.

What this means operationally: monthly and quarterly oversight has to be captured as it happens, not assembled in audit-prep week. The Compliance Metrics and Compliance Work Plan modules together produce the documented oversight story the new CPE model expects. For the full breakdown of what the 12 COA data elements signal to auditors, see our piece on the CPE COA universe and the new discussion-based pilot.

Ongoing oversight beyond audits

Program audits get most of the attention, but they are only one of several channels CMS uses for continuous oversight. Four others compliance teams should treat as real audit inputs:

HPMS memos and final rules. CMS publishes guidance through HPMS continuously. Sponsors are expected to update their policies and procedures in response, with a documented chain from each memo to the affected P&Ps to operational implementation. See why manual memo-to-policy matching breaks at scale.
Star Ratings. The quarterly measure calculations that drive quality bonus payments and influence enrollment. The CY 2027 Final Rule materially changed the measure set. See our Star Ratings overhaul breakdown.
Complaints Tracking Module (CTM). Member-filed complaints CMS routes to the plan for response. CTM volume and response timeliness feed into the broader oversight picture.
Delegated entity oversight. Per 42 CFR, the plan remains accountable for any work delegated to TPAs, PBMs, or other vendors. CMS expects measured oversight, not just contractual oversight. See measuring TPA performance with universe file data.

Each of these produces evidence that auditors can pull during an audit. None of them sleep between audit cycles.

Compliance and enforcement actions

When CMS identifies noncompliance outside an audit cycle, the response falls into two distinct operational buckets, run by different parts of CMS. They are easy to conflate but worth keeping separate.

Administrative compliance actions

Managed by CMS Regional Offices and Account Managers, generally in response to ongoing operational issues (rising CTM volume, repeated reporting misses, persistent member impact):

Notice of Non-Compliance (NONC). The lowest level of formal communication. The plan is expected to respond and resolve the issue without further action.
Warning Letter. Indicates the issue is more significant or that prior notices were inadequately addressed.
Ad hoc Corrective Action Plan (CAP). A documented plan that strengthens controls or resolves member impact. Distinct from a CAR, which is the analogous classification applied inside a formal Program Audit report (see section on Program Audits above).

Formal enforcement actions

Managed by the Medicare Oversight and Enforcement Group (MOEG). These carry legal weight, appear in public CMS records, and can affect the plan's contract:

Civil Money Penalties (CMPs). CMS has authority to impose CMPs for substantiated noncompliance. Penalties scale with the severity and member impact of the violation. See what CMS enforcement looked like in 2025.
Intermediate sanctions. Enrollment freezes, marketing suspensions, or service area restrictions. These hit revenue immediately and are visible to brokers and members.
Contract termination. The most severe action. Rare, but not unheard of for serious or repeated noncompliance.

The headline penalty number rarely tells the full story. For a more complete view of what noncompliance actually costs in operational and reputational terms, see the real cost of Medicare Advantage non-compliance.

What audit-ready looks like in 2026

Plans that treat audit readiness as a continuous operation rather than an annual sprint consistently fare better in fieldwork. The six year-round disciplines that matter most under the 2026 framework:

1. Pre-submission universe validation

Validate universe files against the current CMS specs before each submission window, not after CMS rejects them. The Universe Scrubber runs 1,600+ rules row by row.

2. Living COA capture

Capture auditing, monitoring, and investigation activities as they happen. The Compliance Metrics module assigns each metric to a named business owner.

3. Memo-to-policy traceability

Maintain a clear chain from each HPMS memo to affected P&Ps to operational implementation. AI Policy Intelligence and Guidance Distribution cover the full chain.

4. Measured delegated entity oversight

Track per-entity error rates, iteration counts, and recurring failure modes month over month. Contractual oversight alone does not satisfy 42 CFR.

5. Active CAR resolution

Every CAR carries through to evidenced resolution. The Compliance Work Plan tracks corrective actions through documented closure.

6. Risk assessment cadence

Formal risk assessments per OIG and CMS expectations, with mitigation tracked through completion via the Risk Assessment module.

Bottom line

CMS oversight of MA and Part D is continuous, multi-channel, and data-heavy. The 2026 framework changes how findings are classified, but raises rather than lowers the bar on operational discipline. Plans that build pre-submission validation, living COA evidence, memo-to-policy traceability, and measured delegated oversight into normal monthly work tend to walk through audits with fewer surprises than plans that treat compliance as a fieldwork-week sprint.

What the new framework rewards is the same thing it has always rewarded, just with sharper teeth: a documented compliance program that produces evidence as a byproduct of normal operations.

See how Sevana handles each of these in one platform

Universe Scrubber for pre-submission validation, Compliance Metrics and Work Plan for living COA and CAR tracking, AI Policy Intelligence and Guidance Distribution for the memo-to-policy chain. All built for Medicare Advantage compliance teams.

Request a demo See the platform