Due to limited resources, sponsors may not have the capacity to conduct a full audit each
year of all of its first tier entities. These types of audits inform the sponsor as to where
compliance problem areas lay for each first tier entity, enabling the sponsor to work with that
first tier entity to correct the problem and eliminate or significantly reduce program
noncompliance or fraud, waste and abuse. Some sponsors do not have a large number of first
tier entities and may be able to audit every first tier entity every year. However, we have heard
from numerous sponsors that they do not have the resources to conduct an audit every year of
every first tier entity. It is in that circumstance that CMS requires that the sponsor conduct a
risk assessment to identify its highest risk first tier entities and to devote its limited resources to
the auditing of those high risk entities. The sponsor will want to also have a rotation so that
every first tier entity is audited at some time.
