FDRs may perform their own audits (using auditors independent of the department being
audited) at their discretion. CMS encourages sponsors to obtain a copy of the audit reports
generated from these audits. However, even if FDRs perform their own audits, this does not
relieve sponsors of the obligation to have their own auditing and monitoring work plan and to
monitor and audit their high risk operational and compliance risk areas. It is a best practice to
investigate the deficiencies identified in the FDRs’ audit reports and require appropriate and
timely corrective action.
