We currently do not track who has read the SOC. Would it be appropriate if we took a sample of 30 employees and verify they have read and understood the SOC or must we receive confirmation from all employees?

CMS is looking for evidence of the distribution of the Standards of Conduct. Sponsors must
be able to demonstrate to CMS that their Standards of Conduct and compliance policies and
procedures were distributed to all of their employees within 90 days of hire, when there are
updates and annually thereafter. CMS will audit this requirement by pulling a sample of
employees. Since the sponsor will not know until the audit begins which employees are in the
sample, it should have a reliable method of showing distribution to every employee.