Medicare Advantage Administration: Complete Guide

Q: What are the seven programme areas CMS audits for Medicare Advantage plans?

(1) Compliance programme effectiveness, (2) Utilization management, (3) Organisation determinations, appeals, and grievances (ODAG), (4) Formulary and pharmacy administration (MA-PD), (5) Care coordination and health risk assessments, (6) Quality improvement, (7) Marketing, enrollment, and disenrollment. In 2024, CMS audited 39 sponsors covering 494 contracts and 87.6% of Part C enrollees.

Q: What is a Utilization Management Committee and is it required for all MA plans?

Yes. The 2024 Final Rule requires all MA organisations to establish a UM Committee with a documented charter, qualified clinical membership, meeting cadence, and meeting minutes to review and approve internal coverage criteria and conduct annual UM tool reviews. Plans that delegated UM to vendors without a plan-level committee must now establish one.

Q: What are the required timeframes for coverage determinations and appeals in Medicare Advantage?

Organisation determinations: 14 days standard, 72 hours expedited. First-level appeals: 60 days standard, 72 hours expedited. Enrollees may file appeals within 65 calendar days (changed from 60, effective January 1, 2025). Grievances: 30 days standard, 24 hours urgent. All timeframes measured from date of receipt.

Q: How does CMS use universe tables during Medicare Advantage programme audits?

CMS requests structured datasets of all coverage determinations, appeals, grievances, and prior authorisations for the audit period. Auditors sample from these and request complete case files. Incomplete or inaccurate universe tables are themselves compliance findings. Plans must be able to produce them within days of an audit request.

Q: What is the Medicare Prescription Payment Plan (M3P) and what does it require?

Effective January 2025, the M3P requires Part D plan sponsors to offer enrollees the option to pay out-of-pocket drug costs in capped monthly installments rather than at the pharmacy. Plans must identify eligible enrollees, communicate the programme, process elections, reconcile payments, and report M3P data to CMS. The 2025 audit cycle is the first to assess M3P compliance.

Q: What does CMS require for Medicare Advantage quality improvement programmes?

Under 42 CFR 422.152, MA plans must maintain a QI programme covering data collection, analysis, improvement interventions, and results measurement; at least one Chronic Care Improvement Programme (CCIP) with demonstrated outcomes; HEDIS and CAHPS data submission; and documented QI committee activities.

Q: Is a plan responsible for the compliance of its downstream entities and delegates?

Yes. Under 42 CFR 422.504(i), plans are responsible for delegated functions and must maintain active oversight. Delegation does not transfer audit liability. PBM, UM vendor, and TPMO failures generate audit findings against the plan sponsor, not the vendor.

GUIDE: Medicare Advantage Administration

Medicare Advantage Administration:
A Complete Management Guide for Plans

Medicare Advantage plan administration requires managing seven interlocking programme areas that CMS audits annually: compliance programme effectiveness, utilization management, coverage determinations and appeals, pharmacy and formulary administration, care coordination, quality improvement, and marketing and enrollment. In 2024, CMS audited 39 plan sponsors covering 494 contracts, and announced in 2025 that it would move to auditing every MA plan annually. This guide covers every major administration and management function, what CMS examines in each area, what the most commonly cited deficiencies are, and how plan administrators can build and maintain the operational infrastructure that compliance requires.

CMS Programme Audits in 2024

CMS conducted 39 programme audits of 36 parent organisations in 2024, covering 494 contracts and 87.6% of all Medicare Part C enrollees. Of those audits, 19 were routine and comprehensive and 20 were targeted at specific programme areas, particularly utilization management. CMS announced in May 2025 it will audit every plan annually.

WilmerHale: CMS 2024 Audit and Enforcement Report (July 2025)

Programme Areas CMS Audits

CMS evaluates compliance in seven programme areas: compliance programme effectiveness, utilization management, organisation determinations and appeals, formulary administration, care coordination, quality improvement, and marketing and enrollment. Each area has specific audit protocols and common deficiency patterns that plan administrators must understand before auditors arrive.

CMS: Part C and Part D Compliance and Audits

Annual

CMS Audit Cadence from 2025

CMS announced in May 2025 that it would move to auditing every Medicare Advantage plan annually, a significant expansion from the prior selective audit model. For plan administrators, this means that no contract is guaranteed a cycle without audit. Every plan must maintain audit-ready programme documentation at all times.

UnitedHealth Group: Support for CMS Audit Enhancements (May 2025)

Overview: What Medicare Advantage Administration Covers

Medicare Advantage administration is not a single function, it is an operational system spanning compliance, clinical, pharmacy, enrollment, and quality functions that must work together to satisfy CMS contract requirements and pass programme audits. A plan that manages each function well in isolation but lacks integration between them fails the same way a plan with weak individual functions fails: it generates audit findings across multiple programme areas that collectively indicate a systemic compliance failure.

This guide organises Medicare Advantage administration around the seven programme areas CMS audits. For each area, the guide explains what CMS requires, what auditors examine, what the most frequently cited deficiencies are, and what an administratively sound programme looks like in practice. The guide also covers the operational foundations that cut across all seven areas: the compliance programme infrastructure, the data and reporting systems, and the delegation oversight obligations that apply when functions are contracted to downstream entities.

Who this guide is for

Medicare Advantage plan administrators, compliance officers, operations managers, and clinical directors responsible for the day-to-day management of an MA or MA-PD contract. It assumes familiarity with the basic structure of the Medicare Advantage programme and focuses on the operational and administrative requirements that determine audit outcomes.

Prerequisites: What Every MA Plan Must Have in Place

An active CMS contract in good standing

Every Medicare Advantage organisation operates under a contract with CMS governed by 42 CFR Part 422. The contract must be current, the plan must be offering approved benefits in approved service areas, and the organisation must be in compliance with the Conditions of Participation. Plans with open corrective action plans from prior audits must track their CAPA status, outstanding CAPAs from previous audit cycles carry forward and are reviewed in subsequent audits.

A documented compliance programme meeting the Seven Elements

CMS requires MA plans to have a compliance programme meeting the seven elements described in the Office of Inspector General’s compliance guidance: written standards and policies, a compliance officer and committee, training and education, effective communication channels, internal monitoring and auditing, disciplinary standards, and prompt response to detected offences. This is not a documentation exercise, CMS auditors test whether the compliance programme is operational, not whether the policies exist on paper. Source: CMS: Part C and Part D Compliance Programme Requirements

Delegation agreements with all downstream entities

MA plans that delegate administrative or clinical functions to downstream entities, pharmacy benefit managers, utilization management vendors, care management organisations, and TPMOs, must maintain written delegation agreements that specify the functions delegated, the oversight obligations the plan retains, and the standards the downstream entity must meet. CMS holds the plan sponsor accountable for downstream entity performance regardless of the delegation agreement’s terms. A plan cannot delegate its audit exposure along with its functions.

Universe tables and audit-ready data systems

CMS programme audits require plans to produce “universe tables”, structured datasets of coverage requests, denials, appeals, grievances, and other transactions for the audit period. Plans that cannot produce accurate, complete universe tables within the CMS-specified timeframe fail the data production step of the audit before substantive compliance review begins. Universe tables must be drawn from production systems, not reconstructed from summary records. The data infrastructure to support audit response is itself an administrative prerequisite.

Medicare Advantage Administration: The 7 CMS Programme Areas

Compliance Programme Effectiveness

CMS audits the effectiveness of the plan’s compliance programme, not just its existence. Auditors review the compliance officer’s qualifications and independence, the training and testing records for employees and downstream entities, the internal monitoring and auditing schedule and results, the process for reporting suspected non-compliance through the compliance hotline, and the documented response to identified compliance issues. The 2024 CMS audit report specifically cited deficiencies in compliance programme oversight as a top-tier finding. A compliance programme that has all required policies but cannot produce evidence of active monitoring, training completion records, or documented responses to hotline reports is a failing programme in an audit context. Source: WilmerHale: CMS 2024 Audit and Enforcement Report

Utilization Management (UM)

UM was the primary focus of CMS targeted audits beginning in January 2024. Under the 2024 Final Rule changes to 42 CFR 422.101, MA plans must follow national and local Medicare coverage policies, use internal coverage criteria (ICC) only when Medicare guidance is unclear, avoid denying previously approved services after prior authorisation was granted, ensure adverse decisions are reviewed by qualified clinical professionals, make ICC publicly available, and establish a Utilization Management Committee to oversee UM policies and conduct annual reviews. The UM Committee must have a charter, defined membership, and a documented meeting cadence. Plans that delegate UM to a vendor must retain oversight of the vendor’s policies and ensure they meet these requirements. Source: Ankura: CMS Prior Authorisation Requirements, 2024 Final Rule

Organisation Determinations, Appeals, and Grievances (ODAG)

ODAG is consistently among the highest-risk programme areas in CMS audits. Organisation determinations (coverage decisions) must be made within required timeframes: 14 calendar days for standard coverage decisions and 72 hours for expedited requests. First-level appeals must be decided within 60 calendar days for standard and 72 hours for expedited. Plans must produce Notices of Denial of Medical Coverage (NDMCS) with required content including coverage determination rationale and appeal rights. Grievances must be distinguished from appeals at intake and responded to within 30 days (standard) or 24 hours (urgent). The November 2024 guidance update changed the enrollee appeal filing window from 60 to 65 calendar days, denial notices must reflect this change for any denial issued after January 1, 2025. Source: CMS: Medicare Managed Care Appeals and Grievances; 42 CFR 422.578-422.600

Formulary and Pharmacy Administration (for MA-PD Plans)

For MA-PD plan sponsors, formulary and pharmacy administration is a distinct programme area covering Part D coverage determinations, formulary management, transition policy, low-income subsidy administration, and the Medicare Prescription Payment Plan (M3P) effective January 2025. Coverage determinations for Part D drugs must be decided within 72 hours (standard) and 24 hours (expedited). Formularies must be reviewed and CMS-approved annually. Transition fills must be provided when an enrollee requests a non-formulary drug within 90 days of plan enrollment or a plan year change. The M3P requires plans to offer enrollees the option to pay out-of-pocket drug costs in monthly installments, a new administrative capability that required system and staff changes for plan year 2025. Source: CMS: Prescription Drug Coverage; 42 CFR Part 423 Subpart C

Care Coordination and Health Risk Assessments

Care coordination was flagged in the 2024 CMS audit report as an area where plans were failing to complete health risk assessments (HRAs) timely and incorporate findings into individualised care plans. Under 42 CFR 422.101(f), MA plans must conduct HRAs for all enrollees, particularly those with chronic conditions. HRA results must be incorporated into care plans within required timeframes, and care plans must be updated when the enrollee’s health status changes. Special Needs Plans (SNPs) have additional care coordination requirements including a Model of Care (MOC) that must be approved by the National Committee for Quality Assurance (NCQA) and updated annually. Plans that conduct HRAs but do not document the pathway from HRA result to individualised care plan fail this area. Source: AHCA: CMS 2024 Audit Results, HRA and Care Coordination Findings

Quality Improvement Programme

Under 42 CFR 422.152, MA plans must maintain a Quality Improvement (QI) programme with two components: a quality improvement programme (QIP) that monitors and improves care across multiple dimensions, and at least one Chronic Care Improvement Programme (CCIP) for a specific chronic condition that measures and demonstrates improvement in health outcomes and beneficiary satisfaction. The QI programme must collect and analyse data, identify areas for improvement, implement interventions, and measure results. HEDIS and CAHPS data form the backbone of external QI measurement. Plans must also report quality data to CMS through required reporting mechanisms and maintain documentation of QI committee meetings, improvement initiatives, and outcomes. Source: Nebraska Blue: MA Quality Management Requirements; 42 CFR 422.152

Marketing, Enrollment, and Disenrollment

Marketing and enrollment compliance covers agent and broker training and oversight (42 CFR 422.2272), TPMO oversight and monthly non-compliance reporting, marketing material review and approval through HPMS, the Scope of Appointment 48-hour requirement, call recording for all sales calls, enrollment period eligibility and processing, and disenrollment processing within required timeframes. CMS also audits plan compliance with the April 2024 broker compensation rule changes (non-salary compensation caps, volume-bonus prohibition, express written consent for data sharing). Enrollment processing must meet specific timeliness standards: CMS requires plans to process clean enrollment requests within 7 days of receipt. Source: CMS: CY2025 Agent and Broker Training Guidelines; 42 CFR 422.60-68; 422.2272

Medicare Advantage Administration Compliance Checklist

Compliance Programme

All seven compliance programme elements documented and operational

Training completion records current for all employees and downstream entities

Internal audit and monitoring schedule completed with documented findings

Hotline operational and complaints documented with resolution records

Outstanding CAPAs from prior audit cycles tracked with current status

Utilization Management

UM Committee established with charter, membership, and meeting records

Internal coverage criteria publicly available and reviewed annually

Adverse decisions reviewed by qualified clinical professionals

Prior authorisation timeframes met: 14 days standard, 72 hours expedited

Approved services not denied post-authorisation without new clinical basis

ODAG and Grievances

Denial notices include all required content and 65-day appeal window (from Jan 2025)

Appeals processed within 60 days (standard) and 72 hours (expedited)

Grievances triaged vs. appeals at intake and responded to within 30 days or 24 hours (urgent)

Universe tables complete and producible within CMS audit response timeframes

Marketing, Enrollment, and Quality

Agent and broker CY2025 training and testing completed for all TPMO relationships

Monthly TPMO non-compliance reports submitted to CMS account manager

QI programme active with CCIP documented and outcomes measured

Health risk assessments completed and incorporated into individualised care plans

Troubleshooting: Common Administration Failures and How to Fix Them

Problem: Compliance programme exists on paper but cannot demonstrate operational activity

Symptoms: policies and procedures filed, but no training completion records; internal audit schedule exists but audits were not conducted; compliance committee meets but minutes are not documented. Fix: implement a compliance calendar with mandatory deliverables at defined intervals. Each quarter must produce a documented internal audit, a training completion report, and compliance committee minutes. The compliance officer must be able to produce all three for any audit period in less than 48 hours of request. The deliverable is the evidence, not the policy that says the deliverable will be produced.

Problem: UM denials reviewed by non-clinical staff or outdated clinical criteria applied

Symptoms: adverse coverage decisions signed off by case managers without MD or DO review; internal coverage criteria not updated to reflect new national or local coverage determinations; UM Committee has not approved criteria revision since the prior year. Fix: establish a standing UM Committee review schedule with a quarterly review of internal coverage criteria against current national and local coverage policies. All adverse decisions must route through a qualified clinical reviewer, document the reviewer’s credentials in the determination record. Make all ICC publicly available on the plan website and update the publication date each time criteria are revised.

Problem: ODAG timeframes missed for expedited determinations

Symptoms: case management system does not differentiate expedited requests from standard in workflow prioritisation; 72-hour deadline breached in a pattern of cases; auditors find determinations dated after deadline in universe table sample. Fix: build the 72-hour expedited deadline into the case management system as a mandatory workflow stage gate, no expedited case can progress past its decision deadline without generating an alert. Separately, implement a daily expedited case review by a supervisor during high-volume periods. Track expedited timeliness in the internal monitoring programme monthly and report outliers to the compliance committee.

Problem: HRAs completed but findings not incorporated into care plans

Symptoms: HRA completion rates are high but care plan update rates are low; auditors find HRAs with identified needs but care plans with no corresponding interventions; care management staff conduct HRAs and care plan updates in separate systems with no automated link. Fix: create a mandatory workflow link between HRA completion and care plan review, every completed HRA with identified needs must generate a care plan review task with a defined completion deadline. Run a monthly reconciliation report comparing HRA completion counts to care plan update counts. Plans with high HRA volume but low care plan update rates are generating audit exposure even if their HRA numbers look good.

Problem: Universe tables are incomplete or cannot be produced within CMS audit response windows

Symptoms: data for coverage determinations, appeals, and grievances is stored across multiple systems with no unified extract; historical data is archived in formats that require significant manual reconstruction; the first time the plan attempts to produce a universe table is during an audit request. Fix: run a mock universe table production exercise at least annually, request the same data fields CMS would request for each programme area and measure how long it takes to produce a complete, accurate table. Identify the data fields that require manual supplementation and build automated supplements before the next audit cycle. Universe table readiness is a data governance problem before it is an audit problem.

Key Takeaways

CMS now audits every plan annually, audit readiness is a permanent operational state, not a cyclical preparation

The May 2025 announcement that CMS will audit every Medicare Advantage plan annually closes the gap that allowed some plans to treat audit readiness as a periodic project rather than a continuous state. Every plan must now maintain complete, accurate, and producible documentation across all seven programme areas at all times. The audit preparation mindset is the operating mindset.

Utilization management and compliance programme effectiveness are the two highest-risk areas in the current enforcement environment

The 2024 audit report specifically cited compliance programme oversight deficiencies and UM failures, including HRA incorporation gaps, as top-tier findings. The 2024 Final Rule’s new UM requirements, including the mandatory UM Committee and annual ICC review, are now actively audited. Plans that have not updated their UM infrastructure to reflect these requirements are carrying audit exposure in the area CMS has specifically announced it is targeting.

Downstream entity performance is plan performance, delegation does not transfer audit liability

Every finding in this guide applies equally to functions the plan performs directly and functions it has delegated to a pharmacy benefit manager, UM vendor, care management organisation, or TPMO. CMS programme audits hold the plan sponsor accountable for downstream entity performance regardless of the delegation agreement structure. A plan whose TPMO agents are not completing annual training, whose UM vendor is not applying current coverage criteria, or whose PBM is not meeting Part D determination timeframes generates audit findings as if those failures were the plan’s own, because under CMS’s regulatory framework, they are.

Frequently Asked Questions

What are the seven programme areas CMS audits for Medicare Advantage plans?

CMS evaluates compliance in seven programme areas: (1) compliance programme effectiveness, (2) utilization management, (3) organisation determinations, appeals, and grievances (ODAG), (4) formulary and pharmacy administration (for MA-PD plans), (5) care coordination and health risk assessments, (6) quality improvement, and (7) marketing, enrollment, and disenrollment. In 2024, CMS conducted 39 audits covering 494 contracts serving 87.6% of Part C enrollees, with 20 targeted specifically at UM requirements. Source: CMS: Part C and Part D Compliance and Audits

What is a Utilization Management Committee and is it required for all MA plans?

Yes. The 2024 Final Rule changes to 42 CFR 422.101 require all Medicare Advantage organisations to establish a Utilization Management Committee to oversee UM policies, criteria, and procedures. The UMC must have a documented charter, defined membership that includes qualified clinical professionals, a meeting cadence, and meeting minutes. The UMC must review and approve internal coverage criteria and conduct an annual review of all UM tools. Plans that previously managed UM through a delegated vendor without a plan-level oversight committee now need to establish the committee structure to meet this requirement. Source: Ankura: CMS Prior Authorisation Requirements, 2024 Final Rule

What are the required timeframes for coverage determinations and appeals in Medicare Advantage?

Organisation determinations (coverage decisions): 14 calendar days for standard requests and 72 hours for expedited requests. First-level appeals (redeterminations): 60 calendar days for standard and 72 hours for expedited. Enrollees must file appeals within 65 calendar days of the denial notice (changed from 60 days effective January 1, 2025 per the November 2024 CMS guidance update). Grievances must be resolved within 30 calendar days for standard and 24 hours for urgent matters. All timeframes are measured from the date the request is received by the plan. Source: CMS: Medicare Managed Care Appeals and Grievances; 42 CFR 422.578

How does CMS use universe tables during Medicare Advantage programme audits?

CMS programme auditors request universe tables at the beginning of every audit, structured datasets of all coverage determinations, appeals, grievances, prior authorisations, and other transactions for a defined audit period. Auditors select a sample from the universe table and then request the complete case files for the sampled cases. If the universe table is incomplete or inaccurate, missing cases, incorrect dates, or omitted fields, the sample drawn from it will not accurately represent the plan’s compliance profile, and the inaccuracy itself is a compliance finding. Plans must be able to produce complete, accurate universe tables for all seven programme areas within the CMS-specified response timeframe, which is typically days rather than weeks. Source: CMS: Part C and Part D Programme Audit Protocols

What is the Medicare Prescription Payment Plan (M3P) and what does it require MA-PD plans to do?

The Medicare Prescription Payment Plan (M3P), effective January 2025, requires Part D plan sponsors, including MA-PD plans, to offer all enrollees the option to pay their out-of-pocket prescription drug costs in capped monthly installment payments rather than all at once at the pharmacy. Plans must identify enrollees who may benefit from the M3P, communicate the programme to them, process monthly payment elections, reconcile payments with pharmacy partners and CMS, and report M3P data. Implementing M3P required new administrative systems and workflows for most plans, and the 2025 audit cycle is the first in which CMS will assess M3P compliance. Source: AHIP: CMS 2025 Compliance Changes Webinar

What does CMS require for Medicare Advantage quality improvement programmes?

Under 42 CFR 422.152, MA plans must maintain a quality improvement programme that collects and analyses data on clinical and non-clinical quality indicators, identifies opportunities for improvement, implements interventions, and measures and reports results. Plans must also operate at least one Chronic Care Improvement Programme (CCIP) that measures and demonstrates improvement in health outcomes and beneficiary satisfaction for a specific chronic condition. QI programme requirements also include HEDIS and CAHPS data collection, analysis, and submission; Star Ratings programme participation; and documentation of QI committee activities including meeting records and improvement project status. Source: 42 CFR 422.152; CMS Star Ratings Programme

Is a plan responsible for the compliance of its downstream entities and delegates?

Yes. Under 42 CFR 422.504(i), MA plans are responsible for the functions they delegate and must have oversight mechanisms to ensure downstream entities meet CMS requirements. A plan cannot insulate itself from audit findings by pointing to a delegation agreement or a downstream entity’s own compliance programme. If a PBM is missing Part D determination timeframes, if a UM vendor is applying non-compliant coverage criteria, or if a TPMO is enrolling beneficiaries without proper consent, those are the plan’s audit findings, not the vendor’s. Plans must maintain active oversight of all delegated functions, document their oversight activities, and have a corrective action process when downstream entities are found to be non-compliant. Source: 42 CFR 422.504(i); CMS Medicare Managed Care Manual Chapter 11

Sources

Government and Regulatory Sources

CMS: Part C and Part D Compliance and Audits: the primary CMS page for Medicare Advantage and Part D programme audit protocols, audit activity reports, compliance programme requirements, and universe table specifications.
42 CFR Part 422, Medicare Advantage Programme: the governing federal regulation for Medicare Advantage organisations covering all seven programme areas, including compliance programme requirements (422.503), UM requirements (422.101), ODAG requirements (422.566-422.600), quality improvement (422.152), and delegation accountability (422.504(i)).
CMS: Medicare Managed Care Appeals and Grievances (MMCAG), Updated November 2024: source for coverage determination and appeal timeframes, the November 2024 guidance update changing the appeal filing window from 60 to 65 calendar days, and denial notice content requirements.
CMS: CY2025 Agent and Broker Training and Testing Guidelines: training content requirements for all agents and brokers selling Medicare products, applicable to the marketing, enrollment, and disenrollment programme area and TPMO oversight obligations.

Industry and Analysis Sources

WilmerHale: CMS Releases Part C and Part D Program Audit and Enforcement Report (July 2025): source for 2024 audit volume (39 audits of 36 sponsors, 494 contracts, 87.6% of Part C enrollees), the seven programme areas evaluated, and the specific finding categories cited, including compliance programme oversight deficiencies and HRA incorporation failures.
Ankura: CMS Confirms New Prior Authorisation Requirements, 2024 Final Rule: detailed analysis of 42 CFR 422.101 changes requiring the Utilization Management Committee, annual ICC review, public ICC availability, and clinical professional review of adverse decisions.
UnitedHealth Group: Support for CMS Medicare Advantage Audit Enhancements (May 2025): confirmation of CMS’s May 2025 announcement to audit every Medicare Advantage plan annually.
AHIP: CMS 2025 Compliance Changes Webinar: source for M3P implementation requirements for 2025, universe table updates, and the 2025 CMS audit priorities covering prior authorisation, UM, and appeals and grievances.