A CMS ODAG audit is the part of a Medicare Advantage program audit that tests Part C Organization Determinations, Appeals and Grievances. CMS collects universes of the plan's own cases for a few recent weeks, tests the timeliness of every one of them against its regulatory clock, and reads small samples, up to 40 denials, 10 dismissals and 15 grievances, for whether each was decided, classified and notified correctly. The arithmetic matters because the timeliness test is not a sample: every late case in the window counts. The organization determination universes rest on the same receipt and decision times a plan already posts in its prior authorization metrics reporting. Botminds' Appeals & Grievances Management is an agentic case management solution for health plans that captures the receipt times, clocks, classifications and notices an auditor asks for as the work happens, with every step on the audit trail.
This guide follows the revised Part C protocol CMS posted in October 2026 with its information collection package (OMB control number 0938-1395), CMS's appeals guidance effective 6 July 2026 and the CY 2025 Program Audit and Enforcement Report. CMS has said it will publish a revised Program Audit Process Overview before its 2027 audits; check it when it appears.
How CMS samples an ODAG audit: what it takes, and what it tests
Universe integrity
What CMS takesUp to 10 cases from each universe submitted
How it is testedChecked live against your systems on a webinar; selections arrive at least an hour before it.
1. Timeliness
What CMS takesEvery case in each universe
How it is testedTested at the universe level against the clock for its type, with and without extensions.
2. Processing coverage requests
What CMS takesUp to 40 denied requests
How it is testedCriteria, reviewer expertise, notices, extensions, refusals to expedite, reopenings.
3.1 Classification: dismissals
What CMS takesUp to 10 dismissed requests
How it is testedAn allowed reason, and a notice with the rights to vacate and to review.
3.2 Classification: grievances
What CMS takesUp to 15 grievances
How it is testedTimely response, 24 hours if expedited, and whether it should have been a coverage request or appeal.
What is a CMS ODAG audit, and what does ODAG stand for?
ODAG stands for Organization Determinations, Appeals and Grievances, the Part C program area in which CMS's Medicare Parts C and D Oversight and Enforcement Group tests how a Medicare Advantage organization handles requests for services and payment, reconsiderations and complaints. CMS describes the area as a review of "compliance with timeframes for processing service requests and post-service claims, and whether these requests/ claims were processed in accordance with 42 CFR 422 Subpart M" (CMS, CY 2025 Program Audit and Enforcement Report). Its Part D counterpart is CDAG, for coverage determinations, appeals and grievances.
The revised protocol names three audit elements: timeliness, processing of coverage requests, and classification of requests. Each has numbered compliance standards that cite the regulation they test, from 422.590 for reconsideration clocks to 422.564 for grievances. The audit covers delegated entities too: every universe row names the "First Tier, Downstream, and Related Entity" that processed the request, and CMS's 2025 report states the principle plainly: "Delegation Does Not Transfer Accountability."
What is a universe in a CMS program audit?
A universe is a complete list of one type of case the plan handled in a set period, in a record layout CMS prescribes. The ODAG protocol asks for five: standard and expedited organization determinations, standard and expedited reconsiderations, payment determinations and reconsiderations, standard and expedited grievances, and reopened determinations. Plans must provide "accurate and timely universe submissions within 15 business days of the audit engagement letter date", and the protocol warns: "Submissions that do not strictly adhere to the record layout specifications will be rejected."
The layouts are exacting. Dates go in CCYY/MM/DD format and times in military format, all fields in one row must use one time zone, no field may be blank, and a reconsideration row records, among other things, the date and time received or upgraded to expedited, the date good cause was established for a request filed after the 65-day window, when any appointment of representative arrived, whether an extension was taken, and the date and time of the determination and of each notification. A universe is, in effect, the plan's own case data read back to it.
The data source is changing. CMS says it will use the Service Level Data Collection for Initial Determinations and Appeals where plans have submitted it and "does not intend to collect audit universes when Sponsors have successfully submitted service level data". The grievance universe is collected either way. The burden moves rather than disappears: data reported to CMS during the year becomes the audit population, so errors in it are found later and counted.
How does CMS sample cases in a program audit?
In two different ways, and the difference is the most useful thing to understand about an ODAG audit. For timeliness, CMS does not sample: it tests every case in each universe against its deadline. For the substance of decisions, CMS reads small samples: up to 40 denied requests across the coverage and payment universes, up to 10 dismissals and up to 15 grievances. Before fieldwork it also picks up to 10 cases from each universe and checks them live against the plan's systems. "The integrity of the universe will be questioned if data points specific to the sample case(s) are incomplete, do not match, or cannot be verified."
The size of the universe depends on the plan's size. The protocol sets the lookback by Medicare Advantage enrollment, so a small plan hands over months of cases and a large one a fortnight.
How many weeks of cases the universes cover, by enrollment
The arithmetic of a timeliness test
Because timeliness is tested on the whole universe, a plan's audit result on timeliness is simply its late cases in the window, and the window is not of its choosing. Take an illustrative plan with 120,000 Medicare Advantage enrollees: its universes cover 12 weeks. If it decides 40 standard reconsiderations a week, the reconsideration universe holds about 480 cases, and every one is timed against 30 calendar days, or 44 where an extension was properly taken. A single bad fortnight, say a mailroom backlog that put 15 cases past day 30, is in the universe in full.
The clocks tested are the ones in the regulation, stated in the protocol in days with and without extensions. For standard initial decisions, 14 calendar days (28 with an extension) for items not subject to prior authorization and 7 (21) for those that are; for reconsiderations, 30 calendar days (44) for services and 7 for a Part B drug; for expedited reconsiderations, 72 hours (17 days with an extension) when the plan approves and 24 hours from its affirmation to forward an upheld case to the independent review entity; 60 days for payment determinations and reconsiderations; and 30 days (44) for grievances. For integrated dual plans, payment reconsiderations are tested against 30 days.
Where CMS uses service level data, it "will request mitigating information from the Sponsor prior to citing noncompliance" for cases that appear untimely. That makes the case file's own dates, such as the true receipt time of a request first received by a delegated vendor, the plan's only defence. How each Medicare appeal clock is counted sets out the counting rules CMS applies.
What fails a case in the samples
In the samples, a case fails on substance rather than timing. The protocol's compliance standards for processing coverage requests and classification amount to a list of questions an auditor asks of each case file, and an appeals team can ask the same questions of its own cases first.
What auditors check in each sampled ODAG case
- Was the decision made on the right criteria?
NCDs, LCDs, general Medicare rules, or internal criteria built under Medicare rules, on appropriate evidence and approved by the committee.
- Was the enrollee's own record considered?
Medical history, physician recommendations and clinical notes.
- Did the right person decide?
A physician with appropriate expertise, not involved in the initial decision, for medical necessity reconsiderations.
- Does the denial notice say why?
Approved language, a specific reason, and the right to a reconsideration, standard and expedited.
- Was any extension proper?
A listed reason, and written notice of it with the right to an expedited grievance.
- Was a refusal to expedite handled correctly?
Oral and written notice, the standard timeframe, and the rights to complain and to resubmit with a physician's support.
- Was an approval later taken back?
Approved services may not be denied later for lack of medical necessity, or reopened without good cause.
- Was a dismissal allowed, and its notice complete?
An allowed reason, the right to have it vacated and the right to review.
- Was the grievance really a grievance?
Or should it have been handled as a coverage request or appeal?
The classification standard catches errors that start at intake. CMS's guidance spells out what a plan must do when it gets classification wrong: an appeal misfiled as a grievance must be forwarded and the member told in writing, and the appeal's clock runs from the day it was received, "as opposed to the date the plan discovers its error" (CMS appeals guidance, §50.11). How to split a letter into a grievance and an appeal covers the intake side.
What are common ODAG audit findings?
CMS's 2025 report, its most recent, describes a reduced audit year (a bid protest cut the number of audits) and draws lessons from what it found. Several concern appeals and grievances directly. Under delegation, CMS found dismissal notices missing the required language about vacating a dismissal and requesting review, quality of care grievance letters that wrongly offered Medicare appeal rights, extension notices that did not explain why the decision was extended, and the new 65-day appeal window applied inconsistently across systems and vendors (CY 2025 report, Lesson 2).
Two other lessons reach appeals through the systems behind them. Under "Coverage Decisions Must Be Based on Complete Information", CMS cites Part D appeals from different prescribers processed as second coverage determinations instead of redeterminations, and duplicate logic failures that caused redeterminations to be processed incorrectly. Under its first lesson it describes a prior authorization system whose duplicate logic failed after an update, so that appeals were processed incorrectly. Its tip is the obvious one that is hard to do: "Test system changes before deployment and after implementation."
CMS also changed how it closes audits. In 2025 it piloted validating simple fixes, such as notice templates or system settings, through webinars or document review instead of a full validation audit. The report credits the change with validating 75% of findings without a full validation audit and cutting average audit closure from 219 to 150 days.
What penalties follow an ODAG audit?
Findings become conditions the plan must correct and validate; serious or widespread noncompliance can be referred for enforcement, which can mean a civil money penalty, an intermediate sanction that suspends marketing or enrollment, or, in the most serious cases, contract termination. In 2025, CMS's enforcement arm imposed 14 civil money penalties totalling $1.54 million, based on violations found through program audits, financial audits and other routine oversight.
CMS's 2025 enforcement in four numbers
14
civil money penalties imposed on referrals from 2025 oversight
$1.54M
total of those penalties
89%
of the violations involved enrollees with financial harm over $100
150days
average audit closure after streamlined validation, down from 219
Read the penalties carefully. None of the 2025 penalty types was about appeals clocks: the violations were in beneficiary cost sharing and provider payments, out-of-pocket limits, low-income subsidy processing and Part D eligibility. What raised penalties was harm to members, and CMS says it considers "whether a Sponsor's monitoring and auditing identified the failure and whether the Sponsor promptly responded to fix the issues". For an appeals department the practical lesson is that a plan which finds and fixes its own late or misclassified cases, and can show it, is in a different position from one whose auditors find them first.
How do you prepare for an ODAG audit?
Run the audit on yourself, on the same data, before CMS does. Produce each universe in the protocol's layout for a recent period, time every case against its clock and read a sample with the checklist above. The weaknesses that show up, such as missing receipt times from a vendor, notices without the dismissal rights or extensions without a written reason, are the ones an auditor will find, and the 15 business days after an engagement letter are not the time to discover them.
Three habits make that easier all year. Capture each field CMS asks for when the work happens, not afterwards. Keep notice templates in one place, with versions, so the plan can show which template a case used and when it changed. And keep a log of the plan's own monitoring and fixes, because CMS weighs self-identified, promptly corrected failures differently. What appeals software needs on day one lists the inputs that make universes an export instead of a project.
Every view, change, signature and letter on the record
Where Appeals & Grievances Management helps with audit readiness
The solution keeps the fields of the ODAG record layouts on every case as a by-product of the work: the receipt time from the earliest channel, the case type and whether it was upgraded to expedited, any appointment of representative, extensions with their listed reason, the determination time and each notification. Classification proposals carry the sentence they rest on, so the classification standard can be answered from the case file. Clocks are settings citing 42 CFR 422.590 and 422.564, versioned and audited, so the plan can show which rule applied on any date.
The universe an auditor would ask for, already in one queue
It does not answer for the plan. Agents never dismiss, extend, sign or send, so every decision an auditor samples was made by a named person, and the compliance analyst still owns the self-audit and the corrective actions. To see the record a sampled case would show, start from Appeals & Grievances Management.
Questions people ask
How often does CMS conduct ODAG audits?
CMS audits a subset of sponsors each year rather than every plan on a fixed cycle, and ODAG is one of the program areas tested. 2025 was not a typical year: CMS's report says a bid protest reduced the number of audits it could conduct.
What is the difference between ODAG and CDAG?
ODAG covers Part C, Medicare Advantage medical services and payments, under 42 CFR 422 Subpart M. CDAG covers Part D coverage determinations, appeals and grievances for prescription drugs, under 42 CFR 423 Subpart M, with its own universes and clocks.
How long does a plan have to submit ODAG universes?
Fifteen business days from the date of the audit engagement letter, in the record layouts the protocol specifies, as Excel or text files zipped and uploaded to the HPMS audit module. Submissions that do not follow the layouts are rejected.
Are delegated entities included in an ODAG audit?
Yes. Universes include determinations made by first tier, downstream and related entities, and each row names the entity that processed the request. CMS's 2025 report was explicit that delegation does not transfer accountability.
What happens after audit findings are issued?
The plan corrects each condition and CMS validates the correction, now often by webinar or document review for simple fixes. Serious noncompliance can be referred for a civil money penalty or an intermediate sanction; in 2025 CMS imposed 14 penalties totalling $1.54 million across all program areas.