CMS Open Payments Audit: Resources & FAQs

CMS can initiate an audit at any time. Common triggers include discrepancies between submitted data and third-party sources, late or incomplete submissions, patterns of disputed records, and prior enforcement history.

CMS has also added Sunshine Act-specific audit guidance to its official FAQ documentation, a signal that audit activity is an ongoing enforcement priority rather than a periodic one. CMP issuance has increased in recent fiscal years: 7 penalties in FY2020, 3 in FY2021, and 9 in FY2022. Combined with new proposed rulemaking, that pattern indicates compliance teams should treat audit readiness as a continuous operational requirement, not an annual exercise.

CMS audit authority is established under 42 C.F.R. § 403.912(e)(2). This provision requires applicable manufacturers and applicable GPOs to maintain records supporting their submitted data and to make those records available to CMS upon request. The underlying statutory framework is Section 6002 of the Affordable Care Act, which codifies the Sunshine Act.

CMS requests documentation that substantiates each reported transfer of value. Compliance teams should be prepared to produce:

• Contracts and consulting agreements with covered recipients
• Expense reports and receipts tied to specific payment records
• Fair market value (FMV) assessments for services rendered
• Attendance records for meals, events, and speaker programs
• Internal approval workflows and sign-off documentation
• Reconciliation records showing how data moved from source systems into the Open Payments submission

The audit trail must connect each submitted record back to a source document. Gaps in that chain, particularly in high-volume, low-dollar categories like food and beverage, represent meaningful exposure.

Under current CMS proposed rulemaking (public comments due June 15, 2026), failing to respond to an audit request within 30 days would constitute grounds for civil monetary penalties. This is a forward-looking regulatory signal, not yet a final rule, but compliance teams should treat 30 days as the working standard for response readiness.

Documentation cannot be assembled reactively. Records, reconciliation files, and supporting evidence must be organized and accessible before an audit request arrives.

CMS can impose civil monetary penalties across several categories:

• Failure to report: $1,000 to $10,000 per payment not reported, up to an annual cap of $150,000.
• Knowing failure to report: $10,000 to $100,000 per payment, up to an annual cap of $1,000,000.
• Failure to respond to an audit: Under the proposed 2026 rulemaking, non-response within 30 days would trigger additional CMPs.

These figures apply per record, not per submission. For organizations with high transaction volumes, even a small percentage of inaccurate or missing records can produce material penalty exposure.

The reporting deadline for CY2025 data was March 31, 2026. Applicable manufacturers and GPOs were required to submit all general payments, research payments, and ownership and investment interests to CMS by that date. The dispute resolution window and final publication timeline follow the submission deadline.

Amending or missing records after submission does not eliminate audit exposure. CMS retains the right to audit any program year's data within the applicable records retention window.

CMS requires applicable manufacturers and GPOs to retain records supporting their Open Payments submissions for five years from the date of submission. This applies to all supporting documentation, not just the submitted data itself. Compliance teams should confirm that document retention policies cover the full five-year window and that records remain retrievable, not just stored.

A CMS audit is an external, regulatory review initiated by the agency. It carries legal authority, defined response obligations, and penalty risk. An internal compliance audit is self-initiated and serves as the primary mechanism for identifying and correcting data quality issues before CMS review.

The two processes are complementary. Compliance teams that continuously audit their own expense reports, payment records, and submission data are better positioned to respond to a CMS request quickly and accurately. Internal audits reduce the likelihood that a CMS review will surface material discrepancies.

There is no regulatory minimum for internal audit frequency, but the practical standard is continuous monitoring rather than periodic sampling. CMS audits can cover any record in a submitted dataset. A compliance program that reviews only a sample of expense reports leaves the remaining records unexamined and potentially inaccurate.

Compliance teams with high HCP engagement volumes, multiple field sales teams, or complex speaker program activity carry the greatest exposure from incomplete internal review. Continuous, automated auditing of 100% of expense records is the most defensible posture ahead of a CMS audit.

CMS allows covered recipients, including physicians, teaching hospitals, and certain other practitioners, to dispute records submitted about them during a defined dispute resolution window. If a covered recipient disputes a record and the applicable manufacturer cannot substantiate it, that record may require correction or deletion.

Unresolved disputes, or disputes that reveal data quality problems in the original submission, can draw CMS attention. Compliance teams should treat the dispute resolution period as a data quality checkpoint, not just an administrative step.

CMS published proposed rulemaking in 2026 that would formalize the audit response timeline. The key proposal: failing to respond to a CMS audit request within 30 days would constitute a basis for civil monetary penalties. The public comment period closed June 15, 2026.

If finalized, this rule would set a hard deadline that compliance teams must meet regardless of internal resource constraints. Organizations that rely on manual record retrieval or decentralized documentation are most at risk of missing that window.

Covered recipients include physicians and teaching hospitals, the two categories included since the program began, along with six additional practitioner types added starting with Program Year 2021 data collection: physician assistants, nurse practitioners, clinical nurse specialists, certified registered nurse anesthetists, anesthesiologist assistants, and certified nurse-midwives.

Reporting entities need a process for identifying which category a given recipient falls into, since payments to non-covered individuals (such as pure researchers with no clinical license, in certain contexts) are handled differently than payments to a listed covered recipient type.

A Program Year runs from January 1 through December 31 and represents the calendar year in which a reportable payment or transfer of value took place. Reporting entities collect data throughout the Program Year, submit it to CMS the following spring, and CMS publishes the data later that year once the pre-publication review period closes.

For example, Program Year 2025 covers payments made between January 1 and December 31, 2025. That data was due for submission by March 31, 2026, and published on June 30, 2026. Because CMS can audit any Program Year within the five-year retention window, compliance teams should keep several years of records organized and accessible at once, not just the most recent submission.

CMS collects Open Payments data across three separate categories. General Payments cover transfers of value unrelated to research (consulting fees, meals, travel, and speaker compensation, among others) and represent the category most relevant to day-to-day HCP engagement compliance. Research Payments cover payments made in connection with a research agreement, protocol, or clinical study. Ownership and Investment Interests cover ownership or investment stakes that physicians, or their immediate family members, hold in an applicable manufacturer or GPO.

Each category is reported, reviewed, and published separately, and CMS's combined "total Open Payments" figure for a given Program Year adds all three together. Most audit activity for pharmaceutical and device compliance teams centers on General Payments, since that category carries the highest transaction volume.

Research Payment records include a Name of Study field and, where applicable, a ClinicalTrials.gov identifier, so CMS can confirm a reported payment ties back to a real, publicly registered study. When the submitted study title no longer matches its official ClinicalTrials.gov listing, when the identifier field was left blank, or when an internal shorthand name was submitted instead of the study's registered title, the record no longer reconciles against the public registry CMS checks it against.

This scrutiny is not limited to the current Program Year. Because CMS can audit any Program Year within the five-year retention window, a Name of Study mismatch on a recent submission often prompts a look back at prior years' Research Payment records for the same pattern, since a naming habit that produced one mismatch typically produced others.

When CMS flags a Name of Study inconsistency, the first step is to request the specifics directly from CMS: the exact Record IDs and Program Year tied to the flagged entries. Correcting those exact records first keeps the response scoped to what was actually requested and produces a direct, verifiable fix.

The correction shouldn't stop at what CMS identified. Reporting entities should review every Name of Study entry on file, current and prior Program Years, against the ClinicalTrials.gov registry, and correct any mismatch found even if CMS never flagged it. See CMS's dispute and correction guidance for how corrected records are resubmitted and re-attested.

Covered recipients can review the records submitted about them and, if something looks inaccurate, file a dispute directly in the Open Payments system. Reporting entities are notified and are expected to work directly with the covered recipient to resolve the discrepancy. CMS does not mediate disputes. If the reporting entity updates a record in response, it must resubmit and re-attest the corrected data.

Disputes are meant to be resolved during the annual pre-publication review period. Any dispute still outstanding when that window closes is published as disputed rather than resolved, which is a visible flag to anyone reviewing the public data, including CMS. See CMS's dispute and correction guidance.

Each year, before CMS publishes Open Payments data, covered recipients have a defined window, typically April 1 through May 15, to review the records submitted about them and flag anything inaccurate. An extended resolution period runs May 16 through May 30 for outstanding disputes; any records still unresolved by May 30 are published as disputed. Covered recipients can also file disputes on newly submitted data through December 31 of the publication year, outside the standard window.

Compliance teams should treat this window as an early-warning system, not just an administrative step. Unresolved disputes, and the data-quality issues they expose, often mirror the kinds of records CMS is most likely to scrutinize in a later audit. See CMS's review and dispute guidance.

Yes. Physician assistants and nurse practitioners, along with clinical nurse specialists, certified registered nurse anesthetists, anesthesiologist assistants, and certified nurse-midwives, became covered recipients starting with Program Year 2021 data collection. Reporting entities that engage these practitioner types must track and report payments to them using the same standards, categories, and documentation applied to physicians and teaching hospitals.

This expansion meaningfully increased the population of providers a typical field team interacts with that now falls under Open Payments reporting, which is one reason continuous, automated expense monitoring has become more important than periodic manual review.