AuditsCompliance-in-a-Box: The Startup Guide to Audit-Ready DocsSVSid Varma · 12 min readFor health care compliance officers who run a program against OIG's seven elements and keep the code, policies, training and committee records in order.
30-day trialUnlimited free viewersNo credit card required
Checked against primary sources on 18 October 2026.
Voluntary guidance for all individuals and entities in health care; rules make similar elements mandatory for some, such as 42 CFR 483.85 for nursing facilities and 42 CFR 422.503(b)(4)(vi) for Medicare Advantage organizations.
No routine OIG audit; programs are scrutinized in OIG investigations and settlements, by independent review organizations under Corporate Integrity Agreements, and by CMS or state surveyors where a rule makes the program mandatory
OIG recommends policy review at least annually, annual training for board, staff and contractors, an annual training plan review, and a compliance risk assessment at least annually
General Compliance Program Guidance (November 2023), with industry segment-specific guidance for nursing facilities and Medicare Advantage, 2023-11. Free to read.
| Date | What happens | Status |
|---|---|---|
| 2026-02 | OIG publishes industry segment-specific compliance program guidance for Medicare Advantage, the second in its segment series | Done |
Each one needs an owner, an approval, and proof it reached the people it covers.
GCPG Section III.A.1 (Element 1)
A code stating the entity's commitment to federal and state law and the ethical standards that govern officers, employees, contractors and medical staff.
GCPG Section III.A.2 (Element 1)
Policies on how the compliance program operates and how the entity reduces risk in areas such as billing, coding, marketing, quality of care and referral arrangements.
GCPG Section III.A.2 (Element 1)
A policy on screening employees, contractors and vendors against the LEIE and state Medicaid exclusion lists, naming who screens, how matches are verified and what follows.
GCPG Section III.B (Element 2)
The compliance officer and committee oversee the program; OIG says committee minutes provide a documentary record of its work, and the board receives reports at least annually.
GCPG Section III.C (Element 3)
An annual training plan listing topics and audiences, reviewed by the committee at least annually, with board members, officers, employees, contractors and medical staff trained annually.
GCPG Section III.E (Element 5)
Published procedures for identifying, investigating and remediating noncompliance, naming the consequences that may apply and the functions involved, applied consistently at every level.
Citations are to the standard or regulation; wording is ours.
What reviewers sample about these documents and the people they cover.
CIAs track the seven elements and rely on independent review organizations. A December 2025 provider CIA requires policies made available to all covered persons, assessed at least annually, and a written training plan within 90 days.
The same CIA names certifying employees, including the CEO, who confirm each year that their department meets federal health care program requirements and the CIA's terms.
Under 42 CFR 483.85, surveyors look for written compliance and ethics standards, policies and procedures, an annual program review, and, for operators of five or more facilities, mandatory annual training.
For MA organizations, 42 CFR 422.503(b)(4)(vi) requires written policies, procedures and standards of conduct, a compliance officer and committee reporting to the governing body, and training at least annually and at orientation.
Write each policy, send it through approval, and send it to the people it covers. Each acknowledgment is recorded by name, with the version, the date and the time.
When a policy changes, the new version is approved, its Editor sends it out again, and everyone it applies to is asked again. Export the record as a PDF or CSV, or give a reviewer Viewer access to the documents their tags allow.
Need help with the rest of HHS-OIG General Compliance Program Guidance? Find a consultant for your standard (opens in a new tab).
Your region’s laws, the standards your customers ask for, and your own house rules. Write each one as a policy, approve it, and send it to the people it covers.
OIG describes it as voluntary, nonbinding guidance and uses 'should' throughout. Several rules make similar elements mandatory, including 42 CFR 483.85 for nursing facilities and 42 CFR 422.503(b)(4)(vi) for Medicare Advantage organizations.
OIG recommends a regular review schedule and review of policies and procedures at least annually so they reflect changes in statutes, regulations and federal health care program requirements. New or revised policies should be available to relevant individuals before practices change.
OIG says board members, officers, employees, contractors and medical staff, if applicable, should be trained at least annually on the compliance program and compliance risks. It also recommends role-based targeted training and prompt governance training for new board members.
OIG notes the code by design may not need regular review, while any handbook expanding on it should be updated as requirements change. It suggests revisiting the code when a new CEO arrives, particularly if the code carries the prior CEO's endorsement.
The GCPG applies across health care, and OIG pairs it with industry segment-specific guidance, including nursing facilities and, from February 2026, Medicare Advantage. Each segment guidance adds risk areas and mitigations for that sector.
Industries that hear about HHS-OIG General Compliance Program Guidance most.
free for 30 days