Here’s the part that trips people up. Signing a delegation agreement moves the work. It doesn’t move the accountability. The health plan still answers to NCQA, CMS, and state regulators for every practitioner a delegate approves, and the delegate still has to prove its files hold up every single year.
If you manage a delegated arrangement, on the plan side or the delegate side, this guide gives you the policy structure, the audit tool, and the metrics auditors actually score in 2026.
What changed in NCQA delegation oversight for 2026?
Four changes matter most. Information integrity requirements now belong in every new credentialing delegation agreement, the verification window shrank to 120 days, NCQA issued 2026 corrections with a 90 day adoption clock, and automatic credit now attaches to specific elements rather than a vendor’s name.
- Information integrity replaced system controls. NCQA retired its old system controls language in the 2025 cycle. Delegation agreements that take effect on or after July 1, 2025 must spell out information integrity duties for both parties, and the plan must audit each delegate’s credentialing files for information integrity every year.
- The verification window got shorter. Primary source verifications now have to fall within 120 days of the credentialing decision for Credentialing Accreditation and 90 days for Credentialing Certification. The old 180 day cushion is gone, and files that used to pass now fail on timing alone.
- 2026 corrections carry a deadline. On March 30, 2026, NCQA published corrections and policy changes to the 2026 CR and PN standards. Organizations surveyed under the 2026 standards must put corrections and policy changes in place within 90 calendar days of release.
- Automatic credit got more precise. NCQA reports that 153 of 211 elements in the 2026 Health Plan Accreditation standards qualify for automatic credit or delegation oversight relief when delegates hold NCQA Accreditation or Certification. The credit follows the certified functions, not the brand.
Our take? Most delegates spend weeks polishing credentialing files and about an hour on information integrity. In 2026, that’s exactly backwards. Auditors now ask who can change a verification date in your system, how you catch it, and what you did about it last quarter.
What must a delegated credentialing policy include?
A compliant delegated credentialing policy states who does what, how you vet a delegate before you sign, how you monitor the delegate afterward, and what happens when it falls short. NCQA organizes these requirements under CR 9, Delegation of CR, in four elements.
NCQA CR 9 elements and the evidence auditors request
The 11 sections every delegated credentialing policy and procedures document needs
- Purpose and scope. Name the lines of business (commercial, Medicare Advantage, Medicaid) and every practitioner type the delegation covers.
- Definitions. Delegate, subdelegate, CVO, de facto delegation, file universe, and lookback period.
- Delegation decision criteria. NCQA status, practitioner volume, prior audit history, and state requirements.
- Predelegation evaluation. Documents you request, file audit method, passing threshold, and who approves.
- Delegation agreement standards. Responsibility grid, reporting cadence, information integrity terms, and remedies.
- Delegate reporting. What the delegate sends (new approvals, terminations, roster changes, ongoing monitoring hits), how often, and in what format.
- Annual oversight methodology. Policy review, file sampling, information integrity audit, and performance evaluation.
- Corrective action. Deficiency thresholds, CAP deadlines, reaudit timing, and escalation path.
- Subdelegation. Prior written approval and which party oversees the subdelegate.
- NCQA Accredited and Certified delegates. Status checks, scope checks, automatic credit tracking, and reportable event steps.
- Committee reporting and records retention. Which committee reviews results and how long you keep audit evidence.
Write procedures in active voice with a named owner on every step. “The Credentialing Manager sends the audit notice 30 days before the review” tells an auditor exactly who failed if the notice never went out. “Audit notices will be sent” tells them nothing. Our medical credentialing services team rewrites policies this way because surveyors read ownership as evidence of control.
Still deciding whether delegation fits your group at all? Start with our primer on how delegated credentialing works. Smaller practices often get faster results from standard insurance credentialing support for payer enrollment than from taking on the oversight burden that delegation brings.
Keep Your Delegation Evidence Audit Ready
Delegation oversight falls apart when your policy lives in one binder and your audit evidence lives in five inboxes. Our credentialing oversight support maps your delegation agreement to CR 9, builds the evidence folder auditors expect, and tracks every semiannual report so nothing slips. Talk with our team about your next delegated credentialing audit.
How does the NCQA 8/30 file audit method work?
The 8/30 method lets you audit a small sample first and expand only when you find a problem. You randomly select 30 initial credentialing files and 30 recredentialing files, review the first 8 in each group, and stop if all 8 pass. If any of those 8 fail, you review the remaining 22.
NCQA also accepts a second approach: auditing 5 percent of files or 50 files, whichever is less. When a delegate has fewer than 30 files in a category, you review every file in that category. Many health plans pull predelegation samples from files completed in the prior three years and annual samples from files completed since the last review.
Comparing delegated credentialing file audit methods
What score passes a delegated credentialing audit?
NCQA scores elements. Payers set their own pass marks in the delegation agreement. Many health plans treat any file audit score below 90 percent as deficient. Baylor Scott & White Health Plan and Blue Cross and Blue Shield of Kansas both publish 90 percent thresholds in their delegation policies, so plan for that floor unless your agreement says otherwise.
Here’s a scenario that plays out in plenty of groups. The Credentialing Manager at a 45 provider orthopedic practice in Tampa gets a Blue plan audit notice on a Tuesday with a 30 day deadline. The files look clean. Then the auditor opens file number 6, a surgeon recredentialed in March, and finds the license verification dated 131 days before the committee decision. One file. It trips the 8/30 expansion, and the team spends the next week defending 22 more files instead of onboarding three new physicians.
That delay doesn’t stay in the credentialing office. New providers wait, visits go unbilled, and claims start bouncing for enrollment reasons. It’s a clear example of how credentialing gaps ripple into your revenue cycle.
Which audit metrics should you use to evaluate delegated credentialing?
Track the metrics that predict audit failure before an auditor finds it: file accuracy, verification timeliness, recredentialing cycle compliance, ongoing monitoring speed, report timeliness, CAP closure, roster accuracy, and information integrity exceptions.
Audit metrics for evaluating delegated credentialing in healthcare
If you oversee more than one delegate, put these metrics in a single scorecard and review it quarterly. You’ll spot the delegate that’s drifting long before the annual audit tells you.
How do you build a delegated credentialing audit tool?
A delegated credentialing audit tool is a scored checklist that ties each policy requirement and file element to the NCQA standard behind it. Build it in three parts: a policy review, a file review, and an oversight evidence log.
Part 1: Policy review checklist
- Credentialing and recredentialing criteria for each practitioner type
- Primary source verification sources and time limits
- Credentialing committee composition and decision authority
- Practitioner rights to review, correct, and check application status
- Ongoing monitoring sources, frequency, and interventions
- Information integrity controls and subdelegation language
Part 2: File review columns
Columns to include in a delegated credentialing file audit tool
Part 3: Oversight evidence log
- Receipt dates for every semiannual or contractual report
- Committee minutes approving audit results
- CAP issue dates, due dates, and closure dates
- Dated screenshots of each delegate’s NCQA status from the NCQA Report Card directory
Version the tool by standards year. A 2024 tool scores system controls. A 2026 tool needs information integrity rows. Reusing last year’s tool is the fastest way to miss a new requirement without noticing.
How do NCQA Accredited or Certified delegates change your oversight duties?
When a delegate holds NCQA Accreditation or Certification for the delegated functions, you can earn automatic credit for some elements and skip parts of the annual evaluation. You still sign an agreement, still collect reports, and still verify the delegate’s status and scope. NCQA’s practical guidance on delegation for health plans lays out where relief applies.
- Check scope, not just status. Oversight relief covers only the verification options a CVO holds certification for. Every option outside that list goes back on your oversight calendar.
- Check the standards year. For information integrity credit, NCQA’s 2026 delegation appendix looks for CVOs certified under the 2025 standards or later. A CVO certified under an older cycle may not earn you that credit.
- Mixed panels cost credit. Automatic credit applies only when all delegates for a function hold NCQA Accreditation or Certification. One uncertified delegate can pull the oversight work back to you.
- De facto delegation earns nothing. NCQA doesn’t grant automatic credit for de facto delegation, even when that entity holds NCQA status.
- Watch for reportable events. NCQA guidance from December 2023 states that if you delegate more than half of your primary source verification and that delegate loses NCQA status after your survey, NCQA treats it as a reportable event with a 30 calendar day notice window.
What happens when a delegate fails an annual audit?
A failed audit triggers a corrective action plan, a focused reaudit, and, if problems persist, reduced scope or revocation. Your policy should define each step and its deadline long before you need it.
- Written findings. You send results within the window your policy sets, tying each failed element to its standard.
- Corrective action plan. The delegate responds with root cause, fix, owner, and due date for every finding.
- Focused reaudit. You review only the failed elements again on the date your policy specifies.
- Escalation. Your credentialing committee reviews repeat failures and can suspend new approvals or revoke part or all of the delegation.
NCQA expects you to act on what you find. Element D looks for proof that you identified the problem and followed up. A CAP that sits open for a year counts against the plan, not only the delegate. And if a suspension stops new provider approvals, your billing team feels it within weeks. Our outsourced medical billing services often surface those credentialing denials first.
How do you stay audit ready all year?
Run a mock audit twice a year with the same tool your payers use, and keep one evidence folder per delegate organized to mirror CR 9 Elements A through D.
- Schedule desktop audits for all delegated relationships in the same month when your contracts allow it.
- Recheck NCQA status for every certified delegate monthly and save a dated copy.
- Pull your own 8/30 sample 60 days before each payer audit and fix what you find.
- Log every policy change with an effective date and committee approval.
- Run ongoing monitoring against the HHS OIG exclusions database, SAM.gov, and state licensing boards on a fixed monthly calendar.
Medicare Advantage organizations carry one more layer. CMS rules on provider selection and credentialing at 42 CFR 422.204 require written credentialing policies, and CMS holds the plan responsible for functions it delegates. If your delegate serves MA members, your policy should say so plainly.
Take the Fire Drill Out of Your Annual Audit
An annual delegation audit shouldn’t feel like a fire drill. Medicotech runs mock 8/30 audits, rebuilds policies to the 2026 CR 9 structure, and closes CAP items with evidence your auditor can trace. If your next review is already on the calendar, our credentialing team can review your files first and help you reduce audit findings.
The bottom line on delegated credentialing oversight
Delegation saves time only when the oversight behind it is as disciplined as the credentialing itself. Write the policy around CR 9, score files with a tool built for 2026, track the eight metrics above, and close every CAP with evidence. Do that, and the annual audit becomes a formality instead of a scramble.
Frequently asked questions about delegated credentialing oversight
What is a delegated credentialing policy?
A delegated credentialing policy is the written document that governs how a health plan assigns credentialing work to a provider group or CVO and how it oversees that work. It covers the delegation agreement, predelegation evaluation, annual oversight, corrective action, subdelegation, and reporting. NCQA scores it under CR 9, Delegation of CR.
How often must a health plan audit a delegated credentialing entity?
NCQA requires an annual review of the delegate’s credentialing activities, including policies, a file audit, a performance evaluation, and an information integrity audit. The plan also reviews delegate reports at least semiannually. Many plans add monthly reporting in the delegation agreement.
What is the NCQA 8/30 rule in credentialing audits?
The 8/30 rule is a file sampling method. You randomly select 30 initial and 30 recredentialing files and review 8 from each group. If all 8 pass, the review stops. If any fail, you review the remaining 22. Delegates with fewer than 30 files get a full review.
What score do you need to pass a delegated credentialing audit?
The delegation agreement sets the passing score, not NCQA. Many health plans treat file audit scores below 90 percent as deficient and require a corrective action plan. Aim for 95 percent internally so a single failed file doesn’t push you under the payer floor.
Does an NCQA certified CVO remove delegation oversight requirements?
No. An NCQA Accredited or Certified delegate earns automatic credit or oversight relief for specific elements, but only for the functions it holds certification for. You still need a signed agreement, regular reports, and documented status checks. De facto delegation never earns automatic credit.
What is information integrity in delegated credentialing?
Information integrity replaced NCQA’s system controls requirement in the 2025 standards. It covers how a delegate protects credentialing data from inappropriate changes, audits modifications, and reports issues. Agreements effective on or after July 1, 2025 must include these duties, and the plan audits them annually.
Can a credentialing delegate subdelegate its work?
Yes, but only with prior written approval from the health plan. The delegation agreement must state which organization oversees the subdelegate. The plan keeps final accountability for every credentialing decision, no matter how many layers sit beneath it.
What documents should you prepare for a delegated credentialing audit?
Prepare current credentialing policies, the signed delegation agreement, the file universe list, credentialing committee minutes, ongoing monitoring logs, information integrity audit results, prior corrective action plans with closure evidence, and proof of NCQA status if the delegate holds accreditation or certification.
