Medicare Parts C and D sponsors are expected to have strong controls to prevent fraud, waste, and abuse, but there isn’t a statutory or regulatory mandate that every sponsor must operate a formal, written compliance program. Guidance from CMS and the OIG outlines what an effective compliance program should include—written policies and procedures, a designated compliance officer, ongoing training, monitoring and auditing, enforcement with corrective actions, and procedures for investigations and open reporting. Since the requirement to have a formal compliance program isn’t explicitly imposed by law or regulation, the statement is not correct. That said, implementing a formal program aligns with CMS expectations and helps reduce risk, support program integrity, and improve oversight.