The agency must have a post-payment review process that—

(a) Allows State personnel to develop and review—

(1) Beneficiary utilization profiles;

(2) Provider service profiles; and

(3) Exceptions criteria; and

(b) Identifies exceptions so that the agency can correct misutilization practices of beneficiaries and providers.