Audit findings are assessed per claim. So the useful exercise is not “are our records good” but “can we produce a complete, defensible file for this one prescription”. Below is that file, item by item, with the failure mode for each.
1. The prescription itself
Whatever form it arrived in: hard copy, fax, electronic via SCRIPT, or a documented transcription of a verbal order. The required elements are patient name, date of issue, drug, strength, dosage form, quantity, directions, refills authorised, and prescriber identification with a signature.
How it fails: the fill date is recorded and the issue date is not. Auditors check issue date because prescription validity is time-limited, commonly one year for non-controls and six months for schedules III to V, though this is set by state law and you should confirm yours.
2. Directions that produce a computable days supply
The single most productive discrepancy category for auditors. The sig must mathematically support the days supply you billed.
How it fails: “as directed”, “use as needed”, or a titration schedule billed as a flat 30 days. Titration prescriptions are a known audit target and get challenged as overutilisation or refill too soon. If the sig is ambiguous, the file needs a clarification note: who you called, when, what they said, and your initials.
3. The exact NDC dispensed
The 11-digit NDC on the claim must match the package you actually opened, including package size and labeller.
How it fails: billing the 100-count NDC while dispensing from a 500-count bottle. Clinically identical, contractually a discrepancy, and recurring NDC billing errors get read as a systemic problem rather than a slip.
4. Quantity, and for schedule II, quantity prescribed
Quantity dispensed has to reconcile to the prescription and to the days supply.
Worth knowing: the Quantity Prescribed field (460-ET) is required on NCPDP claims for schedule II drugs. Note also that the NCPDP Telecommunication Standard is moving from D.0 to version F6, required as of 11 February 2028, so field-level habits built now will need revisiting.
5. The DAW code, and its basis
The product selection codes run 0 through 9. The ones that generate findings are DAW 1, substitution not allowed by the prescriber, and DAW 2, substitution allowed but the patient requested the brand.
How it fails: DAW 1 with nothing on the prescription indicating the prescriber specified it. DAW 2 with no record of the patient’s request. Each non-zero code needs something in the file that supports it.
6. Refill authorisation detail
For every refill beyond what the original authorised: who authorised it, their name and role, the date, and the initials of the staff member who took it.
How it fails: “OK per office” with no name, no date, and no initials.
7. Prior authorisation particulars
The PA case number, the effective and expiry dates, and the approved quantity.
How it fails: a valid PA that does not cover what you billed. If the PA approved 30 tablets monthly and you billed 60, the PA is not a defence for the extra 30.
8. Evidence the copay was collected
How it fails: cash-drawer practices that leave no per-claim trace. Routine copay waiver is a network violation, and on federally funded claims it is considerably more serious.
9. Signature log or proof of delivery
A patient or authorised agent signature, dated, linked to the prescription number. For anything shipped, a carrier proof of delivery with tracking.
How it fails: incomplete signature logs are among the most commonly cited findings. A missing signature means no evidence the patient received the drug, and the entire claim is recouped.
10. Counselling offer
OBRA ‘90 requires the offer to counsel for Medicaid patients, and most states extended the requirement to all patients.
How it fails: the offer is made verbally a hundred times a day and recorded zero times.
11. The wholesaler invoice
An invoice showing you purchased that NDC, in quantities covering what you dispensed, dated before the fill.
How it fails: this is the item pharmacies most often cannot produce, particularly for secondary wholesaler purchases. In an invoice audit the PBM totals your dispensed units against your purchase records and recoups the entire ingredient cost and dispensing fee on the shortfall. There is no documentation argument against arithmetic.
12. DUR override justification
If you overrode a clinical reject, the file needs the reason for service, professional service and result of service codes you submitted, plus the clinical basis.
How it fails: the override is submitted to clear the reject and the reasoning never gets written down.
13. Prescriber validity at the time of the fill
Active NPI, active state licence, and for controls a valid DEA registration in the right schedule. Validity is assessed as of the fill date, not the audit date.
How it fails: a mid-level’s prescription billed under a supervising physician’s NPI, or a prescriber whose registration had lapsed.
14. Compounds, if applicable
A formula sheet listing every ingredient with its NDC, quantity, lot and expiry, the compounding pharmacist’s initials, and the multi-ingredient claim detail.
How it fails: the label survives and the worksheet does not.
How long you keep all of it
Three separate clocks, and the longest one governs:
| Authority | Typical requirement |
|---|---|
| DEA, controlled substance records | 2 years, federal minimum |
| State boards of pharmacy | Commonly longer, varies by state |
| PBM network contracts | Frequently 10 years, with production required within a set window |
Verify the state figure against your own board’s regulations and the contract figure against each provider manual. Do not assume the federal minimum is sufficient, because for audit purposes it usually is not.
Retrieval is part of the requirement
A record you hold but cannot find within the contract’s production window is functionally a missing record. Contracts typically specify both a deadline and an acceptable format. Legible, complete scans are generally accepted.
The test worth running is simple. Pick a prescription filled two years ago and assemble all fourteen items. Time yourself. That is your audit response capability, measured rather than assumed.
Most of these items already exist as events somewhere in the dispensing system at the moment they happen. Attergo Integrations captures them as they occur and Attergo Audit assembles them into a per-claim file, so the two-year-old prescription is a query rather than an archaeology project.