An audit letter is not an accusation. It is a request for evidence, on a deadline, judged against a standard nobody explained to you when you signed the network agreement. Pharmacies that lose audits mostly do not lose them on the pharmacy practice. They lose them on the paper.
The three shapes an audit takes
Desk audits are remote records reviews. A list of claims arrives with a deadline, and you send prescriptions, signature logs, prior authorisation records and invoices electronically or by post. Most audits are these.
On-site audits put an auditor in your dispensary. You normally get advance notice, though not always much. The scope is usually broader and the auditor can follow threads that a document request cannot.
Invoice audits reconcile what you billed against what you bought. The PBM totals the units of a given NDC you dispensed over a period and asks your wholesaler invoices to account for them. This is the one that produces the largest single findings, because a shortfall is not a documentation problem the auditor can be talked out of. It is arithmetic.
What triggers one
Some audits are random. Most are not. Selection is driven by outlier detection against peer pharmacies: high-dollar claims, unusual concentration in a single NDC, brand dispensing where generics dominate, long day supplies, high-cost compounds, heavy use of refill-too-soon overrides, unusual DAW patterns, a single prescriber accounting for a large share of your volume, or volume that looks like mail order coming from a retail address.
Two behavioural triggers are worth naming because they compound. Repeat findings across successive audits get read as systemic non-compliance rather than error, and that is the path to network termination rather than recoupment. And continuing a practice after a written instruction to stop, a cease-and-desist on mailing being the classic example, changes the character of the finding entirely.
What they actually ask for
For each claim in the sample, expect some combination of:
- The original prescription, in whatever form it arrived
- Signature logs, or proof of delivery for anything shipped
- Prescriber verification, particularly for verbal orders and refill authorisations
- Prior authorisation records, including approved quantity and date range
- Wholesaler invoices covering the audited NDCs across the audit period
- Evidence that the patient copay was actually collected
- Documentation supporting any DUR override
The discrepancy categories that cost real money
Ranked roughly by what they tend to be worth:
Invoice shortfall. You billed more units of an NDC than your purchase records support. Recouped in full, and it invites a wider look.
Days supply not supported by the sig. The claim says 30 days, the directions do not produce 30 days, or the directions are “as directed” and produce nothing computable. Titration prescriptions are a known target here, and they get challenged under labels like overutilisation, refill too soon, therapeutic duplication or clinical misuse.
Wrong NDC. Billed package size or manufacturer does not match what you dispensed. The drug being clinically identical is not a defence.
Missing or incomplete signature log. A named common finding, and an unglamorous one. No signature, no proof the patient received the drug.
Missing refill authorisation detail. Who authorised it, when, and which of your staff took it. “Verified with office” is not a record.
DAW code without basis. DAW 1 requires the prescriber to have specified it. DAW 2 requires a documented patient request. An unsupported code is an unsupported claim.
Copay not collected. Routine waiver is a network violation, and for federally funded claims it is a great deal more serious than that.
How recoupment is calculated
This is the part that surprises people. When a claim is found unsupported, the PBM typically recoups the entire ingredient cost plus the dispensing fee, not your margin. You return money you spent on the drug.
Then there is extrapolation. Some contracts permit the auditor to take the discrepancy rate found in a sample and project it across the full population of claims in the audit period. Consider an illustrative sample of 200 claims, eleven of which have unsupported day supply, at an average claim value of $184. The direct finding is about $2,024. Extrapolate that 5.5 percent error rate across $900,000 of audited-period claims and the number becomes roughly $49,500. Same eleven prescriptions. Twenty-five times the exposure.
PAAS National, which provides audit assistance to community pharmacies, publishes an average PBM audit recoupment of $26,144 for 2025, and reports an average reduction of $24,314 for its members. Treat those as one organisation’s published figures rather than an industry statistic, but the order of magnitude is the point: this is a five-figure event, routinely.
The protections most pharmacies never invoke
State pharmacy audit statutes exist in most states and pharmacies frequently do not cite them. The specifics vary substantially and you need to read your own, but the recurring themes are worth knowing:
- Extrapolation limits. Texas requires recoupment to be based on the actual overpayment or underpayment and prohibits extrapolation for on-site and desk audits. Minnesota prohibits it unless state or federal law requires it. Kentucky limits it.
- Clerical error protections. Oklahoma provides that typographical, scrivener’s or computer errors are not fraud and are not subject to recoupment. Pennsylvania’s fair audit law prohibits chargeback or recoupment based on clerical or recordkeeping errors. Texas bars recoupment for unintentional clerical errors unless the error caused actual financial harm to a patient or plan. Kentucky prohibits recoupment for non-material clerical errors absent fraud.
- Lookback limits. Several states cap the audit period, commonly at the preceding 24 months of claims.
There is also a federal development worth tracking. The Consolidated Appropriations Act of 2026, signed on 3 February 2026, requires CMS to define and enforce “reasonable and relevant” Medicare Part D contract terms and establishes a process for pharmacies to dispute them, with the Secretary due to define those terms by April 2028 and network access provisions effective 1 January 2029. That does not help with an audit letter sitting on your desk today, but it changes the contractual landscape these audits are conducted under.
Working the appeal
Appeals run on the contract’s clock, and the clock is short. Typically there is a first-level review of preliminary findings, then a second-level review, and in some contracts an escalation to arbitration or outside counsel.
Two things determine whether an appeal works. First, specificity: address each disputed claim individually with the document that refutes it, rather than arguing the finding in general terms. Second, timing: a document produced during the appeal window is usually accepted, and the same document produced after final findings usually is not.
The self-audit that prevents most of this
Once a month, take your top NDCs by dispensed value and reconcile units purchased against units billed. Discrepancies found in your own reconciliation are correctable. Discrepancies found by an auditor are recoupments.
Then pull twenty random claims and audit them yourself against the checklist above. If you cannot produce a complete file for all twenty in an afternoon, you have your answer about how a real audit will go.
Attergo Audit maintains that reconciliation continuously rather than monthly, and Attergo Inventory keeps the purchase-to-dispense picture current, so the invoice question is answered before anyone asks it.