An audit letter is a request for evidence, on a deadline, judged against a standard nobody explained when you signed the network agreement. Pharmacies that lose audits rarely lose them on the pharmacy practice. They lose them on the paper.
The three shapes an audit takes
Desk audits are remote records reviews. A list of claims arrives with a deadline, and you send prescriptions, signature logs, prior authorisation records and invoices electronically or by post. Most audits are these.
On site audits put an auditor in your dispensary. You normally get advance notice, though not always much. The scope is broader and the auditor can follow threads a document request cannot.
Invoice audits reconcile what you billed against what you bought. The PBM totals the units of a given NDC you dispensed over a period and asks your wholesaler invoices to account for them. This produces the largest single findings, because a shortfall is not a documentation problem the auditor can be talked out of. It is arithmetic.
What triggers one
Some audits are random. Most are not. Selection runs on outlier detection against peer pharmacies: high dollar claims, unusual concentration in a single NDC, brand dispensing where generics dominate, long day supplies, high cost compounds, heavy use of refill too soon overrides, unusual DAW patterns, a single prescriber accounting for a large share of your volume, or volume that looks like mail order coming from a retail address.
Two behavioural triggers compound. Repeat findings across successive audits get read as systemic non compliance rather than error, and that path leads to network termination rather than recoupment. And continuing a practice after a written instruction to stop, a cease and desist on mailing being the classic example, changes the character of the finding entirely.
What they actually ask for
For each claim in the sample, expect some combination of:
- The original prescription, in whatever form it arrived
- Signature logs, or proof of delivery for anything shipped
- Prescriber verification, particularly for verbal orders and refill authorisations
- Prior authorisation records, including approved quantity and date range
- Wholesaler invoices covering the audited NDCs across the audit period
- Evidence that the patient copay was actually collected
- Documentation supporting any DUR override
The discrepancy categories that cost real money
Ranked roughly by what they tend to be worth.
Invoice shortfall. You billed more units of an NDC than your purchase records support. Recouped in full, and it invites a wider look.
Days supply not supported by the sig. The claim says 30 days, the directions do not produce 30 days, or the directions are “as directed” and produce nothing computable. Titration prescriptions are a known target, challenged under labels like overutilisation, refill too soon, therapeutic duplication or clinical misuse.
Wrong NDC. Billed package size or manufacturer does not match what you dispensed. The drug being clinically identical is not a defence.
Missing or incomplete signature log. Unglamorous and common. No signature, no proof the patient received the drug.
Missing refill authorisation detail. Who authorised it, when, and which of your staff took it. “Verified with office” is not a record.
DAW code without basis. DAW 1 requires the prescriber to have specified it. DAW 2 requires a documented patient request. An unsupported code is an unsupported claim.
Copay not collected. Routine waiver is a network violation, and on federally funded claims it is a great deal more serious than that.
How recoupment is calculated
When a claim is found unsupported, the PBM typically recoups the entire ingredient cost plus the dispensing fee, not your margin. You return money you spent on the drug.
Then there is extrapolation. Some contracts permit the auditor to take the discrepancy rate found in a sample and project it across the full population of claims in the audit period. Run the arithmetic on your own letter:
- Take the number of claims in the sample and the number the auditor has flagged. Divide to get the error rate.
- Multiply that rate by the total dollar value of claims in the audit period, not by the sample.
That second step is where a handful of prescriptions becomes a five figure number. The direct finding on the sample is rarely the exposure.
PAAS National, which provides audit assistance to community pharmacies, publishes an average PBM audit recoupment of $26,144 for 2025, and reports an average reduction of $24,314 for its members. Those are one organisation’s published figures rather than an industry statistic. The order of magnitude is the point.
The protections most pharmacies never invoke
State pharmacy audit statutes exist in most states and pharmacies frequently do not cite them. The specifics vary substantially and you need to read your own, but the recurring themes matter:
- Extrapolation limits. Texas requires recoupment to be based on the actual overpayment or underpayment and prohibits extrapolation for on site and desk audits. Minnesota prohibits it unless state or federal law requires it. Kentucky limits it.
- Clerical error protections. Oklahoma provides that typographical, scrivener’s or computer errors are not fraud and are not subject to recoupment. Pennsylvania’s fair audit law prohibits chargeback or recoupment based on clerical or recordkeeping errors. Texas bars recoupment for unintentional clerical errors unless the error caused actual financial harm to a patient or plan. Kentucky prohibits recoupment for non material clerical errors absent fraud.
- Lookback limits. Several states cap the audit period, commonly at the preceding 24 months of claims.
Working the appeal
Appeals run on the contract’s clock, and the clock is short. Typically a first level review of preliminary findings, then a second level review, and in some contracts an escalation to arbitration or outside counsel.
Two things decide whether an appeal works. Specificity: address each disputed claim individually with the document that refutes it, rather than arguing the finding in general terms. And timing: a document produced during the appeal window is usually accepted, and the same document produced after final findings usually is not.
The self audit that prevents most of this
Once a month, take your top NDCs by dispensed value and reconcile units purchased against units billed. Discrepancies you find are correctable. Discrepancies an auditor finds are recoupments.
Then pull twenty random claims and audit them yourself against the checklist above. If you cannot produce a complete file for all twenty in an afternoon, you have your answer about how a real audit will go.
Attergo Audit builds the evidence bundle for every fill as it happens: prescription image and origin, prescriber validity at the fill date, day supply logic, refill authorization, counselling record, delivery confirmation. When the letter arrives you paste in the claim list and the bundles attach themselves, with the gaps named. Attergo Inventory keeps the purchase to dispense position current, so the invoice question is answered before anyone asks it. Book a demo and bring a real audit letter.