The Audit Letter Is Coming.
Here’s How to Be Ready.

Audits Stopped Being Occasional

At the National Community Pharmacists Association’s 2025 annual convention in New Orleans, PBM audits were the second most discussed issue among pharmacy owners, behind only reimbursement. That’s according to healthcare law firm Frier Levitt, whose attorneys met with dozens of owners and operators there. Owners reported a significant uptick in audit activity across all the major PBMs, naming OptumRx, Express Scripts, CVS Caremark and Humana. Frier Levitt summed up the sentiment in one line: “audits are no longer episodic; they are constant.”

The tactics have shifted too. The owners Frier Levitt spoke with described several new patterns: inventory audits reviewing purchase records against dispensing records as a standard part of every audit; allegations that patients or prescribers deny authorizing prescriptions even where the pharmacy holds documentation; hard-line positions on DAW and prescriber documentation; claims-level data used to flag anomalies including distance between patients and prescribers; and heightened scrutiny of controlled substances.

Many pharmacies also said PBMs lean heavily on technical points — signature logs, refill documentation, prescriber communications — to justify substantial recoupments “even where no fraud, waste, or abuse exists.”

The practical change is this: you can’t prepare for an audit after the letter arrives. If audits are constant, the file that defends a claim has to exist on the day you dispense it, not the day a PBM asks for it.

The inventory audit is the one to take most seriously, because it doesn’t examine one prescription. It compares everything you billed for a drug against everything you can prove you bought. A gap between the two isn’t treated as a paperwork issue. It’s treated as a claim you can’t support.

Watch which of your products carry the most exposure: high-cost medications, controlled substances, and anything dispensed DAW. Those are the categories the owners at NCPA said are drawing the most scrutiny.

---

Know the Rules Before the Auditor Arrives

Many states have passed pharmacy audit laws — often called fair audit or audit integrity laws — that set rules for how PBMs audit pharmacies. Frier Levitt’s 50-state overview lists the tactics they’re designed to address, including extrapolating minor clerical errors, recouping money for immaterial technical violations, lack of audit transparency, retroactive claim reversals, incentive pay for auditors, undefined appeal rights, and excessive or overly broad audits.

The typical protections include advance notice of audits, limits on how often a pharmacy can be audited, prohibitions on extrapolation, materiality standards, defined appeal rights, and restrictions on recouping for non-material clerical errors.

The details vary state by state, and the details are where a defense is won. Two examples show the range. Oklahoma’s Pharmacy Audit Integrity Act requires written notice by certified letter, identifying the specific prescription numbers and fill dates, at least 14 calendar days before an audit. Wholesale purchase audits need at least 30 calendar days’ notice. Kentucky’s audit law limits extrapolation and prohibits recoupment for non-material clerical errors absent fraud.

There is a catch on scope. According to Frier Levitt, most of these laws apply to commercial plans and Medicaid managed care plans. Whether they reach self-funded ERISA plans or Medicare Part D plans depends on how the individual law is drafted, and PBMs have objected where states have tried.

Federal rules add a separate obligation that no state law shortens. Under 42 C.F.R. § 423.505, Part D plan sponsors must keep records for 10 years, and under § 423.504(i) the same 10-year requirement applies to their first-tier and downstream entities. CMS states it directly: “Although state law may not require a Part D sponsor to participate in any state audits after a specified time period… federal regulation mandates participation for 10 years after the date of service.” Your network contracts are how that requirement reaches your pharmacy, so check what yours say about record retention.

Find your state’s pharmacy audit law this month and note three things from it: the required notice period, whether extrapolation is allowed, and how clerical errors are treated. Then check which of your PBM contracts it actually covers. A protection you don’t know about is a protection you won’t use.

---

The Pre-Audit Checklist

The owners Frier Levitt heard from at NCPA described audit defense as “a core survival skill.” CMS’s own pharmacy self-audit guidance, written for Medicaid program integrity, makes the same point from the other side. By comparing purchases with claims and sales, a pharmacy can find the gaps an auditor will find — before the auditor does. CMS suggests self-auditing can become part of daily, weekly or monthly routines.

Here is the checklist. It is built around the tactics owners reported in 2025 and the documentation an audit will ask for.

1. Reconcile purchases against dispensing. Every month, pick your ten highest-cost products and compare the units you billed with the units on your wholesaler invoices. Include purchases from every supplier, not just your primary wholesaler. This is the core of an inventory audit, so run it on yourself first.
2. Keep invoices retrievable. An invoice you can’t produce within the notice period is, for audit purposes, an invoice you don’t have. Know where every supplier’s invoices live and how far back they go.
3. Audit your signature logs. Spot-check a week of pickups and deliveries each month. Owners reported signature logs as one of the most common technical grounds for recoupment.
4. Document DAW and prescriber communication at the time of fill. If a prescription is dispensed DAW, or a prescriber was contacted to clarify it, the note belongs in the record that day — with the date, who you spoke to, and what was agreed.
5. Check days’ supply and directions. Directions that can’t be calculated, and days’ supply that doesn’t match the quantity, are classic desk-audit findings.
6. Retain records to the longest standard that applies. For Part D claims, that’s 10 years under federal rules, whatever your state’s shorter requirement says.
7. Log every audit request and response. Record the date received, the notice period, what was requested, what you sent and when. If a finding goes to appeal, that log is your timeline.

When an audit letter does arrive, read it before you gather anything. Check the notice period against your state law, confirm which claims and date ranges are in scope, and note the response deadline and the appeal rights. Then produce exactly what is requested, organised and on time. If the findings involve a significant recoupment, a network termination notice or an allegation of fraud, talk to a pharmacy attorney before you respond.

Build it before the letter comes. Reconcile the invoices. Keep the logs clean.