Why PBMs audit pharmacies in the first place
Let me save you a week of anxiety right up front. You did not get picked for an audit because you did something wrong. You got picked because the PBM ran an algorithm against your claims data and something in your mix triggered their system. It could be high volume of a specific drug class. It could be billing patterns that look different from other pharmacies in your region. It could be a single prescription that looks weird on its own even though the full picture is fine.
Audits are not random and they are not fair. They are a business. The audit department inside a PBM is a profit center, not a compliance department. Every dollar they claw back shows up in their P&L. Their auditors get evaluated on recoupment totals the same way a salesperson gets evaluated on revenue. That is the mental model you need to walk into this with.
Once you understand that, everything else falls into place. The auditor is not looking for "whether you did the right thing." They are looking for documentation gaps they can turn into recoupments. Your job is to close those gaps before they arrive and defend the ones they find.
Audits are a permanent part of running an independent pharmacy. The question is not whether you will be audited. The question is whether you will be ready when it happens. The pharmacies that treat audit defense as an ongoing discipline lose 10 to 20 percent of what the unprepared pharmacies lose.
The three phases and why you need to think about all of them
Every audit has three distinct phases and each one demands completely different behavior. Most pharmacy owners I meet only think about the "during" phase. They have no pre-audit discipline and they have no follow up process. That is where the money leaks.
Preparation is where audits are won or lost, and almost nobody does it. The pharmacies that get destroyed in audits are the ones that start preparing the day the audit letter arrives. By then it is already too late. Preparation is an ongoing discipline, not a panic response.
Pre-audit everything they ask for
When the audit notice arrives, it tells you exactly what they want to review. Your first move is to pull every one of those records and run your own audit on them before the auditor ever walks in the door. Find the gaps yourself. Fix what you can fix. Document what you cannot. If there is a problem with a prescription, you want to know about it before the auditor finds it because that gives you time to prepare an explanation.
Assign one trusted person to own the audit
This person is your audit lead. They handle all communication with the auditor, all document retrieval, and all follow up. It should not be the owner unless the owner has serious capacity. It should be a senior technician or pharmacist who is organized, calm under pressure, and knows where everything lives. Pick this person now, not the day of the audit.
Prepare a space
Set up a quiet area away from the prescription counter where the auditor can work. This matters for two reasons. First, HIPAA. Auditors have the right to see the records they paid for, not your entire pharmacy. Second, you want them physically separated from your workflow so they do not disrupt your day or get curious about things that are not in scope.
Know your rights
Every state has laws about what PBM auditors can and cannot do. Florida has strong ones. So does Tennessee, Texas, Arkansas, and a growing number of states through reform legislation. The auditor is not allowed to go on a fishing expedition. They can only look at records tied to claims in their book of business. They cannot audit claims for a PBM they do not represent. They have to give you appropriate notice. They have to follow the appeal process spelled out in your contract.
If you do not know these rules cold, the auditor has leverage over you that they should not have. Read your state's PBM audit law before an audit ever happens. It is usually 5 to 15 pages and it will change how you behave during the visit.
Know the common review items
Most PBM audits target the same handful of things. If you prepare these proactively, you are ahead of 80 percent of pharmacies.
- Compliance education records. Who has been trained on what. Keep a log with dates, topics, and signatures.
- Refrigerator temperatures. Daily logs, signed by a real person, stored in a real folder or a real system. Gaps in this log are free recoupment money for auditors.
- Licensure information. Pharmacy license, pharmacist licenses, technician registrations. All current. All posted. All with clean copies you can hand over in 30 seconds.
- Ownership information. Who owns the pharmacy, in what percentages, documented properly. If this has changed recently, make sure every PBM has the updated information on file.
- On hand inventory evaluation. They may count physical inventory and compare it against your dispensing records. Large discrepancies are a red flag to them.
- CMS 10147 adherence. Medicare compliance documentation. If you fill any Medicare Part D claims, you need to be buttoned up on this one.
Train your team on policies and procedures
Your team should be able to answer basic audit questions without panicking. Daily or weekly huddles should include a quick review of your SOPs. Every staff member should know where the policies live and how to find them. When an auditor asks a technician "where do you keep your refrigerator logs" and the technician looks confused, the auditor smells blood.
Know your contracts and plan manuals
Your PBM contracts and provider manuals are the rulebook they are auditing against. Most pharmacy owners sign these documents and never look at them again. That is a mistake. The contract tells you what the PBM can and cannot recoup, what the appeal process looks like, and what the timelines are. When you know the rules better than the auditor, you have real leverage.
Learn who is auditing you
Before the auditor arrives, look up the audit company. Who are they? What PBMs do they work for? What is their reputation? There are audit firms that are known to be aggressive and ones that are known to be reasonable. Knowing which one is showing up changes how you prepare.
The auditor has arrived. Everything you do from this moment until they walk out the door is either protecting your pharmacy or costing it money. Stay calm. Stay professional. Stay documented.
If they showed up unannounced, verify them first
Do not just assume a person walking in with a clipboard is who they say they are. Ask for identification. Take their business card. Call the number on the card to verify they work for who they say they work for. Ask them what PBM they are representing and document their answer. Ask how long the audit is expected to take and how many records they are requesting.
If you are not adequately staffed to handle the audit in that moment, say so. They should give you reasonable time to call in whatever help you need. If they refuse, that is a red flag and something you will want documented in your response.
Staff appropriately and never leave the auditor alone
A pharmacist or senior technician should be available to help the auditor with document retrieval and answer any questions. All records should be pulled in the auditor's plain view so there is no appearance of manipulation. Ideally the owner or pharmacy manager is on site to handle questions that go beyond routine. The auditor should never be unaccompanied. Not in your pharmacy, not in a back office, not anywhere.
Protect your workflow and your HIPAA boundary
Keep the auditor out of your prescription work area. They do not need to be counting pills or watching patients check out. Minimize their interruption to your business. From a HIPAA standpoint this is critical. The auditor has a legal right to the records tied to the claims they are auditing. They do not have rights or access to your entire pharmacy operation. Let them have what they are owed and nothing more.
Keep the relationship professional, not adversarial
This is the part most owners get wrong. They let their frustration with PBMs boil over onto the auditor standing in front of them. The auditor is a professional doing their job. Yelling at them, being hostile, or being sarcastic does nothing except make them more aggressive in their findings.
Instead, treat every audit as a learning opportunity. Listen to what they are finding. Ask clarifying questions. Use the experience to identify weak spots in your own operation. Audits are part of doing business and they are not going away. The pharmacies that come out of audits stronger are the ones that treated each one as free consulting on where their systems are weak.
Do not video or audio record the audit. Ever. It creates legal complications that will make your life significantly harder if you need to appeal anything. Take notes. Write everything down. Keep a paper trail. But no recording.
Demand an exit interview before they leave
This is the single most important move you can make during an audit and almost nobody does it. Before the auditor walks out your door, they are going to ask you to sign a document acknowledging their visit. Before you sign anything, insist on an exit interview. Here is exactly what to ask.
"Can you walk me through any discrepancies you found?" Some auditors will be friendly and go through everything. Some will give you examples. Your goal here is not to argue. Your goal is to learn what they found so you can start preparing your response immediately. Sometimes you can even talk through a discrepancy on the spot and resolve it before they ever put it in their report. Once the report is written, that window closes.
"Did I give you everything you asked for?" This question does a specific job. If they say no, you have an opportunity to provide it right now before they leave. If they say yes and you missed something later, you have documentation that they confirmed completeness. Either way you are protected.
"Am I under billing anything?" This is the question that blows pharmacy owners' minds. Auditors know your billing data better than you do. If you are billing a drug at $70 when the AWP is $100 and your cost is $80, the PBM is happily paying you $70 every time. It looks like a clean claim. It looks like it is paying at 100 percent. But you are losing $10 per fill. The auditor can see this and will often tell you if you ask directly. They are not obligated to, but many will because it costs them nothing and they know it helps you survive as a pharmacy that keeps paying their audit bills.
In 24 years I have had auditors point out under billing patterns that were costing pharmacies $2,000 to $5,000 a month. The auditor was there to take money out of the pharmacy but the under billing insight gave the pharmacy more back than the audit recoupment took. You will never get this information if you do not ask.
Review what you sign before you sign it
Before you put your name on any exit document, read it. Make sure the time the auditor was on site is accurate. Make sure the date is correct. Make sure any handwritten notes match what you discussed. Small documentation errors on the exit form become big problems later when you try to appeal something.
The auditor has left. You feel some combination of relief and dread. The actual work starts now. What you do in the next 30 days determines how much of that recoupment you actually pay.
The report and the recoupment
A few weeks after the audit you will receive an audit report detailing every discrepancy and a total recoupment amount. Read it carefully. Some of the items on this report will be documentation corrections you can fix and submit. These are the easy ones. Others will be substantive recoupments where the PBM is claiming you owe them money. Those are the ones you need to decide whether to appeal.
When to appeal and when to just pay
Not every recoupment is worth fighting. Some recoupments are small enough that the time and effort to appeal exceeds the amount at stake. But significant recoupments should almost always be appealed, even if you are not sure you will win.
Before you respond, gather every piece of documentation that supports your position. Prescription copies, prescriber communications, patient records, policy documents, anything that shows you followed protocol.
If the recoupment is significant, do not submit your first appeal without expert review. The single biggest mistake pharmacy owners make in audit defense is responding to the recoupment with the wrong argument on the first try. PBMs have limited appeal windows. You usually get one or two bites at the apple. Submit the wrong argument first and you have limited your options to recover. An hour of expert review can save you tens of thousands of dollars.
Follow up relentlessly
When you are submitting corrections or working through an appeal, document every single interaction. Every phone call. Every email. Who you spoke with. Date. Time. What was said. Reference number if they give you one. When you call back, reference your previous conversations by date and name. This accomplishes two things. It keeps your case moving because the person on the other end knows you are tracking. And it creates a paper trail if you have to escalate.
Use the audit as a learning tool
Once the recoupments are settled, one way or another, the last job is to use the audit to make your pharmacy stronger. Pull the audit report out and study it like a report card. What did they find? Why did they find it? What policies or procedures need to change to make sure the same issue does not show up in the next audit?
This is where most pharmacies drop the ball. They survive the audit, pay what they owe, and go right back to the same habits that got them audited in the first place. The pharmacies that actually improve are the ones that update their SOPs, train their team on the findings, and adjust their systems so the next audit is cleaner.
The pattern I see in pharmacies that survive audits well
After 24 years in pharmacy operations, including a VP role where I built audit defense systems from scratch, I can tell you the single biggest predictor of how a pharmacy handles an audit. It is not size. It is not volume. It is not how good your pharmacist is. It is whether the owner has internalized that audits are part of the job.
The pharmacies that struggle are the ones that treat every audit as an emergency, an insult, or an attack. They get defensive. They cut corners. They do not pre-audit. They do not train their team. They do not read their contracts. And they get crushed.
The pharmacies that thrive treat audit readiness as a permanent operating discipline. Their refrigerator logs are clean every day. Their compliance education records are updated every month. Their contracts are read and reread. Their team knows the SOPs. When the audit comes, it is inconvenient but not catastrophic. They pay a small recoupment, learn something, and keep going.
If you are reading this because you just got an audit notice and you are panicking, that is normal. But read this guide one more time before the auditor arrives, do the pre-audit work on whatever they asked for, and walk into the audit with a calm plan. You will be fine. And when it is over, use the experience to build the ongoing discipline you need so the next one is easier.
The biggest lie pharmacy owners tell themselves about audits
I will leave you with this. The biggest lie I hear from pharmacy owners about audits is "I do everything right so I have nothing to worry about." That is not how audits work. Auditors are not checking whether you did the right thing. They are checking whether you can prove you did the right thing with documentation that meets the specific format their PBM contract requires. Those are two completely different things.
You can be the most ethical pharmacist in America and still lose six figures in an audit because your refrigerator log is missing a signature from June 14th of last year. You can fill a prescription perfectly and still get hit with a recoupment because the prescriber's DEA number was not recorded in the exact format the PBM wanted. The audit game is a documentation game. Play it accordingly.