The best way to prepare for a pharmacy audit is to stay ready before anyone asks. Keep prescription, purchasing, controlled substance, and license records current every month, make sure your written policies describe what staff actually do, and name an owner for each record set. Then the audit letter starts a retrieval job instead of a scramble.
Most pharmacy audit advice kicks in after the letter shows up. By then the records either exist or they don't. No one went to pharmacy school to reconcile a year of invoices against dispensing logs over a weekend, and nobody should have to.
What Kinds of Pharmacy Audits Should You Expect?
"Pharmacy audit" covers several different reviews, and each one reads your records through a different lens.
- PBM and payer audits. A pharmacy benefit manager or health plan checks paid claims against the prescription, the dispensing record, and proof that the patient received the drug. These can be desk audits run by mail or portal, or on-site visits.
- DEA inspections. The DEA reviews controlled substance inventories, ordering records, and loss reports under your registration.
- State board of pharmacy inspections. Boards check licensure, practice standards, and facility requirements, and the specifics vary by state.
- Government program reviews. Medicaid and Medicare program integrity reviews look at claims paid with public money.
- 340B audits. If you dispense for a 340B covered entity, HRSA or a drug manufacturer can audit the related records. Their website covers what 340B compliance requires you to track.
Accreditation surveys from URAC or ACHC aren't audits in the payer sense, but they test the same thing: does practice match policy, and can you prove it?
What Triggers a Pharmacy Audit?
Some audits are routine and some aren't. Payers rarely publish exactly how they choose which pharmacies to review, so assume any claim you submit can be pulled later.
That said, a few things tend to draw attention. Billing patterns that look different from similar pharmacies, high-cost specialty claims, quantity or days-supply mismatches, and complaints can all put a pharmacy on a list. DEA and board inspections can be scheduled, tied to a license or registration event, or prompted by a specific concern.
A pharmacy with clean, retrievable records handles a random audit and a targeted one the same way.
What Do Auditors Actually Look For?
Auditors look for proof. Every claim, count, and policy statement should trace back to a document someone can hand over.
For a payer audit, that usually means a valid prescription with the required elements, a dispensing record that matches what was billed, proof of delivery or pickup, and purchase invoices that support the quantity you dispensed. A claim with a missing signature log or an invoice gap can be recouped even when the patient got exactly the right drug.
For controlled substances, the bar is written into federal rules. DEA registrants must keep required inventories and records available for inspection for at least 2 years, and must take a new inventory of all controlled substances on hand at least every two years. If theft or significant loss happens, the registrant has to notify the local DEA Field Division Office in writing within one business day of discovery and file DEA Form 106 within 45 days. Your state board of pharmacy will want to know too, and board reporting timeframes vary by state. Auditors will check that those reports exist and match your inventory records.
Across every audit type, the most common problem we see is drift: an SOP that described the workflow two years ago, while staff quietly changed how the work gets done.
What Records Should Be Ready on Any Given Day?
This table is a starting point, not a complete or definitive list of every requirement. Your state board, your payer contracts, and your DEA registration each add their own rules, so check the current published requirements for each.
| Record set | What "ready" looks like | Who should own it |
|---|---|---|
| Prescriptions and claims | Required prescription elements present; billed quantity and days supply match the dispensing record | Pharmacist-in-Charge or dispensing lead |
| Proof of delivery | Signature logs or carrier confirmations filed and searchable by claim | Operations or shipping lead |
| Purchase invoices | Wholesaler invoices reconcile to dispensed quantities for high-cost drugs | Purchasing or inventory lead |
| Controlled substances | Inventory on file at your state's required interval (every two years federally; as of September 2026, South Carolina requires it every year), ordering records complete, any loss reports filed on time | Pharmacist-in-Charge |
| Licenses and registrations | Every state license, non-resident license, and DEA registration current | Compliance manager |
| Policies and training | SOPs dated, reviewed, and signed; training records show who learned each change | Compliance manager |
If a row has no named owner today, that's your first fix.
How Do You Stay Audit-Ready All Year?
Audit readiness comes from small, repeated checks. A big push the month before an audit won't get you there.
- Run a monthly self-audit on a sample of claims. Pull a handful of paid claims and trace each one from prescription to invoice to proof of delivery. Anything that takes more than a few minutes to find is a gap.
- Reconcile high-cost inventory against dispensing on a set schedule. Purchase-to-dispense gaps are much easier to explain in the month they happen than a year later.
- Route every rule change to an owner. In 2025, RegComply tracked and triaged nearly 2,000 regulatory alerts and monitored over 3,300 bills. We wrote about turning regulatory alerts into documented action because an unrouted alert is one of the fastest ways for policy and practice to drift apart.
- Track license renewals outside one person's calendar. A lapsed non-resident license can surface during any audit. Our post on keeping every state board current walks through the multi-state version of this problem.
- Hold a mock audit once a year. Have someone who didn't build the records request them unannounced, with a deadline.
If regulatory tracking is the piece that keeps slipping, RegComply, the regulatory alerts module in ComplySuite®, was built for exactly that job.
What Should You Do When the Audit Letter Arrives?
Read the letter twice before anyone pulls a file. Confirm who is auditing, which claims or date range are in scope, how records must be submitted, and the response deadline.
Check your rights, too. Payer contracts set audit terms, and many states have their own pharmacy audit laws. As of September 2026, Minnesota, for example, requires 14 days' notice before an initial on-site PBM audit and limits the audit period to 24 months from the claim date, unless state or federal law requires longer. Your state's rules may differ, so confirm them for each audit.
Then name one point of contact, log every document you hand over, and answer only the questions asked. Guessing out loud during an audit creates findings that the records wouldn't have.
Frequently Asked Questions
What is a pharmacy audit?
A pharmacy audit is a review of a pharmacy's records to confirm that claims, dispensing, purchasing, and controlled substance handling meet the rules set by payers, regulators, or program administrators. Common types include PBM and payer audits, DEA inspections, state board inspections, and government program reviews.
How far back can a pharmacy audit go?
It depends on who is auditing. DEA registrants must keep required controlled substance records for at least 2 years. PBM look-back periods are set by contract and, in some states, by law; as of September 2026, Minnesota limits PBM audits to 24 months from the claim date unless other law requires longer. Check your contracts and your state's rules.
How often should a pharmacy run an internal audit?
A light monthly self-audit on a sample of claims catches most problems early, and a full mock audit once a year tests whether records can be produced under deadline. The right cadence depends on your claim volume, your drug mix, and how many states you're licensed in.
Can software make a pharmacy audit-proof?
No. Software and consultants can't promise how any audit will turn out. What they can do is keep records current, route rule changes to the right person, and make documents easy to retrieve, which makes an audit a lot less painful to get through.
Does this apply to 340B pharmacies too?
Yes, with added requirements. Pharmacies that dispense 340B drugs for a covered entity also face HRSA and manufacturer audits focused on diversion and duplicate discounts, which call for their own record set.
Get Ahead of the Next Audit
Pharmacies that get through audits calmly usually had current records long before anyone asked for them. D2 was built by pharmacists and former pharmacy owners, so we've sat on your side of the table when the records request lands.
If you'd like help finding the gaps in your records before an auditor does, talk with our team.
