The best way to prepare for a pharmacy audit is to stay ready before anyone asks. Keep prescription, purchasing, controlled substance, and license records current every month, make sure your written policies describe what staff actually do, and name an owner for each record set. Then the audit letter starts a retrieval job instead of a scramble.
Most pharmacy audit advice kicks in after the letter shows up. By then the records either exist or they don't. No one went to pharmacy school to reconcile a year of invoices against dispensing logs over a weekend, and nobody should have to.
"Pharmacy audit" covers several different reviews, and each one reads your records through a different lens.
Accreditation surveys from URAC or ACHC aren't audits in the payer sense, but they test the same thing: does practice match policy, and can you prove it?
Some audits are routine and some aren't. Payers rarely publish exactly how they choose which pharmacies to review, so assume any claim you submit can be pulled later.
That said, a few things tend to draw attention. Billing patterns that look different from similar pharmacies, high-cost specialty claims, quantity or days-supply mismatches, and complaints can all put a pharmacy on a list. DEA and board inspections can be scheduled, tied to a license or registration event, or prompted by a specific concern.
A pharmacy with clean, retrievable records handles a random audit and a targeted one the same way.
Auditors look for proof. Every claim, count, and policy statement should trace back to a document someone can hand over.
For a payer audit, that usually means a valid prescription with the required elements, a dispensing record that matches what was billed, proof of delivery or pickup, and purchase invoices that support the quantity you dispensed. A claim with a missing signature log or an invoice gap can be recouped even when the patient got exactly the right drug.
For controlled substances, the bar is written into federal rules. DEA registrants must keep required inventories and records available for inspection for at least 2 years, and must take a new inventory of all controlled substances on hand at least every two years. If theft or significant loss happens, the registrant has to notify the local DEA Field Division Office in writing within one business day of discovery and file DEA Form 106 within 45 days. Your state board of pharmacy will want to know too, and board reporting timeframes vary by state. Auditors will check that those reports exist and match your inventory records.
Across every audit type, the most common problem we see is drift: an SOP that described the workflow two years ago, while staff quietly changed how the work gets done.
This table is a starting point, not a complete or definitive list of every requirement. Your state board, your payer contracts, and your DEA registration each add their own rules, so check the current published requirements for each.
| Record set | What "ready" looks like | Who should own it |
|---|---|---|
| Prescriptions and claims | Required prescription elements present; billed quantity and days supply match the dispensing record | Pharmacist-in-Charge or dispensing lead |
| Proof of delivery | Signature logs or carrier confirmations filed and searchable by claim | Operations or shipping lead |
| Purchase invoices | Wholesaler invoices reconcile to dispensed quantities for high-cost drugs | Purchasing or inventory lead |
| Controlled substances | Inventory on file at your state's required interval (every two years federally; as of September 2026, South Carolina requires it every year), ordering records complete, any loss reports filed on time | Pharmacist-in-Charge |
| Licenses and registrations | Every state license, non-resident license, and DEA registration current | Compliance manager |
| Policies and training | SOPs dated, reviewed, and signed; training records show who learned each change | Compliance manager |
If a row has no named owner today, that's your first fix.
Audit readiness comes from small, repeated checks. A big push the month before an audit won't get you there.
If regulatory tracking is the piece that keeps slipping, RegComply, the regulatory alerts module in ComplySuite®, was built for exactly that job.
Read the letter twice before anyone pulls a file. Confirm who is auditing, which claims or date range are in scope, how records must be submitted, and the response deadline.
Check your rights, too. Payer contracts set audit terms, and many states have their own pharmacy audit laws. As of September 2026, Minnesota, for example, requires 14 days' notice before an initial on-site PBM audit and limits the audit period to 24 months from the claim date, unless state or federal law requires longer. Your state's rules may differ, so confirm them for each audit.
Then name one point of contact, log every document you hand over, and answer only the questions asked. Guessing out loud during an audit creates findings that the records wouldn't have.
A pharmacy audit is a review of a pharmacy's records to confirm that claims, dispensing, purchasing, and controlled substance handling meet the rules set by payers, regulators, or program administrators. Common types include PBM and payer audits, DEA inspections, state board inspections, and government program reviews.
It depends on who is auditing. DEA registrants must keep required controlled substance records for at least 2 years. PBM look-back periods are set by contract and, in some states, by law; as of September 2026, Minnesota limits PBM audits to 24 months from the claim date unless other law requires longer. Check your contracts and your state's rules.
A light monthly self-audit on a sample of claims catches most problems early, and a full mock audit once a year tests whether records can be produced under deadline. The right cadence depends on your claim volume, your drug mix, and how many states you're licensed in.
No. Software and consultants can't promise how any audit will turn out. What they can do is keep records current, route rule changes to the right person, and make documents easy to retrieve, which makes an audit a lot less painful to get through.
Yes, with added requirements. Pharmacies that dispense 340B drugs for a covered entity also face HRSA and manufacturer audits focused on diversion and duplicate discounts, which call for their own record set.
Pharmacies that get through audits calmly usually had current records long before anyone asked for them. D2 was built by pharmacists and former pharmacy owners, so we've sat on your side of the table when the records request lands.
If you'd like help finding the gaps in your records before an auditor does, talk with our team.