A PBM Audit Is an Enterprise Risk Event

A pharmacy benefit manager audit may begin with claims, but its consequences can reach payment, network participation, remediation, and termination.¹

The response cannot live at one pharmacy desk. A single finding may involve the submitted claim, prescription, purchase invoice, inventory movement, delivery record, provider manual, and governing agreement. Prime Therapeutics, for example, identifies all of those records within its current oversight framework.²

Federal rules add other record duties. Medicare Part D contracts preserve broad audit rights and require records that support coverage and payment decisions.³ Federal drug supply law separately requires dispensers to retain specified transaction records for at least six years.⁴

Reconstruct four connected records

• Claim record. Identify each submission, rejection, reversal, correction, rebill, payment, and adjustment.
• Product record. Match purchases, receipts, transfers, dispenses, returns, and inventory to the product actually billed.
• Authorization record. Connect the prescription, prescriber communications, patient documentation, and delivery evidence.
• Obligation record. Identify the agreement, manual, amendment, network term, and legal requirement that controlled on the transaction date.

Aggregate totals can expose patterns, but they can also hide reversals, timing differences, omitted suppliers, labeler changes, and arithmetic errors. Leaders need a transaction-level matrix that ties each allegation to evidence, contract language, financial exposure, an accountable owner, and a deadline.

Preserve first, interpret second

Secure native claim histories, prescriptions, invoices, inventory reports, correspondence, portal notices, manuals, and accreditation records before drafting the response. Prime’s July 2026 manual permits invoice verification through wholesalers and requires prompt cooperation.⁵ It also states that conflicting documentation may not be accepted during its appeal process.⁶

A working spreadsheet can organize the case, but it should never replace the underlying business record. The response should distinguish contemporaneous evidence from later remediation.

Quantify the real exposure

The demand total is a starting point, not the conclusion. Separate duplicated amounts, math errors, documentation issues, transaction exceptions, systemic control failures, and defensible claims. That analysis guides reserves, escalation, appeal priorities, and operating corrections.

Deadlines deserve the same discipline. Prime’s general process gives a pharmacy 30 days after the final report to appeal, while state law may require a different period.⁶ A central calendar should capture each contractual, regulatory, and litigation date.

Use the review to strengthen operations

A rigorous response can reveal recurring reversal patterns, weak invoice intake, missing prescription support, provider-manual gaps, credentialing risks, or training failures. The goal is not only to contest an unsupported demand. It is also to prevent the same weakness from producing the next one.

Operations must supply the records, executives must own the response, and counsel must test the evidence.

See the related analysis on contract governance, review areas of experience, or read the author’s background.