17 Aug 340B Audit Findings, Severity, and Remediation
An audit letter is not the moment your program is judged. It is the moment your last three years of record keeping gets read back to you. Covered entities that come through well are not the ones with perfect programs. They are the ones who can produce evidence quickly, explain their own exceptions before anyone asks, and respond to a finding with a corrective action plan that a reviewer can accept without a second round. Below is who audits, how the process runs, what gets found, and what closing a finding actually takes.
Who Audits 340B?
Three parties can look at a 340B program, and they are not looking for the same things.
HRSA audits covered entities as the program’s administrator. The scope is the statutory obligations, meaning eligibility of the entity and its sites, the prohibitions on diversion and duplicate discounts, and the entity’s ability to evidence both.
Manufacturers may audit covered entities under the program’s dispute resolution provisions, subject to the required process. Manufacturer audits are narrower and adversarial in posture, and they usually follow a specific concern rather than a general review.
Then there is you. Independent external audits and internal self audits are the only category you control the timing of, and they are the reason most entities never see the other two go badly. An independent reviewer with no stake in the answer finds different things than the team that built the process. That is the entire point of our independent 340B external audit work, and we have written separately on what independent 340B audits cover.
How Much Does a 340B Auditor Make?
That question gets searched constantly, and the interesting version of it is not about salaries. It is about what audit capability costs an entity, and there are only three ways to buy it.
You can hire it, which means a dedicated internal role with 340B specific experience, competing against a small national talent pool. You can develop it, which is slower and creates key person risk if the person leaves. Or you can contract it, paying for expertise only when it is applied and getting exposure to patterns across many programs rather than one.
The honest comparison is not consultant cost against salary. It is either of those against the cost of a finding you did not catch, which arrives as repayment obligations, remediation work, and management attention, and does not arrive on a schedule you chose.
What Are the 5 Stages of Audit?
Most audit frameworks describe five stages, and the 340B cycle maps onto them cleanly enough to be a useful planning tool.
Notification and engagement. You receive notice, an engagement letter, and a scope. Your first job is internal. Name the response owner, freeze nothing, and confirm who is allowed to speak for the entity.
Document production. The reviewer requests policies, registration records, purchase and dispense data, patient eligibility evidence, and contract pharmacy documentation. This stage is where preparation shows most visibly. An entity that has to build its data joins from scratch under a deadline is already behind. Our post on what covered entities must prepare for is the checklist version of this stage.
Fieldwork. Sampling, testing, and interviews. Expect questions to move from the general to the specific, and expect the specific ones to be about claims where your own data looks inconsistent.
Draft findings and response. You receive preliminary results and get an opportunity to respond. This is the most underused stage in the entire process. A well evidenced response can change how a finding is characterized or remove it, and a rushed response cannot.
Corrective action and closure. You submit a plan, execute it, and demonstrate completion. Closure is not the day you submit. It is the day the evidence of execution is accepted.
The First Week After a Notice Arrives
The stages above describe the process. What determines the outcome is usually decided in the first week, before any document leaves the building.
Name one response owner and one point of contact. Multiple people answering a reviewer independently produces inconsistencies that become their own line of inquiry.
Assemble the evidence you already have before you assemble anything new. Registration records, current policies, the last several self audits, the site list, contract pharmacy agreements, and the data extracts you produce routinely. Entities routinely underestimate how much of the request they can already satisfy.
Run your own version of the review first, on the same scope. If there is a problem, you want to know about it before the reviewer does, because a self identified issue with remediation already underway is a materially different conversation from the same issue discovered in fieldwork.
Decide who is in the room, and get counsel involved early where the facts suggest financial or legal exposure rather than after a finding lands.
Say nothing you cannot evidence. The single most damaging habit in audit response is the confident verbal explanation that the records do not support. Reviewers test explanations, and an explanation that fails costs more credibility than the underlying issue was worth.
The Finding Categories That Recur
Duplicate discounts
A drug that generated a 340B discount also generated a Medicaid rebate. The usual root causes are a Medicaid Exclusion File entry that no longer matches billing practice, a managed care arrangement that was never addressed, or a site that carved in on paper and carved out in reality. Our detailed treatment of Medicaid duplicate discounts covers the failure modes.
Diversion
A 340B drug reached someone who was not a patient of the covered entity as the program defines it, or the entity could not evidence that they were. The second version is more common than the first, and it is worth sitting with that distinction, because it means good programs generate diversion findings through documentation gaps rather than through actual misuse.
Eligibility and site registration
A location dispensed 340B drugs before it was registered, after it moved, or without the cost report relationship its category requires. Growth and acquisition activity drive most of these.
Purchasing and account separation
Drugs purchased on the wrong account, or purchased through a group purchasing organization by an entity type prohibited from doing so. This one is unforgiving because it is visible in purchase records and difficult to explain away after the fact.
Records and auditable trail
The underlying transaction may be entirely correct, and the entity still cannot demonstrate it. Findings in this category are the most frustrating and the most preventable.
Contract pharmacy documentation
Written agreements that do not reflect current practice, arrangements that were never registered, or a data feed that cannot evidence what was dispensed to whom. Distance is the problem here. The entity remains accountable for compliance at a location it does not operate, staffed by people it does not employ, running a system it did not configure. Oversight has to be designed deliberately, and the entities that struggle most are the ones that treated the signed agreement as the end of the work rather than the start of it.
How Severity Gets Judged
Reviewers weigh three things. Whether the issue is systemic or isolated, meaning did one claim break or did the control break. Whether the entity found it first, because a documented self identified issue with a remediation already underway reads very differently from the same issue discovered by the reviewer. And whether there is a material financial consequence, since findings with repayment implications carry different weight than procedural ones.
Two secondary factors shape how a finding reads. Duration matters, because an issue that persisted across years of unchanged process is harder to characterize as an anomaly than one introduced by a recent system change. And repetition matters, because an issue that appeared in a prior review and recurred suggests the earlier corrective action was cosmetic. That second one is worth sitting with. The most expensive finding is usually not the new one. It is the old one that was closed on paper.
The practical lesson is that self identification is a severity lever you control. Programs that run genuine self audits and document what they found are not admitting weakness. They are building the record that argues for the milder characterization later.
Corrective Action That Actually Closes
A corrective action plan that only fixes the instance will come back. A plan that closes has four parts. It states the root cause at the level of the control rather than the claim. It describes the change to process, system configuration, or policy that prevents recurrence. It names an owner and a date. And it defines the monitoring that will demonstrate the fix held, along with when that evidence gets reviewed.
Set the review date at the time you write the plan rather than when you close it. A corrective action with monitoring defined but never scheduled is the most common way a closed finding reopens, and reopened findings are read as evidence that the first remediation was cosmetic. We ask entities to put the verification date on the same calendar that carries recertification, because that is the calendar people actually keep.
Where a finding carries repayment or material legal exposure, involve qualified counsel and work from current HRSA guidance rather than from precedent you heard about at a conference. Program facts change, and the version of a rule that circulated two years ago may not be the one that applies. We maintain current material in our 340B resources library for exactly that reason.
Most findings that get overturned are overturned with evidence the entity already possessed and had not assembled into an argument. That is where our 80% success rate in overturning 340B audit findings, a figure published on our site, actually comes from. The record was there. The argument was not.
Frequently Asked Questions
What is 340B in simple terms?
The 340B program requires drug manufacturers participating in Medicaid to offer covered outpatient drugs to eligible safety net providers at or below a statutory ceiling price. Those providers, called covered entities, use the resulting savings to support care for the populations the program was written to protect. In exchange, they accept two hard prohibitions. They may not resell or transfer 340B drugs to anyone who is not their patient, and they may not let a drug generate both a 340B discount and a Medicaid rebate.
Next Steps
If you have received a finding, or you suspect a self audit would produce one, the sequence matters more than the speed. Establish the facts, assemble the evidence you already hold, and only then write the plan. A remediation built on your own records is the kind that stays closed. Get help remediating 340B audit findings.