26 Aug How to Evaluate 340B Consulting Firms and Audit Companies
Most covered entities run this selection once every few years, which means the process is rarely practiced and the criteria are usually invented under time pressure. We sit on the other side of it constantly, and the pattern is consistent. Entities compare firms on price and reputation, then discover after signing that the categories of firm they were comparing were never doing the same job. This is the evaluation we would run if we were buying instead of selling, including the parts that do not favor us.
Sort the Category Before You Sort the Firm
Five kinds of provider sell into this market and they are not substitutes.
Boutique 340B specialists do this and little else. Deep, current, usually small. The risk is bench depth and continuity.
Large healthcare consultancies bring scale, adjacent expertise, and a brand your board recognizes. The risk is that 340B is one practice among many and the person on your engagement may be less specialized than the pitch implied.
TPA and software vendors with advisory arms know the data intimately because they built the system producing it. The risk is independence, since reviewing the output of your own configuration is a structural conflict that has to be managed explicitly.
Law firms with 340B practices are the right call for legal exposure, dispute resolution, and interpretation questions with real consequences. They are not usually the right call for operational remediation.
Audit only firms perform independent external audits without the ongoing advisory relationship. Clean independence, narrower scope.
Deciding which category fits the job comes first. An entity that needs a data remediation and hires a law firm will get excellent advice about a problem it did not have. Our own 340B services sit in the specialist category, and there are engagements where we tell entities a different category fits better.
The Criteria That Actually Separate Firms
Independence
Ask directly whether the firm has any commercial relationship with your TPA, wholesaler, or split billing vendor, including referral arrangements. Entanglement is not automatically disqualifying, but undisclosed entanglement is. If the same organization configures the system and audits its output, the audit is a self assessment wearing a different name.
Audit experience and what happened next
Volume of audits supported matters less than what the firm did when findings landed. Ask how many findings they have responded to, how many were modified or withdrawn after response, and what the response actually consisted of. A firm that has only ever done pre audit readiness work has not been tested in the part that hurts. Our independent external audit practice and our HRSA audit support work are deliberately separate services for that reason.
Depth on the moving parts
Contract pharmacy conditions, manufacturer data requirements, rebate mechanics, and state level contract pharmacy legislation have all been changing. Ask what changed in the last quarter and what the firm advised clients to do about it. A firm that answers that question fluently is tracking the program. A firm that answers generally is reading the same newsletters you are.
Data practice
Ask how they will access, validate, and document your data, and what they will leave behind. The deliverable that matters most long term is a documented lineage from purchase through accumulation to dispense that your team can maintain. If the firm’s method depends on a proprietary tool you will lose access to at the end of the engagement, price that in.
Staffing model
Find out who does the work, not who sells it. Ask for the named individuals, their 340B specific background, and what proportion of the engagement each will personally deliver. Then ask what happens if that person leaves mid engagement.
Continuity and knowledge transfer
The best outcome is that you need the firm less over time. Ask what knowledge transfer is built into the scope and what your team will be able to do unaided at the end. A firm that structures itself as permanently indispensable has told you its business model.
Engagement Models and What They Cost You in Practice
Fixed scope projects give you a predictable price and a hard boundary. The failure mode is a scope written before anyone understood the problem, followed by change orders.
Retainers suit continuous monitoring and are easy to under specify. Write down the cadence, the sample sizes, and the escalation path or you will be paying for availability rather than work.
Hourly advisory suits unpredictable questions and rewards firms who answer slowly. Cap it.
Contingency pricing tied to identified savings deserves the hardest look. In a program where the compliance risk runs in the direction of capturing too much, paying a firm more for capturing more is an incentive pointed at your risk rather than away from it.
Red Flags in a Proposal
Guaranteed savings figures. Nobody can promise a number before seeing your data, and a promise made at proposal stage is a promise the delivery team has to hit somehow.
Findings language that implies certainty about audit outcomes. Outcomes depend on facts and evidence, and no firm controls both.
A methodology section that could describe any client. If the sampling approach is not specific to your site count, payer mix, and contract pharmacy footprint, it was not designed for you.
Credential inflation, particularly certifications presented as though they were program requirements.
No named team. If you cannot see who does the work before you sign, you will meet them after. More of these are catalogd in our list of 340B consultant red flags.
Questions to Ask Before You Sign
Who specifically does the work, and what is their 340B background.
What commercial relationships exist with our other 340B vendors.
Describe a finding you responded to that was not modified, and what you learned.
How will you test our patient definition at a contract pharmacy, in operational detail.
What will our team be able to do without you twelve months from now.
What would you tell us not to buy from you.
The last question is the most informative one on the list. A firm that cannot name anything outside its lane is selling everything.
Running the Selection Itself
The process is worth as much attention as the criteria, because a good criteria list applied to a rushed process still produces a bad decision.
Scope internally first. Write down the problem you are solving in one paragraph, before any vendor sees it. Is this a remediation, an ongoing monitoring function, an audit response, an implementation, or a knowledge transfer. Firms will happily reshape your problem into the one they sell, and the only defense is having written yours down first.
Decide who is on the panel. Pharmacy, compliance, finance, and whoever owns the data should all be represented, because these engagements touch all four and a selection made by one function reliably surprises the other three.
Keep the field small. Three to five firms is enough to see real differences, and beyond that the evaluation degrades into scoring documents rather than assessing people.
Score before you price. Rank the firms on the criteria above with the commercial terms sealed, then open them. It is a small discipline and it changes outcomes, because price anchoring is difficult to unwind once you have seen it.
Check references properly. Ask for entities of your category and roughly your size, and ask the reference what went wrong during the engagement rather than whether they were satisfied. Every engagement has something that went wrong. A reference who cannot name one is a reference who was coached.
Consider a paid pilot. A scoped diagnostic, priced fixed, gives you a working sample of the firm’s judgment, its writing, and its ability to hit a date, at a fraction of the cost of discovering those things during a full engagement. We do these routinely and we would rather be chosen on one than on a proposal.
Write the exit into the contract at the start. Notice periods, deliverable handover, data return, and documentation formats. Nobody negotiates this well once the relationship is already strained.
How We Answer These Questions
We are a 340B specialist firm, so the independence question is easy for us and the bench depth question is the one we have to answer well. Our team is named and published on our about us pages, including the consultants who would actually run your engagement. On audit experience, we have supported 148 HRSA 340B audits and hold an 80% success rate in overturning 340B audit findings, and our clients are 67% more likely to have a HRSA audit without any 340B findings. Those figures are published on our home page.
We will also tell you where we are not the answer. If your issue is primarily legal, you want counsel. If you need a system replaced rather than reviewed, you want an implementation partner. Firms that claim every job is theirs are the ones to be careful with, and that includes us if we ever start saying it.
Frequently Asked Questions
Who audits the 340B program?
HRSA audits covered entities as the program’s administrator. Participating manufacturers may audit covered entities under the program’s dispute resolution provisions, subject to the required process. Covered entities also commission independent external audits and run internal self audits, which is the only category where the entity controls the timing and the scope.
What is a 340B auditor?
A 340B auditor examines whether a covered entity’s purchases, accumulations, and dispenses comply with the program’s eligibility requirements and its prohibitions on diversion and duplicate discounts, and whether the entity can evidence that compliance. The role sits between pharmacy operations and data analysis, and the strongest auditors are fluent in both rather than one.
Who are 340B covered entities?
They are the hospitals and federal grantees named in the statute. Disproportionate share and critical access hospitals sit on the hospital side, federally qualified health centers, Ryan White clinics, and the other grantee types sit on the grantee side, and the category an entity falls into decides which purchasing rules bind it. We keep the full category breakdown in our primer on 340B program eligibility.
What pharmacy companies are in 340B?
Retail and specialty pharmacies participate as contract pharmacies under written arrangements with covered entities rather than as program members in their own right. Which chains and independents are available to a given entity has become less stable, because manufacturer conditions on contract pharmacy distribution have changed repeatedly and continue to evolve. Treat any list of participating pharmacies as a snapshot rather than a settled answer, and verify current arrangements directly.
Next Steps
Run the criteria above across every firm on your list, including the incumbent, and score them before you look at price. If we come out of that process well, we would be glad to talk. Compare Ponaman against other 340B consulting firms and bring the scorecard with you.