Pharmacy Revenue Cycle Internal Audit: 340B, Diversion, and Charge Capture

A pharmacy revenue cycle internal audit is a stage-by-stage examination of how medications move from purchase through dispensing, charge capture, billing, and collection, checking that every step is accurate, compliant, and free of revenue leakage. In hospitals and health systems, the work typically follows frameworks from the Association of Healthcare Internal Auditors and touches regulatory programs from the DEA’s controlled-substance rules to the 340B Drug Pricing Program and Medicare Part D.¹ The scope breaks into five connected areas: purchasing and procurement, dispensing and inventory management, the charge description master, pharmacy charge capture, and patient billing and collections. Each stage has its own failure modes, and a competent audit reaches all of them.

Procurement and Receiving Controls

Auditors start upstream. They look for formal procurement procedures that get reviewed on a schedule, competitive bidding, participation in group purchasing organizations, and — for eligible entities — 340B compliance.¹ Testing usually means pulling a sample of drug payments and verifying that invoice pricing matches contracted rates and that receiving records confirm the right drugs arrived in the right quantities.

Controlled substances get closer scrutiny. Schedule I and II drugs must be ordered on official DEA 222 forms or through the electronic Controlled Substances Ordering System, and only a DEA registrant can execute the order. Auditors request the forms for a sample of orders and confirm that ordering access is restricted to licensed pharmacists.¹

Segregation of duties is foundational: whoever orders drugs should not be the same person who receives and stocks them. In smaller pharmacies where full separation isn’t practical, compensating controls such as management review of exception reports and dual signatures on invoices stand in.¹

Inventory, Access, and Diversion Prevention

Once drugs are on the shelf, the focus shifts to inventory accuracy, physical security, and diversion risk.

Access Controls

AHIA guidance considers traditional lock-and-key pharmacy access insufficient; badge readers or biometric scanners are the expected standard, with controlled substances stored in secured narcotic vaults or automated dispensing machines with restricted access.¹ Auditors compare badge access logs against current employee rosters to catch terminated or transferred staff who still have entry privileges. One university health system audit turned up 229 employees across four locations who retained inappropriate pharmacy access after leaving or changing departments.²

Inventory Reconciliation

Pharmacy management systems track par levels, expiration dates, and real-time quantities. Auditors assess whether discrepancy reports from automated dispensing devices are reviewed and resolved promptly. AHIA recommends that unresolved discrepancies be jointly reviewed by pharmacy and patient-care leadership within 24 hours.³ Stock rotation and temperature monitoring are also observed for drug integrity.¹

Diversion Monitoring

Modern diversion programs lean on data analytics rather than manual chart reviews. Automated systems flag users whose dispensing counts sit well above their peer group mean, and alerts fire when preset thresholds on dispensing devices are exceeded.³ Red flags auditors look for include unresolved discrepancy reports, handwritten witness initials that vary in appearance or belong to nonexistent staff, frequent stock outages, and heavy use of overrides on automated dispensing units.

A peer-reviewed study found that supervised machine learning trained on consolidated data from electronic medical records, dispensing cabinets, inventory systems, and employee time clocks classified transactions as high or low risk for diversion with 96.3% accuracy, detecting diversion incidents an average of 160 days faster than manual methods. The same consolidated platforms have compressed audit timelines from 4 to 20 hours per case for manual reconciliation down to 10 to 30 minutes.⁴

Waste disposal is another checkpoint. DEA regulations require two approved employees to witness the destruction of controlled substances, record the drug type and quantity, and sign documentation. Inconsistent or unwitnessed waste is a recognized gap.¹

Charge Description Master Accuracy

The charge description master lists every medication, its dosage, its billing units, and its price. An inaccurate CDM produces overbilling, underbilling, denials, and compliance exposure, which is why it draws high-priority audit attention.

Effective CDM governance includes monthly updates with a formulary service vendor for current pricing and National Drug Codes, quarterly downloads of CMS files for NDC-to-HCPCS mapping and drug multiplier updates, and regular comparison of actual acquisition costs against the pharmacy information system’s cost fields.⁵ Auditors test whether new drugs are added to the CDM promptly and whether the pricing methodology is documented and defensible.¹

Common CDM errors include obsolete NDCs (which cause denials and block drug interaction checks), missing or incorrect quantity conversion factors (which can trigger fraud flags), inappropriate pharmacy billing units such as reporting per milligram instead of per dose, and charges that vary inconsistently across similar products.⁵⁶

Charge Capture and Billing Testing

Charge capture is where pharmacies most often lose revenue. Auditors look for services rendered but never documented, charges posted after the billing cycle has closed, charges coded to the wrong service or patient, and services missing entirely from the digital charge screen.⁷ High staff turnover, decentralized responsibilities, thin training, and skipped daily reconciliation all feed the problem.

A workhorse technique is the inventory roll-forward: beginning inventory plus purchases minus ending inventory equals the amount that should have been billed, and that figure is compared against the billing report to surface variances.⁸ One documented practice saw monthly missed charges swing from under $2,000 to over $29,000, which is why the analysis runs monthly rather than quarterly.

AHIA also recommends reviewing the interfaces between pharmacy information systems and billing systems, examining how NDC-to-HCPCS billing unit conversion factors are configured, and analyzing denials and corrected claims for high-priced drugs.⁹ Another approach, a “medication revenue tracer,” selects 10 to 15 high-cost medication claims and tracks each from administration through final payment to pinpoint gaps in authorization, documentation, coding, and billing.¹⁰

Billing and Coding Errors to Test For

CMS self-audit guidance identifies specific billing errors pharmacies should test proactively:

NDC mismatches, where the claim’s National Drug Code differs from the drug actually dispensed, which also distorts manufacturer rebate calculations.
Quantity and days-supply miscalculations that don’t align with the prescribed dosing schedule.
Partial fill billing that charges for a full prescribed quantity when only a partial supply was dispensed, or that generates a second dispensing fee through a partial fill claim.
Dispense As Written coding errors, particularly DAW 1 on multi-source products.
Package size selection that exceeds what was needed, a frequent issue with topical preparations and compounded products.
Auto-refill abuse and use of financial incentives such as gift cards or copayment waivers to influence where patients fill prescriptions.

CMS frames these as issues to catch internally before a payer or government audit does.¹¹

Denial Root Cause Analysis

When claims are denied, auditors separate three things: the payer’s stated reason, the category of issue (coding, documentation, or authorization), and the specific internal failure that caused it.¹² “Documentation does not support medical necessity” is a reason; the actual root cause might be something as narrow as a missing two-midnight expectation notation for a traditional Medicare admission. UNC Health’s pharmacy-based denials management team, working from a standardized denial correspondence record within Epic, drove the health system’s terminal denial rate from 2.7% to 0.33% between 2017 and 2023.¹³

340B Program Compliance

For covered entities in the 340B Drug Pricing Program, accurate charge capture is what replenishes eligible medications with 340B discounts. Incomplete capture erodes program savings; incorrect billing units create financial and compliance risk at once.¹⁴

The Health Resources and Services Administration runs its own audits of 340B covered entities, focused on preventing duplicate discounts and diversion. HRSA verifies internal controls, tests drug transaction records on a sample basis, and reviews how entities define inpatient versus outpatient status. If noncompliance is found, the entity must submit a corrective action plan within 60 calendar days of the final report and complete implementation and manufacturer settlement within six months. A finding of noncompliance with the diversion prohibition in two or more audits may be treated as “knowing and intentional” and result in removal from the program.¹⁵

PBM Audits and Clawbacks

Pharmacies also face regular audits from pharmacy benefit managers. PBMs review claims for discrepancies and may recoup payments for incorrect quantities and days-supply calculations, NDC mismatches between purchase invoices and submitted claims, and similar errors.¹⁶ Audit types include desktop reviews, onsite visits, invoice audits, and Medicaid and Medicare Part B audits. The preliminary appeal window ranges from 10 to 60 days depending on state law, and final appeals generally must be postmarked within 30 days of the final results letter, with no new documentation permitted at that stage.¹⁷

Post-sale clawbacks, including Direct and Indirect Remuneration fees and Generic Effective Rate adjustments, can substantially reduce reimbursement months after a drug is dispensed. A 2021 Delaware State Auditor’s report described practices where PBMs billed health plans for claims while paying pharmacies nothing, keeping the entire amount as profit, and recommended data analytics programs, full audit rights in contracts, and legislative protections such as clawback bans and reimbursement floors.¹⁸ States including California, Colorado, Georgia, Montana, Indiana, and Nebraska have since enacted PBM reform laws that vary widely in scope, so internal auditors also need to confirm the pharmacy’s rights under state-specific rules and contracts.¹⁹

Drug Supply Chain Security Act Compliance

The Drug Supply Chain Security Act of 2013 requires an interoperable electronic system for tracing prescription drugs at the package level. Dispensers must capture and exchange transaction information, transaction history, and transaction statements with trading partners through secure electronic systems, and must retain the data for six years.²⁰ Full package-level traceability is now in effect for most dispensers, with small business dispensers of 25 or fewer employees exempt through November 27, 2026.²¹ Internal auditors verify that the pharmacy does business only with licensed, registered trading partners, that product appearance is checked on arrival, and that suspect or illegitimate products are quarantined and reported to the FDA within 24 hours.²²

Federal Focus Areas: OIG Work Plan and Price Transparency

The HHS Office of Inspector General maintains an active list of pharmacy work plan items that signal where federal auditors are looking. FY 2025–2026 projects include reducing pharmacy fraud in Medicare Part D, reviewing nursing home pharmacy internal controls for opioid diversion prevention, examining billing vulnerabilities for outpatient drugs that differ from those actually administered, and identifying 340B units to recoup inflation rebates for Part B drugs in Medicare Advantage.²³ Internal audit teams read the Work Plan as a roadmap and shape their own scopes accordingly.

CMS hospital price transparency requirements, updated in the CY 2026 OPPS and ASC final rule, require hospitals to publish payer-specific negotiated rates for all items and services, including medications, in machine-readable files.²⁴ Enforcement of the 2026 requirements began April 1, 2026, with civil monetary penalties for noncompliance. Auditors check that published rates match the CDM and that charge methodologies are documented well enough to withstand public and payer scrutiny.²⁵

Performance Metrics Auditors Track

The Healthcare Financial Management Association’s MAP Keys include 29 metrics across five categories, several directly relevant to pharmacy. Total charge lag days measure the average time between date of service and charge posting. Late charges, defined as posted more than three days after service, are tracked as a percentage of total gross charges. The clean claim rate measures how many claims pass edits without manual intervention, and the remittance denial rate tracks the share of claims denied at the account resolution stage.²⁶ Pharmacy-specific measures such as doses-dispensed-to-charges-billed reconciliation and 340B capture rates round out the picture.

Building a Revenue Integrity Function

Organizations that perform well on these audits tend to have standing, cross-functional teams rather than periodic reviews alone. A pharmacy revenue integrity team usually pulls representatives from pharmacy operations, charge capture, billing and coding, data analytics, and payer contracting.¹⁰ The team maintains the CDM, tracks payer rule changes, trains clinical and billing staff on documentation, analyzes financial trends for risk, and reconciles doses against charges on an ongoing basis. The OIG’s general compliance program guidance identifies seven elements — written policies, a compliance officer, training, communication channels, internal monitoring, discipline for enforcement, and prompt corrective action — as the voluntary framework most organizations adopt for structuring the work.²⁷

1
AHIA. Evaluating Hospital Pharmacy Inventory Management and Revenue Cycle Processes
2
UT System. UTSW Pharmacy Controlled Substances Audit
3
AHIA. Drug Diversion Internal Audit White Paper
4
National Library of Medicine. Machine Learning for Controlled Substance Diversion Detection
5
CompleteRx. Chargemaster Maintenance
6
AAPC. Charge Description Master: Use It to Optimize Revenue
7
NAHRI. Importance of Charge Capture Audits
8
National Library of Medicine. Inventory Roll-Forward Analysis for Drug Charge Capture
9
AHIA. Documentation, Coding, Charging and Billing for Medications
10
Visante. Pharmacy Revenue Cycle 2026
11
CMS. Pharmacy Self-Audit Booklet – Billing
12
HFMA. Getting to the Root Causes of Denials
13
Epic. UNC Pharmacy Denials Reduction
14
Pharmacy Times. Understand the Inextricable Link Between the Pharmacy Revenue Cycle and 340B
15
HRSA. 340B Drug Pricing Program Audit Information
16
CMS. Pharmacy Self-Audit Booklet – Invoice Management
17
Federal-Lawyer.com. Pharmacy Audit Appeals
18
Delaware State Auditor. PBM Audit Report
19
Mintz. PBM Policy and Legislative Update – Spring 2026
20
ASHP. ASHP Drug Supply Chain and Security Act Requirements
21
DSCSA.pharmacy. DSCSA Compliance Information
22
FDA. Drug Supply Chain Security Act
23
HHS OIG. OIG Work Plan – Prescription Drug Projects
24
CMS. Hospital Price Transparency
25
CMS. Hospital Price Transparency Resources
26
HFMA. MAP Keys
27
HHS OIG. General Compliance Program Guidance