340B Mock Audit and HRSA Audit Preparation
HRSA audits roughly 200 covered entities a year, and adverse findings have run between half and two-thirds of audits depending on the year. A mock audit tests the same areas against your real data, so the first time you see a finding is not in a formal letter.
At a glance
- Test areas
- 25
- Engagement length
- 5 weeks
- Findings delivered
- Live, not emailed
- Follow-up review
- Week 12
What a mock audit is, and what it is not
A mock audit is a structured test of your 340B program against the criteria HRSA applies in a formal audit. It is not a policy review, and it is not a checklist walkthrough. We work with your actual claims, your actual OPAIS record, your actual contract pharmacy agreements and your actual purchasing history.
The output is a set of findings, each carrying a severity rating, a root cause, the evidence reference that supports it, and the regulatory basis. Alongside it sits a remediation plan written so your compliance committee can assign owners and dates without reinterpreting anything.
When entities engage us
- A HRSA audit notice has arrived and there are weeks, not months
- Annual recertification is approaching and nobody has tested anything in a year
- A new pharmacy director has inherited a program with no documentation of its history
- Contract pharmacy count has grown faster than oversight capacity
- A board or compliance committee has asked a question nobody can answer with evidence
- An acquisition has merged two programs with different practices and one policy set
The compliance chain HRSA actually tests
Every finding traces back to a break somewhere in this chain. We test it start to finish, in order.
Eligibility
Entity and site qualify under the statute, with evidence to prove it.
OPAIS
The public HRSA record matches your actual registered sites and arrangements.
Patient definition
The written definition is tested against real encounters, not assumed.
Purchasing
340B-priced drugs are bought through the correct, non-GPO pathway where applicable.
Inventory
Virtual or physical inventory accumulation matches how the pharmacy actually dispenses.
Dispensing
Dispenses are correctly attributed to an eligible patient and provider.
Medicaid
Carve-in or carve-out status matches actual billing, preventing a duplicate discount.
Contract pharmacy
Agreements, ship-to bill-to structure and manufacturer restrictions are current.
Reconciliation
Discrepancies between purchasing, dispensing and replenishment are found and closed.
Documentation
Every step above has evidence an auditor can review, not just a practice that exists.
Five weeks, defined week by week
Kick-off & data request
Week 1. Scope confirmation, named client owner, and a specific data request: policies, TPA reports, OPAIS record, child site list, contract pharmacy agreements and a claims sample.
Testing
Weeks 2–4. The 25 areas worked systematically, with evidence logged against each. Two to three clarification calls with your team as questions surface.
Findings & presentation
Week 5. Draft findings shared in advance, then presented live so your team can challenge, correct and understand each one before it is finalized.
Remediation & follow-up
Weeks 5–6 and week 12. Remediation plan with owners and dates, then a progress review at week 12 that is included in the engagement.
A deliverable set built to be used, not filed
Four artifacts, each aimed at a different reader. The findings report is for your 340B team. The executive summary is for your CFO. They are written separately because they are not the same document with different fonts.
- Findings report — every finding with severity, root cause, evidence reference and regulatory citation
- Remediation plan — prioritized actions with named owners and target dates, formatted for your compliance committee
- One-page executive summary — exposure and required investment, written for finance leadership
- Updated policy gap list — what your written policies say versus what your practice does
- Live findings presentation, delivered by the ACE-certified lead
- Week 12 follow-up review — progress against the remediation plan, at no additional cost
ExhibitClient feedback
“The findings we could have guessed. What we could not have produced ourselves was the evidence trail behind each one — that is what made it actionable with our committee.”
Illustrative example based on typical engagements. Client names are withheld and figures are representative, not guaranteed outcomes.
Straight answers before you commit to anything
Can you guarantee we'll pass our HRSA audit?
No, and you should be cautious of anyone who says otherwise. HRSA audits examine your records, practices and history — no external party controls that outcome. What we can do is test the same areas HRSA tests and show you where you'd fail today, with time to close the gaps.
How much does a 340B mock audit cost?
Single-site engagements are a fixed fee. Multi-site health systems are priced as a base fee plus a per-site increment, which scales fairly and is straightforward to justify in procurement. You receive a firm number before the engagement begins.
How often should we run one?
Annually is the general expectation for a mature program, and HRSA looks for evidence of regular internal self-auditing regardless of who performs it. Entities with heavy contract pharmacy exposure, recent acquisitions or a change in 340B leadership often benefit from a more frequent cadence in the first year.
We already have a TPA. Why would we need this?
A third-party administrator runs your split billing. It doesn't audit its own accuracy, rewrite your policies, or tell you what it's failing to capture. A mock audit sits alongside whichever TPA you use.
We just received a HRSA audit notice. Can you help in time?
Often, yes — tell us on the first call so we can prioritize. An audit-response engagement is scoped differently from a routine mock audit: we focus first on the areas most likely to be examined and on assembling the evidence you will be asked to produce.
When did someone last test your program against real data?
If the answer is more than a year ago, or nobody is sure, that is usually the point at which a mock audit pays for itself.