SPONSORED CONTENT
You cannot predict when an audit will happen. But you can prepare.
If you operate a 340B covered entity (CE), you know HRSA will eventually come to review your 340B program compliance and integrity. But when?
HRSA’s 340B program audits are random, and you never know when it will be your CE’s turn. However, do not let uncertainty leave you unprepared. Currently, HRSA audits about 200 CEs annually, aligned with the government’s fiscal year, which runs October to September.
After supporting over 500 audits in the last 10 years alone, our team has seen and heard it all. We’ve compiled our observations, checklists, advice, and answers to FAQs into a comprehensive, step-by-step guide for covered entities like yours.
The first thing you should know: The HRSA audit has four distinct stages, each with individual needs, challenges, requirements, and questions.
Here is a glimpse of what happens during each phase along with the most common questions we hear from CEs. Timelines are approximate and can vary from audit to audit.
1. Pre-Audit: 14-90 days
Question: “When is the audit and how long do we have to prepare?”
Answer: The initial audit notification is brief and is emailed to the “Authorizing Official” and “Primary Contact” as noted in the 340B database. HRSA informs the CE they will be audited and instructs that further information will follow. Expect to learn more about timing in the second communication, which will come shortly after. You’ll also receive more information during the pre-audit welcome call, which is typically within 3-4 weeks of the initial notice. Audits are generally held two to three months after notification, but that timing can vary.
2. Audit Pre-Work and the Data Request List (DRL): 30-60 days
Question: “How should we dedicate staff to support DRL preparation?”
Answer: Completing the DRL can be a high-effort activity for many CEs, especially first-timers. On average CEs should expect to dedicate a whole FTE’s-worth of time to assemble documentation, as the process can take more 40+ hours. The time it takes will vary significantly based on the size of the CE, and could take even longer. CEs should also have staff ready for follow-up questions and requests from the auditors.
3. The Audit Review: 30-60 days from the DRL, on average
Question: “What happens if we do not have an answer to an auditor’s question readily available?”
Answer: Many CEs worry about auditors asking the one question they did not prepare for. If the auditor asks for documentation that is not readily available, be honest. Between the close of the audit and receipt of the findings, you will have time to find the missing information and perform corrective actions. Additionally, if you find the documentation, you will have an opportunity to present it to HRSA.
4. Post-Audit and Continuous Readiness: 90 days to several months
Question: “When will we know the results of the audit?”
Answer: After the rigor of the previous phases, most CEs are eager to read the audit report. In our experience working with CEs, HRSA typically sends a report within 6-12 weeks. However, it can sometimes take several months for CEs to receive feedback.
“What now?” is the last question we commonly hear from CEs, particularly those that have just completed their HRSA audit. It is always a good idea to be in a state of continuous readiness. Our HRSA Audit Guidebook is a great place to begin or upgrade your compliance journey.
The guide explains everything you need to know, do, and expect during each phase so you can navigate the increasingly complex and variable audit landscape with ease.
