.png)
By the time audit day arrives, most of the outcome has already been decided by how well the sample claims were reviewed in advance. But knowing the shape of the day itself, and what happens in the months that follow, still matters. Audits can wrap in a single day or stretch across several, depending on the size and complexity of the program, and the schedule can shift based on staff availability.
The day typically opens with a brief introductory conference, simple introductions to get things started. From there, the auditor moves into pharmacy and site tours, observing how drugs are purchased, received, stored, dispensed, and replenished, and how each of those steps is tracked.
The bulk of the day is spent on documentation and the sample claim review. This is where the auditor works through the EMR, tracing each selected claim from the qualifying encounter through to the 340B purchase. Credentialing is a common point of friction here: the auditor will want someone from credentialing or medical staff services to walk through how providers are employed, contracted, and credentialed, along with the actual employment documentation for every provider represented in the sample.
Having a virtual meeting line open throughout the day is worth setting up in advance, in case a TPA representative, a consultant, or another team member needs to join quickly to answer a specific question without being physically present.
The day closes with a short conference covering any outstanding items, since entities typically have a few days afterward to upload additional documentation to the portal. The auditor won't share any conclusions or make any determinations on-site. Findings are written up and submitted to HRSA separately.
The sample review follows the same logic used in internal audits, applied claim by claim in real time. Auditors start with the patient and the qualifying encounter, confirming where care occurred and that it meets your program's eligibility methodology. From there, they validate the provider relationship and location, then follow the transaction through purchasing to confirm the utilization was compliant. If Medicaid is involved, they'll review your duplicate discount process against what your policy says you do, pulling in billing documentation as needed.
Throughout this process, staff will move between the EMR, billing system, purchasing system, and TPA, building one continuous story: the qualifying encounter, followed all the way through to the 340B purchase. The clearer that story is, the faster the review goes.
A few habits help during the day itself. Stay organized. Answer only what's asked. If you need to confirm something before answering, say so. Auditors expect this and will simply note the item to revisit before the day ends.
Once audit day wraps, you may be asked to submit a small amount of additional documentation over the following days. After that, the waiting period begins. Results typically take anywhere from two to six months to arrive, and they may include both areas for improvement and formal findings.
If HRSA identifies findings, you'll be required to submit a corrective action plan, commonly called a CAP. A CAP details the specific steps you'll take to address each finding, including any policy updates or operational changes, and how you'll prevent the same issue from recurring. HRSA has to formally review and approve the CAP before the audit is considered closed, and may request proof of implementation as part of that review.
This stage can involve back and forth. HRSA may decline an initial CAP submission and request revisions, additional detail, or documented proof that changes were actually implemented. Because of that back and forth, the full timeline from audit day to formal closure can range from roughly six months to, in less straightforward cases, up to two years.
Once an audit closes, the findings themselves are worth treating as a resource. Updating and tightening policies and procedures, adjusting TPA configurations, and refreshing staff education based on what the audit surfaced are all part of using the experience to strengthen the program going forward, rather than simply closing the file and moving on.
Audit readiness works best as something built into how a program operates year-round, not something assembled after a notification letter arrives. That means keeping policies aligned with actual practice, documenting internal audits and any corrective actions taken, and making sure everyone on the team knows who owns each part of the program. Annual mock audits, run in the same style as an actual HRSA audit, are one of the most effective ways to surface gaps and prepare a team before a real deadline is on the table. The goal isn't a perfect program. It's a program that can consistently show it identifies issues, corrects them, and stays actively managed.
We support covered entities through the full arc of an audit, from mock audits and DRL preparation through the audit day itself and, when needed, drafting and tracking a corrective action plan to formal closure. The covered entity's job is running the program and its patients. Ours is making sure the story that program tells, from encounter to purchase, holds together the day it's tested.
