.png)
The moment a covered entity opens an HRSA audit notification, the instinct is to panic first and read second. That instinct is understandable, but it costs time you don't have. The first few weeks of an audit follow a predictable sequence, and knowing what's coming is what lets you spend that time preparing instead of scrambling.
In most cases, notification arrives as two separate emails, usually on the same day.
The first comes directly from HRSA. It's the formal notification that your organization has been selected for an audit, along with a high-level overview of what will be reviewed, including eligibility, OPAIS records, contract pharmacies, and the specific 340B IDs in scope.
The second comes from the contractor HRSA uses to coordinate and conduct 340B audits. This email is more operational. It identifies your auditor and primary point of contact, proposes a welcome call time, and outlines your on-site audit dates and initial deadlines. It typically includes two attachments: an information request form, used to gather logistics like who will be on the welcome call, and the data request list, which outlines everything you'll ultimately need to provide.
The right first move is to read both emails carefully, confirm the dates, and review the data request list before uploading anything. This is also the point to start looping in everyone who needs to be involved: your internal 340B team, pharmacy, finance, IT, your TPA, any relevant vendors, and your 340B consulting team. The earlier every resource is engaged, the more time everyone has to identify gaps and coordinate a response before the deadline arrives.
Once the notification letter is received, the auditing contractor will send a scheduling link to set up a welcome call. The time between notification and the welcome call varies, but a gap of a few weeks is common.
The welcome call is often where covered entities get caught off guard. It's not simply an introductory meeting. The auditor will introduce themselves, walk through the audit timeline and key deadlines, review the data request list, and then ask a series of detailed questions about the covered entity's 340B program operations, sometimes twenty-five to forty questions in a single call.
Many of these questions get asked again on the actual audit day, so the welcome call functions as a preview of what's coming. Some questions are simple enough to feel like a trick. Others go deep into the specifics of a particular policy or process. The mix and depth depend on your auditor and on which program settings apply to your organization.
The welcome call questions generally fall into a few categories, and knowing them ahead of time makes a real difference in how prepared your team feels on the call.
Program structure basics. General questions about your covered entity setup and how your 340B program is structured, including mixed-use, contract pharmacy, and entity-owned operations, to the extent each applies.
Procurement. Expect questions across every setting your program uses: mixed-use, contract pharmacy, and entity-owned.
Inventory. What inventory model you use in each setting, whether you stock any consignment inventory, and whether medications are stocked at child sites or non-pharmacy locations.
Vendors and systems. Which wholesalers and TPAs you use, what pharmacy software and inventory tracking systems are in place.
Universe structure. How many separate universes of claims data you'll submit. This trips people up more often than expected. Think through how your organization's claims should logically be divided, whether that's mixed-use, contract pharmacy, entity-owned, or a separate universe for each TPA if you use more than one. It's reasonable to ask the auditor directly whether they have a preference for how you split things up.
Accumulation methodology. How you accumulate 340B eligibility, particularly whether it's based on administration or dispense, which can be a point of confusion in mixed-use settings.
A few habits make the welcome call go more smoothly. Answer only what's being asked, without volunteering extra detail the auditor can always follow up on if they need it. If you don't know an answer, say so and follow up later rather than guessing. And make sure the right people, including any outside consultants, are actually on the call. A short internal planning meeting beforehand, walking through your program's main structure and anticipating likely questions, is one of the most effective ways to prepare.
We sit in on welcome calls with our clients, help prepare answers to the questions auditors consistently ask, and make sure the right internal staff are in the room before the call happens. The covered entity's job is knowing their own program. Ours is making sure that knowledge is organized and ready the moment the phone rings.
The notification letter starts the clock. The welcome call sets the tone for everything that follows. Treating both as preparation opportunities, rather than just steps to get through, is what makes the rest of the audit manageable.
