In FY25, HRSA audited 115 covered entities, and nearly half came back with adverse findings, most of them traced to incorrect OPAIS records. Early FY26 numbers show the same pattern. Of the first 30 audit closures HRSA has posted this year, OPAIS mismatches are once again a top adverse finding.
Two years of findings point to the same root cause. Documentation drifted out of sync with actual operations long before the engagement letter arrived, and the audit only exposed it. Programs that struggle typically carry three things into the review:
- Stale policies that describe how the program used to run, not how it runs today
- Outdated contract pharmacy records
- Unconfirmed OPAIS entries
Each one turns what should be a same-day export into a multi-week reconstruction project.
Why HRSA Audit Risk Is Climbing for Covered Entities
HRSA selects 340B audits through a risk-based and targeted process. Three factors push a covered entity up that risk curve:
- Higher purchasing volume
- More complex program administration
- Larger contract pharmacy networks
Programs that have grown in any of those directions over the past few years have quietly moved up the curve, whether or not anyone updated the compliance plan to reflect it.
The trend line runs back further than one audit cycle. Bluesight’s audit-readiness research put the 2024 adverse-finding rate at 46%, a number that held into FY25’s nearly-half figure and hasn’t reversed heading into FY26. Three fiscal years running, the direction hasn’t changed.
Program growth isn’t the only pressure building. HRSA’s 340B rebate model pilot is adding new documentation and reconciliation requirements on top of existing audit obligations, often for the same compliance teams that haven’t grown alongside the program itself. Audit scope is expanding. Headcount mostly isn’t.
What to Assemble Before the Engagement Letter Arrives
Every HRSA 340B audit prep guide eventually points to the same data request list. Four things should already exist in a covered entity’s file before that list ever lands:
- Policies and procedures that reflect current practice, not whatever was written when the program launched
- A single inventory of every contract pharmacy agreement, pharmacy service agreement, and Medicare cost report
- Confirmation that the OPAIS record matches what’s actually operating, not what was true at last recertification
- A clear owner for each of the above, so nothing depends on one person’s memory
HRSA’s data request list typically pulls together eligibility documentation, contract pharmacy records, and Medicaid Exclusion File status, all things that take weeks to compile if they don’t already live in one place. Programs that keep this file current treat a data request as an export. Programs that don’t treat it as a research project with a deadline attached.
Centralize Documentation So Nothing Gets Rebuilt Under Deadline
Centralizing 340B audit documentation means building one system of record where policies, contract pharmacy agreements, cost reports, and OPAIS status live together, not scattered across three departments and someone’s inbox.
A working system of record does four things differently than a shared drive or a spreadsheet ever could:
| Function | What it replaces |
| One system of record for all auditable documents | Shared drives, spreadsheets, and email threads |
| Named ownership per document type | A single scramble owner assigned after the letter arrives |
| Real-time OPAIS sync | Quarterly manual reconciliation between systems |
| Standing version history and audit trail | Reconstructing a year of activity from memory |
340BCheck is built around this exact model. It syncs with OPAIS daily, so a mismatch surfaces the same week it appears rather than at the next reconciliation cycle. It also keeps policy and agreement documentation in one place and gives every document an owner and a task trail instead of a folder full of undated files.
Auditors respond to organized, consistent documentation with fewer follow-up requests and a shorter review cycle. Disorganized documentation invites more questions, not fewer.
Where 340B Audit Findings Actually Originate
Duplicate discounts and diversion remain the two statutory violations every HRSA 340B audit is built to catch, but the administrative errors that trigger those findings usually take one of three forms:
- Eligibility drift at the patient, provider, or location level between recertification cycles
- 340B split billing software misconfigurations at the contract pharmacy layer that let an ineligible transaction slip through
- Manual, sample-based internal reviews that check a fraction of transactions instead of all of them
A quarterly spot check catches whatever happens to fall in the sample. It doesn’t catch what it doesn’t look at, and the drift keeps accumulating in the gap between reviews until the next audit finally surfaces it.
How to Move Remediation From Finding to Closure
An adverse finding starts a clock. HRSA sets a fixed timeline for full corrective action plan implementation and manufacturer settlement, and covered entities, not HRSA, are responsible for identifying every affected manufacturer and negotiating repayment. Remediation closes faster when it follows four defined stages instead of a running list of open items:
| Stage | What happens | Who owns it |
| Tasking | Finding is logged and assigned immediately, not at the next team meeting | Compliance lead |
| Remediation | Root cause is fixed and manufacturer notification begins | Program owner and pharmacy operations |
| Verification | Fix is confirmed against real transaction data, not assumed | Compliance lead |
| Closure | Repayment settled, documentation filed, and finding formally closed | Program owner |
Unresolved findings carry more than a repayment risk. HRSA posts audit outcomes publicly, and manufacturers, auditors, and future contract pharmacy partners can see an entity’s history before the next conversation even starts.
Continuous Monitoring Replaces the Scramble
HRSA recommends quarterly internal audits as a floor, not a finish line. Sampling and continuous monitoring catch different things:
| Approach | What it catches |
| Quarterly sample-based review | Whatever transactions happen to fall in the sample |
| Continuous 100% transaction monitoring | Every transaction, the same week an error occurs |
Covered entities that treat quarterly reviews as the whole compliance strategy are still operating on a sample, which means they’re still exposed between reviews.
340B compliance software closes that gap by validating every transaction as it happens, not a sample of them after the fact. Split billing carries its own version of the same risk. 340B split billing software that flags contract pharmacy mismatches in real time catches it before HRSA does.
Audit-ready stops being a pre-audit project once monitoring runs continuously. It becomes the program’s normal operating state.
Who Should Own End-to-End 340B Audit Readiness
A document template or a once-a-year consultant engagement won’t cover this. The job calls for 340B software that spans the full cycle, covering documentation, transaction validation, and remediation tracking in one system instead of three.
This isn’t a single-department decision. Pharmacy, compliance, and finance stakeholders all touch some piece of the audit file, and the system chosen should give all three visibility into the same record instead of three separate exports pulled from three separate places.
340BCheck was built around real-world HRSA audit requirements. It covers:
- OPAIS sync
- Policy and procedure management
- Mock HRSA audits
- Task-level remediation tracking
It’s also extending toward the 340B rebate pilot, so procurement decisions and rebate tracking run through the same system instead of a spreadsheet built after the fact. Programs that centralize this work now are the ones that meet the next engagement letter with a file that’s already built, not one that still needs to be.
See how 340BCheck turns audit prep into a daily habit instead of an annual scramble.