PBM Audit Best Practices: Tips for Prioritizing and Conducting PBM Audits

By Yvonne Zachman Fiedler & Derek Frye
Thu, Jun, 29, 2017

Given the many types of PBM audits that are available, figuring out how to plan and schedule these can be challenging for health plans. It is simply not feasible from an operational or resource issue to conduct too many PBM audits at once. A PBM audit best practice is to start with audits that are most likely to yield the greatest return, and to stagger different PBM audits out over a period of several years.

The first step is to check your PBM contract. If such language is not already in your contract, make sure you revise it to include a clause giving you the right to hire an outside, independent auditor to periodically conduct PBM audits.

If your plan has never done PBM audits before, start with a PBM Contractual or Guarantee Rebate Audit. These can often be done without the auditor having to come on site, provided the right data is provided. Given the current rebate environment, this type of audit is likely to yield a high financial return. It’s also beneficial do a separate, but more involved, drug manufacturer rebate audit, which delves into rebate agreement between the PBM and drug manufacturers. These can also yield high financial returns. Given the high dollar amounts involved, it’s a good idea to do a rebate audit once a year.

To get the most accurate picture of your PBM rebate dollars, make sure your PBM rebate audits cover a full calendar year period. Given PBM reporting lag times, you will want to wait to do the audit to at least 180 days after the end of the last quarter you wish to have audited. So, to audit your PBM rebates for calendar year 2016, you will want to start your PBM audit in 3Q 2017. Because every PBM is different, another PBM audit best practice is to work with your auditor regarding timing for notifying your PBM of your intention to conduct an audit.

Even if you don’t believe there’s a need to pay for a full PBM audit of manufacturer rebate contracts, retaining a specialized PBM consulting firm can help you verify that your traditional PBM rebate guarantees are met each quarter. These firms do this by comparing your claims data and product status against information in the same subscription database that PBMs use (Medi-Span).

The next most important PBM audit to consider is a pharmacy audit. This involves a thorough review and analysis of the discounts applied from AWP, and pharmacy dispensing fees, to make sure all drug pricing and discount guarantees as stated in the PBM contract have been achieved for the health plan. Again, the financial returns on these audits tend to be high, given the dollar volumes involved. And like rebate audits, a pharmacy audit should be conducted once a year.

When prioritizing other types of PBM audits, it is helpful to look at where your health plan is in your current PBM contract cycle. In general, PBM audits that are not rebate- or price-related can be staggered out and performed every other year. If you have a new PBM, you may want to prioritize doing a benefit audit first. This audit helps health plans determine if their PBM vendor is properly administering the pharmacy benefits. As benefit designs have become more complex, this type of audit is becoming increasingly important in uncovering errors – which are most prevalent during PBM transition years. And such errors by the PBM expose your plan to compliance risks.

Another PBM audit best practice: if your plan has little or no oversight over PBM fraud waste and abuse programs, then consider prioritizing a pharmacy fraud waste and abuse audit. It’s an effective way to preserve the integrity of the pharmacy benefit, avoid monetary losses, and protect members from potentially serious and costly harm, especially given recent surges in opioid abuse.

For Medicare plans, highly-targeted PBM audits can be a crucial component of your overall risk assessment strategy. Every year, CMS requires Medicare plans to develop a risk assessment plan. (This is likely done by your compliance department, but might be owned by your internal audit department.) CMS mandates that all First-Tier Downstream and Related Entities (FDRs) be listed and a risk category assigned to each. Individual subject matter experts in your health plan should provide key input to the risk plan so you can determine which vendors pose the highest risks. Those with high or medium risk should be audited relative to the functions they perform and relative to the Medicare Managed Care Manual sections they’re performing against (whether compliance focused like chapter 13 or 18, or operational areas they must comply with such as chapters 7 and 16).

Making sure your PBM contract allows you to conduct audits – and conducting these regularly—will help you avoid leaving money on the table, protect your members, reduce compliance risks and put you in a stronger position to demand higher levels of service performance from your PBM. If in doubt about your organization’s ability to conduct effective PBM audits, consider hiring an experienced, independent third-party reviewer with extensive experience in this area.