Employer plan audit guideline

Every pharmacy-benefit audit turns on a date: which contract terms applied, which entity held the money, and what the public record showed at the time.

A self-funded plan pays for a claim on one date, under one version of its PBM contract, through a pharmacy that may be affiliated with the PBM, and earns a rebate that may pass through an aggregator months later. Whether the plan was charged correctly and paid what it was owed depends on the terms and facts in force at each of those dates.

This guideline sets out how a plan can test every claim against those dates. It covers what the Consolidated Appropriations Act, 2026 adds from 2028–29, and where 340B affects a plan's costs and rebates without appearing in any report the plan receives.

This is a practice guideline, not legal or accounting advice. Statutory references are cited; the rest is our method, and we label it that way.

A single claim and its rebate carry many dates

A single "claim date" hides most of these. Most disputes about pricing, rebates and fees are really disputes about which date's terms apply.

Which record governs which question

What the Consolidated Appropriations Act, 2026 adds, and what it leaves out

For plan years beginning on or after August 3, 2028, the CAA 2026 (ERISA §726, added by §6701) requires PBMs to give plans detailed reports, including drug-level spending, rebates, spread pricing, and dispensing through affiliated pharmacies. Rebates must pass through in full, including amounts an aggregator first receives. Plans gain an annual rebate audit by an auditor they choose and the PBM does not pay. A PBM contract that doesn't comply is treated as unreasonable under ERISA §408(b)(2).

What it leaves out. No reporting element identifies 340B claims, covered entities or contract pharmacies. The Medicare Part D provisions require only a list of drugs subject to 340B agreements where the PBM or an affiliate has an arrangement with a covered entity, not individual claims. For employer plans, 340B stays invisible in the statutory reports.

Before 2028–29, every right a plan has comes from its contract.

Tests on every claim

Finding 340B rebate exclusions without a 340B flag

A manufacturer may exclude a claim from commercial rebates because it treats the claim as 340B. The plan loses that rebate, and the statute gives it no way to see why. Four routes, strongest first:

1. Manufacturer dispute files. Claim-level exclusions, with reasons, in the rebate invoicing and dispute records. Reached through the contract's audit clause now, and through the rebate audit from 2028–29.
2. The claim's own 340B indicator, where pharmacies populate it and the PBM passes it through.
3. Unit gap. Units paid against units rebated, by drug and quarter, from the plan's own rebate reports. This measures what is missing, not why.
4. Dated-registry inference. Claims at pharmacies listed as contract pharmacies on the date of service, identified without anyone's cooperation.

Routes 3 and 4 together support the audit demand. Route 1 turns it into proof. A claim excluded as 340B at a pharmacy that was not listed for the entity on the date of service is a rebate the plan may be owed.

What an audit right has to specify

"Audit rights" in PBM contracts are often narrowed by annual limits, capped samples, PBM-approved auditors and excluded rebate contracts. A right that means something states:

1. Scope, including records held by affiliates, aggregators and subcontractors.
2. Claim-level electronic data in a defined layout, with control totals.
3. An auditor the plan chooses, with no PBM approval.
4. Frequency and a lookback that match the relevant limitation periods.
5. Deadlines for notice, production and response.
6. Full-population analysis, with no sample caps.
7. Confidentiality that never blocks production to the auditor.
8. Cost-shifting above an error threshold, and interest on recoveries.
9. Survival after the contract ends.
10. Status questions (340B listing, affiliation) decided against a named, independent dated record as of the date of service.

With LLM-assisted review, testing every claim no longer costs more than testing a sample. What limits an audit now is the data the contract secures.

Every finding has a route

Audit standard

The same ten requirements apply as for every audit we describe: named assertions, a complete population, evidence the PBM does not control, testing against the terms and record in force on each date, cited provenance for every dated fact, full-population screening before sampling, reconciliation end to end, typed and routed findings, an auditor independent of the PBM, and unsettled questions reported rather than resolved silently.

One claim, three audits

The plan, the manufacturer and the 340B covered entity can each examine the same claim. The plan asks whether 340B treatment cost it a rebate. The manufacturer asks whether a 340B price was owed. The covered entity asks whether it received the value it was due. When all three test against the same dated record, their findings reconcile instead of conflicting.

The limits

• Rebates are earned on utilization in bulk, so attributing them to a single claim is an allocation, not an observation.
• Public data shows 340B listing, not whether a particular claim was actually replenished at a 340B price.
• Until 2028–29, the plan's data rights are whatever its contract provides.
• A plan fiduciary's duties sit with the plan. This guideline supports those duties; it does not replace advice from the plan's own counsel.

Sources

• Consolidated Appropriations Act, 2026 (H.R. 7148, enrolled bill), Division J: §6701 (ERISA §726 reporting), §6702 (ERISA §408(b)(2)), §6224 (Part D)
• ERISA §408(b)(2); Form 5500 Schedule C
• Department of Labor proposed rule on PBM fee disclosure (January 2026)