Why the annual PBM audit is no longer enough

Annual pharmacy benefit manager (PBM) audits review a sample of claims 12 to 24 months after payment, within a scope the PBM contract defines. That design leaves mid-year errors, systemic issues outside the sample, and anything beyond the audit scope unreviewed until the next cycle. Continuous pharmacy claims monitoring reviews every adjudicated claim in the months between audits.

The annual audit remains a standard oversight tool for health plan pharmacy departments, and it does a specific job well: it creates a documented record and tests named contract guarantees. The gap is what happens between audits, when benefit designs and PBM contract terms change and errors introduced mid-cycle continue to pay until a review reaches them. In Rivera’s State of Pharmacy Payment Integrity research with pharmacy executives at 19 health plans covering more than 32 million lives, respondents reported that audit findings typically lag adjudication by 12 to 24 months, and that engagement fees often approach or exceed the amounts recovered.

This article covers why the audit model leaves those gaps, why mid-year errors in particular go unreviewed, and what continuous pharmacy claims monitoring adds. For a side-by-side comparison of the two approaches, see pharmacy benefit oversight: audits vs. continuous monitoring.

What is a pharmacy benefit audit, and why does it fall short?

A pharmacy benefit audit is a retrospective review, typically by an independent firm, that tests a sample of PBM-adjudicated claims against the plan’s contract terms, benefit design, and regulatory requirements. It falls short because its design limits what it can see: the claims it samples, the period it covers, and the scope the contract allows.

Four features of that design create gaps that a more rigorous audit cannot fully close:

• Lag. Audits typically cover claims adjudicated 12 to 24 months earlier. An error introduced at the plan year build, with a new PBM clinical program, or with a formulary change has already repeated across thousands of claims by the time it appears in findings.
  
  

• Sample. Audits test a portion of claims. A systemic error confined to one drug class, network tier, or member segment can fall outside the sample entirely.
  
  

• Scope. An audit tests what the contract allows it to test. In Rivera’s experience, standard PBM audits cover roughly 35% of the issue landscape.
  
  

• Contractual limits on audit rights. In its proposed rule on PBM fee disclosure for self-insured group health plans, the Department of Labor noted that PBMs often limit audit rights, for example by providing only a sample of records, requiring that the PBM approve the auditor, or requiring the audit to take place on-site at a facility the PBM chooses.

Why do pharmacy benefit audits miss mid-year errors?

An audit tests a fixed historical window on a fixed schedule, so an error introduced in March is not reviewed until the next cycle reaches March claims, often a year or more later. Mid-year changes are where those errors typically originate.

Each mid-year event has to be translated correctly into the PBM’s adjudication configuration, whether it is a formulary update, a new clinical program, a maximum allowable cost (MAC) list change, a contract amendment, or a new state requirement. When the translation is off, the error starts on the first affected claim and repeats on every claim after it. Pharmacy executives in Rivera’s research described a specific version of this: a PBM clinical program implemented mid-year can undo a configuration fix made earlier, and the audit cycle has no checkpoint between reviews to catch it.

This is the core of configuration drift, covered in depth in what is configuration drift in pharmacy benefits. Pricing benchmarks change even more often; national average drug acquisition cost (NADAC), for example, updates weekly.

How does continuous claims monitoring close the gap between audits?

Continuous pharmacy claims monitoring tests every adjudicated claim, each cycle, against the plan’s current contract and benefit rules, so an error is identified in the cycle it appears instead of at the next audit.

The two work together. The annual audit establishes a documented record and tests specific contract guarantees. Continuous monitoring covers the months in between and the categories of error a sample-based review is not designed to catch.

Why does continuous oversight matter more now?

The rules and contracts that govern adjudication are changing more often, and the people pharmacy leaders report to are asking for more than an annual report.

• Rules and contracts are changing faster. Federal reform, state PBM laws, and annual plan design cycles all change the terms adjudication has to follow. On Oct. 16, 2026, CMS issued proposed rule CMS-4214-P, which would require PBMs to allow Part D sponsors to audit them at least once a year on request and would move Part D PBM compensation to flat, itemized service fees beginning Jan. 1, 2028. Each change becomes a new configuration event at the PBM, which is why PBM legislation demands continuous oversight.
  
  

• Financial scrutiny is rising. Pharmacy executives in Rivera’s research described pressure from CFOs, regulators, ASO clients, and state Medicaid programs at the same time, while traditional savings levers such as contract renewals and specialty programs are narrowing. The difference between what was negotiated and what is paid sits apart from those levers.
  
  

• Oversight expectations are changing. In Rivera’s experience working with health plans, plan leadership, large employer clients, and regulators increasingly ask for evidence of ongoing oversight: trend data, documented findings, corrective actions, and financial impact. An annual report covers one point in the year, and continuous monitoring keeps that record current.

What do pharmacy leaders say about the annual audit?

In Rivera’s research, pharmacy executives described the annual audit as a compliance tool more than a savings tool. Their concerns centered on the model’s timing and coverage, and they did not fault audit quality.

• Annual PBM audits are conducted primarily to satisfy a contractual or regulatory expectation.
  
  

• Audit findings arrive 12 to 24 months behind current adjudication activity.
  
  

• Reviewing 100% of claims on an ongoing basis is beyond what internal tools and staffing can support, which leaders described as a known limitation.
  
  

• A PBM clinical program implemented mid-year can break earlier configuration fixes, and the audit cycle has no checkpoint to catch it.

The question pharmacy leaders are increasingly asked is what is happening in their pharmacy claims now. Most pharmacy leaders have the intent to answer it. What they lack is scale.

How does continuous pharmacy monitoring work in practice?

It applies a library of proprietary algorithms, encoded from the plan’s benefit design, PBM contract terms, and regulatory requirements, to every claim after adjudication. Each claim is tested against the rules that should govern it, and pharmacists validate discrepancies before they are documented and quantified for the plan.

Independence from the PBM matters here, because the rules should reflect what the plan negotiated instead of the PBM’s interpretation of its own contract. The work happens after adjudication, with no intervention at the point of claim and no effect on members at the pharmacy counter.

Findings represent dollars the plan should already receive under its existing contract and benefit design. They are not clawbacks from pharmacies, members, or providers. Resolution runs between the health plan and its PBM, and the plan pursues recovery. For how this fits the broader discipline, see what is pharmacy payment integrity.

FAQ

What is a pharmacy benefit audit?

A pharmacy benefit audit is a retrospective review, typically conducted by an independent firm, that tests a sample of PBM-adjudicated claims against the plan’s contract terms, benefit design, and regulatory requirements. Findings become the basis for recovery discussions with the PBM. Because audits cover a defined historical window on a set cycle, they do not show what is happening in current adjudication.

Why are PBM audits called compliance exercises rather than savings tools?

Pharmacy executives in Rivera’s research described annual audits as conducted mainly to meet a contractual or regulatory expectation. Findings arrive 12 to 24 months after claims are paid, the sample can miss systemic errors in narrow claim populations, and respondents reported that engagement fees often approach or exceed recovered amounts. The audit documents oversight, but it is not designed to find savings as they occur.

What does continuous pharmacy claims monitoring do that an audit does not?

Continuous pharmacy claims monitoring reviews every adjudicated claim, each cycle, against the plan’s current benefit design, contract terms, and regulatory requirements. Mid-year changes such as formulary revisions, PBM program updates, and benefit amendments are tested in the cycle they take effect, so pricing discrepancies and configuration errors are identified before they accumulate across a full plan year.

Can a health plan audit its PBM more than once a year?

It depends on the line of business and the contract. For Medicare Part D, CMS proposed on Oct. 16, 2026, that PBMs allow sponsors to audit them at least once a year on request. Outside Part D, audit frequency is typically set by the PBM contract along with applicable federal and state requirements. Continuous claims monitoring runs on the plan’s own adjudicated claims data, so it does not depend on audit frequency.

Are findings from continuous monitoring the same as audit recoveries?

Both identify dollars the plan should already receive under its PBM contract and benefit design. The difference is timing and documentation. Continuous monitoring findings are identified as claims are adjudicated, validated by pharmacists, and documented against specific contract language, so the plan can pursue them with its PBM while the claims are recent. Recovery runs between the health plan and its PBM, not with pharmacies, members, or providers.