Mutually Acceptable Audit Rights
Sounds like agreement. Functions like a veto.
Executive Brief
An audit is how a promise becomes collectible. Everything you negotiated, every guarantee, every pricing term, is an assertion until someone independent checks it.
Here’s a sentence from a PBM contract we scored earlier this year.
Under no circumstances can the specific individual auditor(s) have testified previously as a witness in litigation against [PBM] or any other pharmacy benefit managers.
Read the reach of that language. Not just litigation against this PBM. Litigation against any PBM.
The full clause grants an audit right, then disqualifies every auditor who has ever examined a pharmacy benefit contract and told a court what they found. The same section requires the auditor to be mutually acceptable, so the exclusion sits on top of a general approval right rather than replacing it.
Across 44 employer and coalition contracts in our database, not one reaches Good on audit rights. One reaches Fair. 43 of 44 fall below 60. The median is 35.
The Right That Runs Out
Ginny Crisp, PharmD, audits pharmacy benefit contracts for self-funded employers. She posted something last month I keep coming back to:
The audit right expires with the clock.
Her point is the window to exercise an audit right is typically annual. Then the year passes and the window resets. By renewal, three or four have opened and closed unused. The PBM has no reason to mention it.
When a plan finally runs an audit, findings turn up. Some are recoverable. Others sat in years that already closed.
So there are two problems, and they compound. The audit right in most contracts is weak. And the weak version isn’t being used. That’s a real fiduciary failure.
How They Say Yes But Mean No
The clauses below come from contracts across our database. None of them refuses an audit. Every one of them makes the audit unable to return anything useful.
#1. The audited party writes the test and grades it. One PBM writes the eligibility criteria itself: a separate audit division, minimum malpractice coverage, a confidentiality form acceptable to the PBM. It then determines whether a proposed auditor has a conflict of interest, and is acting reasonably and in good faith.
#2. The findings you may not read. A publicly available coalition agreement provides that auditor findings will not be revealed in any manner to any third party, and names the participating employer among those third parties. The employer commissions the audit, pays for the audit, and is named in the contract as a party that cannot see the results.
#3. More findings you may not read. The same mechanism appears in an unrelated PBM’s template, where the auditor’s NDA bars disclosure of manufacturer and rebate administrator terms in any manner to any third party, including to the client. Two unrelated PBMs, same structure. One occurrence is an outlier. Two is a practice.
#4. No copies permitted. A third contract handles it physically. On-site access exists, and no usable evidence leaves the premises. The PBM reviews the auditor’s handwritten notes to confirm compliance before the auditor leaves the building.
#5. The agreements you may not examine. One coalition agreement bars auditing the PBM’s agreements with manufacturers, distributors, participating pharmacies, and other vendors. The agreements determining what the PBM gets paid are named and excluded by name.
#6. The scope you must ask permission for. One template provides that the scope, procedures, and limitations of any audit of rebates or pass-through pricing obligations shall be mutually agreed by the parties. An annual audit right requiring the audited party’s consent on scope isn’t a plan-directed audit right.
#7. The next audit you may never start. This is the quietest one in the library. New audits cannot be initiated until all parties agree the prior audit is closed. The PBM participates in closure. Decline to close one audit and the next one never begins. One sentence with fourteen innocuous words converts an annual right into a right contingent on the cooperation of the party being audited.
When They’re Stacked
One coalition contract combines several at once. Rebate audits are capped at ten manufacturer contracts. The auditor must be mutually agreeable. The auditor’s confidentiality agreement bars disclosure of findings to the employer. And audit adjustments are paid only within thirty days of execution of an appropriate release document covering the audit period.
Scope capped. Findings unreadable. Payment conditioned on signing away the claim.
Each element would be defensible alone. Together they describe a process where the employer pays for an examination it can’t scope, can’t read, and can’t collect on without releasing whatever it found.
The Objection Worth Taking Seriously
A PBM pushed back recently when we deducted points over auditor approval. Their position: they need to know who’s coming in.
Two versions of that argument came up, and they aren’t equivalent.
The first is they don’t want to be audited by a competitor. That’s fair. No PBM should have to open its pricing methodology and rebate arrangements to a rival. The exclusion is narrow, it turns on who the auditor is, and it leaves the entire independent audit market available.
The second is the litigation exclusion this issue opened with. That one disqualifies people for what they’ve concluded. The credential that disqualifies you is having found a problem and testified to it. Applied consistently, it removes the auditors with the most experience finding exactly what an audit is meant to find.
So approval rights aren’t automatically a defect, and we don’t score them as one. What we score is how much discretion the language leaves. Our scale treats an approved list as a minor deduction and a required PBM approval as a significant one.
A clause excluding a named category, like direct competitors, is a business term. A clause requiring approval that may be withheld by the PBM is a veto.
Moving from 36 to 86
Every clause above can be rewritten. One PBM did it across three review cycles.
Cycle 1 scored 36. Twelve-month look-back. One audit only. Restrictions on the audit protocol and on removing records. Scope excluded rebate calculations.
Cycle 2 scored 72. The look-back cap came out. The once-only restriction came out. Notice dropped to 30 days. The protocol and record-removal restrictions were deleted. Scope extended to claims processing, pharmacy reimbursements, and rebate calculations.
Cycle 3 scored 86. One gap remained after Cycle 2, and it’s the one worth understanding. The sponsor still had no audit reach into the rebate aggregator’s arrangements with manufacturers.
Our workpaper from that cycle put it plainly: without reach into the aggregator’s manufacturer arrangements, the sponsor cannot verify the 100% rebate pass-through the contract now promises.
50 points gained, and not one of the changes was exotic. Remove a cap. Delete a restriction. Extend a scope. Every one of them is a sentence a PBM can strike in a redline.
Where the Trail Goes Cold
The Cycle 3 gap deserves more than a sentence, because it’s the hardest problem in this issue and the one least likely to be solved in your contract.
Rebates are rarely negotiated by your PBM directly. They run through a rebate aggregator, a group purchasing organization that contracts with manufacturers on behalf of one or more PBMs. Your audit right reaches your PBM. The aggregator is a separate entity, and the calculation happens there.
For the largest PBMs, the aggregator is an affiliate, and those entities are commonly domiciled outside the United States. The practical effect is the same regardless of why: the place where manufacturer value is determined sits outside your audit right and outside the jurisdiction where you would enforce it.
Smaller PBMs face a different version of the same problem. Aggregators exist because scale produces better rebate terms, and a mid-sized PBM contracting directly with manufacturers will not match what an aggregator commands. So they use one, and the aggregator’s terms typically provide no audit access to downstream clients. The PBM isn’t hiding anything. It’s buying scale and inheriting opacity.
We learn where that line sits by asking for the language in live negotiations. Push on aggregator reach and you find out quickly how much a given PBM controls and how much it has already signed away.
Three outcomes come up, and they’re worth knowing because they tell you what to ask for.
- Nothing available. Some PBMs can’t grant what they don’t hold. The aggregator’s contract governs, the PBM is a downstream party to it, and no amount of negotiating pressure changes the document.
- Negotiated reach. Some PBMs will extend audit rights into their aggregator arrangements. Narrow, specific, and real. That’s what Cycle 3 accomplished, and it’s why that provision reached 86.
- No aggregator at all. A few PBMs contract with manufacturers directly, accept smaller rebate dollars, and offer verifiable numbers instead. Lower gross rebate, higher provable value.
Better Yet, Avoid The Problem
That’s the response available to you regardless of which answer you get. A formulary built on lowest net cost rather than highest rebate, with guarantees written so nobody profits from steering to the higher-rebate drug, shrinks the amount of money moving through the channel nobody can verify.
That doesn’t solve the problem. It makes the unauditable portion smaller, which is a different kind of progress and the kind you control.
What an Audit Can and Can’t Recover
Contract X-Ray scores ten provisions at equal weight. Audit rights don’t mathematically reduce the pricing score or the rebate score. Our calibration guidance states the relationship in plain terms instead:
Audit and termination are the verification and enforcement mechanisms for everything else in the contract.
There’s a limit to that, and it’s worth knowing before you commission an audit expecting a recovery.
An audit finds breaches. It can’t recover money the contract permitted the PBM to keep. If your agreement authorizes retained spread, an auditor will find the spread, confirm it was allowed, and hand you a report documenting that you were charged exactly what you agreed to.
So the two provisions fail in opposite ways. Weak audit rights leave good pricing terms unverifiable. Weak pricing terms leave good audit rights with nothing to collect.
Which is why they belong on the same page of your review. An audit right is worth what your pricing terms make it worth, and your pricing terms are worth what your audit right can prove.
What to Do First Thing Monday
- Read your audit clause for who controls the four variables. Auditor selection, scope, claim population, and timing. Language requiring mutual agreement gives the audited party a veto without ever using the word.
- Find out who is permitted to read the findings. If the auditor’s confidentiality agreement bars disclosure to third parties, check whether your plan is defined as a third party.
- Ask which rebate aggregator your PBM uses and what audit access your contract provides into that entity. Three answers are possible: none, negotiated reach, or direct contracting. All three can be useful, and none belongs in a guess.
- Find out whether your plan has ever audited the PBM, and when the next window closes. If nobody knows, that’s the finding. Put the date on a named person’s calendar with a reminder 90 days out.
In Closing
Not one of the clauses in this issue refuses an audit. Every one of them was drafted by someone who understood that refusing would be conspicuous.
So the right stays in the contract and the conditions around it decide what it can return. Who may perform it. What it may examine. Who may read the result. When the next one can start.
The good news is in the rewrite. One PBM moved 50 points by striking sentences, and none of the changes cost them anything they should have wanted to keep.
Your audit clause is a set of sentences someone wrote. Which means it’s a set of sentences someone can rewrite. That logic reminds me of my favorite joke:
Q: What language should never appear in a PBM contract?
A: Anything the PBM wrote.
Once you see it, you can change it.
Here’s to clearer thinking, stronger plans, and better outcomes for the people who rely on us.
All the best,
P.S. Next week closes the series. Lock-in, where leaving costs more than staying wrong. Across 67 scored contracts, the median for termination and clean exit is 49, and 43% land in Red Flag. You negotiated your data rights, you negotiated your audit rights, and then the exit fee decided whether either one mattered.
A Note of Appreciation
Ginny Crisp, PharmD is the Founder and CEO of Prescription Benefit Solutions. Her expertise includes PBM contract negotiation and RFP management, clinical pharmacy program development, and cost containment strategies. You can follow her work on LinkedIn and at benefitblindspots.substack.com.
Subscribe & Share
🔗 Subscribe: Was this newsletter forwarded to you? Signup to receive The Middleman’s Cut every Monday.
📤 Share: Know someone reviewing a PBM contract? Forward this issue.
Tools and Resources
────────────────────────────────────────
Employers pay far more than they should to middlemen most executives have never heard of. Change the status quo and reap the benefits. Employers who act are recovering 20% to 30% of pharmacy spend, and returning it to wages and benefits.
Schedule an introductory call with us.
