Common FQHC Audit Findings & How to Prevent Them

FQHCs operate under multiple overlapping audit and oversight mechanisms. A finding in any one of these reviews can trigger consequences across other funding streams — a Single Audit finding may prompt HRSA scrutiny, an OSV finding may affect 340B standing, and a 340B audit finding may raise questions in the next NCC review. Understanding the most common findings and implementing proactive prevention is far less costly than remediation after the fact.

Financial Findings

Financial findings appear in both the Single Audit and in HRSA oversight reviews. They are often the most consequential because they can result in disallowed costs, required repayments, and restrictions on future funding.

Cost Allocation Errors

The most frequent financial finding for FQHCs managing multiple funding streams is improper cost allocation. Under 2 CFR Part 200, shared costs must be distributed across benefiting programs using a methodology that is documented, consistently applied, and produces results that are reasonable and allocable. Common allocation errors include:

• Charging 100% of a shared cost (facility rent, utilities, IT systems) to a single federal grant when the expense benefits multiple programs
• Using an allocation base (such as patient visits or square footage) that does not reasonably reflect how the cost benefits each program
• Changing the allocation methodology mid-year without documentation of the reason for the change
• Failing to update allocation rates when new funding streams are added or existing ones are substantially modified

Prevention: Maintain a written cost allocation plan that identifies every shared cost category, the allocation base for each, and the methodology for calculating the allocation rate. Review and update the plan at least annually and whenever a new funding stream is added. Run quarterly reconciliations to verify that allocated costs match the approved methodology.

Time-and-Effort Documentation

Personnel costs are typically the largest expense category for FQHCs, and 2 CFR §200.430 requires documentation of how employee time is allocated across funding sources. When an employee's salary is charged to multiple federal awards (or to a mix of federal and non-federal activities), the health center must maintain records that reflect the actual activity of each employee. Common findings include:

• No time-and-effort documentation for employees whose salaries are split across multiple funding sources
• Using budgeted percentages as the allocation basis instead of actual time distribution
• Time documentation that is completed retroactively or in batches rather than contemporaneously with the work period
• Supervisor certification of time reports without meaningful review of the reported allocations

Prevention: Implement a time-and-effort reporting system that captures actual activity distribution for all employees whose costs are charged to multiple funding sources. Train employees on proper completion, require timely submission (at least monthly), and have supervisors with firsthand knowledge of the employee's activities certify the reports. Conduct periodic comparisons of reported time distribution to budgeted allocations and investigate significant variances.

Unallowable Costs

2 CFR Part 200 Subpart E defines categories of costs that are never allowable on federal awards, regardless of how they are allocated. Common unallowable cost findings for FQHCs include:

• Entertainment expenses (including staff meals that are not associated with a working meeting with a documented business purpose)
• Lobbying costs (including staff time spent on advocacy for specific legislation)
• Alcoholic beverages (in any context, regardless of business purpose)
• Bad debt expenses charged to federal awards (write-offs for uncollected patient balances cannot be charged to grants)
• Costs incurred outside the grant budget period without prior approval for pre-award costs

Prevention: Train all staff who approve expenditures on the 2 CFR 200 allowability criteria: necessary, reasonable, allocable, consistently treated, and in conformance with limitations and exclusions. Implement a pre-approval review process for expense categories that frequently result in findings (travel, meals, consultant contracts). Code unallowable costs to a non-federal cost center at the point of entry, not after the fact.

HRSA Program-Specific Findings

The HRSA Operational Site Visit (OSV) evaluates compliance with the 19 Program Requirements. OSV findings are categorized as met, partially met, or not met. The following areas produce the most frequent findings:

Scope of Project Violations

Scope violations occur when the health center's actual operations differ from the approved scope of project in EHBs. Common examples include operating a service site that is not listed in the scope, providing services that are not included in the scope (or that have been added without a CIS request), or discontinuing services that are still listed in the scope without notifying HRSA. Scope violations have cascading consequences — services provided outside the approved scope are not covered by FTCA, may not be reportable in UDS, and may not be eligible for PPS reimbursement.

Prevention: Conduct an annual reconciliation of the EHBs scope of project against actual operations. Before adding any new service, site, or provider type, determine whether a CIS request is required and submit it before implementation. Assign a single staff member responsibility for scope management.

Sliding Fee Scale Gaps

Sliding fee discount program (SFDP) findings are among the most common in OSVs. Frequent issues include:

• Using outdated Federal Poverty Level guidelines (FPL is updated annually, typically in January, and the schedule must be updated accordingly)
• Fewer than three discount levels between 100% and 200% FPL
• Not applying the discount schedule to all services in the scope (dental and pharmacy are commonly missed)
• Collection practices that effectively deny access (sending patients to collections for balances that should have been discounted, or requiring payment at the time of service without accommodation for patients who qualify for discounts)
• No documented process for patients to self-declare income when documentation is not available

Prevention: Update the SFDP schedule within 30 days of annual FPL publication. Conduct quarterly audits of a sample of patient accounts to verify that discounts are being applied correctly. Review collection policies with the SFDP compliance officer to ensure they do not create access barriers. Train all front desk and billing staff on the schedule and the self-declaration process.

Board Composition Findings

Board governance findings typically involve failure to maintain the 51% patient majority, lack of documentation that patient board members actually use the health center, board members who are also employees, insufficient meeting frequency, or incomplete documentation of board actions (budget approvals, CEO evaluations, SFDP approvals).

Prevention: Maintain a board roster spreadsheet that tracks each member's patient status, term expiration, committee assignments, and attendance. Verify patient status annually through the practice management system. Calendar all required board actions and build them into the annual board meeting schedule. Maintain minutes that clearly document motions, votes, and approvals.

340B Program Findings

HRSA's Office of Pharmacy Affairs (OPA) conducts audits of 340B covered entities, and 340B audit findings can result in required repayment to manufacturers, restrictions on program participation, and reputational damage. The most common findings for FQHCs include:

Duplicate Discounts

The 340B statute prohibits covered entities from receiving both the 340B discount and a Medicaid drug rebate on the same prescription. This requires systems to identify Medicaid prescriptions and either carve them out of the 340B program or prevent the state from claiming a rebate. In states with Medicaid managed care, the carve-out/carve-in rules are complex and have changed over time. FQHCs that use both in-house pharmacies and contract pharmacies face additional complexity because duplicate discount prevention must operate across all dispensing locations.

Prevention: Implement a 340B software system (such as a split billing or virtual inventory model) that automatically prevents duplicate discounts at the point of dispensing. Run monthly reconciliation reports comparing 340B claims against Medicaid managed care claims. Work with the state Medicaid agency and MCOs to ensure that the carve-out/carve-in methodology is correctly implemented.

Contract Pharmacy Compliance

FQHCs that use contract pharmacies face heightened scrutiny under recent OPA guidance and manufacturer restrictions. Common findings include inadequate written agreements between the covered entity and the contract pharmacy, failure to verify patient eligibility at the contract pharmacy, and inability to demonstrate oversight of the contract pharmacy's dispensing practices. Some manufacturers now require covered entities to provide claims-level data to a third-party clearinghouse as a condition of honoring 340B pricing at contract pharmacies.

Prevention: Maintain executed written agreements with all contract pharmacies that clearly define roles, responsibilities, and compliance expectations. Implement patient-level eligibility verification at the contract pharmacy (not just at the prescribing site). Conduct at least quarterly reviews of contract pharmacy dispensing data to identify anomalies. Monitor manufacturer-specific restrictions and adjust contract pharmacy arrangements accordingly.

Eligible Patient Definition

The 340B eligible patient definition requires that the individual receive a health care service from the covered entity, that the service is provided by a provider who is employed by or under contract with the entity, and that the individual has an established relationship with the entity (e.g., is recorded in the patient records). Findings occur when FQHCs dispense 340B drugs to individuals who do not meet this definition — for example, walk-in pharmacy customers who are not registered patients, family members of patients, or patients who received services only from a referring provider outside the health center.

Prevention: Configure the pharmacy system to require a matching provider visit before dispensing a 340B prescription. Define and document the criteria for “established relationship” in 340B policies. Train pharmacy staff on the eligible patient definition and implement a verification step in the dispensing workflow.

Single Audit Findings Common to FQHCs

The Single Audit under 2 CFR 200 Subpart F examines all federal programs simultaneously. For FQHCs, the Health Center Cluster (CFDA 93.224) is almost always a major program subject to detailed testing. Common Single Audit findings for FQHCs include:

• Activities allowed/unallowed — costs charged to the Health Center Cluster that are not within the approved scope of work or budget categories
• Cash management — failure to minimize time between receipt of federal funds and disbursement, or drawing down funds in advance of immediate cash needs
• Period of performance — costs incurred outside the approved budget period charged to the grant
• Procurement and suspension/debarment — purchases above the simplified acquisition threshold without documented competition, or failure to check SAM.gov exclusion lists for vendors receiving federal funds
• Reporting — late or inaccurate SF-425 Federal Financial Reports, UDS reports with data quality issues, or failure to report significant developments to HRSA
• Subrecipient monitoring — for FQHCs that pass through federal funds to subrecipients, failure to conduct risk assessments, issue subaward agreements, or monitor subrecipient compliance

For detailed guidance on corrective action plans for Single Audit findings, see our Single Audit compliance guide.

How Findings in One Stream Affect Other Funding

The interconnected nature of FQHC funding means that a finding in one oversight mechanism can cascade across others. Understanding these connections is essential for risk management:

The cascade effect makes early detection and rapid remediation essential. A finding that is promptly corrected with a documented corrective action plan generally produces minimal cross-stream impact. A finding that lingers, or that reveals a systemic issue rather than an isolated error, can trigger escalating oversight across multiple programs.

Prevention Strategies and Internal Monitoring

The most effective FQHC compliance programs share several common characteristics:

Proactive Self-Assessment

Conduct an annual mock OSV using HRSA's published compliance assessment tool. Walk through each of the 19 Program Requirements with the documentation you would present to a BPHC reviewer. Identify gaps before HRSA does. Similarly, conduct a mid-year financial compliance review using the Single Audit compliance supplement testing procedures for the Health Center Cluster. For 340B, perform at least quarterly self-audits of dispensing records, contract pharmacy activity, and eligible patient verification.

Compliance Calendar with Escalation

Maintain a master compliance calendar that tracks every deadline across every funding stream. Assign an owner for each deadline, set internal due dates 2–4 weeks before external deadlines, and implement an escalation process when internal deadlines are missed. The calendar should include not just reporting deadlines but also internal compliance activities: board meeting schedules, credentialing renewal dates, policy review dates, insurance expiration dates, and audit preparation milestones.

Cross-Functional Compliance Team

Compliance is not a single person's job in an FQHC. The compliance function should involve the CFO/Finance Director (cost allocation, financial reporting, audit preparation), the Chief Medical Officer or Clinical Director (credentialing, quality, scope of project), the Grants Manager (reporting deadlines, NOFO compliance, budget management), the Pharmacy Director (340B compliance), and the CEO/Executive Director (governance, board relations, strategic compliance decisions). A monthly compliance team meeting that reviews status across all areas creates accountability and early warning of emerging issues.

Documentation Standards

Many audit findings result not from actual non-compliance but from inability to produce documentation demonstrating compliance. The standard should be: if you cannot produce the documentation within 48 hours of a request, treat it as if the activity did not happen. This applies to board minutes, credentialing files, time-and-effort records, procurement documentation, cost allocation records, and policy approvals. Implement a document management system (even a well-organized shared drive with consistent naming conventions) and assign responsibility for maintaining each document category.

OSV vs. Single Audit vs. HRSA Compliance Review

Health centers often conflate these three oversight mechanisms, but they serve different purposes, are conducted by different entities, and cover different compliance domains:

Understanding which review covers which domain helps health centers prepare appropriately. Preparing for an OSV by organizing financial records is valuable but misses the mark — the OSV focuses on programmatic compliance, not detailed financial testing. Conversely, preparing for a Single Audit by organizing board minutes addresses the wrong audience. Tailor preparation activities to the specific review type and its scope.