Building the CFO business case for rebate and implant spend controls

A funding request for supply chain controls usually arrives with a benchmark attached: a percentage of spend that hospitals are said to lose, multiplied by your spend. Finance has seen that slide before and discounts it to zero, because nothing on it traces to your ledger. A sounder business case starts from your own records. Recalculate a few of your own rebate contracts, price-check a sample of your own bill-only purchase orders, and present what you find in the categories finance already uses.

Why the request is timely

The American Hospital Association’s Costs of Caring report, published in March 2026, puts total hospital expense growth at 7.5% in 2025, more than twice the growth in hospital prices. Supplies were 18% of hospital expenses, about $297 billion, and grew 9.9%.

Those figures explain why the CFO will take the meeting. They do not belong in your savings estimate, because they say nothing about whether your rebates were paid or your implant lines were billed at contract.

The same goes for industry leakage estimates. A Vizient article from April 2026 cites industry estimates that procure-to-pay inefficiencies can represent 3% to 5% of total supply chain spend. It names no study behind the figure, so finance has nothing to inspect. Treat numbers like that as a reason to look, never as the amount you expect to find.

Frame it as recovery and control, not software

Finance does not fund software. It funds cash, lower expense and reduced exposure. Sort everything you find into three buckets and keep them apart through the whole document.

Bucket	What goes in it	How finance treats it
One-time recovery	Rebates earned in past periods and not paid or short paid; overbilled implant lines still claimable under the contract	Non-recurring cash, shown separately and never in the run-rate
Run-rate capture	Rebates calculated and claimed every period, tiers no longer missed by small margins, implant lines held to contract price before the PO is cut	Recurring expense reduction, after a ramp
Risk exposure	Cost report accuracy, unreported device credits, reliance on one person, missing history	Not savings. Listed as exposures, each with an owner

Mixing the buckets is the fastest way to lose credibility. A one-time recovery presented as annual savings is found out in year two.

Size the rebate opportunity from your own numbers

1. List every rebate-bearing agreement, whether GPO, local or supplier-direct, with its thresholds, tiers and eligible products. This is the first item on the AHIA paper’s audit checklist. If the list cannot be produced on request, that is your first finding.
2. For each agreement, pull the last four quarters of eligible purchases and apply the contractual rate at the tier reached. That is the expected rebate.
3. Pull rebate receipts for the same periods from the general ledger: checks, credit memos and GPO distributions. That is the received amount. Note the account each one was booked to.
4. Take the five to ten largest agreements and recalculate them line by line, using the contract’s own product list, exclusions and period dates.
5. Classify every gap before you total anything.

Step 5 matters most. Here is an illustrative result, with round fictional figures, for eight recalculated agreements covering $40 million of eligible purchases: expected $1,200,000, received $1,020,000, gap $180,000.

Cause of the gap	Amount	Bucket
Timing: paid after the period you examined	$30,000	None. Remove it
Earned, then not paid or short paid, still claimable under the contract	$90,000	One-time recovery
Forfeited: a tier missed by a small margin, or a compliance form filed late	$60,000	Run-rate capture. Preventable next year, not claimable now

A gap is not an accusation. Two of the case studies in the AHIA paper are administrative failures: a health system that exceeded its purchase threshold and still forfeited a year of rebates because compliance forms went unsubmitted during staff turnover, and credit memos that arrived but were not applied correctly in the accounting system. Recovery means collecting what both sides already agreed, and most of the work is showing the arithmetic.

Extrapolate with restraint. Your largest agreements are not a random sample of the rest. Report the recalculated result as found, and label anything beyond it as a scenario.

Size the implant opportunity from a sample

Pull 100 recent bill-only POs, or every bill-only PO for one service line over 60 days. Reprice each line against the contract price in effect on the date of surgery, and record four measures.

Measure	Illustrative sample result
Dollars above contract price	$18,000 on $1,500,000 of PO value, or 1.2%
Lines with no contract price on file	40 of 700
Median business days from surgery to PO	9
Invoice price exceptions per 100 POs	20

For context on the first measure, the Vizient article reports, from Vizient data, that only 61% of purchase orders are issued at the correct contract price. That is purchase orders in general, not implants, and not your number. Your sample is.

For the third, a 2024 GHX work group guide recommends that a bill-only PO reach the supplier within five business days of the case.

For the fourth, a 2014 contract price alignment paper published by AHRMM, citing GHX data, put a provider’s cost of resolving one price discrepancy at $10 to $25 by conservative estimates. The figure is old, so time your own buyers and AP staff on ten exceptions and apply a loaded hourly rate. If you use the published range, show it as a range.

Then annualize honestly. If annual bill-only spend is $30 million, the sample rate of 1.2% implies $360,000 a year above contract. At the sample’s average of $15,000 a PO, that spend is about 2,000 POs a year, and 20 exceptions per 100 is 400 exceptions, or $4,000 to $10,000 of labor at the published range. Keep the labor figure small and call it what it is: capacity returned to buyers and AP, not cash. Finance will trust the rest of the document more because you said so.

The risk column

Some findings have no place in a return calculation. State them as exposures, and take the first two to your reimbursement and compliance teams, who own the rules.

• Cost report accuracy. The AHIA paper states that rebates received, whether directly from a manufacturer or through a GPO, must be reported on the Medicare cost report, and that providers must keep documentation of rebate sources, amounts and calculation methods. If rebates are booked wherever the check lands, ask your reimbursement team how they assemble that support.
• Unreported device credits. A November 2020 audit by the HHS Office of Inspector General found that for 3,233 of 6,558 Medicare claims reviewed, hospitals likely did not comply with requirements for reporting manufacturer credits for recalled or prematurely failed cardiac devices. The 911 hospitals involved received $76 million where $43 million was due, a potential overpayment of $33 million. A credit nobody tracks is a claim nobody adjusts.
• Key people and lost history. The AHIA paper describes a five-hospital system that lost a $220,000 cardiology rebate when the only staff member managing rebate compliance went on leave with no trained backup to meet the submission deadline, and a hospital that lost years of rebate history in an IT migration, which made retrospective audits impossible.

Give each exposure an owner and a control. Keep it out of the payback math.

Count the costs honestly

List every cost, including the ones that never appear on a quote.

• Software subscription and implementation fees.
• Data extracts: purchase history, AP payments, contract price files and the surgical case schedule, delivered on a schedule. Someone in IT has to build and maintain them.
• Contract abstraction. Each rebate agreement has to be read into structured terms and reviewed by someone who knows the deal. Start with the 20 largest.
• Analyst time to work claims with suppliers, and approver time to review implant lines that were stopped.
• A ramp. One-time recovery depends on supplier response and on how far back the contract lets you claim. Run-rate rebate benefit needs at least one full rebate period to show. Put no recurring benefit in the first quarter.

Presenting it

Build three scenarios from rules, so finance can change an assumption and see the effect.

Scenario	Rebates	Implants
Conservative	Only the claimable gap found in the recalculated agreements. No extrapolation	Half the sample rate, applied to the sampled service lines only
Base	Add the sample gap rate at half strength on the remaining rebate-bearing spend	Sample rate on the sampled service lines, half rate on the rest
Upside	Sample gap rate across all rebate-bearing spend	Sample rate across all bill-only spend

Show payback twice: on recurring benefit alone, and with one-time recovery included. Finance will do the first calculation anyway. If the case only pays back in the upside scenario, say so.

Then propose a 90-day proof on a limited set, for example ten rebate agreements and one surgical service line, with exit criteria agreed in advance:

• Recalculations tie to supplier statements, or each difference is explained.
• At least one claim is submitted and acknowledged by the supplier.
• Every bill-only request in the pilot service line is price-checked before the PO.

Pair the proof with leading indicators finance can verify without you: agreements with a current recalculation; claims submitted, acknowledged and paid; the percentage of bill-only lines checked before PO; and over-contract dollars stopped before PO. The proof itself can run in a spreadsheet.

Governance after approval

Three habits keep the benefit from eroding.

• Joint ownership. Supply chain owns the contract terms and the claim. Finance owns the accrual, the booking and the cost report support.
• A quarterly rebate close. The AHIA paper recommends quarterly internal audits, and its checklist asks for supplier-provided reports to be verified, not accepted at face value, and for credit memos to be applied and reconciled in the general ledger.
• A standing report to the CFO. Three columns per agreement: earned, received, booked. Any row where the three disagree gets a named owner and a date.

Questions to answer before you walk in

The AHIA paper lists four questions an organization should be able to answer at any time, including how many rebate programs are active and what it expects to earn this quarter and year. Add these:

• For the agreements we recalculated, what was expected, received and booked?
• How much of the gap is claimable today, and how much was forfeited?
• What share of sampled bill-only dollars was above contract, and how many lines had no contract price?
• What does year one cost, including our own people’s time?

One rule of thumb covers the whole document: if a number in the case cannot be traced to a ledger line, a contract clause or a sampled PO, take it out.