No cure, no pay audits: how do they work and what should you watch out for?

No cure, no pay is the standard in the recovery audit world: the auditor only receives a fee on money that has actually been found, approved by you and is in your account or has been offset. If the audit finds nothing, you pay nothing. The model sounds simple, but the details in the contract determine whether it works out fairly. Here are the key points from practice, including the questions you should ask an auditor.

Why the model works

• The risk lies entirely with the auditor: they invest the analysis hours and only earn on results.
• Interests are aligned: the auditor has every reason to substantiate claims fully and correctly, otherwise the supplier will not repay.
• No budget discussion is needed: by definition the engagement costs less than it delivers.

What to look out for in the contract

• When is a claim 'found'? The fee should only be due after you approve the claim and the money is actually received or offset, not at identification.
• Who contacts the supplier? You want control over each claim before your suppliers are contacted; the relationship is yours, not the auditor's.
• What percentage is reasonable? Fees differ per market and per scope. Always ask how the percentage is built up and whether it decreases for large claims.
• What happens to claims you had already found yourself? They should fall outside the fee; put that in writing.
• What about data security? Ask about encryption, storage within the EU, access restrictions and deletion of your data afterwards.
• Is the report included? A management report with process recommendations should be part of the engagement, not a paid extra.

What no cure, no pay does not mean

The model is not free: if it succeeds, you pay a fair percentage of the proceeds. The right comparison, however, is not 'fee versus no fee' but 'part of the recovered money versus no recovered money at all'. Without an audit, the full amount stays with your suppliers and the claims expire. In addition, a no cure, no pay engagement also requires a modest internal effort: a one-off data delivery and periodic claim reviews. A professional auditor keeps that burden to at most one hour every two weeks.