The Nuts and Bolts of Preparing For and Managing DEA Cyclic Inspections: What Every Registrant Should Know

By Larry K. Houck –

Deputy Assistant Administrator Joseph Rannazzisi, Office of Diversion Control, Drug Enforcement Administration (“DEA”), told the House of Representatives Energy and Commerce’s Subcommittee on Oversight and Investigations on April 29, 2014 that his agency “has steadily increased the frequency of compliance inspections” of manufacturers, distributors, pharmacies, importers, exporters and narcotic treatment programs.  Statement of Joseph T. Rannazzisi, Deputy Administrator, Office of Diversion Control, Drug Enforcement Administration, Before the Subcommittee on Oversight and Investigations Committee on Energy and Commerce, U.S. House of Representatives, “Examining the Growing Problems of Prescription Drug and Heroin Abuse,” Apr. 29, 2014.  We can attest that Mr. Rannzzisi’s assertion is not only accurate, but understated.  The current DEA cyclic inspections are more frequent and more in-depth as well.

Many aspects of DEA inspections are beyond registrants’ control, but there are certain actions that registrants can and should take to prepare for and manage the inevitable DEA inspection.  This article offers practical guidance on some of those actions. 

Non-practitioner registrants (manufacturers, distributors, importers, exporters and narcotic treatment programs) can expect to be inspected about once every three years, and Drug Addiction Treatment Act (“DATA”)-waived practitioners approximately once every five years.  (DATA-waived practitioners are physicians administering, dispensing, and prescribing specific FDA-approved controlled substances for narcotic treatment.  DEA-registered physicians who apply and are qualified pursuant to DATA are issued a waiver, and are then able to conduct maintenance and detoxification treatment using specifically approved schedule III, IV, or V narcotic medications for either 30 or 100 patients at any one time.)  Registrants must understand that although the diversion investigators who conduct the inspections are within DEA’s Office of Diversion Control, the regulatory arm governing legitimate controlled substance handlers, the focus of the Agency, and thus of the investigators, is primarily law enforcement.  Diversion investigators typically prepare for the inspections by reviewing previous inspection reports and Automation of Reports and Consolidated Orders System (“ARCOS”) data (to the extent available).  Investigators will also consider areas of prior non-compliance during the current inspection to ensure that registrants have remedied past deficiencies.

A.  Scope

The federal Controlled Substances Act (“CSA”) authorizes DEA to inspect “controlled premises,” which the CSA defines as places where registrants “may lawfully hold, manufacture, distribute, dispense, administer, or otherwise dispose of controlled substances or listed chemicals or where records relating to those activities are maintained.”  21 U.S.C. § 880(a)(2).  They can inspect and copy required records and reports; inspect finished and unfinished drugs, equipment, containers, labeling, processes and controls.  Investigators may inventory controlled substances on-hand and take samples.  They are not authorized to inspect financial data, sales data other than shipment data, or pricing data unless the registrant provides written consent.

B.  Procedures 

Diversion investigators arrive unannounced.  They must present their DEA credentials and a written notice of their inspection authority.  At least two investigators must be present, but inspection teams may include DEA special agents or officers from other federal or state agencies.  The investigators ask the responsible employee for informed consent by having them sign a Notice of Inspection (“DEA Form-82”).  Registrants may withhold consent or, if given, may withdraw consent at any time.  Withholding or withdrawing consent will require the investigators to obtain an administrative inspection warrant or search warrant from a federal magistrate.

The investigators explain the purpose and scope of the inspection.  Their questions may include inquiries about the officers and employees who have access to controlled substances.  They may walk through the facility upon arrival looking for obvious violations.

C.  Accountability Audit

Registrants must account for all of the controlled substances that they receive and handle; therefore, the investigators likely will conduct an accountability audit of a number of controlled substances, usually at least two drugs in each schedule for a six-month time period, at a minimum.  The investigators begin with a physical count conducted by the registrant — usually a biennial inventory — as the starting point for the audit. 

The accountability audit allows the investigators to determine whether a registrant has maintained complete and accurate records, and thus maintained effective controls against diversion.  The accountability audit will indicate any variance in the quantity of controlled substances that the registrant can account for versus what it should be able to account for during the time period.  The investigators try to balance the controlled substances on-hand at the beginning of the audit period plus receipts against dispositions and quantities on-hand at the end of the period.  Ideally the audit balances, but a negative variance can indicate incomplete or inaccurate records, or a loss.  A positive variance can indicate recordkeeping errors.  There is no “acceptable” discrepancy range for DEA purposes.  Registrants should regularly conduct internal audits to disclose any discrepancies and detect any possible losses without the presence of DEA investigators.

D.  Records and Reports

Diversion investigators also inspect and review required controlled substance records and reports to ensure that they are complete, accurate and available dating back the required two year period.  Registrants with automated records can offer to generate a report of receipt and disposition transactions for the audit period.  Each transaction on the automated report should correspond to a particular Official Order Form (“DEA-222”), invoice, packing slip or other primary record.  Investigators will typically compare and verify a number of transactions on the report with the primary records.  The investigators review DEA-222s to ensure that they have been maintained, are properly executed, complete and accurate, and that orders were filled within sixty days of the date the customer completed them.  Investigators review the registrant’s Powers of Attorney to ensure that individuals executing DEA-222s are properly authorized to do so.  Investigators also review invoices and packing slips to ensure that the registrant has maintained them as required and that those also are complete and accurate.  Investigators verify random transactions with the firm’s vendors and customers to ensure that the transactions occurred and the records are accurate. 

E.  Security

Registrants must provide effective controls to guard against theft and diversion of controlled substances, and must employ specified security (set forth in applicable DEA regulations) depending on their business activity and the type and quantities of controlled substances they handle.  The investigators inspect the overall security system and individual components thereof to ensure that all components meet specifications and are operational.  The investigators test the alarm system by activating a number of sensors.

Diversion investigators may provide some feedback at the end of an on-site inspection.  They likely cannot provide their final conclusions, but can recommend what the registrant can do to comply with the CSA and its implementing regulations.  Registrants may not receive formal notice of the inspection results, audit results and DEA’s intended enforcement action, such as a Letter of Admonition, informal or formal hearing, civil penalty, or administrative action, for a number of months or longer.

F.  Preparing for and Managing Cyclic Inspections

Registrants should consider implementing the following in preparing for and managing cyclic inspections:

1. Designate a primary employee to manage controlled substance operations, and a back-up employee and team to assist him or her.
2. Maintain, review and regularly update controlled substance policies and procedures to ensure that they comply with DEA requirements.
3. Draft detailed policies and procedures mandating how the registrant should manage DEA inspections.
4. Conduct periodic mock DEA inspections comprising an accountability audit, and record, report and security reviews by a third-party who is not responsible for daily controlled substance operations.  The inspections ensure compliance and instill confidence in employees during actual DEA inspections.  Random or periodic audits help discover internal thefts or losses.
5. Maintain an updated list of names, home addresses, dates of birth and social security numbers of officers and responsible employees to provide to investigators.
6. File required controlled substance records and reports daily in one location.  Review the file weekly to ensure records are current, complete and accurate.  Maintain required records and reports for at least two years unless required to be maintained by state law for a longer period of time.
7. Maintain controlled substances in secure areas at all times except during processing, packaging, labelling or conveying to the secure loading area.  Return controlled substances to secure areas at the end of the workday pursuant to company policies addressing the handling of controlled substances.
8. Ensure that controlled substances awaiting return or destruction are properly secured and documented.
9. Be diligent about establishing, maintaining and documenting new and current customer due diligence and suspicious order monitoring and reporting.  Ensure that policies and procedures are up to date and frequently revisited.
10. Change locks or key card access, and update lists of employees who have authorized access to the warehouse, cage and vault after relevant personnel changes.
11. Inspect security system components often.  Repair broken or inoperable components immediately.  Maintain documents and materials related to the security system and its components for future reference.
12. Upon commencement of an inspection, the responsible employee should greet the investigators immediately.  Review each investigator’s credentials and obtain their business cards.  Determine whether the inspection is a routine cyclic inspection or if there is another specific reason for the inspection.  Review the Notice of Inspection presented by the investigators.
13. Take detailed notes of all observations, suggestions and recommendations made by the investigators.  If the employee cannot take contemporaneous notes, they should write them down immediately afterwards.
14. Ask the investigators questions about any aspect of the inspection and audit.  Employees should answer the questions asked, and respond when they know the correct information.  They should not speculate.
15. Do not overlook the drugs in the morgue awaiting destruction or return.
16. Understand the methodology the investigators use to conduct their accountability audit.  Conduct an internal simultaneous audit of the investigators’ audit.
17. Make sure that the investigators understand the recordkeeping system that the company uses.
18. Apprise investigators of limitations of automated transaction reports.  Advise them if such reports are not primary records.
19. Photocopy all records the investigators take, make copies of, review or specifically raise questions about during the investigation.
20. If the investigators take drugs or original records off-site, obtain a DEA receipt (“DEA Form 12”) listing each item.
21. Inform the investigators immediately if they do not have accurate counts and inventories of all the drugs they are auditing, or if they are missing relevant records or reports.
22. Request a final discussion or exit interview with the investigators.  Designate an employee to take detailed notes. 
23. Provide unavailable information and records or reports requested by the investigators as soon as possible if appropriate to do so.

G.  Conclusion

DEA diversion investigators take the lead as to how they conduct cyclic inspections, but registrants can and should proactively prepare for and manage the inspection and audit elements within their control.  Implementing the recommendations provided here will help registrants prepare for and manage the inspection and audit process.