I Hear You Knockin’… Preparing for and Managing DEA Inspections (Part 2)

Although we blogged on Drug Enforcement Administration (“DEA”) cyclic and on-site inspections in June 2014, we thought it helpful to update registrants on what they can expect as diversion investigators resume activities following the Covid-19 shutdown.  We are providing a post in three parts on cyclic and on-site inspections in which we focus on the background of inspections, how investigators conduct them, and how registrants should proactively prepare for and manage them.  Part 2, below, explains how diversion investigators conduct on-site inspections and what registrants must do before, during, and after each inspection to minimize negative findings.  Part 1, posted May 3rd, explains the purpose, background, and scope of DEA cyclic and on-site inspections.  The link to Part 1 is here.

A.  Investigator Preparation 

Based upon my experience conducting cyclic and on-site inspections, investigators prepare by reviewing reports of prior inspections and Automation of Reports and Consolidated Orders System (“ARCOS”) transaction reports involving the registrant.  Investigators review records and reports the registrant submitted to DEA including Official Order Forms (“DEA-222s”), Controlled Substance Ordering System (“CSOS”) transactions, and Theft/Loss Reports (written notifications and “DEA-106s”).  They also review any suspicious order reports filed by or about the registrant.  Investigators are known to focus on areas of prior non-compliance for close scrutiny during the current inspection to ensure the registrant has remedied past deficiencies.  Investigators likely consult with DEA headquarters about the registrant’s compliance with required reporting and review its registration category, status, and authorized controlled substances to assess whether it may be conducting unauthorized activities.  Investigators typically confirm with state authorities that the registrant has maintained required state professional and controlled substance licenses, and whether it has been the target of a state investigation.  They ask for the results of any state inspections.  Investigators may inquire with local police whether the registrant has reported controlled substance thefts or other criminal activity.

B.  Investigator Arrival

Historically, diversion investigators arrived unannounced at a registrant’s facility but, during the Covid-19 shutdown, some DEA offices have reached out beforehand to schedule inspections when the registrant is open and operating.  At least two investigators must be present during the on-site inspection, but teams can include DEA special agents or task officers from state and local law enforcement and regulatory agencies.  They are required to present their credentials, explain the purpose of their visit, and provide a written notice of their inspection authority.  21 C.F.R. § 1316.05.

The investigators ask the registrant’s designated responsible employee, such as the Operations or Compliance Manager, for informed consent by signing a Notice of Inspection (“DEA Form-82”).  Notices of Inspection contain the name and title of the owner, operator, or agent in charge of the premises; controlled premises name; address; date and time of inspection; inspection authority; and investigator’s signature.  Id. § 1316.06.  Notices of Inspection inform the responsible employee that the registrant has the right not to be subject to an administrative inspection without an administrative inspection warrant.  Registrants may withhold consent or, if given, can withdraw consent at any time.  Withholding or withdrawing consent will require the investigators to obtain an administrative inspection warrant from a federal magistrate.  Administrative inspection warrant applications need only identify the name and address of the controlled premises, contain a statement of statutory authority, set forth the nature and extent of the inspection, and provide a statement that the establishment has not been previously inspected or date when it was last inspected.  Id. § 1316.09(a).

Investigators may also conduct targeted inspections rather than routine cyclic inspections as part of the local DEA office’s annual workplan if the registrant reported controlled substance thefts/losses or were the subject of suspicious order reports.

In our experience, investigators review copies of the registrant’s federal and state licenses.  They will ask for updated information about the registrant’s operations, responsible employees, corporate structure, controlled substances handled, and hours of operation.  Although not required by the Controlled Substances Act (“CSA”) or regulations, investigators will ask for personal information of management and employees with access to controlled substances that includes home addresses, dates of birth, and social security numbers.  Registrants should consult with counsel and their Human Resources departments in deciding whether to provide this information.  Investigators ask about controlled substance security including who has access to the vault, cage, and safe, system components and specifications, internal inspection results, alarm test results, and central station monitoring contracts.  They may request a list of the registrant’s suppliers and customers.  Upon arrival, investigators might conduct a preliminary walk-through of the facility for obvious security violations such as propped-open or broken vault or cage locks or doors and unsecured controlled substances.

Some registrants compile and maintain a binder containing the information and documentation that investigators typically request during on-site inspections.  Having this updated information and documentation together eliminates time and stress required to search and compile it during the inspection.

C.  Policies and Procedures

It is crucial that registrants understand what the investigators request and require to successfully conduct their inspection.  To prevent misunderstanding, registrants must also ensure that the investigators fully understand their controlled substance recordkeeping, reporting, and security systems.  Investigators will likely ask for a copy of the registrant’s policies and procedures, and although not required by the CSA or DEA regulations, registrants should consider whether to provide copies to assist them with their understanding of controlled substance operations.  Registrants should ensure when developing their policies and procedures that they comply with federal and state controlled substance requirements and are updated frequently.  Registrants must comply with their own policies and procedures in practice.  The policies and procedures should include a section on how the registrant handles DEA inspections.

D.  Accountability Audit

Registrants must account for all of the controlled substances they receive, manufacture, or otherwise handle, so it is important that registrants document all controlled substance movement from receipt to transfer from the facility or disposal.  Because registrants must account for all the controlled substances they handle, investigators will conduct an accountability audit of a random number of controlled substances, usually at least two drugs in each schedule, for a minimum one year period.  The accountability audit allows investigators to ascertain whether the registrant can account for all controlled substances handled during the period, that it has maintained complete and accurate records, and that it provides effective controls against diversion.

The investigators select the drugs they will audit.  They may choose drugs audited during the last DEA inspection for continuity or those that are highly abused in the geographic area.  As the starting point for the audit, the investigators use a physical count conducted by the registrant, usually a biennial inventory taken at least a year prior.  The registrant’s employees together with the investigators conduct a closing physical count of the drugs to be audited.

Registrants with automated records systems may offer to assist investigators by generating a report of receipt and disposition transactions for the audit period.  However, generating and providing such a report may negatively impact the registrant if investigators find it to be inaccurate.  Registrants should check with counsel before creating this secondary transaction record.  If the registrant generates an electronic report, each transaction should correspond to a specific primary record including DEA-222, CSOS record, invoice, packing slip prescription, or administration record.  Investigators typically compare and verify a number of transactions on the automated report with the primary records.  Investigators may review all primary records if there are discrepancies with the automated report.

The accountability audit calculates controlled substance quantities that the registrant can account for versus what it is responsible to account for during the period.  The investigators compare the controlled substances on-hand at the beginning of the audit period plus receipts against dispositions plus quantities on-hand at the end of the period.  Ideally, the audit balances.  A negative variance can identify a shortage.  It may also indicate incomplete or inaccurate records.  A positive variance can also indicate recordkeeping deficiencies.  While it is more favorable for registrants to have smaller audit variances, there is no “acceptable” discrepancy range for DEA purposes.

E.  Records and Reports

Diversion investigators also review required controlled substance records and reports to ensure that they are complete, accurate, and maintained for at least two years.  Investigators review initial or biennial inventories and, when required, year-end inventories, ensuring that registrants have taken a complete physical count of all controlled substances on-hand, that inventories document date and whether taken at the beginning or close of business, and that schedule I and II substances are separate from schedule III-V substances.

Investigators review DEA-222 purchaser and supplier copies to ensure that the registrant has maintained them, they are properly executed, complete and accurate, and orders were filled within sixty days of the date customers completed them.  They also review CSOS transactions for completeness and accuracy.  Investigators review the registrant’s Powers of Attorney to ensure that individuals ordering schedule I and II substances are properly authorized to do so.  They may check the timeliness and accuracy of ARCOS reporting.  Investigators review invoices and packing slips to ensure that the registrant has maintained them and that they also are complete and accurate.  Investigators review prescriptions at pharmacies and administration/dispensing records at Narcotic Treatment Programs.  They review destruction and disposal records including DEA Form-41s.  Off-site investigators typically verify random transactions with the registrant’s suppliers and customers to ensure the transactions occurred as documented and the registrant’s records are accurate.

If the registrant has a manufacturing or import quota, the investigators may ensure the registrant has not exceeded their established quota.

F.  Security

Registrants must provide effective controls to guard against controlled substance theft and diversion, and employ specified security (set forth in applicable DEA regulations) depending upon their business activity and the type and quantities of controlled substances they handle.  The investigators inspect the overall security system and individual components to ensure that they meet specifications, are fully operational, and have not changed since the last inspection.  Investigators work with the central monitoring station to test the alarm system by activating a number of sensors.

DEA regulations have required the identification and reporting of suspicious orders since 1971 but investigators may not have focused on them during past inspections.  Going forward, investigators will assuredly assess registrants’ suspicious order monitoring and reporting policies and procedures.  Investigators will likely inquire about the registrant’s customer due diligence as well as how the registrant monitors, identifies, handles, and reports suspicious orders.  The investigators may review suspicious order records and reports.

G.  Investigator’s Departure

Diversion investigators may, but are not required to, have a final discussion with the registrant’s management at the end of an on-site inspection.  They may recommend corrective action for the registrant to comply with the CSA and its regulations, and may work with the registrant to remedy deficiencies while on-site.  Investigators will likely not provide final conclusions and definitive enforcement action that DEA may take without consulting with their supervisors.  After conclusion of the inspection, registrants may not receive a formal notice of the inspection and audit results, and DEA’s intended enforcement action, such as a Letter of Admonition, informal or formal hearing, civil penalty, or administrative action, for a number of months or longer.

H.  Mirror DEA Inspection and Audit

Registrants should photocopy or set aside in a separate file every record and report that the investigators use in their accountability audit and inspection.  Concurrent with the DEA inspection, or very shortly afterwards, the registrant should conduct a mirror inspection and accountability audit of DEA’s inspection and audit.  The mirror inspection and audit will identify DEA’s potential findings for the registrant before the investigators may be prepared to share them.  Conducting a concurrent mirror inspection and audit will also enable the registrant to respond to DEA’s findings without having to reconstruct the inspection and audit when investigators share their results in the future.

*****

The third part of our series, also scheduled for publication in about two weeks, will identify the DEA inspection do’s and don’ts for registrants.