Trouble-Free DEA Audits: 5 Best Practices Pharma Manufacturers and Distributors Should Follow

Reduce risk of civil monetary penalties, certifiB,cation issues, licensing actions or criminal sanctions by avoiding divergence of controlled substances.

Drug Enforcement Administration (DEA) audits are primarily carried out to ensure that there is no diversion or misuse of controlled substances. The audits also help to educate registrants in case of any identified discrepancies. This article addresses compliance issues relating to DEA audits, provides assistance to registrants to ensure strict compliance and the right adoption of drug ordering practices. It also details the correct ways to interact with inspectors during a DEA audit.

What is the Diversion of a Controlled Substance?

Diversion applies to illegitimate or unauthorized use of controlled substances like depressants, other stimulants and even purely synthetic drugs manufactured for valid medical uses. Drugs are diverted into the illicit drug trade by circumventing regulations relating to drug security, registration process, place of manufacture etc. Diverted drugs are not dispensed from the site of production to the pharmacies and are synthesized in concealed environments. Therefore, they pose a threat to the safety of consumers.

Diverted drugs or adulterated products are a result of vulnerable or dysfunctional distribution systems in which the origin of a particular drug is obscured either by segregating wholesale drugs for further sale to pharmacies or purchasing excess quantities for resale. These drugs are likely to go through multiple repackaging units and distributors, raising questions on identity aspects and facilitating diversion.

How Does the DEA's Diversion Control Program Work?

The main objective of the DEA's Office of Diversion Control is to prevent, detect, monitor, investigate and reduce the diversion of controlled substances and drugs from authorized sources. At the same time, the program ensures that there is a sufficient and continuous supply for approved needs.

Diversion investigations apply to all individuals directly or indirectly involved with the abuse of controlled substances and other chemicals. Pharmacies, physicians and distributors all fall under the purview of the program. DEA control program is responsible for enforcing the Controlled Substances Act (CSA) by establishing internal controls (in form of providing guidance, training to team personnel), voluntary compliance measures and other obligations for all registrants.

Why does DEA Diversion Compliance Matter?

DEA Diversion compliance matters not only because of the huge fines that the agency levies on individuals and institutions that break drug distribution laws, but also because controlled substances that are diverted can cause great harm to the general population.

The fines, which often run into the millions of dollars not only damage the profit margins of businesses, but also affect the reputation of the company. Individuals who violate the law can lose their license to practice (in the case of physicians) and pharmacies can lose their registration. The use of the internet to illegally distribute drugs also raises the stakes, making it necessary for businesses to ensure that they are compliant with DEA Diversion Control regulations. Ensuring compliance is key to coming through a DEA audit unscathed.

The DEA's Authorization to Inspect

The DEA exercises the right to inspect, copy and verify the correctness of records, reports and other documents under the CSA. The list of documents that the DEA can inspect also includes break-up invoices with only the financial data as exemption.

A prior notice will be issued by DEA officials for consent to inspect facilities and in case any organization does not provide it, then an administrative inspection warrant will be prepared for approval from concerned attorneys and magistrates for seizure of records.

The DEA can also produce or issue a search and seizure warrant, if it is found that:

• Dispensaries are misusing records and
• Physicians are tampering patient's records.

When will the DEA Inspect?

Drug manufacturers and others are at risk of being audited for their compliance with DEA requirements. Registrants with previous non-compliance issues have a greater chance of being audited.

• The DEA is significantly active in its enforcement efforts and usually conducts periodic unannounced audits (which can occur in peak hours or over the weekends) on long-term facilities of its registrants. So, it is extremely important to be prepared at all times by executing an action plan well in advance.
• DEA monitors its database for tracking drug abuse and diversion - it closely monitors suspicious orders.
• A prior notice of inspection is issued to registrants but in some cases (compelling instances of diversion / inappropriate or lack of response from registrants) an administrative warrant can issued for an urgent audit of the facilities; the Agency utilizes its authorization to inspect in order to gather evidence in support of a criminal investigation.

The following administrative actions can be taken by the DEA in case of non-compliance issues:

• An agreement or a MoU between the registrant and DEA that will be made in serious situations to ensure that regulations are met.
• A Letter of Admonition, in response to civil and criminal penalties can be issued (to be responded within 30 days along with corrective action taken)
• Loss or suspension of DEA registration can occur in worst case scenarios. This usually happens when a complete non-compliance or deviation from the requirements is found.

In all of the above, registrants should ensure that their legal counsel is a witness or is aware of such agreements.

How Should Companies and Personnel Behave During Inspections?

It is important for companies and their personnel to be aware of how to interact with DEA officials who are inspecting a site.

DEA officials will present their credentials for identification upon arrival and will complete the necessary formalities for Informed Consent by the company. Permission or consent to the inspection is given by signing the DEA Form 82.

Key things to remember regarding acceptable behavior during a DEA audit include:

• Companies can ask for the reason for the audit
• Companies must provide the inspectors a room for completing their duties without any interruption,
• The company must provide all the required documentation,
• Ensure that company staff (especially the people involved in receiving and shipping orders/lab personnel) are aware of their responsibilities under an action plan created for just such an inspection
• Ensure that everything necessary is in good condition and in place
• A person (generally people dealing with regulatory affairs or controlled substances can be selected) must be delegated to communicate with the inspectors throughout the audit.
• Staff can make a note of the deviations, suggestions given. Clarify questions, if any, regarding the discrepancies so that necessary corrective action can be taken at the earliest.

5 Best Practices for Trouble Free DEA Audits

For trouble free DEA inspections, it is crucial for pharma manufacturers and distributors to follow these 5 best practices:

1. Keep Proper Records

Adequate supporting documentation is essential for registrants to avoid landing in hot water with the DEA.

Storing Required Documentation

• DEA registered sites should ensure that required documentation (records of controlled substances, security screening statements, invoices, Forms, dispensing logs inventory etc.) is kept on site
• Sites should have electronic records created using automated data processing systems (In some cases, registrants will be given 2 business days to produce a period of two years records so it is always safe to keep a hard copy of the data).

Recordkeeping requirements vary for records other than e-records.

Other records that have to be stored on site include:	The following records should be readily retrievable:
Break-up invoices, Biennial and perpetual inventory related documentation, Total purchases of raw material or any substance received from another registrant, copy of reports of equipment in the facility etc.	All inventory records along with reports All quota letters (for a period of two years) ARCOS reports Power of Attorney forms (for authority to order a new Schedule I and Schedule II controlled substances) Theft and loss reports Drug destruction reports Controlled substance batch records Other quarterly reporting records

Insufficient and inadequate Quota records are most frequently cited violations in audits. Manufacturers intending to work on a Schedule II product should invest time for paper work and ensure that all quota records are correct and adequate. Registrants should ensure that their customers are aware of the Power of Attorney section which allows other individuals to issue orders for Schedule I and II controlled substances.

Invoices for Schedules III, IVs and V must also be available for inspection with following information is a must:

• Gross weight
• Net weight
• Date when drugs were received
• Quantity received
• Initials of the person verifying or receiving the drugs


2. Ensure Due Diligence with Know Your Customer Policy

DEA emphasizes more on Due Diligence when compared with its other enforcement activities. The Know Your Customer (KYC) policy requires registrants to prepare a "Customer's Responsibility Policy" so that customers know their responsibilities while handling and purchasing controlled substances. Other registrant's responsibilities pertaining to KYC and due diligence include:

• Closely monitoring a new customer's purchases
• Tracking suspicious orders so as to report any incidence of drug diversion / misuse.
• Know what the customer is doing with the drugs and pay more attention to sales staff (as they are first line of diversion defense).
• Sales executives should be approached to verify the need of the order through a verbal and written verification
• Shipment should be delivered only after evaluation by concerned staff
• Clearly differentiate between legitimate orders and suspicious orders to prevent drug diversion.
• Verify if the customer has a DEA number and State Registration.
• Establish software controls for detecting and tracking excessive purchases, orders deviating from normal pattern and orders of unusual frequency
• Implement other policies in order to prevent the diversion of controlled substances

The DEA will inspect all individuals involved in placing, distributing, and delivering orders. So it is highly important for the registrant to be aware of his core responsibilities and process of execution.

3. Install Alarm and CCTV System in Facilities

An alarm and CCTV system can be installed to keep a track on drug diversion. A separate alarm system should be maintained for each vault and cage, even extending to the hallway and temporary storage so as to monitor independent units in facilities.

Other measures that can give the DEA a good impression of your processes include:

• A cellular back-up system is essential as an alternative alarm system
• Limiting employee access to wiring equipment/vaults/cages
• Testing of wiring equipment should be carried out on a quarterly basis
• Besides vaults and cages, CCTV should also ideally cover the packaging and production areas and other storage areas
• Manufacturers should ensure that only controlled substances are stored in the temporary storage area with an Alarm system for monitoring


4. Secure Your Lab and Report Any Theft

Security is an important aspect of the DEA enforcement mandate:

"All applicants and registrants shall provide effective controls and procedures to guard against thefts and diversion of controlled substances".

During the DEA audit, the inspector will do a thorough evaluation of physical security controls, operating procedures against controlled substance diversion and he or she will carry out a closing inventory check and look at the security of the facility.

Labs are some of the most sensitive areas of any pharma manufacturing facility. The following should be ensured:

• Lab and research facilities must be secured when not lab personnel are not in attendance
• Secured lock doors must be provided to employees in their absence
• All samples and quantities used for research in the lab must be accounted for from the moment they are received, transferred, shipped or destroyed after the completion of a test.

Reporting Thefts

• Any events of theft or loss should be reported in writing (within one business day) at the earliest to the nearest DEA office/ local police department (in the case of in-transit loss).
• This should be followed by a completed Form 106 either done manually or by filling it online on the DEA diversion website by providing the correct address and making a note of the given verification control number.
• Information in the theft or loss reports should include name of the drug, its quantity, strength, NDC number of the product, explanation of the action, notifications if any.
• Copies of all such supporting documents should be kept in the customer file.


5. Carry Out Thorough Employee Background Checks

A number of diversion cases relating to theft or drug abuse involve employees, making the proper vetting of employees a critical best practice. Companies should:

• Include a pre-employment agreement and drug testing as a part of the recruitment process, as it is neither advisable nor permitted to employ someone involved with drug diversion or conviction for controlled substances. In cases where such individuals need to be hired, a DEA waiver is required and usually such a request will be rejected by the Agency for reasons known.
• Carry out employee checks / criminal record checks every five years by following a set-up policy / action plan in the organization as it is not possible to properly evaluate people in initial record checks. The workforce can be divided into groups and record checks can be conducted for a single group every year.

Proper Compliance with DEA Diversion Control Rules - Critical for Hassle-Free Audits

It is necessary for pharma manufacturers to take precautions in order to stay in compliance and ensure that their customers are dispensing or selling controlled substances for legitimate purposes only.

Registrants should also remember that if worse comes to worst, it is always better to allow DEA take action against non-compliance issues / discrepancies rather than voluntarily surrender a DEA registration. In such instances, companies should approach a legal counsel at the earliest and take necessary corrective actions to prevent such circumstances in future.

How can pharmaceutical regulatory compliance training help?

DEA compliance and audits are just a small part of regulatory compliance requirements that pharmaceutical companies have to fulfil. Subjects such as pharmaceutical compliance are multi-faceted and complex and can be better understood after attending a training course such as the ones offered by ComplianceOnline. Our courses are available as live webinars, training recordings and seminars. We also offer customized training courses developed in conjunction with organizations that wish to train large groups of their employ.

We offer training in other areas of pharmaceutical regulatory compliance such as FDA regulations, GMP, international regulatory requirements and so on.

If you need customized training courses or specialist pharmaceutical regulatory consulting services, please contact us through email [email protected] or call us at this
toll-free number: +1-888-717-2436.