Distributor Suspicious Order Monitoring Controls

kagonzalez444

Aug 25

9 min read

A controlled substance order can appear commercially reasonable and still present a diversion risk.

Effective distributor suspicious order monitoring is not a software setting, a volume threshold, or a report submitted after a shipment has already moved. It is a process. The system needs to identify unusual ordering activity, someone needs to look at what triggered the concern, the underlying facts need to be investigated, and the distributor needs to be able to explain why the final decision was made.

For distributors, the real question is simple:

If DEA asked to see the file tomorrow, could you explain what happened?

Could you show that the order was identified, that someone actually reviewed it, that the customer's explanation was evaluated, and that the decision to ship, hold, decline, or report the order was supported by the information available at the time?

That is where a SOM program either works - or doesn't.

What Suspicious Order Monitoring Must Accomplish

DEA regulations require registrants that distribute controlled substances to design and operate a system to identify suspicious orders. Suspicious orders include, but are not limited to, orders of unusual size, orders that deviate substantially from a customer's normal pattern, and orders of unusual frequency.

Those categories are important, but they should not become a checklist where an employee simply asks, "Did this order exceed our threshold?"

There is more to the analysis.

A customer may suddenly increase its controlled substance purchases for a completely legitimate reason. Maybe the pharmacy acquired another business. Maybe it added a new prescriber or service line. Maybe another pharmacy in the area closed. Maybe the customer population changed.

The important question is whether there is a legitimate explanation and whether the distributor can support that explanation.

A customer's explanation may make sense on the surface, but additional information could tell a different story. Likewise, an order that initially looks unusual may make a perfect sense once the distributor understands the customer's business and ordering history.

This is why suspicious order monitoring cannot be reduced to a number on a screen.

The objective is not to eliminate every unusual order. The objective is to identify activity that may indicate diversion and then determine, through appropriate review and due diligence, whether there is a legitimate basis for the order. DEA guidance has specifically recognized that distributors should consider the relevant circumstances rather than treating an unusual order as suspicious based on a single factor alone.

Distributor Suspicious Order Monitoring Starts With Usable Data

A monitoring program is only as good as the information going into it.

Customer ordering history is essential, but it should not stand alone. A distributor needs a current picture of the customer and the circumstances surrounding its controlled substance purchases.

Depending on the customer and the distributor's monitoring program, useful information may include:

Historical order volume and frequency
Controlled substance schedules, products, and dosage units purchased
Customer type and location
DEA registration status
Previous due diligence findings
Returns and credits
Changes in ownership
Changes in authorized purchasers
Customer business model
Dispensing information, when available and appropriate
Changes in patient population or services
Other information that may help explain a change in ordering activity

This is where data quality becomes a compliance issue - not just an IT issue.

If customers profiles are outdated, locations are incorrectly linked, drug identifiers are inconsistent, or important account notes are missing, the monitoring system may not give the reviewer an accurate picture.

That can create two problems.

First, the distributor may generate so many false positives that employees begin treating alerts as routine administrative work.

Second, a meaningful change in a customer's ordering activity could be overlooked because the underlying information is incomplete.

Thresholds Are Tools, Not the Answer

Many distributors use thresholds and analytics to identify orders that require additional review. That can be an effective part of a SOM program, but a threshold should be treated as a tool for identifying risk - not the final compliance decision.

DEA has clarified that federal law does not establish a universal quantitative threshold for the amount of controlled substances a customer may order, nor does DEA require distributors to establish a particular threshold. Those decisions are made as part of the distributor's own monitoring system.

A single percentage increase may mean something very different for a large health system, an independent pharmacy, and a specialty provider.

The same is true for the products being ordered.

A distributor should understand what its system is actually designed to identify and whether the thresholds make sense for the customers and products being monitored.

A one-size-fits-all approach can create excessive noise-or dangerous blind spots.

Alerts Are the Beginning of the Review

An alert is not the end of the process. It is the beginning of the review.

One of the weaknesses I have seen in compliance programs is treating the alert queue as an administrative workflow instead of what it really is: a diversion-control tool.

The reviewer needs to understand why the order was flagged and what information is necessary to determine whether the concern can be resolved.

A meaningful review should compare the current order with the customer's historical activity and then look at the circumstances surrounding the change.

What changed?

Why did it change?

Does the customer's explanation make sense?

And perhaps most importantly:

Can the explanation be supported?

A Real-World Example

I remember reviewing a suspicious order monitoring issue involving a pharmacy located near a large university.

The distributor's system repeatedly identified the pharmacy's orders because of it purchases of Adderall. During the school year, the pharmacy's purchases increased significantly. During the summer, the ordering dropped. Then, when students returned for the fall semester, the ordering increased again.

At first glance, there was certainly something unusual about the ordering pattern.

However, the pattern itself was not enough to tell us whether diversion was occurring.

The pharmacy was located in an area heavily influenced by the university population. The increase in demand corresponded with the academic year, while the decrease during the summer corresponded with students leaving the area.

Suddenly, the ordering pattern made a lot more sense.

The seasonal pattern provided important context for understanding why the pharmacy's-controlled substance purchases increased and decreased as predictable times of the year.

That does not mean the distributor should simply ignore the alert because the explanation sounds reasonable.

It identified an ordering pattern that was different enough to warrant a closer look. The next step was to understand the circumstances behind the pattern. That distinction is important.

An alert should cause someone to ask questions. It should not cause someone to automatically assume the worst - and it should not be automatically dismissed because the customer provides an explanation.

The review is where the distributor determines whether the explanation is supported by the available information and whether additional due diligence is necessary.

That is the difference between having a monitoring system and actually monitoring suspicious orders.

Build a Defensible Investigation and Escalation Process

A written procedure should clearly identify who reviews alerts, who can plan an order on hold, when management or legal personnel needs to be involved, and who has authority to approve, decline, or otherwise disposition an order.

The procedure should also address how suspicious orders are reported and how information is communicated to the appropriate regulatory authorities.

But having a procedure is only the beginning.

The investigation record should tell a story.

Someone reviewing the file later should be able to understand:

What order was identified?
What did it trigger?
What information was reviewed?
What did the customer say?
Was supporting documentation obtained?
What additional due diligence was performed?
What was the final decision?
Why was that decision considered reasonable based on the information available at the time?

A note that simply says "reviewed and approved" does not tell that story.

Neither does "customer provided explanation - approved."

If the order was significant enough to trigger additional review, the documentation should demonstrate that meaningful review actually occurred.

Don't Let the Business Relationship Make the Decision

Commercial pressure can complicate SOM.

A customer may be one of the distributor's largest accounts. Sales may be pushing to get an order out before the end of the month. The customer may have been doing business with the distributor for years.

None of those things resolve a diversion concern.

In fact, familiarity can sometimes create its own risk. When employees become comfortable with a customer, changes in ordering behavior may be easier to overlook.

The question should remain the same:

Does the information available support the legitimacy of the order?

If the concern cannot be adequately resolved, the distributor needs a process for escalating the matter rather than allowing the order to move simply because delaying it is inconvenient.

Reporting Does Not End the Distributor's Responsibility

Reporting a suspicious order to DEA is an important part of the distributor's responsibility, but the report itself does not replace the distributor's obligation to exercise appropriate due diligence regarding the order.

If an order raises concerns, the distributor needs to address those concerns rather than treating the act of reporting as the end of the process. DEA has emphasized the importance of considering the relevant circumstances and determining whether there is a legitimate basis for the order.

The same discipline should continue after the immediate review.

If a suspicious order reveals a change in a customer's ordering behavior, the distributor may need to look at subsequent orders more closely. The customer profile may need to be updated. The monitoring system may need to be adjusted. Other customers with similar ordering patterns may warrant review.

A suspicious order may be an isolated event.

It may also be the first indication of a much larger problem.

Common Monitoring Failures That Increase Risk

Many SOM programs do not fail because the distributor lacks technology.

They fail because the controls do not operate the way the written procedure says they should.

Common problems include:

Alert thresholds that have never been evaluated or validated
Employees who do not have authority to place an order on hold
Incomplete customer due diligence
Poor communication between sales and compliance
Incomplete investigation notes
Inconsistent escalation
Employees closing alerts without adequately documenting the basis for the decision
A compliance policy that says one thing while employees routinely do something else

Another issue is separating compliance from operations too much.

Sales personnel may learn about a customer's new business before compliance does. Customer service personnel may receive an explanation for a sudden increase in ordering. Finance may notice payment issues or other account activity.

That information can matter.

A good SOM program creates a clear way for relevant information to reach the people responsible for controlled substance oversight.

Training Needs to Match the Job

SOM training should also be role-specific.

Investigators need to understand red flags, documentation, due diligence, and escalation.

Sales and account personnel need to understand that they should not promise fulfillment while a compliance review is pending, coach customers on how to avoid alerts, or minimize information that could affect a compliance decision.

Management needs meaningful information about trends, unresolved concerns, held orders, reported orders, customer actions, and exceptions.

Everyone involved needs to understand the same basic principle:

The purpose of SOM is not to get orders through the system. The purpose is to identify and address potential diversion.

Test the Program Before an Inspection Tests It for You

One of the best ways to determine whether a SOM program is actually working is to look at what the program has already done.

A distributor can conduct periodic retrospective reviews of closed alerts, approved orders, held orders, and reported orders.

Then ask:

Does the file support the decision?
Was the order properly identified?
Did the reviewer understand why it was flagged?
Was relevant information obtained?
Was the customer's explanation evaluated?
Was the rationale documented clearly?
Did subsequent ordering activity confirm or undermine the original decision?

These reviews can reveal weaknesses that may not be obvious when the program is running day to day.

Testing should also compare the written policy to actual practice.

A policy may require enhanced due diligence after certain triggers, while employees may be using a less rigorous process because of workload, unclear responsibilities, or a lack of training.

Those differences matter.

If the policy says one thing and the records show something else, an organization may have difficulty explaining which process is actually being followed when DEA asks questions.

The Bottom Line

A strong suspicious order monitoring program does not depend on the hope that a computer system will catch every problem.

Technology is important. Data is important. Thresholds and analytics can be useful, but none of those things replace the person who has to look at the alert and ask:

Why did this happen?

And then:

Does the information support the explanation?

The strongest programs create accountability around what happens after the alert: identify the concern, investigate the facts, document the rationale, and take appropriate action when the risk cannot be responsibly resolved.

That is what turns suspicious order monitoring from a box-checking exercise into an actual diversion control process.