United States Government Accountability Office

Report to Congressional Committees

January 2020

DRUG CONTROL
Actions Needed To
Ensure Usefulness
Of Data On
Suspicious Opioid
Orders
Accessible Version

GAO-20-118
 January 2020

DRUG CONTROL
Actions Needed to Ensure Usefulness of Data on
Suspicious Opioid Orders

Highlights of GAO 20-118, a report to

congressional committees.

Why GAO Did This Study What GAO Found

Since 1999, more than 700,000 people The Drug Enforcement Administration (DEA) collects industry-reported data on
have died of a drug overdose in the the sale and purchase of controlled substances and prescription drugs, including
United States, with about 48,000 dying opioids. It uses these data to support ongoing investigations into the diversion of
of an opioid overdose in 2017 alone. such substances into the illegal market place and to identify investigative leads
The DEA administers and enforces the for its field division offices.
Controlled Substances Act as it
pertains to ensuring the availability of
controlled substances, including
certain prescription drugs, for
legitimate use while limiting their
availability for abuse and diversion.
The Substance Use-Disorder GAO identified deficiencies associated with DEA’s drug diversion efforts,
Prevention that Promotes Opioid including the following:
Recovery and Treatment for Patients
and Communities Act, enacted in 2018 • Limited proactive and robust analysis of industry-reported data. While
included a provision for GAO to study DEA’s current data systems are not designed to conduct real-time analysis,
the reporting of suspicious opioid and it conducts some analyses of industry-reported data, such as in
orders on a real-time basis nationally response to requests from its field division offices, DEA could conduct more
using computer algorithms. This report analyses using automated computer algorithms to help identify questionable
examines, among other things, how patterns in the data. For example, DEA could analyze data to identify
DEA obtains and uses industry- unusual volumes of deleted transactions or unusual volumes of drugs that
reported data to identify and address were disposed of rather than sold. It could also analyze data to identify
suspicious opioid orders and
trends in distribution or drug purchases in a given geographic area. Other
opportunities for DEA to improve these
analysis DEA could perform is to look for unusual patterns when comparing
efforts, such as using computer
drug orders in one geographic area with other nearby areas. These analyses
algorithms or real-time reporting. GAO
analyzed program documentation and could potentially help DEA proactively identify suspicious activities or
DEA data, and interviewed DEA and registrants that may warrant investigation.
industry officials as well as officials • No data governance structure to manage all drug transaction data.
from national associations representing Although DEA has guidance, policies and procedures for the use of some
distributors, investigators, state boards information systems, it has not established a formal data governance
of pharmacy, and other federal and structure to manage all data it collects and maintains, which are integral to its
state agencies. diversion control activities. A data governance structure is defined as an
institutionalized set of policies and procedures for providing data governance
What GAO Recommends throughout the life cycle of developing and implementing data standards.
GAO is making four recommendations Industry and technology councils, domestic and international standards-
related to DEA’s collection and use of setting organizations, and federal entities endorse the use of a governance
industry-reported data. DEA agreed structure to oversee the development, management, and implementation of
with three of the four data standards, digital content, and other data assets. While DEA began
recommendations, and neither agreed efforts to develop a governance structure, it is in the early stages of
nor disagreed with the fourth. development and does not have additional details or documentation of its
efforts. An effective data governance structure could help DEA ensure its
important data assets are consistently and fully utilized.

View GAO-20-118. For more information,

contact Triana McNeil at (202) 512-8777 or
mcneilt@gao.gov

United States Government Accountability Office

 Contents
Background 5
DEA Collects Industry-Reported Data to Help Address Opioid
Diversion, but Opportunities Exist to Improve its Management
and Use of Data 13
DEA Has Taken Some Steps to Help Industry Report Suspicious
Orders, but Has Not Addressed Identified Limitations with the
Data it Shares or Receives 28
Conclusions 35
Recommendations for Executive Action 36
Agency Comments and Our Evaluation 37

Appendix I: Scope and Methodology 40

Appendix II: Timeline of Selected Events and Legislation Impacting or Related to Industry-Reported Data on
Prescription Opioids 45

Appendix III: Comments from the Department of Justice 47

Appendix IV: GAO Contact and Staff Acknowledgments 53

GAO Contact 53
Staff Acknowledgments 53

Figures
Figure 1: The Prescription Drug Supply Chain and Examples of
Opportunities for Abuse and Diversion 7
Figure 2: Overview of the Information Reported to and Used by
the Drug Enforcement Administration (DEA) to Monitor
Controlled Substances 11
Figure 3: Timeline of Selected Key Events and Legislation Related
to Industry-Reported Data on Prescription Drugs 46

Abbreviations
ARCOS Automated Reports and Consolidated Orders
System
CDC Centers for Disease Control and Prevention
CSA Controlled Substances Act

Page i GAO-20-118 Suspicious Order Reporting

CSOS Controlled Substance Ordering System
DEA Drug Enforcement Administration
DOJ Department of Justice
GPRA Government Performance and Results Act of 1993
GPRAMA GPRA Modernization Act of 2010
LSD lysergic acid diethylamide
MOA memorandum of agreement
PDMP prescription drug monitoring program
SORS Suspicious Orders Reporting System
SORS Online Suspicious Orders Report System Online
SUPPORT Act Substance Use Disorder Prevention that Promotes
Opioid Recovery and Treatment for Patients and
Communities Act of 2018

This is a work of the U.S. government and is not subject to copyright protection in the
United States. The published product may be reproduced and distributed in its entirety
without further permission from GAO. However, because this work may contain
copyrighted images or other material, permission from the copyright holder may be
necessary if you wish to reproduce this material separately.

Page ii GAO-20-118 Suspicious Order Reporting

441 G St. N.W.
Washington, DC 20548

January 29, 2020

The Honorable Lindsey Graham

Chairman
The Honorable Dianne Feinstein
Ranking Member
Committee on the Judiciary
United States Senate

The Honorable Jerrold Nadler

Chairman
The Honorable Doug Collins
Ranking Member
Committee on the Judiciary
House of Representatives

Since 1999, more than 700,000 people have died from a drug overdose in
the United States, with over 70,000 of those deaths occurring just in
2017, according to the Centers for Disease Control and Prevention
(CDC). About 48,000 of the 2017 overdose deaths involved an opioid,
including prescription opioids and illegal opioids like heroin and illicitly
manufactured fentanyl. Both the President’s Commission on Combating
Drug Addiction and the Opioid Crisis as well as the CDC noted that the
number of opioid overdose deaths has reached epidemic proportions in
the United States. 1 The Department of Justice’s (DOJ) Drug Enforcement
Administration (DEA) plays a key role in addressing the diversion of
controlled substances as well as certain prescription drugs, including
opioids. Diversion occurs when legally produced controlled
pharmaceuticals are illegally obtained for non-medical use.

The prescription drug supply chain provides a means for controlled

substances to be distributed for useful and legitimate medical purposes,
but may also present opportunities for the drugs to be abused and
diverted into the illegal marketplace. Pursuant to the Controlled

1ThePresident’s Commission on Combating Drug Addiction and the Opioid Crisis: Final
Report (2017).

Page 1 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

Substances Act (CSA), as amended, registrants, 2 such as distributors,

are subject to various recordkeeping and reporting requirements 3
including detecting and reporting to DEA any identified “suspicious
orders” for controlled substances. 4 A “suspicious order” may include, but
is not limited to, an order of a controlled substance of unusual size, an
order of a controlled substance deviating substantially from a normal
pattern, and orders of controlled substances of unusual frequency. 5

DEA enforces the CSA enacted to regulate and facilitate the use of
controlled substances for legitimate purposes while preventing them from
being diverted for illegal ones. In about 2005, DEA began focusing its
attention on wholesale distributors of prescription opioids, which ship the
drugs from drug manufacturers to pharmacies, according to DEA
Diversion Control Division officials.

The Substance Use-Disorder Prevention that Promotes Opioid Recovery

and Treatment for Patients and Communities Act of 2018 (SUPPORT
Act) includes a provision for us to study the reporting of suspicious
orders, including evaluating real-time reporting on a national level using
computer algorithms and the extent to which that reporting could help
identify issues with orders before they are filled or reduce the length of a
drug diversion investigation. 6 This report examines the following
questions:(1) To what extent does DEA obtain and use industry-reported
data to identify and address suspicious opioid orders and what
opportunities exist, if any, for DEA to improve these efforts, such as using
computer algorithms or real-time reporting? (2) To what extent does DEA
collaborate with industry stakeholders to combat opioid diversion?

To address our first objective, we reviewed relevant federal laws,

regulations, program guidance, and relevant reports and conducted
interviews with DEA headquarters offices, including the Diversion Control

2Pursuant to 21 U.S.C. § 822(a), generally, every person who manufactures or distributes

any controlled substance or who proposes to engage in the manufacture or distribution of
any controlled substance is required to obtain an annual registration issued by the
Attorney General in accordance with certain rules and regulations.
3See 21 U.S.C. § 827.
421 U.S.C. § 832(a).
521 U.S.C. § 802(57).
6Pub. L. No. 115-271, § 3292, 132 Stat. 3894, 3956-59 (2018).

Page 2 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

Division and a non-generalizable sample of eight DEA field division

offices. This included interviewing DEA officials at these field division
offices to learn about how diversion investigators use industry-reported
data and what, if any, improvements might be needed. To identify which
of the 23 DEA field division offices to interview, we prioritized our
selection based on criteria such as the controlled prescription drug
availability rate in their geographic area, whether the office was the
location of a DOJ opioid-related task force, and whether the office was in
a top ten state for controlled prescription drug prescribing rates, based on
data from CDC. In addition, we reviewed DEA documentation of
procedures for conducting drug-related investigations, information system
manuals for data and information systems used by DEA, written
communications from DEA to registrants, and DEA forms registrants use
to report prescription drug transactions to DEA. We also interviewed
officials from other federal, state, and local entities with opioid diversion
prevention responsibilities, such as state level Prescription Drug
Monitoring Programs, the Department of Health and Human Services,
including the Centers for Medicare and Medicaid Services, and the DOJ
U.S. Attorney’s Office Opioid Fraud and Abuse Detection Unit. We also
conducted interviews with industry associations and private sector
industry members to gather their perspectives and experiences with
efforts to detect and report suspicious opioid orders.

To determine what opportunities exist, if any, for DEA to improve data use
efforts, such as using computer algorithms or real-time reporting, we
analyzed the data DEA collects to identify possible types of analyses DEA
could conduct to identify unusual patterns of distribution using computer
algorithms.

In addition, we reviewed key data governance practices identified through

our past work, to determine the extent to which DEA applied select
practices to manage how it collects and uses data to support diversion
control efforts. 7 Furthermore, we reviewed the extent to which DEA
defined objectives and outcome-oriented goals and established
measurable performance targets to evaluate the effectiveness of how it
obtains and uses data for diversion control purposes and compared them
to Government Performance and Results Act (GPRA) and GPRA

7GAO, Data Act: OMB Needs to Formalize Data Governance for Reporting Federal
Spending, GAO-19-284, (Washington, D.C.: Mar. 22, 2019).

Page 3 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

Modernization Act (GPRAMA) of 2010 requirements, which may serve as

leading practices for DEA.

To determine how DEA collaborates with industry stakeholders on

combatting opioid diversion, we examined DEA agency-wide directives
and guidance, and component management policies and procedures for
providing information to industry stakeholders related to industry’s
suspicious order reporting requirements. In addition, DEA officials
provided us with a demonstration of relevant information systems,
including the Suspicious Orders Reporting System (SORS), Automation
of Reports and Consolidated Orders System (ARCOS), and the ARCOS
Enhanced Lookup Buyer Statistic Tool – available to distributors to help
them identify and report suspicious opioid orders. 8 We interviewed opioid
distributors of varying sizes, including some of the largest opioid
distributors, based on DEA-provided ARCOS data of opioid-related
transactions, for their perspectives on the information and tools DEA
provides to them, including the Lookup Buyer Statistics Tool and the
ARCOS enhanced lookup Buyer Statistic Tool. We also spoke with trade
organizations that represent distributors to gather their perspectives
regarding industry interaction and coordination with DEA related to
diversion efforts and data sharing. We interviewed DEA officials about
current or future initiatives to address industry concerns regarding the
data DEA provides them and the status of those initiatives. Appendix I
contains a more detailed discussion of our scope and methodology.

We conducted this performance audit from January 2019 through January

2020 in accordance with generally accepted government auditing
standards. Those standards require that we plan and perform the audit to
obtain sufficient, appropriate evidence to provide a reasonable basis for
our findings and conclusions based on our audit objectives. We believe
that the evidence obtained provides a reasonable basis for our findings
and conclusions based on our audit objectives.

8The ARCOS Enhanced Lookup Buyer Statistic Tool, discussed in further detail later in
this report, allows DEA-registered manufacturers and distributors to view the number of
distributors and the amount of certain controlled substances each distributor sold to a
customer in the previous six months. DEA first made the tool available in February 2018,
with an additional enhancement released in February 2019.

Page 4 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

Background
The CSA and DEA Registration
The Controlled Substances Act (CSA) was enacted in 1970 to regulate
and facilitate the use of controlled substances, including certain
prescription drugs such as opioid pain relievers, for legitimate medical,
scientific, research, and industrial purposes while preventing them from
being diverted for illegal uses.

According to DEA, the CSA requires DEA to maintain a “closed system”

of distribution, which includes limiting the amount of certain controlled
substances that are available in the marketplace by setting quotas. 9
Various CSA provisions also require persons who handle controlled
substances to register with the DEA. This includes businesses that
import, export, manufacture, or distribute controlled substances; certain
health care practitioners, such as physicians, licensed to dispense,
administer, or prescribe them; and pharmacies authorized to fill
prescriptions, referred to as “registrants.” 10 The registration mechanism
creates a “closed system” of distribution in which distribution may lawfully
occur among the registrants. The closed system of distribution, along with
registrant compliance with the CSA’s regulatory requirements, helps to
ensure that a particular controlled substance is always accounted for by a
DEA-registered entity, from its creation until it is dispensed to a patient or
is destroyed.

The CSA places controlled substances in one of five schedules based

generally on findings related to the substance, including whether the
substance has a currently accepted medical use in treatment in the
United States, its relative potential for abuse, and the degree of
dependence the drug or other substance may cause. 11 For further
information on this and other legal requirements, please see appendix II.

921 U.S.C. § 826.

1021 U.S.C. § § 822, 957-958.
1121 U.S.C. § 812.

Page 5 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

Legitimate Use of Prescription Drugs, Drug Supply Chain,

and Opportunities for Opioid Abuse and Diversion
The prescription drug supply chain is the means through which
prescription drugs are ultimately delivered to patients with legitimate
medical needs. Although there can be many variations in the flow of
prescription drugs through the supply chain, in a common example,
prescription drugs are produced by manufacturers; are purchased and
stored by distributors, who take orders and deliver them to customers
such as pharmacies; and ultimately are dispensed by pharmacies to
patients who have a prescription from a practitioner, as shown in figure 1.
Although prescription drugs are intended for legitimate medical uses, the
prescription drug supply chain may present opportunities for the drugs to
be diverted and abused as the drugs move through the various
components of the supply chain. For example, an individual may visit
multiple practitioners posing as a legitimate patient, referred to as a
doctor shopper, to obtain prescriptions for drugs for themselves or others,
or criminal enterprises may rob distributors and pharmacies of
prescription drugs to sell to others.

Page 6 GAO-20-118 Suspicious Order Reporting

 Appendix I: Scope and Methodology

Figure 1: The Prescription Drug Supply Chain and Examples of Opportunities for Abuse and Diversion

Roles and Responsibilities Related to Controlled

Substances
DEA, through its Diversion Control Division, is responsible for preventing,
detecting and investigating the diversion of controlled substances from

Page 7 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

legitimate sources while ensuring an adequate and uninterrupted supply

is available for legitimate medical, commercial, and scientific needs. The
division is responsible for enforcing the CSA and its regulations pertaining
to pharmaceutical controlled substances and listed chemicals. In doing
so, it conducts domestic investigations, among other things, in DEA’s 23
field division offices.

By law, generally, manufacturers, distributors, and reverse distributors 12

are required to report to DEA every sale, delivery, or other disposal of any
controlled substance. 13 As we previously reported, manufacturers and
distributors of schedules I and II drugs and schedule III narcotics must file
reports with DEA through ARCOS, a drug reporting system that allows
the agency to monitor the flow of DEA controlled substances from their
point of manufacture through commercial distribution channels to point of
sale or distribution at the dispensing/retail level. 14 In addition, certain
schedule III non-narcotics and some schedule IV narcotics are also
covered by the ARCOS reporting requirements. 15 DEA implemented the
ARCOS database in 1997, and approximately 1,250 distributors,
manufacturers, and reverse distributors report more than 72 million
transactions into ARCOS each year, according to DEA. Generally, certain
registrants must report certain data at least quarterly and they have the
option to report voluntarily on a monthly basis. 16

By law, each registrant, such as manufacturers and distributors of

controlled substances, is required (1) to design and operate a system that
is compliant with applicable federal and state privacy laws to identify
suspicious orders of controlled substances, and (2) upon discovering a
suspicious order or series of orders, notify the DEA Administrator and the
special agent in charge of the appropriate DEA field division office. 17

12Areverse distributor is a business that collects controlled substances from registrants

and either returns them to the manufacturer or arranges for their disposal.
13See 21 U.S.C. § 827.
14GAO, Prescription Drug Control: DEA Has Enhanced Efforts to Combat Diversion, but
Could Better Assess and Report Program Results, GAO-11-744, (Washington, D.C.:
August 2011).
1521 C.F.R. § 1304.33.
16See 21 C.F.R. § 1304.33(b).
1721 U.S.C. § 832(a).

Page 8 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

The SUPPORT Act, which amended the CSA in part, also includes
requirements related to preventing drug diversion. The SUPPORT Act
provisions require the DEA Administrator to establish a centralized
database for collecting suspicious orders reports, 18 which is discussed in
more detail below. In addition, the SUPPORT Act requires the Attorney
General to make certain data available to registered manufacturers and
distributors through ARCOS. 19 The SUPPORT Act also requires the
Attorney General to submit to Congress a report that provides information
about how the Attorney General is using ARCOS data to identify and stop
suspicious activity no later than one year after the date of enactment of
the SUPPORT Act. 20

DEA Diversion-Related Data Systems

DEA operates and maintains various information systems containing
registrant information, transaction data, and suspicious drug orders that
support its efforts to prevent, detect, and investigate the diversion of
pharmaceutical controlled substances. These include

• Controlled Substance Ordering System (CSOS). This system is used

primarily by manufacturers and distributors, as well as pharmacies
and hospitals to place orders for controlled substances in a secure
electronic environment, and includes information such as the number
of packages, size of packages and name of items ordered, according
to DEA.
• ARCOS. As discussed above, ARCOS monitors the flow of
transactions of schedule I, II, III and select schedule IV controlled
substances from their point of manufacture to their point of sale or
distribution at the dispensing or retail level (such as hospitals, retail
pharmacies, practitioners, and teaching institutions). The data in
ARCOS are used to, among other things, track regulatory compliance
in the pharmaceutical drug industry and to detect abuse of legally
manufactured pharmaceuticals that are diverted to illegal markets,
according to DEA Diversion Control Division officials.

18Pub. L. No. 115-271, § 3292, 132 Stat. 3894, 3956-59. See 21 U.S.C. § 832(b).
19Pub. L. No. 115-271, § 3273, 132 Stat. 3894, 3952-54. See 21 U.S.C. § 827(f).
20Pub. L. No. 115-271, § 3274, 132 Stat. 3894, 3954.

Page 9 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

• Suspicious Order Reporting System (SORS). DEA developed SORS

to receive and store suspicious order reports. To date, DEA has
developed three versions of SORS as described below.
• SORS Online version. In late October 2019, DEA launched the
Suspicious Orders Report System (SORS) Online, a centralized
database required by the SUPPORT Act, for registrants that
distribute controlled substances to report suspicious orders to
DEA. 21 Reporting a suspicious order to SORS Online constitutes
compliance with the reporting requirement that registrants notify
the Administrator of the Drug Enforcement Administration and the
Special Agent in Charge of the Division Office of the Drug
Enforcement Administration for the area in which the registrant is
located or conducts business. 22 SORS online is the third version
of DEA’s SORS system that was originally developed in 2008.
Unlike earlier SORS versions, SORS Online requires users to
provide a reason an order is suspicious. At the time of our study,
the use of SORS Online was voluntary. Registrants who are under
active MOAs with DEA are reporting to the new SORS Online
system, according to DEA.
• Follow-up version. Suspicious order reports reported by
registrants since March 2017 operating under an active
memorandum of agreement (MOA) with the DEA that required
them to submit their reports electronically to DEA headquarters as
opposed to their local DEA field division office using the SORS
Follow-up version, according to DEA Diversion Control Division
officials.
• Initial version. The initial version of SORS stores suspicious
order reports for registrants with an expired MOA but who elected
to voluntarily continue to report suspicious orders in the same way
as under the MOA, according to DEA Diversion Control Division
officials. The initial version of SORS was established in 2008.
Figure 2 provides an overview of the information DEA obtains and uses to
support its diversion control efforts.

21SORS Online is intended for use by DEA registrants that distribute controlled
substances to other DEA registrants.
2221 U.S.C. § 832(b)(2).

Page 10 GAO-20-118 Suspicious Order Reporting

 Appendix I: Scope and Methodology

Figure 2: Overview of the Information Reported to and Used by the Drug Enforcement Administration (DEA) to Monitor
Controlled Substances

a
CSOS is an electronic ordering system which allows registrants to place orders for controlled
substances. All CSOS orders are also included in registrant’s ARCOS reporting at a later date.
b
ARCOS contains drug manufacturer and distributor reported transaction data used by DEA to
monitor the flow of controlled substances from their point of manufacture through commercial
distribution channels to point of sale or distribution at the dispensing and retail level.
c
Registrants, upon discovering a suspicious order or series of orders, notify the Administrator of DEA
and the Special Agent in Charge of the Division Office of DEA for the area in which the registrant is
located or conducts business.
d
SORS is a system that allows registrants to report suspicious orders to the DEA electronically and
was initially developed in 2008. The current SORS, SORS Online system, was launched on October
23, 2019 and supersedes prior versions.

Page 11 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

State Prescription Drug Monitoring Programs (PDMP)

A PDMP is an electronic database that tracks controlled substance
prescriptions, managed within and at the state level. State PDMPs can
provide health care providers and authorities timely information about
prescribing and patient behaviors that may indicate drug abuse or
diversion and facilitate a response. Authorized users, such as
practitioners and pharmacists, may access information submitted to
PDMPs by dispensers. A state’s PDMP is housed by a specified
statewide regulatory, administrative or law enforcement agency. The
PDMP distributes data from the database to individuals who are
authorized under state law to receive the data for purposes of their
profession. PDMP data can assist law enforcement and health care
providers such as practitioners and pharmacists in identifying patterns of
prescribing, dispensing, or receiving controlled substances that may
indicate abuse or diversion.

PDMPs vary in numerous ways across states, including what data they
collect; what drugs they cover; who has access to, or who is required to
use, the prescription drug monitoring program; and which state agency
oversees and administers the program. DEA may request state PDMP
data through submitting requests or subpoenas to the state official
operating the PDMP database, for example, to support diversion control
investigations. The requirements on requesting and accessing state
PDMP vary from state to state according to DEA Diversion Control
Division officials. Officials noted that the different state-by-state
requirements create difficulties for federal law enforcement during a multi-
state or national case as law enforcements’ requests for data have to be
addressed at the state level.

Data Analytics
Data-analytics activities can include a variety of techniques to prevent
and detect diversion, including data matching and data mining. Data
matching is the large scale comparison of records and files to detect
errors or incorrect information. It can be used to verify information
provided by recipients or detect unreported changes. Data mining is the

Page 12 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

use of automated computer algorithms 23 to detect patterns, including

those that are otherwise not obvious, correlations, or anomalies within
large data sets indicative of potential diversion. Entities may identify many
types of analytics techniques that can be used to address improper
transactions, such as

• Rules based – Identify suspicious orders with rules, such as orders

that go above a threshold;
• Anomaly – Detect individual and aggregated abnormal patterns
versus peer group, for example, the orders from one pharmacy
compared to other pharmacies in the same geographic area; and
• Predictive – Assess against known diversion. A provider that has
characteristics similar to those of known bad actors.

DEA Collects Industry-Reported Data to Help

Address Opioid Diversion, but Opportunities
Exist to Improve its Management and Use of
Data
DEA Uses Self-Reported Industry Purchase Data to Help
Identify and Address Opioid Diversion Activities
DEA uses industry-reported ARCOS data to help generate leads, support
enforcement actions, and allocate resources. The agency uses these
data in a number of ways, including supporting field diversion control
activities and developing analytical products.

• Field-Based requests for data analysis. DEA’s Diversion Control

Division’s ARCOS Unit responds to requests for data analysis from its
field division offices in support of diversion control enforcement
activities. According to DEA officials, this unit is responsible for the
collection, maintenance, and analysis of ARCOS data. For example,
DEA said this unit conducts analysis on controlled substances that are
bought and sold in a particular timeframe between a seller and a
23A computer algorithm is a software program that automates decision making, enabling
the automation of functions such as some of those that require the ability to reason. For
example, an algorithm may use data on weather, traffic, and roadways to estimate and
provide real-time information to drivers on traffic delays and congestion.

Page 13 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

buyer. The ARCOS Unit also obtains information on the quantity,

dosage units, grams, and ingredients of the drugs in the sale and
conducts analyses in response to specific requests from field-based
investigators who send their requests to the unit. For example, DEA
officials said that out of the 800 field division office requests for
analysis sent to the DEA ARCOS Unit in calendar year 2018, about
60 percent of those were for “enhanced” validations. 24 This process
includes a controlled substance report which the unit provides to field
investigators for their use during scheduled drug investigations, and
contains a summary of, among other things, an ARCOS registrant’s
reported sales and purchases compared against what other
registrants report was sold to them. This process uses both automatic
and manual checks. According to DEA officials, they received
approximately 480 requests for enhanced validations from DEA field
investigators in 2018. While DEA officials noted that DEA’s enhanced
validation procedures are not documented, they acknowledged that
the ARCOS Unit is in the process of developing standard operating
procedures for ARCOS data quality control, including the enhanced
validation process. All requests for validations submitted to the
ARCOS Unit are analyzed and compiled, and sent to field-based
investigators to support scheduled investigations. Although validations
are primarily requested for scheduled investigations, field offices can
request these reports pursuant to any scheduled or non-scheduled
investigation.
• DEA Analytic Product - Drug Profiles. Using ARCOS data, DEA
creates drug profiles for suspected bad actors at the retail level (such
as certain pharmacies), who have irregular transactions–also known
as outliers, according to DEA officials–in a specific area or zip code
and provides this information to its field division offices. The ARCOS
Unit compares this suspected “bad actor” with other area competitors.
• DEA Analytic Product – Annual Threat Assessments. DEA’s ARCOS
Unit also uses ARCOS data to develop threat assessments annually
to aid field investigators. The threat assessments use ARCOS data to
provide drug-related transaction trends and patterns related to a given
DEA field division office area of operations to help establish priorities
and allocate resources. DEA officials noted that field division office

24According to DEA officials, the enhanced validation is a controlled substance report

provided to investigators in the field for their use during scheduled drug investigations, and
contains, among other things, a summary of what a particular ARCOS registrant reported
for sales and purchases, versus what other registrants reported purchasing or selling to
that registrant.

Page 14 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

staff use these assessments to develop work plans identifying which

registrants will be subject to the office’s routine regulatory
investigation that year.
• Field Querying of ARCOS Data. – Field division offices may also use
ARCOS querying tools to analyze ARCOS data to proactively identify
diversion targets, such as reviewing ARCOS data to identify
information on top purchasers of controlled substances. In a written
response to our questions, DEA officials told us that several ARCOS
drug profiles they developed have contributed to state and federal
administrative, criminal and regulatory investigations.
DEA officials recently informed us that as part of a reorganization, it
established the Targeting and Special Projects Section whose goal is to
focus on leveraging DEA’s data capabilities. Specifically, this section is
composed of two units, including the Reports Analytics Unit and the
Targeting and Special Projects Unit, which was established in March
2019 and is responsible for conducting data analytics on ARCOS and
other data, according to DEA Diversion Control Division officials. DEA is
currently working to determine the types of analysis these units will
conduct.

DEA Conducts Limited Analysis of Industry-Reported

Data Using Automated Computer Algorithms
We found that while DEA uses ARCOS data to support ongoing
investigations and conducts analysis on this data to identify investigative
leads for its field division offices, it could conduct more robust analysis
using automated computer algorithms to help identify questionable
patterns in the data. This analysis in turn could be used to identify
registrants that need to be investigated. 25

According to DEA officials, most of the analysis DEA currently conducts

on ARCOS data is used by the field division offices. For example, upon
receiving information on pharmacies that have a high frequency of
reporting stolen or lost-in-transit drugs a field division office may contact
DEA’s ARCOS Unit to request ARCOS information. DEA then analyzes
the ARCOS data to produce the requested reports to support the field’s

25Registrants can submit ARCOS reports through a paper form, Form 333, the ARCOS
online database or Electronic Data Interface. Most registrants use the Electronic Data
Interface or ARCOS online, however approximately 37 of the more than 1100 registrants
reported their information via Form 333.

Page 15 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

ongoing investigations. DEA also conducts routine analysis of ARCOS

data to identify

• high volumes of drugs sold by a distributor to a single purchaser,

• high volumes of drugs purchased by a single purchaser, and
• trends in drugs sold or purchased in a given geographic area
compared to similar nearby areas.
DEA officials also identified one type of analysis it conducts using a
computer algorithm. Specifically, DEA uses a computer algorithm when
comparing large volumes of drugs purchased in a given geographic area
to the area’s population data. According to DEA officials, DEA conducts
this analysis quarterly. However, DEA did not report conducting active
and recurring monitoring of transactions using algorithms to detect and
flag transactions that indicate potential diversion, either on a real-time or
near real-time basis.

We identified several additional opportunities for DEA to proactively

analyze ARCOS data using computer algorithms to identify unusual
patterns of drug distribution on a more routine basis. Such analyses could
be used to proactively support or generate leads for investigations of
potential drug diversion. For example, DEA could

• Analyze ARCOS data to identify unusual volumes of drugs that were

disposed of rather than sold.
• Conduct analysis of ARCOS data to identify unusual numbers of
deleted transactions or deletions of transactions of high volumes of
drugs.
• Analyze ARCOS data by comparing the amount of drugs being
acquired by a registrant to the amount of drugs accounted for, through
being sold or disposed of, among other things, by each registrant to
determine any differences.
• Analyze ARCOS data to identify trends in distribution or purchases of
drugs in a given geographic area. DEA could look for unusual patterns
when comparing such activity in an area with that of other nearby
areas; or analyze volumes of drugs purchased in a geographic area
when adjusted by the area population.
In addition to the analysis noted above using ARCOS data, we also
identified further analysis that DEA could perform using ARCOS data and
additional available data to help identify potentially suspicious purchase
or distribution patterns. Specifically, in our review and analysis of ARCOS

Page 16 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

data and information about PDMP data, we identified an opportunity for

DEA to analyze ARCOS and PDMP data together for a more complete
picture of drug transactions from distribution to retailers through
dispensation to patients. We determined this could help in assessing
whether the amount of drugs being prescribed is consistent with the
amount of drugs being purchased or distributed in a given geographic
area. For example, in areas where the number of prescriptions increases,
a subsequent increase in drug orders and distribution to that area could
be considered understandable. However, where the number of
prescriptions in an area remains the same, or decreases, a significant
increase in drug orders and distribution to that area could be considered
unusual, especially if this pattern persists over several reporting periods.
DEA stated that it occasionally performs such analysis manually, noting
however that its access to PDMP data is contingent upon each state’s
requirements and willingness to share its PDMP data with federal law
enforcement.

In July 2019, DEA officials responsible for overseeing the use and
analysis of ARCOS data expressed an interest in improving DEA’s
ARCOS data analytic capabilities but stated that they needed more staff
and resources. Specifically, they noted they would like to hire additional
staff, such as data scientists, to conduct analysis on ARCOS data using,
for example, additional computer algorithms. DEA also noted that it was
considering automation of additional types of analyses, but did not
provide a start date or estimate as to when it would move forward on that
consideration.

While DEA created the new Targeting and Special Projects Section in
March 2019 to enhance DEA’s data analytics and set aside some
positions for program analysts and subject matter experts, among other
positions, as of October 2019, DEA officials did not have any details or
documentation about the data analysis efforts the new division plans to
undertake. We have previously reported that new approaches to
combining and “making sense of” large amounts of varied data—methods
referred to as advanced analytics—are helpful to uncover patterns,
identify anomalies, and provide insights not suggested by assumed
hypotheses. 26 In addition, other federal entities responsible for detecting
diversion and abuse of controlled substances utilize computer algorithms

26GAO, Data and Analytics Innovation: Emerging Opportunities and Challenges,

GAO-16-659SP, (Washington, D.C.: Sept. 2016).

Page 17 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

as part of their analysis of available data in order to flag and prioritize

potential instances of diversion for further investigation. For example, the
Centers for Medicare & Medicaid Services and its National Benefit
Integrity Medicare Drug Integrity contractor use proactive data analysis to
detect aberrant patterns and potential diversion in drug prescribing. As a
result, the contractor is able to produce “prescriber risk assessments,”
which provide a comparison of controlled substance prescribing patterns
across peers. The Centers for Medicare & Medicaid Services also uses
proactive data analysis to identify providers with potentially inappropriate
prescribing patterns, especially as it concerns opioids. Similarly, some
opioid drug distributors use computer algorithms to identify suspicious
orders that are the basis for the suspicious order reports they are required
to provide to DEA.

The establishment of this new section within DEA focused on its data
analytics capabilities presents an opportunity for DEA to more proactively
use data analytics with regard to its ARCOS and other data. In doing so,
DEA could more effectively identify possible diversion activities or
unusual activity to aid its ongoing efforts to prevent, detect, and
investigate diversion more quickly and assist it in reporting on how it is
using ARCOS data to identify suspicious activities.

DEA Recently Developed a Centralized Database to

Collect Suspicious Opioid Order Data but Lacks an
Overall Structure to Manage all of its Data
DEA Recently Created the Required Centralized Database for
Suspicious Order Reports

In October 2019, DEA established the Suspicious Orders Report System

(SORS) Online, a centralized database for collecting suspicious order
reports, which is required by the SUPPORT Act to be established by
October 24, 2019. 27 The SORS Online data fields include a requirement
for registrants to note their reasons for identifying an order as suspicious,
drug quantity, and dosage strength.

The successful implementation of the centralized database is important

because it could address the fragmented way in which suspicious order

27Pub. L. No. 115-271, § 3292, 132 Stat. 3894, 3956-59. See 21 U.S.C. § 832(b).

Page 18 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

reports are currently submitted. However, reporting to the centralized

database is currently voluntary. Registrants may notify DEA of a
suspicious order using other means, including email, facsimile, or
telephone. The systems and reports are not currently integrated, and
investigators must query each system or office separately in order to find,
for example, information related to a lead they are investigating.
Currently, registrants are required upon discovery of a suspicious order or
series of orders, to notify the Administrator of the DEA and the Special
Agent in Charge of the division office of the DEA for the area in which the
registrant is located or conducts business. 28

Prior to DEA establishing the SORS Online centralized database,

registrants with an existing or a prior MOA also have reported suspicious
orders into one of two SORS databases when reporting to headquarters.
The new SORS Online is the only electronic mechanism for reporting
suspicious orders now, according to DEA. Registrants who are under
active MOAs with DEA are reporting to the new SORS Online system,
according to DEA. Registrants that are not under an MOA may also use
SORS Online, but are not required to do so. Registrants not under an
MOA may also use a paper-based process, among others, when
reporting to the field division offices and DEA headquarters. However, no
integration exists across headquarters’ and field division offices’ various
electronic- and paper-based systems. DEA officials we met with said that
some of the suspicious order reports received at the field division office
level are stored in hard copy in accordion file folders, instead of being
digitized or entered into a searchable database. 29 Reporting to SORS
Online satisfies the requirement to report such orders to the Administrator
of the DEA and the Special Agent in Charge of the Division Office of the
DEA for the area in which the registrant is located or conducts business.
Successfully managing the SORS Online database could lead to needed
efficiency improvements and more effective use of the suspicious order
report data.

2821 U.S.C. § 832.

29InSeptember 2019, the DOJ Office of the Inspector General reported that DEA does not
have a method for uploading all of the suspicious order reports and information submitted
to DEA field division offices. See Department of Justice, Office of Inspector General,
Review of the Drug Enforcement Administration’s Regulatory and Enforcement Efforts to
Control the Diversion of Opioids, Evaluation and Inspections Division 19-05 (Washington,
D.C.: September 2019).

Page 19 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

DEA Lacks a Data Governance Structure to Manage its Data on

Opioid Orders

Although DEA has guidance, policies and procedures regarding the use
of some of its information systems, it has not established a formalized
data governance structure to manage its collection and use of data used
to support the Diversion Control Division’s mission. DEA specifically has
not institutionalized and clearly documented policies and procedures that
describe division staff’s roles and responsibilities for collecting and
analyzing data nor has it provided a structure that describes the agency’s
approach to establishing and maintaining such a program. We have
identified a number of issues with DEA’s management of data. For
example, DEA does not have any documentation on their process for
ensuring the quality of data registrants submit to its ARCOS database—
the main system that enables DEA to monitor the flow of controlled
substances. As a result, it is difficult to understand the controls they have
over this important data.

A data governance structure is defined as an institutionalized set of

policies and procedures for providing data governance throughout the life
cycle of developing and implementing data standards. 30 A data
governance structure also helps to ensure important data assets are
formally managed and fully utilized, and can also provide consistent data
management. We previously reported on key practices based on several
data governance models, including developing and approving data
standards, managing, controlling, monitoring, and enforcing consistent
application of data standards, and delineating roles and responsibilities
for decision making and accountability. 31 Additionally, in June 2019, the
Office of Management and Budget established a Federal Data Strategy
(Strategy) as a framework of operational principles and practices to help
agencies use and manage data. 32

We found several areas where DEA’s current practices do not reflect

select leading data governance practices.

30GAO, Data Act: OMB Needs to Formalize Data Governance for Reporting Federal
Spending, GAO-19-284, (Washington, D.C.: March 2019).
31GAO-19-284.

32Officeof Management and Budget, Federal Data Strategy – A Framework for

Consistency, OMB Memorandum M-19-18 (Washington, D.C.: 2019).

Page 20 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

• Agencies should identify data needs to answer key agency

questions: We found that DEA does not have a governance structure
to determine and prioritize its data requirements for either suspicious
order reports it receives or data reported into its ARCOS systems. For
example, DEA has not established standard requirements for the
information required in a suspicious order report. As a result,
distributors’ suspicious order reports vary and may contain
inconsistent and insufficient data for DEA to make investigative
decisions. In addition, DEA does not have a governance structure to
identify agency and industry stakeholder data needs to help inform its
opioid diversion control efforts.
• Agencies should provide resources explicitly to leverage data
assets: Agencies should ensure that sufficient human and financial
resources are available to support data driven agency decision-
making, and accountability. As mentioned earlier, while DEA created
the new Targeting and Special Projects Section in March 2019 to
enhance DEA’s data analytics, as of October 2019, DEA officials did
not have details or documentation about the data analysis efforts the
new division plans to undertake or the resources they plan to provide
for those efforts. As a result, DEA is unable to conduct the analysis
that would enable it to more effectively use its existing data in making
decisions about diversion related efforts.
• Agencies should prioritize data governance: Agencies should
ensure there are sufficient authorities, roles, organizational structures,
policies, and resources in place to transparently support the
management, maintenance, and use of strategic data assets.
Similarly, leading practices for data governance includes delineating
roles and responsibilities for decision-making and accountability,
including roles and responsibilities for stakeholder input on key
decisions. As mentioned earlier, DEA established the Targeting and
Special Projects Section in March 2019 whose goal is to focus on
leveraging DEA’s data capabilities and conducting data analytics on
ARCOS and other data, according to Diversion Control Division
officials. While the new section appears to hold promise, DEA has not
clearly defined and adopted the new section’s roles and
responsibilities for managing and analyzing data across the DEA or
how the new section will communicate and collaborate with other
Diversion Control Division headquarters and field staff. As a result, the
new division may not operate in a predictable, repeatable, and
accountable way.
• Agencies should support non-federal stakeholders: Agencies
should engage with industry, academic, and other nonfederal users of

Page 21 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

data to share expert knowledge of data assets, promote wider use,

improve usability and quality, and advance innovation and
commercialization. Later in this report, we identify an opportunity for
DEA to collaborate with industry stakeholders and seek their input for
an initiative that is supposed to assist industry stakeholders in their
responsibilities to report suspicious orders to DEA.
Although DEA has not incorporated these data governance practices, it is
in the early stages of developing a data governance structure. As of
September 2019, DEA officials told us that its Office of Information
Systems’ Chief Data Officer just recently started to work with DOJ and
other components to develop a data strategy in response to the recently
released department wide strategy, and therefore does not have any
additional documentation or information related to timelines and
deliverables for formally implementing a DEA data governance or other
data structure for the agency. 33 Without additional details, such as a
timeframe for developing the structure or more information about what it
would entail, it is unclear how or if these efforts will incorporate leading
practices for data governance and if they will be effective.

Data governance processes are important for DEA given it works with an
extensive and complex network of stakeholders to manage opioid
diversion risks and uses industry-reported data to help it identify patterns
that might indicate potential diversion. An effective data governance
structure could help DEA ensure its important data assets are formally
managed and fully utilized, and can also help ensure consistent data
management. Industry and technology councils, domestic and
international standards-setting organizations, and entities within the
federal government endorse the establishment and use of a governance
structure to oversee the development, management and implementation
of data standards, digital content and other data assets. 34

33In February 2019, DOJ released its first Data Strategy for the U.S. Department of
Justice, a framework from which to build an approach to manage and share data, among
other things. The strategy noted that one of DOJ’s long-term objectives is to optimize the
value of its data assets for use in its missions.
34According to these organizations and entities, data governance involves setting and
institutionalizing a system of decision rights and accountabilities for information, which
includes planning, oversight, and control over management of data and data-related
resources. GAO, DATA Act: OMB and Treasury Have Issued Additional Guidance and
Have Improved Pilot Design but Implementation Challenges Remain, GAO-17-156
(Washington, D.C.: December 2016).

Page 22 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

While DEA’s Systems Do Not Provide Complete, Real-

Time Data on Suspicious Orders, Most Industry
Stakeholders Said Adding Such Capabilities Would Not
Provide Extensive Value
DEA does not have an existing mechanism or a comprehensive database
of orders before they are filled that it can analyze, on a real-time basis, to
identify potentially suspicious orders. However, most industry
stakeholders we spoke with on the usefulness of real-time data noted that
such a mechanism would not add extensive value to diversion detection.

DEA’s current data systems either contain historical, not real-time, data or
do not contain all drug order data that could be reported.

ARCOS. The data in the ARCOS database is historical, rather than real-
time, on orders that have been filled. Every registered manufacturer is
required, at such time or times and in such form as required by the
Attorney General, to make periodic reports to the Attorney General of
every sale, delivery or other disposal of any controlled substance. Each
distributor is required to make such reports with respect to narcotic
controlled substances. 35 For example, as part of the reporting to ARCOS,
acquisition and distribution transaction reports are required, by regulation,
to be filed every quarter, except that a registrant may be given permission
to file more frequently, but not more frequently than monthly, depending
on the number of transactions being reported each time by that
registrant. 36 In addition, manufacturing transaction reports are required to
be filed annually, except that a registrant may be given permission to file
more frequently, but not more frequently than quarterly. 37

CSOS. DEA does not require registrants to use CSOS and thus it is not
used by all registrants. As previously discussed, CSOS is an electronic
ordering system which allows registrants to place orders for controlled
3521 U.S.C. § 827(d).
3621 C.F.R. § 1304.33(b). Acquisition and distribution transaction reports must provide
data identifying whether the acquisition is by purchase or transfer, return from a customer,
or supply by the Federal Government, and each reduction from inventory (identifying
whether it is, e.g., by sale or transfer, theft, destruction or seizure by Government
agencies).
3721C.F.R. § 1304.33(b). Manufacturing reports must provide data on the material
manufactured, and use in producing dosage forms, among other things.

Page 23 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

substances. Shipments of all ARCOS-reportable controlled substances,

ordered through CSOS, are included in registrant’s periodic ARCOS
reporting.

Suspicious Order Reports. Suspicious order reports are intended to

identify orders of unusual size, orders deviating substantially from a
normal pattern, and orders of unusual frequency before they are filled. By
law, each registrant is required to design and operate a system to identify
suspicious orders that it receives. 38 Registrants identify, then report, to
DEA using their own systems to determine suspicious orders. 39 As
discussed previously in this report, registrants can report these orders
into DEA’s newly launched SORS Online database, but reporting into this
database is voluntary and registrants have an option to report in other
ways, so this database does not capture all suspicious orders and is
therefore not comprehensive. Suspicious orders are likely identified in
close to a “real-time” basis. Orders that have been identified and reported
as suspicious by the registrants, are orders that have not yet been filled.

While two individual drug distribution companies we interviewed said they

saw some value in real-time reporting, most industry stakeholders we
spoke with on the usefulness of real-time data, including a broad cross-
section of associations representing pharmacies and drug distribution
companies, said that real time dissemination of suspicious orders by DEA
would not add extensive value to efforts to detect possible diversion.
Instead, some industry stakeholders suggested that a focus on data that
provide trends over time might be more useful. 40 As discussed earlier in
this report, we provide examples of data analysis DEA currently performs
and could perform on its existing data that could potentially help DEA
determine or identify possible patterns of aberrant behavior in drug order

3821 U.S.C. § 832(a). Upon discovering a suspicious order or series of orders, the
registrant is required by law to notify the Administrator of the DEA and the Special Agent
in Charge of the DEA Division Office for the area in which the registrant is located or
conducts business. A “suspicious order” may include, but is not limited to, an order of a
controlled substance of unusual size; an order of a controlled substance deviating
substantially from a normal pattern; and orders of controlled substances of unusual
frequency.
3921 C.F.R. § 1301.74(b).
40One drug distribution company’s representative raised questions about DEA’s legal
authority to flag and report suspicious orders, but noted that a real-time national level
review could be beneficial. Another drug distribution company’s representative told us they
do believe that a centralized repository of certain types of information would be helpful to
their suspicious order monitoring efforts.

Page 24 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

information. 41 Others we spoke with raised concerns about the varying

ways companies determine what is suspicious and that using real-time
data reported from DEA on these orders could be like comparing apples
to oranges.

Most of the associations that represent pharmacies and drug distributors

that we met with indicated they did not see much value in either reporting,
or receiving reports, of suspicious orders in “real-time.” For example, a
representative from an association representing pharmacists told us that
rarely would there be a case where a single order was so egregious that
stopping it would have a significant impact on public health. This
representative also noted that it would be more important to focus on
historical trends, given “trends don’t happen in a day.”

Other stakeholders we spoke with said that while there may be utility in
real-time reporting of suspicious orders, they also had concerns about its
feasibility, given current available data. They noted it would be difficult to
compare suspicious order data as reported by registrants because
companies rely on their own methods to determine a suspicious order.
For example,

• Officials from an association that represents a large number of drug

distributors indicated that receiving more real-time data might allow
their members to have an additional check on orders that a wholesale
distributor receives, but this utility would largely be contingent on the
distributors’ ability to compare suspicious order reports across one
another. Distributors use different criteria for determining whether an
order is suspicious; there is no continuity across them; and they
experience varying order volumes and patterns across their
customers and over time as patient needs change. Thus, such
analyses would be difficult to conduct, if they could be done at all, and
would not necessarily result in useful comparisons.
• A representative from one drug distribution company told us that
having knowledge of other distribution companies’ suspicious orders
is not helpful because the company would not know how the other
distributor made a determination on the suspicious order.

41For example, as we discuss earlier in this report, DEA could conduct analysis of its
ARCOS data to review the volume of drugs in a certain area as compared to the number
of prescriptions in that same area, which could help it identify patterns of questionable
behavior.

Page 25 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

• Another representative stated that distributors are operating

proprietary systems that may or may not vary substantially from each
other depending on a large number of varying circumstances, and
may be operating “wildly different” systems for identifying suspicious
orders and therefore the information would not be valuable.
Representatives from two drug distribution companies identified
additional challenges to real-time reporting of suspicious orders if the
determination of whether an order was suspicious or not was made by
DEA. First, they did not believe DEA had sufficient resources or
knowledge to identify suspicious orders. One representative said DEA
does not know the history and market dynamics in the pharmaceutical
industry to help inform decisions it would need to make on an order.
Second, identifying an order as suspicious before it is filled would add
a tremendous burden on DEA. According to one of the
representatives, their company typically ships orders on the same day
the order is received, consistent with “just-in-time” inventory
management practices. If DEA were expected to make suspicious
order determinations without the risk of disrupting patient care needs,
it would be imperative for DEA to act quickly to identify suspicious
orders. These distribution companies did not believe DEA would be
able to identify them rapidly as needed. As noted above, DEA’s
current systems are not designed for real-time reporting, and it does
not have an existing mechanism or a comprehensive and complete
database of orders before they are filled that it can analyze, on a real-
time basis, to identify potentially suspicious orders.
Officials from the association that represents a large number of drug
distributors were careful to point out, however, that systems sometimes
differ intentionally due, for example, to varying customer bases, service
requirements and patient care needs. Thus, a certain amount of
variability in suspicious order systems, criteria and decisions may be
warranted, and even desirable.

DEA Does Not Have Outcome-Oriented Goals and

Performance Measures for its Opioid Diversion Activities
While DEA has developed some performance measures to track and
publicly report the progress and results of its efforts in reducing diversion,
DEA has not developed objectives, outcome-oriented goals, or
measurable performance targets to assess the effectiveness of its opioid
diversion control data analysis efforts and the link between DEA’s use of
data and progress toward its diversion goals and strategies. DEA does
have performance measures including the number of civil penalties and

Page 26 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

administrative actions it has undertaken, planned or scheduled

investigations completed, and community outreach events completed.
While these measures are useful, they do not account for outcomes of
these actions, such as their potential impact on the volume of opioids
being improperly sold or purchased.

DEA officials noted that it adheres to goals established through the Office
of National Drug Control Policy’s National Drug Control Strategy, such as
reducing the prescription opioid rate by one-third within three years,
reducing overdose deaths, and within five years, ensuring all health care
providers have adopted best practices for opioid prescribing. However,
those goals involve a multitude of federal agencies, and are not directly
related to DEA’s use of industry-reported data, nor linked specifically to
DEA diversion control efforts. DEA also noted that they have a number of
goals across strategies such as DEA’s 360 strategy in addition to the
goals in DOJ’s strategic plan; a performance measure with a measurable
target for its agency-wide objective related to dismantling drug trafficking
organizations 42—maximizing the monetary value of currency, property,
and drugs seized; and a measure for curbing opioid and other illicit drug
use.

GPRAMA directs agencies to develop and document goals, as well as

performance measures to assess progress towards their goals. 43
Agencies can use performance measurement to make various types of
management decisions to improve programs and results, such as
developing strategies and allocating resources, including identifying
problems and taking corrective action when appropriate. Additionally,
GPRA as amended by GPRAMA 44 states that management should define
outcome-oriented objectives in specific and measurable terms. 45
42For example, DEA’s target for its performance measure on the monetary value of
currency, property, and drugs seized was $3.0 billion in fiscal year 2018.
43Pub. L. No. 111-352, 124 Stat. 3866 (2011); 31 U.S.C. § 1115 (relating to agency
performance plans and performance measurement).
44Pub. L. No. 111-352, 124 Stat. 3866 (2011). See 31 U.S.C. § 1115. While GPRAMA
requirements are applicable to the department or agency level, we have previously
reported that they can serve as leading practices at other organizational levels, including
the program, project, or activity level. See GAO, Federal Criminal Restitution: Most Debt is
Outstanding and Oversight of Collections Could Be Improved, GAO-18-203 (Washington,
D.C.: Feb. 2, 2018).
45GAO-14-704G; Government Performance and Results Act of 1993 (GPRA), Pub.L. No.
103-62, 107 Stat. 285 (1993); GPRA Modernization Act of 2010, Pub. L. No. 111-352, 124
Stat. 3866 (2011).

Page 27 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

Measurable targets help decision makers conduct assessments of

whether program goals were achieved, and linkages between an
organization’s goals and performance measures create a line of sight so
that everyone understands how program activities contribute to the
organization’s goals. 46

DEA officials view their existing performance goals as sufficient overall.

However, without defining objectives in specific measurable terms, DEA
is likely not able to adequately assess whether its respective investments
and efforts are helping it to limit the availability of and better respond to
the opioid prescription diversion threat. Until program officials can review
the effectiveness of these systems based on quantifiable benefits and
measurable performance targets, they are not well-positioned to
determine the extent to which suspicious order reports or ARCOS data
and systems are enhancing the effectiveness of the agency’s opioid
related regulatory and criminal diversion investigations, prosecutions and
civil actions. Documenting program goals and developing measurable
performance targets and linkage to program goals could provide DEA
with the information it needs to assess progress and make informed
decisions about current and future operations.

DEA Has Taken Some Steps to Help Industry

Report Suspicious Orders, but Has Not
Addressed Identified Limitations with the Data it
Shares or Receives
DEA Has Developed a Tool to Share Some Drug
Purchase Data with Industry, but the Tool Has Limitations
DEA developed an ARCOS query option for registrants to use, called the
ARCOS Enhanced Lookup Buyer Statistic Tool, in February 2019 to
better support registrants’ efforts to identify and report suspicious
orders. 47 This tool allows registrants to query certain ARCOS data

46GAO,Managing For Results: Enhancing Agency Use of Performance Information for

Management Decision Making, GAO-05-927 (Washington, D.C.: Sept. 9, 2005).
47The current version of the ARCOS Enhanced Lookup Buyer Statistic Tool was released
in February 2019. A prior iteration, containing less detailed search results, was released in
February 2018. Both iterations are discussed later in this report.

Page 28 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

maintained by DEA. Although this tool was supposed to be an

improvement upon a prior iteration of the lookup tool DEA had developed,
distributors and an industry association representing distributors identified
several limitations with the tool. 48 Specifically:

• Single query challenges and no bulk downloads. The distributor

can only query the tool one pharmacy at a time, even though some
distributors supply thousands of pharmacies on a daily basis. Thus, if
certain distributors were to query all of its pharmacies for possible
suspicious order patterns, the process could be time-consuming or
not feasible. DEA noted it was working on this limitation.
• Limited login credentials. DEA only provides each distributor with
one set of login credentials, so only one employee can log in at a time
to query the tool. DEA noted it was working on this limitation.
• Data provided in the tool are not detailed enough. The tool does
not provide detailed enough information to be useful to facilitate the
identification of suspicious orders. For example, when a distributor
queries the tool, the search results will list the total dosage units for a
particular opioid for the past six months at the pharmacy. Because
some opioid drug dosages are more commonly abused than others,
distributors told us that simply having the total number of dosage units
is not as helpful as seeing the breakdown of the different dosage
units. In another instance, the data provided to distributors does not
include critical details about the number of suppliers. One distributor
might have multiple warehouses and distribution centers that it uses
to package and ship pharmaceutical products. In the ARCOS data
that DEA provides to distributors, these individual warehouses are
counted as distinct suppliers in the total supplier count data provided
to the distributors. Therefore, the number of suppliers may appear
inflated to the distributors, even though it is only a single company
providing the products.
According to DEA, the ARCOS lookup tool is meant to be a pointer
and assist distributors in conducting due diligence so they can “know

48DEA developed the initial iteration of a look up tool for distributors in an effort to address
distributors’ prior requests for access to additional transaction data when making a
determination about whether an order is suspicious, as discussed later in this report. The
new version of the lookup tool was released after the enactment of the SUPPORT Act,
which required DEA to provide the total number of distributor registrants that distribute
controlled substances to a pharmacy or practitioner registrant, as well as the total quantity
and type of opioids distributed to each pharmacy and practitioner registrant. See 21
U.S.C. § 827(f).

Page 29 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

their customer.” 49 Regardless if a distributor is shipping from multiple

distribution centers and therefore showing as multiple suppliers in the
lookup tool, these are all unique DEA registration numbers and are
therefore unique suppliers to the customer. According to DEA, the
important part here is that distributors can see quantity and gram
totals per registrant (such as, a pharmacy customer) that they query.

When evaluating whether an order is suspicious, a distributor uses its

own internal transaction data to evaluate a buyer’s ordering patterns.
However, purchasers of controlled substances, such as pharmacies and
medical practices, may use multiple distributors for their purchases. 50
Distributors have previously raised concerns that they did not have
access to additional transaction data, such as whether the purchaser is
also buying controlled substances from additional suppliers. They have
noted that this additional data would be useful when making decisions
about whether an order is suspicious, and specifically, that ARCOS data
would be useful in helping them evaluate whether an order was
suspicious. For example, in 2018, one distributor testified that, given
DEA’s access to the controlled substance transaction data that
distributors report, “[o]nly DEA has visibility over the entire landscape and
can track and analyze aggregate data on the distribution of controlled
substances in particular jurisdictions.” 51 In addition, an industry
organization we met with provided comments to DOJ in 2017 that certain
data could provide more context for them to identify problematic orders.
Specifically, the organization noted that if DEA could provide ARCOS
data in aggregate form without identifying individual distributors’

49DEA’s “Know your Customer” policy states that registrants are to take reasonable
measures to identify their customers, understand normal and expected transactions
typically conducted by those customers, and identify transactions that are suspicious in
nature.
50According to organizations that we interviewed, purchasers may utilize multiple
distributors for a variety of reasons, including as a protection against supply chain
disruptions or price variations.
51Combating the Opioid Epidemic: Examining Concerns About Distribution and Diversion,
Before the Subcommittee on Oversight and Investigations, H. Comm. on Energy and
Commerce, 115th Cong. 22-30 (2018) (statement of John Hammergren, Chairman,
President, and Chief Executive Officer, McKesson Corporation).

Page 30 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

competitors, the distributor could consider a pharmacy’s orders in the

context of the pharmacy’s overall ordering from all distributors. 52

An industry association representing distributors, and two of the

distributors that we interviewed stated that the Enhanced Lookup Buyer
Statistic Tool is a step in the right direction. However, the industry
association and four distributors that we interviewed stated that the tool
remains limited in helping distributors improve how they identify
suspicious orders, as noted above. DEA officials told us that distributors
have brought some of these concerns about the ARCOS Enhanced
Lookup Buyer Statistic Tool’s usability to their attention. For example, in
May 2019, an industry association representing distributors sent a letter
to DEA, outlining a consolidated list of industry’s concerns about the tool.

In recent discussions in June 2019, DEA officials acknowledged some of

these limitations and stated that some industry concerns would be easier
to fix than others, but that they had not established a timeframe for when
the changes would be implemented. For example, DEA officials noted it
might be easier to provide additional login credentials to distributors and
make the data available to be downloaded in a more functional way for
distributors. For some of the other limitations industry stakeholders
identified, such as providing more detailed ARCOS data to the
distributors, DEA officials raised concerns. For example, DEA officials
noted that distributors could use the additional detailed data as a market
research tool in order for distributors to gain unfair market advantages or
to learn more about their competitor’s business contracts with
pharmacies.

In September 2019, DEA officials told us that it was not currently

addressing changes to the ARCOS Enhanced Lookup Buyer Statistic
Tool, due to competing priorities within DEA. Specifically, DEA officials
noted that it is focused on existing priorities related to meeting upcoming
requirements mandated in the SUPPORT Act, including establishing a
suspicious order centralized database, as discussed previously in this
report. While we recognize that agencies need to determine and set
priorities, it is important for DEA to continue to work with industry in
ensuring that the tool it created to address the SUPPORT Act

52Healthcare Distribution Alliance. Request for Public Comment: Enforcing the Regulatory
Reform Agenda; Department of Justice Task Force on Regulatory Reform Under E.O.
13777 (Docket No. OLP 164). Letter to the U.S. Department of Justice Office of Legal
Policy. (Arlington, VA, August 14, 2017).

Page 31 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

requirement will help industry in addressing its suspicious order reporting

requirement under the CSA, as amended.

The SUPPORT Act requires DEA to provide distributors with access to

ARCOS data to help the distributors identify, report, and stop suspicious
orders of opioids and reduce diversion rates. 53 By identifying solutions –
in consultation with industry stakeholders – to address the limitations of
the ARCOS Enhanced Lookup Buyer Statistic Tool, DEA could better
ensure registrants have more useful information at their disposal when
evaluating whether an order is suspicious.

DEA Identified Extensive Limitations with Suspicious

Order Reports it Received
DEA officials and DEA field division offices we interviewed identified a
number of limitations with suspicious order reports they received, and,
due to these limitations, they rarely use suspicious order reports to
generate potential investigative leads. The issues DEA identified
included:

• Threshold-based algorithm triggers. Several DEA headquarters

and field division officials told us that some distributors used fixed
thresholds to identify suspicious orders, which DEA officials stated are
not helpful or useful because the information is often not actionable.
• Lack of documented rationale. During the course of our review,
DEA officials told us that many suspicious order reports do not include
the rationale for why the registrant decided the order was suspicious,
making it difficult to determine which suspicious order reports might
contain actionable intelligence. In September 2019, the DOJ Office of
the Inspector General reported that the current regulatory language
governing industry suspicious order reporting does not require
manufacturers and distributors to state why they believe an order is
suspicious. 54 In October 2019, DEA launched a new centralized
database of suspicious order reports, as required by the SUPPORT
Act. 55 DEA’s new reporting format of suspicious order reports includes
a required field for “Reason,” for registrants to provide an explanation

53Pub. L. No. 115-271, § 3273, 132 Stat. 3894, 3952-54. See 21 U.S.C. § 827(f).
54DOJ Office of the Inspector General, 19-05 at 31.
55Pub. L. No. 115-271, § 3292, 132 Stat. 3894, 3956-59. See 21 U.S.C. § 832(b).

Page 32 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

of why the order is suspicious. 56 However, currently reporting to the

new centralized database is voluntary.
• Differing methodologies. As discussed earlier in this report, the
definition of a “suspicious order” may include, but is not limited to, an
order of a controlled substance of unusual size, an order of a
controlled substance deviating substantially from a normal pattern,
and orders of controlled substances of unusual frequency. 57
However, it is up to the individual distributor companies to decide the
more specific metrics, according to DEA Diversion Control Division
officials. Each distributor must design and operate a system to identify
suspicious orders. Therefore, distributors utilize different methods to
flag customer orders as suspicious.
According to our analysis of DEA data, it has collected at least 1.5 million
suspicious order reports since 2014, and these reports may contain data
on attempted purchases that were denied, based on indicators of
suspicious patterns. 58 These data could help with DEA’s efforts to
prevent, detect, and investigate diversion. Officials from six DEA field
division offices we interviewed said they refer to suspicious order reports
when conducting their routine regulatory investigations of registrants.
DEA field division officials also stated that, while suspicious order reports
are generally not used as the primary or sole impetus to initiate an
investigation, officials will infrequently refer to related suspicious order
reports when there is an ongoing criminal investigation that is initiated
through other means. However, of the DEA field division offices we
interviewed, officials from two offices told us that they had used a
suspicious order report as the sole or primary impetus for initiating a
criminal investigation in the past year – one stating that it happened once,

56Four choices for reason codes are available to registrants in the new online reporting
system – 1) large order size, 2) unusual order frequency, 3) unusual order pattern, or 4)
other reason. For each reason selected, there is a subsequent field available providing the
registrant an optional entry for a free-text explanation of its selection, limited to 200
characters.
5721 U.S.C. § 802(57).
58The 1.5 million figure presented are the suspicious order reports reported to the
electronic reporting systems only, since DEA is able to track those figures. DEA told us in
a written response that they “are unable to provide [GAO] with a count of how many
registrants or the number of suspicious order reports submitted to DEA field division
offices,” and that therefore, they are “only able to provide estimates of the average
number of suspicious transactions reported to the division offices.” Therefore, we report
that “more than” or “at least” 1.5 million suspicious order reports have been collected since
2014.

Page 33 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

and another estimating that it happened one to three times. 59 Another

field division told us that they had two convictions “in recent memory” that
began with a suspicious order report. Three offices told us that they had
not used suspicious order reports as the sole or primary impetus for a
criminal investigation in the past year, and one told us they did not know if
a suspicious order report had been used in that way.

DEA field division offices we interviewed also identified reasons why

suspicious order reports may not be as useful as they could be in helping
to identify investigative leads. For example, one DEA field division office
characterized the suspicious order reports they received from one
particular registrant as being “spot on” and always warranting a DEA
follow-up investigation, given the amount of detail and evidence of the
registrant conducting its own on-site investigation into the customer.
However, the same DEA office reported that other suspicious order
reports were based on industry-developed thresholds that were not useful
because the resultant reports did not indicate why the order was
suspicious. Of the five DEA field division offices that we asked to
characterize the quality of suspicious order reports, three of them
reported that suspicious order reports were either “moderately” or
“somewhat” useful. 60 Officials from one field division office said that
suspicious order reports are “very useful,” while officials from another
DEA field division office reported that suspicious order reports are “not at
all useful.” 61

We have previously reported on these issues, including DEA

communication with registrants, and in June 2015, we found that
additional guidance from and additional communication with DEA was
needed about registrants’ roles and responsibilities under the CSA, as
amended. We recommended that DEA develop additional guidance for

59DEA told us in a written response that it “does not track if a case was initiated based on
a suspicious order report.” Therefore, we are reporting the summary estimations of cases
initiated reported by DEA field division office officials during interviews.
60We asked DEA field division offices to characterize how useful suspicious order reports
were using the scale of “extremely useful,” “very useful,” “moderately useful,” “somewhat
useful,” and “not at all useful.”
61None of the DEA field division offices that we interviewed characterized suspicious order
reports as “extremely useful.”

Page 34 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

distributors for suspicious order monitoring and reporting. 62 DEA did not
expressly agree or disagree with our recommendation, but raised
concerns about the recommendation, stating that “short of providing
arbitrary thresholds to distributors, it cannot provide more specific
suspicious orders guidance because the variables that indicate a
suspicious order differ among distributors and their customers.” 63 In
responding to this recommendation, DEA officials told us that the agency
had refocused its efforts on revising draft regulations in line with the
SUPPORT Act, and that the revised draft was undergoing internal DEA
and DOJ review. The agency noted that it expected the rule to codify
existing legal obligations related to due diligence and suspicious order
reporting and provide additional guidance regarding the nature and timing
of the suspicious order reporting requirement, but also indicated that it
was not possible to be certain of the precise nature of the draft rule. The
2015 recommendation remains relevant and important, and while DEA
has reported taking some actions to address it, as noted above, DEA has
not taken all the necessary steps to address the recommendation. We will
continue to monitor DEA’s progress in addressing our recommendation.

Conclusions
Given the extensive and complex network of stakeholders DEA works
with to manage opioid diversion risks and the agency’s use of a large
amount of industry-reported data, DEA could do more to use proactive,
automated computer algorithms to analyze its data sources in detecting
questionable patterns in industry-reported drug transaction data. It is
missing opportunities to more effectively identify questionable ordering
patterns and possible diversion activities than through its current analysis
methods. Using more automated analyses, similar to other federal entities
that use computer algorithms as part of their analysis of available data to
help flag instances of diversion, DEA could enhance its ongoing efforts to
prevent, detect, and investigate diversion more quickly and assist it in
reporting on how it is using ARCOS data to identify suspicious activities.

62GAO, Prescription Drugs: More DEA Information about Registrants’ Controlled

Substances Roles Could Improve Their Understanding and Help Ensure Access,
GAO-15-471 (Washington, D.C.: June 25, 2015).
63GAO-15-471.

Page 35 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

Furthermore, because DEA does not have a documented data

governance structure in place to manage its data, it risks challenges
related to quality, availability, and integrity of the data it uses to support
opioid diversion. Although DEA has started to explore developing a data
governance structure, it is important for DEA to document and define its
process about what the structure would entail. This would help the
agency determine the effectiveness of its structure, an important
consideration given the large amounts of varied data DEA receives from
industry stakeholders. Also, while DEA does have some performance
goals related to opioid diversion, it lacks outcome-oriented goals and
measurable performance targets to assess the extent to which the
industry-reported data it obtains and uses support the agency’s diversion
control activities. Defining these targets could help DEA adequately
assess whether its respective investments and efforts are helping it to
limit the availability of and better respond to the opioid prescription
diversion threat.

DEA’s efforts to provide registrants with additional information to facilitate

the identification of suspicious orders is promising, but has limitations.
Due to these limitations, registrants, such as distributors, might not have
complete information when they are identifying suspicious orders. By
identifying solutions – in consultation with industry stakeholders – to
address the limitations of the ARCOS Enhanced Lookup Buyer Statistic
Tool, such as the need for additional login credentials or the ability to bulk
download data, DEA could better ensure registrants have more useful
information at their disposal when evaluating whether an order is
suspicious.

Finally, we continue to monitor implementation of our 2015

recommendation that DEA provide additional guidance to distributors
related to suspicious orders, and we believe that it remains relevant and
important.

Recommendations for Executive Action

We are making the following four recommendations:

• The DEA Administrator should develop and implement additional

ways to use algorithms in analyzing ARCOS and other data to more
proactively identify problematic drug transaction patterns.
(Recommendation 1)

Page 36 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

• The DEA Administrator, in coordination with the department-wide

efforts on data strategy, should establish and document a data
governance structure to ensure DEA is maximizing its management of
industry-reported drug transaction data. (Recommendation 2)
• The DEA Administrator should establish outcome-oriented goals and
associated measurable performance targets related to opioid
diversion activities, using data it collects, to assess how the data it
obtains and uses supports its diversion control activities.
(Recommendation 3)
• The DEA Administrator, in consultation with industry stakeholders,
should identify solutions to address the limitations of the ARCOS
Enhanced Lookup Buyer Statistic Tool, to ensure registrants have the
most useful information possible to assist them in identifying and
reporting suspicious orders to DEA. (Recommendation 4)

Agency Comments and Our Evaluation

We provided a draft of this report to DOJ, including DEA, for review and
comment. In its comments, reproduced in appendix III, DEA agreed with
three of the four recommendations, and neither agreed or disagreed with
the fourth. DEA also provided technical comments, which we incorporated
as appropriate.

In response to our first recommendation that DEA should develop and

implement additional ways to use algorithms in analyzing ARCOS and
other data to more proactively identify problematic drug transaction
patterns, DEA concurred and stated it will continue to examine a variety
of technologies to analyze ARCOS and other data and implement
additional ways to use algorithms to more proactively identify problematic
drug transaction patterns. If these and other actions to expand the
agency’s analytic capabilities are effectively implemented, DEA would
address the intent of our recommendation.

DEA also concurred with our second recommendation that DEA, in

coordination with the department-wide efforts on data strategy, should
establish and document a data governance structure to ensure DEA is
maximizing its management of industry-reported drug transaction data. In
its response, DEA stated it is currently implementing this recommendation
and will continue to mature its data governance structure. The intent of
this recommendation is for DEA to establish a formalized data
governance structure to manage its collection and use of data used to

Page 37 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

support the Diversion Control Division’s mission. By establishing such a

structure, DEA could better ensure its important data assets are formally
managed and fully utilized, and could also help ensure consistent data
management across the Diversion Control Division.

DEA neither agreed nor disagreed with our third recommendation that
DEA should establish outcome-oriented goals and associated
measurable performance targets related to opioid diversion activities,
using data it collects, to assess how the data it obtains and uses supports
its diversion control activities. In its response, DEA stated it recognizes
that measurable performance targets related to opioid diversion activities
can serve as leading practices at different organizational levels including
the program, project, or activity level. However, DEA stated it needs
additional clarification on the specific actions needed to fulfill this
recommendation. Our recommendation is intended to ensure that DEA
can demonstrate the usefulness of the data it collects and uses to support
its opioid diversion control activities. We will continue to work with DEA to
address the specific actions needed to assess how the data it obtains and
uses support its diversion control activities to fully address the intent of
this recommendation. Based on our review of DEA’s existing performance
goals and targets for its opioid diversion efforts, as well as our previous
work on performance measurement, we believe that further development
of related performance goals and targets is warranted and could
potentially improve the usefulness of the data DEA collects and uses in
support of its diversion control program.

DEA also stated in its comments that the limited timeframe did not allow
GAO to meet with DEA officials responsible for performance metrics for
opioid diversion. However, in our interviews with DEA regarding its
performance metrics for opioid diversion, we submitted our questions in
advance of meeting with DEA officials to allow time for the questions to
be reviewed by relevant officials. DEA stated in its comments that it will
ensure that GAO meets with the appropriate officials to address metrics.
As stated earlier, we will continue to work with DEA to address the
specific actions needed to meet the intent our recommendation.

DEA concurred with our fourth recommendation that DEA, in consultation

with industry stakeholders, should identify solutions to address the
limitations of the ARCOS Enhanced Lookup Buyer Statistic Tool, to
ensure registrants have the most useful information possible to assist
them in identifying and reporting suspicious orders to DEA. DEA stated it
has consulted with industry stakeholders and has identified solutions to
address the limitations of the tool. We believe such consultation will be

Page 38 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

beneficial for DEA to understand its industry stakeholders’ needs and that
identifying solutions for addressing these needs would help ensure
registrants have the information necessary to help identify and report
suspicious opioid orders.

We are sending copies of this report to the appropriate congressional

committees, the Attorney General, the DEA Administrator and the
Secretary of Health and Human Services, and other interested parties. In
addition, the report is available at no charge on the GAO website at
http://www.gao.gov.

If you or your staff have any questions about this report, please contact
me at (202) 512-6691 or McneilT@gao.gov. Contact points for our Offices
of Congressional Relations and Public Affairs may be found on the last
page of this report. GAO staff who made key contributions to this report
are listed in appendix IV.

Triana McNeil
Director, Homeland Security and Justice

Page 39 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

Appendix I: Scope and

Methodology
To understand the extent to which DEA obtains and uses industry-
reported data, and the opportunities that exist to improve how that data
are obtained and used, including the feasibility of real-time reporting, we
reviewed applicable laws, regulations, court cases, and DEA internal
documentation. We also conducted interviews with DEA headquarters
offices, including the Diversion Control Division and DEA field division
offices. To determine DEA registrant legal reporting requirements related
to prescription drug orders and the meaning of suspicious orders, we
reviewed applicable laws and regulations, including the CSA and its
subsequent amendments and related DEA regulations and guidance. In
addition, we reviewed the recently enacted SUPPORT Act. To identify
policies and guidelines DEA uses to obtain and review registrant-reported
data, we reviewed DEA procedures for conducting drug-related
investigations, information system manuals for data and information
systems used by DEA, and DEA written communications to registrants
and DEA forms registrants use to report prescription drug transactions to
DEA. As part of our work examining the information systems used to
obtain and analyze data reported by registrants, we interviewed officials
who oversee the management of DEA information systems, such as
Automation of Reports and Consolidated Orders System (ARCOS),
Controlled Substances Ordering System (CSOS), Registrant Information
Consolidated System, and the Suspicious Orders Reporting System
(SORS) systems used to obtain and store suspicious order reports at
DEA headquarters. We interviewed DEA officials in headquarters and
field division offices to determine how information that industry members
report to DEA is obtained and used to detect and identify potential
diversion activities. The perspectives we gathered from field division
offices cannot be generalizable to the entire population of field division
offices, but did provide us with insights into the agency’s diversion efforts
and use of industry-reported data.

To identify what opportunities exist, if any, for DEA to improve these

efforts, such as using computer algorithms or real-time reporting, we also
interviewed DEA officials responsible for developing analytical products
based on industry-reported data. In addition, we interviewed DEA officials
at eight field division offices to learn about how diversion investigators

Page 40 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

use industry-reported data and what, if any, improvements might be

needed. To identify which of the 23 DEA field division offices to interview,
we prioritized our selection based on four primary criteria: 1) the
controlled prescription drug availability rate in their geographic area,
according to a 2017 DEA threat assessment report, indicating whether
the field division office had a “high” or “moderate” rate of availability; 2)
whether the office was within the location of a DOJ Opioid Fraud and
Detection Unit task force location; 3) whether the office was located within
top ten state with high controlled prescription drug prescribing rate, as
identified by the CDC; and 4) whether the office was located within a state
that the CDC identified as having a high ER visit rate for opioid
overdoses. We also ensured that the DEA field division offices we
interviewed represented different geographic areas within the United
States.

We also conducted interviews with four pharmaceutical distributors and

one trade organization whose membership includes wholesale
distributors. We interviewed three organizations representing pharmacies,
pharmacists, and drug diversion professionals to gather their perspectives
and experiences with efforts to detect and report suspicious opioid orders.
We based our initial interview selection of distributors based on DEA-
provided ARCOS data of opioid-related transactions, which indicated the
three largest distributors for opioids. To identify smaller distributors to
gather their perspectives, we contacted an industry association
representing distributors to facilitate our efforts to arrange for an
interview, resulting in an interview with one additional distributor.

In addition, we interviewed officials from a state prescription drug

monitoring program (PDMP) that collects real-time data, a Bureau of
Justice Assistance grant program that supports PDMPs, and a company
that operates 44 of the 53 state PDMPs to gain insights on the data they
collect. The views of these organizations cannot be generalized to the
entire population, but provided important insights and perspectives about
suspicious order detection and reporting. We reviewed the data DEA
collects to identify possible types of analyses DEA could conduct using
ARCOS data to identify unusual patterns. In addition, we reviewed key
data governance practices used by organizations and identified through
our past work to determine the extent to which DEA has a governance
structure in place to manage how it collects and uses data to support

Page 41 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

diversion control efforts. 1 Additionally, we reviewed the June 2019 Office

of Management and Budget Federal Data Strategy which provides a
framework of operational principles and practices to help agencies use
and manage data. 2 The key practices we identified to compare DEA’s
data governance efforts against were: identify data needs to answer key
agency questions; provide resources explicitly to leverage assets;
prioritize data governance; and support non-federal stakeholders. We
selected these practices because they are important to early development
of a data governance structure. We also reviewed the February 2019
Data Strategy, released by DOJ, that is to serve as a roadmap for DOJ
components to manage their data assets.

To understand the extent to which DEA assesses the results of the data it
obtains and uses from its ARCOS system and through suspicious order
reporting, we reviewed DEA’s performance measures and applicable laws
governing performance reporting in the federal government, including the
Government Performance and Results Act of 1993 (GPRA), as updated
and expanded by the GPRA Modernization Act of 2010 (GPRAMA).
Although GPRA and GPRAMA requirements apply to those goals
reported by departments (e.g., DOJ), we have previously reported that
they can serve as leading practices at other organizational levels, such as
component agencies for performance management. 3 We also reviewed
related national, DOJ, and DEA strategy documents that are used to
communicate diversion control goals and performance. These documents
included the 2018 National Drug Threat Assessment and 2019 National
Drug Control Strategy, DOJ’s department-wide strategic plan, DOJ
Annual Performance Report, DEA’s 360 strategy guide, and DEA
congressional budget justification documents. 4 In addition, we evaluated
DEA’s performance measures against criteria in Standards for Internal

1GAO, Data Act: OMB Needs to Formalize Data Governance for Reporting Federal
Spending, GAO-19-284, (Washington, D.C.: Mar. 22, 2019).
2Officeof Management and Budget, Federal Data Strategy – A Framework for
Consistency, OMB Memorandum M-19-18 (Washington, D.C.: 2019).
3GAO, Managing for Results: A Guide for Using the GPRA Modernization Act to Help
Inform Congressional Decision Making, GAO-12-621SP (Washington, D.C.: June 15,
2012).
4The 360 Strategy is a three prong approach that involves coordinating Law Enforcement
operations, engaging the registrant population through Diversion Control and community
outreach and partnership with local organizations following enforcement operations.

Page 42 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

Control in the Federal Government. 5 Furthermore, we reviewed the extent

to which DEA defined objectives and outcome-oriented goals, or
established measurable performance targets to evaluate the
effectiveness of how it obtains and uses data and compared them to
GPRAMA requirements, which may serve as leading practices for DEA.

To determine what opportunities exist, if any, for DEA to improve its use
and collection of industry-reported data, such as using computer
algorithms or real-time reporting, we interviewed DEA officials to
determine what analytics, if any, DEA is using to detect and identify
potential opioid diversion activities. In our interviews with field division
offices, we requested information regarding how investigators received
suspicious order reports from registrants and how the investigators
requested and used ARCOS and other system analysis to conduct or
support their investigative work. We also interviewed officials from other
entities with opioid diversion prevention responsibilities, such as state
level Prescription Drug Monitoring Programs, the Department of Health
and Human Services, including the Centers for Medicare and Medicaid
Services, and the Department of Justice (DOJ) U.S. Attorney’s Office
Opioid Fraud and Abuse Detection Unit.

To obtain perspectives of industry stakeholders on how data, such as

suspicious orders may be better reported to DEA, we interviewed four
industry associations whose memberships include industry stakeholders.
We selected these associations based on their roles in representing
various DEA registrant communities, such as pharmacists, pharmacies,
and distributors. 6 We also reviewed documentation describing the data
available to DEA via its ARCOS database, as well as documentation that
described examples of unusual patterns of orders. Based on such
information, two GAO specialists identified methods that could be
implemented using computer algorithms to analyze ARCOS data to
identify patterns that might indicate unusual activity. Additionally, these
specialists identified related opportunities that DEA could use to analyze
ARCOS data combined with data from other sources, such as
prescription rate information, to identify these patterns.

5GAO, Standards for Internal Control in the Federal Government, GAO-14-704G.

(Washington, D.C.: (Sept,2014),
6The views of these associations are not generalizable to the entire population, but did
provide important insights into suspicious order detection and reporting.

Page 43 GAO-20-118 Suspicious Order Reporting

Appendix I: Scope and Methodology

To address the extent to which DEA collaborates with industry

stakeholders to combat opioid diversion, we examined DEA policies and
procedures, and interviewed relevant DEA officials, industry associations,
and private sector industry members. Specifically, we examined DEA
agency-wide directives and guidance, and component management
policies and procedures for providing information to industry stakeholders
related to industry’s suspicious order reporting requirements, including
written communication DEA sent to industry stakeholders related to
suspicious order reporting. In addition, DEA officials provided us with a
demonstration of SORS, ARCOS, and the ARCOS Enhanced Lookup
Buyer Statistic Tool – available to distributors to help them identify and
report suspicious opioid orders. 7

We interviewed DEA officials in eight field division offices who interact

with industry stakeholders on, among other things, identifying and
reporting suspicious orders. These officials provided their perspectives on
the usefulness of suspicious order reports to their investigations as well
as other industry self-reported data collected in DEA information systems.
We interviewed opioid distributors of varying sizes, as noted above,
including some of the largest opioid distributors, based on DEA-provided
ARCOS data of opioid-related transactions, for their perspectives on the
information and tools DEA provides to them, including the Lookup Buyer
Statistics Tool and the ARCOS Enhanced Lookup Buyer Statistic Tool.
The views of these distributors are not generalizable to the entire
population, but provide insights and information on how industry detects
and reports suspicious orders through use of ARCOS data and other
tools.

We conducted this performance audit from January 2019 through January

2020 in accordance with generally accepted government auditing
standards. Those standards require that we plan and perform the audit to
obtain sufficient, appropriate evidence to provide a reasonable basis for
our findings and conclusions based on our audit objectives. We believe
that the evidence obtained provides a reasonable basis for our findings
and conclusions based on our audit objectives.

7The ARCOS Enhanced Lookup Buyer Statistic Tool allows DEA-registered

manufacturers and distributors to view the number of distributors and the amount of
certain controlled substances each distributor sold to a customer in the previous six
months. The tool was first made available in February 2018, with an additional
enhancement released in February 2019.

Page 44 GAO-20-118 Suspicious Order Reporting

Appendix II: Timeline of Selected Events and
Legislation Impacting or Related to Industry-
Reported Data on Prescription Opioids

Appendix II: Timeline of

Selected Events and
Legislation Impacting or
Related to Industry-Reported
Data on Prescription Opioids

Page 45 GAO-20-118 Suspicious Order Reporting

 Appendix II: Timeline of Selected Events and
Legislation Impacting or Related to Industry-
Reported Data on Prescription Opioids

Figure 3: Timeline of Selected Key Events and Legislation Related to Industry-Reported Data on Prescription Drugs

a
Pub. L. No. 91-513, 84 Stat. 1242 (Title II of the Comprehensive Drug Abuse Prevention and Control
Act of 1970, Pub. L. No. 91-513, 84 Stat. 1236).
Pub. L. No. 115-271, 132 Stat. 3894.
b

Page 46 GAO-20-118 Suspicious Order Reporting

 Appendix III: Comments from the Department
of Justice

Appendix III: Comments from the

Department of Justice

Page 47 GAO-20-118 Suspicious Order Reporting

Appendix III: Comments from the Department
of Justice

Page 48 GAO-20-118 Suspicious Order Reporting

Appendix III: Comments from the Department
of Justice

Page 49 GAO-20-118 Suspicious Order Reporting

Appendix III: Comments from the Department
of Justice

Text of Appendix III: Comments from the Department of

Justice
Page 1

U.S. Department of Justice

Drug Enforcement Administration
www.dea.gov

Nov 2020

Director Triana McNeil Homeland Security and Justice

Government Accountability Office 441 G Street, NE
Washington, DC 20548

Dear Director McNeil:

The Drug Enforcement Administration (DEA) has reviewed the

Government Accountability Office

(GAO) draft report DRUG CONTROL Actions Needed to Ensure

Usefulness of Data on Suspicious Opioid Orders. DEA has provided
additional comments regarding sensitivity and technical corrections on a
marked-up draft of the GAO report.

DEA was required to implement a centralized suspicious orders reporting

system (SORS) database within one year of passage of the Substance
Use-Disorder Prevention that Promotes Opioid Recovery Treatment for
Patients and Communities Act, the SUPPORT Act, signed into law on
October 24, 2018.

On October 23, 2019, DEA Diversion Control Division released its

centralized suspicious orders reporting system (SORS Online) meeting
DEA's statutory obligations. DEA notified all registrants who are required
to report to SORS Online. The SUPPORT Act also included a provision
for GAO to study the reporting of suspicious opioid orders. GAO's review
was conducted concurrently with DEA's actions to implement SORS
Online, so GAO was only able to review existing databases.

GAO was able to examine, among other things, how DEA obtains and
uses industry-reported data to identify and address opportunities for DEA
to improve ARCOS reporting using computer algorithms.

Page 50 GAO-20-118 Suspicious Order Reporting

Appendix III: Comments from the Department
of Justice

GAO made four recommendations to the DEA Administrator to ensure

that DEA effectively collects and uses industry-reported data. The
recommendations include that DEA consider ways to use algorithms to
proactively analyze industry data and establish and document a data
governance structure.

GAO RECOMMENDATIONS

To help ensure that DEA effectively collects and uses industry-reported

data to better support its ongoing diversion control efforts, GAO made the
following four recommendations:

Page 2

1. The DEA Administrator should develop and implement additional

ways to use algorithms in analyzing ARCOS and other data to more
proactively identify problematic drug transaction patterns.

DEA RESPONSE

DEA concurs. DEA will continue to examine a variety of technologies to

analyze ARCOS and other data and implement additional ways to use
algorithms to more proactively identify problematic drug transaction
patterns.

2. The DEA Administrator, in coordination with the department-wide

efforts on data strategy, should establish and document a data
governance structure to ensure DEA is maximizing its management of
industry-reported drug transaction data.

DEA RESPONSE

DEA concurs. As noted by GAO in the report, DEA is currently

implementing this recommendation and will continue to mature its data
governance structure.

3. The DEA Administrator should establish outcome-oriented goals and

associated measurable performance targets related to opioid
diversion activities, using data it collects, to assess how the data it
obtains and uses supports its diversion control activities.

Page 51 GAO-20-118 Suspicious Order Reporting

Appendix III: Comments from the Department
of Justice

DEA RESPONSE

DEA requests clarification. DEA needs additional discussion with GAO to

clarify specific actions needed to fulfill this recommendation. The
expansion of GAO's scope from the original mandate to review the
SORS, and the limited timeframe of the review, did not allow GAO to
meet with DEA officials responsible for performance metrics for opioid
diversion. DEA recognizes that measurable performance targets related
to opioid diversion activities can serve as leading practices at different
organizational levels, including the program, project, or activity level. DEA
will ensure that GAO meets with the appropriate DEA officials to address
diversion performance metrics.

4. The DEA Administrator, in consultation with industry stakeholders,

should identify solutions to address the limitations of the ARCOS
Enhanced Lookup Buyer Statistic Tool, to ensure registrants have the
most useful information possible to assist them in identifying and
reporting suspicious orders to DEA.

DEA RESPONSE

DEA concurs. DEA, in consultation with industry stakeholders, has

identified solutions to address the limitations of the ARCOS Enhanced
Lookup Buyer Statistic Tool. DEA is in the process of considering the first
two enhancements and how to best address these two requests from
industry. DEA is committed to continuing our engagement with industry to
identify additional enhancements while still maintaining our regulatory
oversight responsibilities.

Page 3

Thank you again for the opportunity to comment on this report. We look
forward to working with GAO as we strive to improve our Diversion
programs and further DEA's mission. If you have any questions regarding
this response, please contact DEA's Audit Liaison Team at 202-307-8200.

Respectfully,

Mary B. Schaefer
Chief Compliance Officer Office of Compliance

Cc: Louise Duhamel

Acting Assistant Director Audit Liaison Group

Page 52 GAO-20-118 Suspicious Order Reporting

 Appendix IV: GAO Contact and Staff
Acknowledgments

Internal Review and Evaluation Office Justice Management Division

145 N Street, NE Ste. 8W, 112
Washington, DC 20002

William T. McDermott
Assistant Administrator Diversion Control Diversion Control Division
Drug Enforcement Administration
600 Army Navy Drive
Arlington, VA 22202

Appendix IV: GAO Contact

and Staff Acknowledgments
GAO Contact
Triana McNeil, Director, 202-512-8777, McneilT@gao.gov

Staff Acknowledgments
In addition to the contact above, Tonnye’ Conner-White (Assistant
Director), Gary M. Malavenda (Analyst in Charge), David Bruno, Jill
Center, Billy Commons, Peter DelToro, Kathleen Drennan, Melissa
Hargy, Will Horowitz, Hayden Huang, Eric Hauswirth, Susan Hsu, Nicole
Jarvis, Benjamin T. Licht, Amanda Miller, and Jan Montgomery all made
key contributions to this report.

(103261)
Page 53 GAO-20-118 Suspicious Order Reporting
GAO’s Mission
The Government Accountability Office, the audit, evaluation, and investigative
arm of Congress, exists to support Congress in meeting its constitutional
responsibilities and to help improve the performance and accountability of the
federal government for the American people. GAO examines the use of public
funds; evaluates federal programs and policies; and provides analyses,
recommendations, and other assistance to help Congress make informed
oversight, policy, and funding decisions. GAO’s commitment to good government
is reflected in its core values of accountability, integrity, and reliability.

Obtaining Copies of GAO Reports and Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost is
through our website. Each weekday afternoon, GAO posts on its website newly
released reports, testimony, and correspondence. You can also subscribe to
GAO’s email updates to receive notification of newly posted products.

Order by Phone
The price of each GAO publication reflects GAO’s actual cost of production and
distribution and depends on the number of pages in the publication and whether
the publication is printed in color or black and white. Pricing and ordering
information is posted on GAO’s website, https://www.gao.gov/ordering.htm.
Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.
Orders may be paid for using American Express, Discover Card, MasterCard,
Visa, check, or money order. Call for additional information.

Connect with GAO

Connect with GAO on Facebook, Flickr, Twitter, and YouTube.
Subscribe to our RSS Feeds or Email Updates. Listen to our Podcasts.
Visit GAO on the web at https://www.gao.gov.

To Report Fraud, Waste, and Abuse in Federal

Programs
Contact FraudNet:
Website: https://www.gao.gov/fraudnet/fraudnet.htm
Automated answering system: (800) 424-5454 or (202) 512-7700
Congressional Relations
Orice Williams Brown, Managing Director, WilliamsO@gao.gov, (202) 512-4400,
U.S. Government Accountability Office, 441 G Street NW, Room 7125,
Washington, DC 20548

Public Affairs
Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800
U.S. Government Accountability Office, 441 G Street NW, Room 7149
Washington, DC 20548

Strategic Planning and External Liaison

James-Christian Blockwood, Managing Director, spel@gao.gov, (202) 512-4707
U.S. Government Accountability Office, 441 G Street NW, Room 7814,
Washington, DC 20548

Please Print on Recycled Paper.