The Controlled Substances Act (CSA) was enacted in 1970 to regulate and facilitate the use of controlled substances, including certain prescription drugs such as opioid pain relievers, for legitimate medical, scientific, research, and industrial purposes while preventing them from being diverted for illegal uses. According to DEA, the CSA requires DEA to maintain a “closed system” of distribution, which includes limiting the amount of certain controlled substances that are available in the marketplace by setting quotas. Various CSA provisions also require persons who handle controlled substances to register with the DEA. This includes businesses that import, export, manufacture, or distribute controlled substances; certain health care practitioners, such as physicians, licensed to dispense, administer, or prescribe them; and pharmacies authorized to fill prescriptions, referred to as “registrants.” The registration mechanism creates a “closed system” of distribution in which distribution may lawfully occur among the registrants. The closed system of distribution, along with registrant compliance with the CSA’s regulatory requirements, helps to ensure that a particular controlled substance is always accounted for by a DEA-registered entity, from its creation until it is dispensed to a patient or is destroyed. The CSA places controlled substances in one of five schedules based generally on findings related to the substance, including whether the substance has a currently accepted medical use in treatment in the United States, its relative potential for abuse, and the degree of dependence the drug or other substance may cause. For further information on this and other legal requirements, please see appendix II. The prescription drug supply chain is the means through which prescription drugs are ultimately delivered to patients with legitimate medical needs. Although there can be many variations in the flow of prescription drugs through the supply chain, in a common example, prescription drugs are produced by manufacturers; are purchased and stored by distributors, who take orders and deliver them to customers such as pharmacies; and ultimately are dispensed by pharmacies to patients who have a prescription from a practitioner, as shown in figure 1. Although prescription drugs are intended for legitimate medical uses, the prescription drug supply chain may present opportunities for the drugs to be diverted and abused as the drugs move through the various components of the supply chain. For example, an individual may visit multiple practitioners posing as a legitimate patient, referred to as a doctor shopper, to obtain prescriptions for drugs for themselves or others, or criminal enterprises may rob distributors and pharmacies of prescription drugs to sell to others. DEA, through its Diversion Control Division, is responsible for preventing, detecting and investigating the diversion of controlled substances from legitimate sources while ensuring an adequate and uninterrupted supply is available for legitimate medical, commercial, and scientific needs. The division is responsible for enforcing the CSA and its regulations pertaining to pharmaceutical controlled substances and listed chemicals. In doing so, it conducts domestic investigations, among other things, in DEA’s 23 field division offices. By law, generally, manufacturers, distributors, and reverse distributors are required to report to DEA every sale, delivery, or other disposal of any controlled substance. As we previously reported, manufacturers and distributors of schedules I and II drugs and schedule III narcotics must file reports with DEA through ARCOS, a drug reporting system that allows the agency to monitor the flow of DEA controlled substances from their point of manufacture through commercial distribution channels to point of sale or distribution at the dispensing/retail level. In addition, certain schedule III non-narcotics and some schedule IV narcotics are also covered by the ARCOS reporting requirements. DEA implemented the ARCOS database in 1997, and approximately 1,250 distributors, manufacturers, and reverse distributors report more than 72 million transactions into ARCOS each year, according to DEA. Generally, certain registrants must report certain data at least quarterly and they have the option to report voluntarily on a monthly basis. By law, each registrant, such as manufacturers and distributors of controlled substances, is required (1) to design and operate a system that is compliant with applicable federal and state privacy laws to identify suspicious orders of controlled substances, and (2) upon discovering a suspicious order or series of orders, notify the DEA Administrator and the special agent in charge of the appropriate DEA field division office. The SUPPORT Act, which amended the CSA in part, also includes requirements related to preventing drug diversion. The SUPPORT Act provisions require the DEA Administrator to establish a centralized database for collecting suspicious orders reports, which is discussed in more detail below. In addition, the SUPPORT Act requires the Attorney General to make certain data available to registered manufacturers and distributors through ARCOS. The SUPPORT Act also requires the Attorney General to submit to Congress a report that provides information about how the Attorney General is using ARCOS data to identify and stop suspicious activity no later than one year after the date of enactment of the SUPPORT Act. DEA operates and maintains various information systems containing registrant information, transaction data, and suspicious drug orders that support its efforts to prevent, detect, and investigate the diversion of pharmaceutical controlled substances. These include Controlled Substance Ordering System (CSOS). This system is used primarily by manufacturers and distributors, as well as pharmacies and hospitals to place orders for controlled substances in a secure electronic environment, and includes information such as the number of packages, size of packages and name of items ordered, according to DEA. ARCOS. As discussed above, ARCOS monitors the flow of transactions of schedule I, II, III and select schedule IV controlled substances from their point of manufacture to their point of sale or distribution at the dispensing or retail level (such as hospitals, retail pharmacies, practitioners, and teaching institutions). The data in ARCOS are used to, among other things, track regulatory compliance in the pharmaceutical drug industry and to detect abuse of legally manufactured pharmaceuticals that are diverted to illegal markets, according to DEA Diversion Control Division officials. Suspicious Order Reporting System (SORS). DEA developed SORS to receive and store suspicious order reports. To date, DEA has developed three versions of SORS as described below. SORS Online version. In late October 2019, DEA launched the Suspicious Orders Report System (SORS) Online, a centralized database required by the SUPPORT Act, for registrants that distribute controlled substances to report suspicious orders to DEA. Reporting a suspicious order to SORS Online constitutes compliance with the reporting requirement that registrants notify the Administrator of the Drug Enforcement Administration and the Special Agent in Charge of the Division Office of the Drug Enforcement Administration for the area in which the registrant is located or conducts business. SORS online is the third version of DEA’s SORS system that was originally developed in 2008. Unlike earlier SORS versions, SORS Online requires users to provide a reason an order is suspicious. At the time of our study, the use of SORS Online was voluntary. Registrants who are under active MOAs with DEA are reporting to the new SORS Online system, according to DEA. Follow-up version. Suspicious order reports reported by registrants since March 2017 operating under an active memorandum of agreement (MOA) with the DEA that required them to submit their reports electronically to DEA headquarters as opposed to their local DEA field division office using the SORS Follow-up version, according to DEA Diversion Control Division officials. Initial version. The initial version of SORS stores suspicious order reports for registrants with an expired MOA but who elected to voluntarily continue to report suspicious orders in the same way as under the MOA, according to DEA Diversion Control Division officials. The initial version of SORS was established in 2008. Figure 2 provides an overview of the information DEA obtains and uses to support its diversion control efforts. A PDMP is an electronic database that tracks controlled substance prescriptions, managed within and at the state level. State PDMPs can provide health care providers and authorities timely information about prescribing and patient behaviors that may indicate drug abuse or diversion and facilitate a response. Authorized users, such as practitioners and pharmacists, may access information submitted to PDMPs by dispensers. A state’s PDMP is housed by a specified statewide regulatory, administrative or law enforcement agency. The PDMP distributes data from the database to individuals who are authorized under state law to receive the data for purposes of their profession. PDMP data can assist law enforcement and health care providers such as practitioners and pharmacists in identifying patterns of prescribing, dispensing, or receiving controlled substances that may indicate abuse or diversion. PDMPs vary in numerous ways across states, including what data they collect; what drugs they cover; who has access to, or who is required to use, the prescription drug monitoring program; and which state agency oversees and administers the program. DEA may request state PDMP data through submitting requests or subpoenas to the state official operating the PDMP database, for example, to support diversion control investigations. The requirements on requesting and accessing state PDMP vary from state to state according to DEA Diversion Control Division officials. Officials noted that the different state-by-state requirements create difficulties for federal law enforcement during a multi- state or national case as law enforcements’ requests for data have to be addressed at the state level. Data-analytics activities can include a variety of techniques to prevent and detect diversion, including data matching and data mining. Data matching is the large scale comparison of records and files to detect errors or incorrect information. It can be used to verify information provided by recipients or detect unreported changes. Data mining is the use of automated computer algorithms to detect patterns, including those that are otherwise not obvious, correlations, or anomalies within large data sets indicative of potential diversion. Entities may identify many types of analytics techniques that can be used to address improper transactions, such as Rules based – Identify suspicious orders with rules, such as orders that go above a threshold; Anomaly – Detect individual and aggregated abnormal patterns versus peer group, for example, the orders from one pharmacy compared to other pharmacies in the same geographic area; and Predictive – Assess against known diversion. A provider that has characteristics similar to those of known bad actors. DEA uses industry-reported ARCOS data to help generate leads, support enforcement actions, and allocate resources. The agency uses these data in a number of ways, including supporting field diversion control activities and developing analytical products. Field-Based requests for data analysis. DEA’s Diversion Control Division’s ARCOS Unit responds to requests for data analysis from its field division offices in support of diversion control enforcement activities. According to DEA officials, this unit is responsible for the collection, maintenance, and analysis of ARCOS data. For example, DEA said this unit conducts analysis on controlled substances that are bought and sold in a particular timeframe between a seller and a buyer. The ARCOS Unit also obtains information on the quantity, dosage units, grams, and ingredients of the drugs in the sale and conducts analyses in response to specific requests from field-based investigators who send their requests to the unit. For example, DEA officials said that out of the 800 field division office requests for analysis sent to the DEA ARCOS Unit in calendar year 2018, about 60 percent of those were for “enhanced” validations. This process includes a controlled substance report which the unit provides to field investigators for their use during scheduled drug investigations, and contains a summary of, among other things, an ARCOS registrant’s reported sales and purchases compared against what other registrants report was sold to them. This process uses both automatic and manual checks. According to DEA officials, they received approximately 480 requests for enhanced validations from DEA field investigators in 2018. While DEA officials noted that DEA’s enhanced validation procedures are not documented, they acknowledged that the ARCOS Unit is in the process of developing standard operating procedures for ARCOS data quality control, including the enhanced validation process. All requests for validations submitted to the ARCOS Unit are analyzed and compiled, and sent to field-based investigators to support scheduled investigations. Although validations are primarily requested for scheduled investigations, field offices can request these reports pursuant to any scheduled or non-scheduled investigation. DEA Analytic Product - Drug Profiles. Using ARCOS data, DEA creates drug profiles for suspected bad actors at the retail level (such as certain pharmacies), who have irregular transactions–also known as outliers, according to DEA officials–in a specific area or zip code and provides this information to its field division offices. The ARCOS Unit compares this suspected “bad actor” with other area competitors. DEA Analytic Product – Annual Threat Assessments. DEA’s ARCOS Unit also uses ARCOS data to develop threat assessments annually to aid field investigators. The threat assessments use ARCOS data to provide drug-related transaction trends and patterns related to a given DEA field division office area of operations to help establish priorities and allocate resources. DEA officials noted that field division office staff use these assessments to develop work plans identifying which registrants will be subject to the office’s routine regulatory investigation that year. Field Querying of ARCOS Data. – Field division offices may also use ARCOS querying tools to analyze ARCOS data to proactively identify diversion targets, such as reviewing ARCOS data to identify information on top purchasers of controlled substances. In a written response to our questions, DEA officials told us that several ARCOS drug profiles they developed have contributed to state and federal administrative, criminal and regulatory investigations. DEA officials recently informed us that as part of a reorganization, it established the Targeting and Special Projects Section whose goal is to focus on leveraging DEA’s data capabilities. Specifically, this section is composed of two units, including the Reports Analytics Unit and the Targeting and Special Projects Unit, which was established in March 2019 and is responsible for conducting data analytics on ARCOS and other data, according to DEA Diversion Control Division officials. DEA is currently working to determine the types of analysis these units will conduct. We found that while DEA uses ARCOS data to support ongoing investigations and conducts analysis on this data to identify investigative leads for its field division offices, it could conduct more robust analysis using automated computer algorithms to help identify questionable patterns in the data. This analysis in turn could be used to identify registrants that need to be investigated. According to DEA officials, most of the analysis DEA currently conducts on ARCOS data is used by the field division offices. For example, upon receiving information on pharmacies that have a high frequency of reporting stolen or lost-in-transit drugs a field division office may contact DEA’s ARCOS Unit to request ARCOS information. DEA then analyzes the ARCOS data to produce the requested reports to support the field’s ongoing investigations. DEA also conducts routine analysis of ARCOS data to identify high volumes of drugs sold by a distributor to a single purchaser, high volumes of drugs purchased by a single purchaser, and trends in drugs sold or purchased in a given geographic area compared to similar nearby areas. DEA officials also identified one type of analysis it conducts using a computer algorithm. Specifically, DEA uses a computer algorithm when comparing large volumes of drugs purchased in a given geographic area to the area’s population data. According to DEA officials, DEA conducts this analysis quarterly. However, DEA did not report conducting active and recurring monitoring of transactions using algorithms to detect and flag transactions that indicate potential diversion, either on a real-time or near real-time basis. We identified several additional opportunities for DEA to proactively analyze ARCOS data using computer algorithms to identify unusual patterns of drug distribution on a more routine basis. Such analyses could be used to proactively support or generate leads for investigations of potential drug diversion. For example, DEA could Analyze ARCOS data to identify unusual volumes of drugs that were disposed of rather than sold. Conduct analysis of ARCOS data to identify unusual numbers of deleted transactions or deletions of transactions of high volumes of drugs. Analyze ARCOS data by comparing the amount of drugs being acquired by a registrant to the amount of drugs accounted for, through being sold or disposed of, among other things, by each registrant to determine any differences. Analyze ARCOS data to identify trends in distribution or purchases of drugs in a given geographic area. DEA could look for unusual patterns when comparing such activity in an area with that of other nearby areas; or analyze volumes of drugs purchased in a geographic area when adjusted by the area population. In addition to the analysis noted above using ARCOS data, we also identified further analysis that DEA could perform using ARCOS data and additional available data to help identify potentially suspicious purchase or distribution patterns. Specifically, in our review and analysis of ARCOS data and information about PDMP data, we identified an opportunity for DEA to analyze ARCOS and PDMP data together for a more complete picture of drug transactions from distribution to retailers through dispensation to patients. We determined this could help in assessing whether the amount of drugs being prescribed is consistent with the amount of drugs being purchased or distributed in a given geographic area. For example, in areas where the number of prescriptions increases, a subsequent increase in drug orders and distribution to that area could be considered understandable. However, where the number of prescriptions in an area remains the same, or decreases, a significant increase in drug orders and distribution to that area could be considered unusual, especially if this pattern persists over several reporting periods. DEA stated that it occasionally performs such analysis manually, noting however that its access to PDMP data is contingent upon each state’s requirements and willingness to share its PDMP data with federal law enforcement. In July 2019, DEA officials responsible for overseeing the use and analysis of ARCOS data expressed an interest in improving DEA’s ARCOS data analytic capabilities but stated that they needed more staff and resources. Specifically, they noted they would like to hire additional staff, such as data scientists, to conduct analysis on ARCOS data using, for example, additional computer algorithms. DEA also noted that it was considering automation of additional types of analyses, but did not provide a start date or estimate as to when it would move forward on that consideration. While DEA created the new Targeting and Special Projects Section in March 2019 to enhance DEA’s data analytics and set aside some positions for program analysts and subject matter experts, among other positions, as of October 2019, DEA officials did not have any details or documentation about the data analysis efforts the new division plans to undertake. We have previously reported that new approaches to combining and “making sense of” large amounts of varied data—methods referred to as advanced analytics—are helpful to uncover patterns, identify anomalies, and provide insights not suggested by assumed hypotheses. In addition, other federal entities responsible for detecting diversion and abuse of controlled substances utilize computer algorithms as part of their analysis of available data in order to flag and prioritize potential instances of diversion for further investigation. For example, the Centers for Medicare & Medicaid Services and its National Benefit Integrity Medicare Drug Integrity contractor use proactive data analysis to detect aberrant patterns and potential diversion in drug prescribing. As a result, the contractor is able to produce “prescriber risk assessments,” which provide a comparison of controlled substance prescribing patterns across peers. The Centers for Medicare & Medicaid Services also uses proactive data analysis to identify providers with potentially inappropriate prescribing patterns, especially as it concerns opioids. Similarly, some opioid drug distributors use computer algorithms to identify suspicious orders that are the basis for the suspicious order reports they are required to provide to DEA. The establishment of this new section within DEA focused on its data analytics capabilities presents an opportunity for DEA to more proactively use data analytics with regard to its ARCOS and other data. In doing so, DEA could more effectively identify possible diversion activities or unusual activity to aid its ongoing efforts to prevent, detect, and investigate diversion more quickly and assist it in reporting on how it is using ARCOS data to identify suspicious activities. In October 2019, DEA established the Suspicious Orders Report System (SORS) Online, a centralized database for collecting suspicious order reports, which is required by the SUPPORT Act to be established by October 24, 2019. The SORS Online data fields include a requirement for registrants to note their reasons for identifying an order as suspicious, drug quantity, and dosage strength. The successful implementation of the centralized database is important because it could address the fragmented way in which suspicious order reports are currently submitted. However, reporting to the centralized database is currently voluntary. Registrants may notify DEA of a suspicious order using other means, including email, facsimile, or telephone. The systems and reports are not currently integrated, and investigators must query each system or office separately in order to find, for example, information related to a lead they are investigating. Currently, registrants are required upon discovery of a suspicious order or series of orders, to notify the Administrator of the DEA and the Special Agent in Charge of the division office of the DEA for the area in which the registrant is located or conducts business. Prior to DEA establishing the SORS Online centralized database, registrants with an existing or a prior MOA also have reported suspicious orders into one of two SORS databases when reporting to headquarters. The new SORS Online is the only electronic mechanism for reporting suspicious orders now, according to DEA. Registrants who are under active MOAs with DEA are reporting to the new SORS Online system, according to DEA. Registrants that are not under an MOA may also use SORS Online, but are not required to do so. Registrants not under an MOA may also use a paper-based process, among others, when reporting to the field division offices and DEA headquarters. However, no integration exists across headquarters’ and field division offices’ various electronic- and paper-based systems. DEA officials we met with said that some of the suspicious order reports received at the field division office level are stored in hard copy in accordion file folders, instead of being digitized or entered into a searchable database. Reporting to SORS Online satisfies the requirement to report such orders to the Administrator of the DEA and the Special Agent in Charge of the Division Office of the DEA for the area in which the registrant is located or conducts business. Successfully managing the SORS Online database could lead to needed efficiency improvements and more effective use of the suspicious order report data. Although DEA has guidance, policies and procedures regarding the use of some of its information systems, it has not established a formalized data governance structure to manage its collection and use of data used to support the Diversion Control Division’s mission. DEA specifically has not institutionalized and clearly documented policies and procedures that describe division staff’s roles and responsibilities for collecting and analyzing data nor has it provided a structure that describes the agency’s approach to establishing and maintaining such a program. We have identified a number of issues with DEA’s management of data. For example, DEA does not have any documentation on their process for ensuring the quality of data registrants submit to its ARCOS database— the main system that enables DEA to monitor the flow of controlled substances. As a result, it is difficult to understand the controls they have over this important data. A data governance structure is defined as an institutionalized set of policies and procedures for providing data governance throughout the life cycle of developing and implementing data standards. A data governance structure also helps to ensure important data assets are formally managed and fully utilized, and can also provide consistent data management. We previously reported on key practices based on several data governance models, including developing and approving data standards, managing, controlling, monitoring, and enforcing consistent application of data standards, and delineating roles and responsibilities for decision making and accountability. Additionally, in June 2019, the Office of Management and Budget established a Federal Data Strategy (Strategy) as a framework of operational principles and practices to help agencies use and manage data. We found several areas where DEA’s current practices do not reflect select leading data governance practices. Agencies should identify data needs to answer key agency questions: We found that DEA does not have a governance structure to determine and prioritize its data requirements for either suspicious order reports it receives or data reported into its ARCOS systems. For example, DEA has not established standard requirements for the information required in a suspicious order report. As a result, distributors’ suspicious order reports vary and may contain inconsistent and insufficient data for DEA to make investigative decisions. In addition, DEA does not have a governance structure to identify agency and industry stakeholder data needs to help inform its opioid diversion control efforts. Agencies should provide resources explicitly to leverage data assets: Agencies should ensure that sufficient human and financial resources are available to support data driven agency decision- making, and accountability. As mentioned earlier, while DEA created the new Targeting and Special Projects Section in March 2019 to enhance DEA’s data analytics, as of October 2019, DEA officials did not have details or documentation about the data analysis efforts the new division plans to undertake or the resources they plan to provide for those efforts. As a result, DEA is unable to conduct the analysis that would enable it to more effectively use its existing data in making decisions about diversion related efforts. Agencies should prioritize data governance: Agencies should ensure there are sufficient authorities, roles, organizational structures, policies, and resources in place to transparently support the management, maintenance, and use of strategic data assets. Similarly, leading practices for data governance includes delineating roles and responsibilities for decision-making and accountability, including roles and responsibilities for stakeholder input on key decisions. As mentioned earlier, DEA established the Targeting and Special Projects Section in March 2019 whose goal is to focus on leveraging DEA’s data capabilities and conducting data analytics on ARCOS and other data, according to Diversion Control Division officials. While the new section appears to hold promise, DEA has not clearly defined and adopted the new section’s roles and responsibilities for managing and analyzing data across the DEA or how the new section will communicate and collaborate with other Diversion Control Division headquarters and field staff. As a result, the new division may not operate in a predictable, repeatable, and accountable way. Agencies should support non-federal stakeholders: Agencies should engage with industry, academic, and other nonfederal users of data to share expert knowledge of data assets, promote wider use, improve usability and quality, and advance innovation and commercialization. Later in this report, we identify an opportunity for DEA to collaborate with industry stakeholders and seek their input for an initiative that is supposed to assist industry stakeholders in their responsibilities to report suspicious orders to DEA. Although DEA has not incorporated these data governance practices, it is in the early stages of developing a data governance structure. As of September 2019, DEA officials told us that its Office of Information Systems’ Chief Data Officer just recently started to work with DOJ and other components to develop a data strategy in response to the recently released department wide strategy, and therefore does not have any additional documentation or information related to timelines and deliverables for formally implementing a DEA data governance or other data structure for the agency. Without additional details, such as a timeframe for developing the structure or more information about what it would entail, it is unclear how or if these efforts will incorporate leading practices for data governance and if they will be effective. Data governance processes are important for DEA given it works with an extensive and complex network of stakeholders to manage opioid diversion risks and uses industry-reported data to help it identify patterns that might indicate potential diversion. An effective data governance structure could help DEA ensure its important data assets are formally managed and fully utilized, and can also help ensure consistent data management. Industry and technology councils, domestic and international standards-setting organizations, and entities within the federal government endorse the establishment and use of a governance structure to oversee the development, management and implementation of data standards, digital content and other data assets. DEA does not have an existing mechanism or a comprehensive database of orders before they are filled that it can analyze, on a real-time basis, to identify potentially suspicious orders. However, most industry stakeholders we spoke with on the usefulness of real-time data noted that such a mechanism would not add extensive value to diversion detection. DEA’s current data systems either contain historical, not real-time, data or do not contain all drug order data that could be reported. ARCOS. The data in the ARCOS database is historical, rather than real- time, on orders that have been filled. Every registered manufacturer is required, at such time or times and in such form as required by the Attorney General, to make periodic reports to the Attorney General of every sale, delivery or other disposal of any controlled substance. Each distributor is required to make such reports with respect to narcotic controlled substances. For example, as part of the reporting to ARCOS, acquisition and distribution transaction reports are required, by regulation, to be filed every quarter, except that a registrant may be given permission to file more frequently, but not more frequently than monthly, depending on the number of transactions being reported each time by that registrant. In addition, manufacturing transaction reports are required to be filed annually, except that a registrant may be given permission to file more frequently, but not more frequently than quarterly. CSOS. DEA does not require registrants to use CSOS and thus it is not used by all registrants. As previously discussed, CSOS is an electronic ordering system which allows registrants to place orders for controlled substances. Shipments of all ARCOS-reportable controlled substances, ordered through CSOS, are included in registrant’s periodic ARCOS reporting. Suspicious Order Reports. Suspicious order reports are intended to identify orders of unusual size, orders deviating substantially from a normal pattern, and orders of unusual frequency before they are filled. By law, each registrant is required to design and operate a system to identify suspicious orders that it receives. Registrants identify, then report, to DEA using their own systems to determine suspicious orders. As discussed previously in this report, registrants can report these orders into DEA’s newly launched SORS Online database, but reporting into this database is voluntary and registrants have an option to report in other ways, so this database does not capture all suspicious orders and is therefore not comprehensive. Suspicious orders are likely identified in close to a “real-time” basis. Orders that have been identified and reported as suspicious by the registrants, are orders that have not yet been filled. While two individual drug distribution companies we interviewed said they saw some value in real-time reporting, most industry stakeholders we spoke with on the usefulness of real-time data, including a broad cross- section of associations representing pharmacies and drug distribution companies, said that real time dissemination of suspicious orders by DEA would not add extensive value to efforts to detect possible diversion. Instead, some industry stakeholders suggested that a focus on data that provide trends over time might be more useful. As discussed earlier in this report, we provide examples of data analysis DEA currently performs and could perform on its existing data that could potentially help DEA determine or identify possible patterns of aberrant behavior in drug order information. Others we spoke with raised concerns about the varying ways companies determine what is suspicious and that using real-time data reported from DEA on these orders could be like comparing apples to oranges. Most of the associations that represent pharmacies and drug distributors that we met with indicated they did not see much value in either reporting, or receiving reports, of suspicious orders in “real-time.” For example, a representative from an association representing pharmacists told us that rarely would there be a case where a single order was so egregious that stopping it would have a significant impact on public health. This representative also noted that it would be more important to focus on historical trends, given “trends don’t happen in a day.” Other stakeholders we spoke with said that while there may be utility in real-time reporting of suspicious orders, they also had concerns about its feasibility, given current available data. They noted it would be difficult to compare suspicious order data as reported by registrants because companies rely on their own methods to determine a suspicious order. For example, Officials from an association that represents a large number of drug distributors indicated that receiving more real-time data might allow their members to have an additional check on orders that a wholesale distributor receives, but this utility would largely be contingent on the distributors’ ability to compare suspicious order reports across one another. Distributors use different criteria for determining whether an order is suspicious; there is no continuity across them; and they experience varying order volumes and patterns across their customers and over time as patient needs change. Thus, such analyses would be difficult to conduct, if they could be done at all, and would not necessarily result in useful comparisons. A representative from one drug distribution company told us that having knowledge of other distribution companies’ suspicious orders is not helpful because the company would not know how the other distributor made a determination on the suspicious order. Another representative stated that distributors are operating proprietary systems that may or may not vary substantially from each other depending on a large number of varying circumstances, and may be operating “wildly different” systems for identifying suspicious orders and therefore the information would not be valuable. Representatives from two drug distribution companies identified additional challenges to real-time reporting of suspicious orders if the determination of whether an order was suspicious or not was made by DEA. First, they did not believe DEA had sufficient resources or knowledge to identify suspicious orders. One representative said DEA does not know the history and market dynamics in the pharmaceutical industry to help inform decisions it would need to make on an order. Second, identifying an order as suspicious before it is filled would add a tremendous burden on DEA. According to one of the representatives, their company typically ships orders on the same day the order is received, consistent with “just-in-time” inventory management practices. If DEA were expected to make suspicious order determinations without the risk of disrupting patient care needs, it would be imperative for DEA to act quickly to identify suspicious orders. These distribution companies did not believe DEA would be able to identify them rapidly as needed. As noted above, DEA’s current systems are not designed for real-time reporting, and it does not have an existing mechanism or a comprehensive and complete database of orders before they are filled that it can analyze, on a real- time basis, to identify potentially suspicious orders. Officials from the association that represents a large number of drug distributors were careful to point out, however, that systems sometimes differ intentionally due, for example, to varying customer bases, service requirements and patient care needs. Thus, a certain amount of variability in suspicious order systems, criteria and decisions may be warranted, and even desirable. While DEA has developed some performance measures to track and publicly report the progress and results of its efforts in reducing diversion, DEA has not developed objectives, outcome-oriented goals, or measurable performance targets to assess the effectiveness of its opioid diversion control data analysis efforts and the link between DEA’s use of data and progress toward its diversion goals and strategies. DEA does have performance measures including the number of civil penalties and administrative actions it has undertaken, planned or scheduled investigations completed, and community outreach events completed. While these measures are useful, they do not account for outcomes of these actions, such as their potential impact on the volume of opioids being improperly sold or purchased. DEA officials noted that it adheres to goals established through the Office of National Drug Control Policy’s National Drug Control Strategy, such as reducing the prescription opioid rate by one-third within three years, reducing overdose deaths, and within five years, ensuring all health care providers have adopted best practices for opioid prescribing. However, those goals involve a multitude of federal agencies, and are not directly related to DEA’s use of industry-reported data, nor linked specifically to DEA diversion control efforts. DEA also noted that they have a number of goals across strategies such as DEA’s 360 strategy in addition to the goals in DOJ’s strategic plan; a performance measure with a measurable target for its agency-wide objective related to dismantling drug trafficking organizations—maximizing the monetary value of currency, property, and drugs seized; and a measure for curbing opioid and other illicit drug use. GPRAMA directs agencies to develop and document goals, as well as performance measures to assess progress towards their goals. Agencies can use performance measurement to make various types of management decisions to improve programs and results, such as developing strategies and allocating resources, including identifying problems and taking corrective action when appropriate. Additionally, GPRA as amended by GPRAMA states that management should define outcome-oriented objectives in specific and measurable terms. Measurable targets help decision makers conduct assessments of whether program goals were achieved, and linkages between an organization’s goals and performance measures create a line of sight so that everyone understands how program activities contribute to the organization’s goals. DEA officials view their existing performance goals as sufficient overall. However, without defining objectives in specific measurable terms, DEA is likely not able to adequately assess whether its respective investments and efforts are helping it to limit the availability of and better respond to the opioid prescription diversion threat. Until program officials can review the effectiveness of these systems based on quantifiable benefits and measurable performance targets, they are not well-positioned to determine the extent to which suspicious order reports or ARCOS data and systems are enhancing the effectiveness of the agency’s opioid related regulatory and criminal diversion investigations, prosecutions and civil actions. Documenting program goals and developing measurable performance targets and linkage to program goals could provide DEA with the information it needs to assess progress and make informed decisions about current and future operations. DEA developed an ARCOS query option for registrants to use, called the ARCOS Enhanced Lookup Buyer Statistic Tool, in February 2019 to better support registrants’ efforts to identify and report suspicious orders. This tool allows registrants to query certain ARCOS data maintained by DEA. Although this tool was supposed to be an improvement upon a prior iteration of the lookup tool DEA had developed, distributors and an industry association representing distributors identified several limitations with the tool. Specifically: Single query challenges and no bulk downloads. The distributor can only query the tool one pharmacy at a time, even though some distributors supply thousands of pharmacies on a daily basis. Thus, if certain distributors were to query all of its pharmacies for possible suspicious order patterns, the process could be time-consuming or not feasible. DEA noted it was working on this limitation. Limited login credentials. DEA only provides each distributor with one set of login credentials, so only one employee can log in at a time to query the tool. DEA noted it was working on this limitation. Data provided in the tool are not detailed enough. The tool does not provide detailed enough information to be useful to facilitate the identification of suspicious orders. For example, when a distributor queries the tool, the search results will list the total dosage units for a particular opioid for the past six months at the pharmacy. Because some opioid drug dosages are more commonly abused than others, distributors told us that simply having the total number of dosage units is not as helpful as seeing the breakdown of the different dosage units. In another instance, the data provided to distributors does not include critical details about the number of suppliers. One distributor might have multiple warehouses and distribution centers that it uses to package and ship pharmaceutical products. In the ARCOS data that DEA provides to distributors, these individual warehouses are counted as distinct suppliers in the total supplier count data provided to the distributors. Therefore, the number of suppliers may appear inflated to the distributors, even though it is only a single company providing the products. According to DEA, the ARCOS lookup tool is meant to be a pointer and assist distributors in conducting due diligence so they can “know their customer.” Regardless if a distributor is shipping from multiple distribution centers and therefore showing as multiple suppliers in the lookup tool, these are all unique DEA registration numbers and are therefore unique suppliers to the customer. According to DEA, the important part here is that distributors can see quantity and gram totals per registrant (such as, a pharmacy customer) that they query. When evaluating whether an order is suspicious, a distributor uses its own internal transaction data to evaluate a buyer’s ordering patterns. However, purchasers of controlled substances, such as pharmacies and medical practices, may use multiple distributors for their purchases. Distributors have previously raised concerns that they did not have access to additional transaction data, such as whether the purchaser is also buying controlled substances from additional suppliers. They have noted that this additional data would be useful when making decisions about whether an order is suspicious, and specifically, that ARCOS data would be useful in helping them evaluate whether an order was suspicious. For example, in 2018, one distributor testified that, given DEA’s access to the controlled substance transaction data that distributors report, “nly DEA has visibility over the entire landscape and can track and analyze aggregate data on the distribution of controlled substances in particular jurisdictions.” In addition, an industry organization we met with provided comments to DOJ in 2017 that certain data could provide more context for them to identify problematic orders. Specifically, the organization noted that if DEA could provide ARCOS data in aggregate form without identifying individual distributors’ competitors, the distributor could consider a pharmacy’s orders in the context of the pharmacy’s overall ordering from all distributors. An industry association representing distributors, and two of the distributors that we interviewed stated that the Enhanced Lookup Buyer Statistic Tool is a step in the right direction. However, the industry association and four distributors that we interviewed stated that the tool remains limited in helping distributors improve how they identify suspicious orders, as noted above. DEA officials told us that distributors have brought some of these concerns about the ARCOS Enhanced Lookup Buyer Statistic Tool’s usability to their attention. For example, in May 2019, an industry association representing distributors sent a letter to DEA, outlining a consolidated list of industry’s concerns about the tool. In recent discussions in June 2019, DEA officials acknowledged some of these limitations and stated that some industry concerns would be easier to fix than others, but that they had not established a timeframe for when the changes would be implemented. For example, DEA officials noted it might be easier to provide additional login credentials to distributors and make the data available to be downloaded in a more functional way for distributors. For some of the other limitations industry stakeholders identified, such as providing more detailed ARCOS data to the distributors, DEA officials raised concerns. For example, DEA officials noted that distributors could use the additional detailed data as a market research tool in order for distributors to gain unfair market advantages or to learn more about their competitor’s business contracts with pharmacies. In September 2019, DEA officials told us that it was not currently addressing changes to the ARCOS Enhanced Lookup Buyer Statistic Tool, due to competing priorities within DEA. Specifically, DEA officials noted that it is focused on existing priorities related to meeting upcoming requirements mandated in the SUPPORT Act, including establishing a suspicious order centralized database, as discussed previously in this report. While we recognize that agencies need to determine and set priorities, it is important for DEA to continue to work with industry in ensuring that the tool it created to address the SUPPORT Act requirement will help industry in addressing its suspicious order reporting requirement under the CSA, as amended. The SUPPORT Act requires DEA to provide distributors with access to ARCOS data to help the distributors identify, report, and stop suspicious orders of opioids and reduce diversion rates. By identifying solutions – in consultation with industry stakeholders – to address the limitations of the ARCOS Enhanced Lookup Buyer Statistic Tool, DEA could better ensure registrants have more useful information at their disposal when evaluating whether an order is suspicious. DEA officials and DEA field division offices we interviewed identified a number of limitations with suspicious order reports they received, and, due to these limitations, they rarely use suspicious order reports to generate potential investigative leads. The issues DEA identified included: Threshold-based algorithm triggers. Several DEA headquarters and field division officials told us that some distributors used fixed thresholds to identify suspicious orders, which DEA officials stated are not helpful or useful because the information is often not actionable. Lack of documented rationale. During the course of our review, DEA officials told us that many suspicious order reports do not include the rationale for why the registrant decided the order was suspicious, making it difficult to determine which suspicious order reports might contain actionable intelligence. In September 2019, the DOJ Office of the Inspector General reported that the current regulatory language governing industry suspicious order reporting does not require manufacturers and distributors to state why they believe an order is suspicious. In October 2019, DEA launched a new centralized database of suspicious order reports, as required by the SUPPORT Act. DEA’s new reporting format of suspicious order reports includes a required field for “Reason,” for registrants to provide an explanation of why the order is suspicious. However, currently reporting to the new centralized database is voluntary. Differing methodologies. As discussed earlier in this report, the definition of a “suspicious order” may include, but is not limited to, an order of a controlled substance of unusual size, an order of a controlled substance deviating substantially from a normal pattern, and orders of controlled substances of unusual frequency. However, it is up to the individual distributor companies to decide the more specific metrics, according to DEA Diversion Control Division officials. Each distributor must design and operate a system to identify suspicious orders. Therefore, distributors utilize different methods to flag customer orders as suspicious. According to our analysis of DEA data, it has collected at least 1.5 million suspicious order reports since 2014, and these reports may contain data on attempted purchases that were denied, based on indicators of suspicious patterns. These data could help with DEA’s efforts to prevent, detect, and investigate diversion. Officials from six DEA field division offices we interviewed said they refer to suspicious order reports when conducting their routine regulatory investigations of registrants. DEA field division officials also stated that, while suspicious order reports are generally not used as the primary or sole impetus to initiate an investigation, officials will infrequently refer to related suspicious order reports when there is an ongoing criminal investigation that is initiated through other means. However, of the DEA field division offices we interviewed, officials from two offices told us that they had used a suspicious order report as the sole or primary impetus for initiating a criminal investigation in the past year – one stating that it happened once, and another estimating that it happened one to three times. Another field division told us that they had two convictions “in recent memory” that began with a suspicious order report. Three offices told us that they had not used suspicious order reports as the sole or primary impetus for a criminal investigation in the past year, and one told us they did not know if a suspicious order report had been used in that way. DEA field division offices we interviewed also identified reasons why suspicious order reports may not be as useful as they could be in helping to identify investigative leads. For example, one DEA field division office characterized the suspicious order reports they received from one particular registrant as being “spot on” and always warranting a DEA follow-up investigation, given the amount of detail and evidence of the registrant conducting its own on-site investigation into the customer. However, the same DEA office reported that other suspicious order reports were based on industry-developed thresholds that were not useful because the resultant reports did not indicate why the order was suspicious. Of the five DEA field division offices that we asked to characterize the quality of suspicious order reports, three of them reported that suspicious order reports were either “moderately” or “somewhat” useful. Officials from one field division office said that suspicious order reports are “very useful,” while officials from another DEA field division office reported that suspicious order reports are “not at all useful.” We have previously reported on these issues, including DEA communication with registrants, and in June 2015, we found that additional guidance from and additional communication with DEA was needed about registrants’ roles and responsibilities under the CSA, as amended. We recommended that DEA develop additional guidance for distributors for suspicious order monitoring and reporting. DEA did not expressly agree or disagree with our recommendation, but raised concerns about the recommendation, stating that “short of providing arbitrary thresholds to distributors, it cannot provide more specific suspicious orders guidance because the variables that indicate a suspicious order differ among distributors and their customers.” In responding to this recommendation, DEA officials told us that the agency had refocused its efforts on revising draft regulations in line with the SUPPORT Act, and that the revised draft was undergoing internal DEA and DOJ review. The agency noted that it expected the rule to codify existing legal obligations related to due diligence and suspicious order reporting and provide additional guidance regarding the nature and timing of the suspicious order reporting requirement, but also indicated that it was not possible to be certain of the precise nature of the draft rule. The 2015 recommendation remains relevant and important, and while DEA has reported taking some actions to address it, as noted above, DEA has not taken all the necessary steps to address the recommendation. We will continue to monitor DEA’s progress in addressing our recommendation. Given the extensive and complex network of stakeholders DEA works with to manage opioid diversion risks and the agency’s use of a large amount of industry-reported data, DEA could do more to use proactive, automated computer algorithms to analyze its data sources in detecting questionable patterns in industry-reported drug transaction data. It is missing opportunities to more effectively identify questionable ordering patterns and possible diversion activities than through its current analysis methods. Using more automated analyses, similar to other federal entities that use computer algorithms as part of their analysis of available data to help flag instances of diversion, DEA could enhance its ongoing efforts to prevent, detect, and investigate diversion more quickly and assist it in reporting on how it is using ARCOS data to identify suspicious activities. Furthermore, because DEA does not have a documented data governance structure in place to manage its data, it risks challenges related to quality, availability, and integrity of the data it uses to support opioid diversion. Although DEA has started to explore developing a data governance structure, it is important for DEA to document and define its process about what the structure would entail. This would help the agency determine the effectiveness of its structure, an important consideration given the large amounts of varied data DEA receives from industry stakeholders. Also, while DEA does have some performance goals related to opioid diversion, it lacks outcome-oriented goals and measurable performance targets to assess the extent to which the industry-reported data it obtains and uses support the agency’s diversion control activities. Defining these targets could help DEA adequately assess whether its respective investments and efforts are helping it to limit the availability of and better respond to the opioid prescription diversion threat. DEA’s efforts to provide registrants with additional information to facilitate the identification of suspicious orders is promising, but has limitations. Due to these limitations, registrants, such as distributors, might not have complete information when they are identifying suspicious orders. By identifying solutions – in consultation with industry stakeholders – to address the limitations of the ARCOS Enhanced Lookup Buyer Statistic Tool, such as the need for additional login credentials or the ability to bulk download data, DEA could better ensure registrants have more useful information at their disposal when evaluating whether an order is suspicious. Finally, we continue to monitor implementation of our 2015 recommendation that DEA provide additional guidance to distributors related to suspicious orders, and we believe that it remains relevant and important. We are making the following four recommendations: The DEA Administrator should develop and implement additional ways to use algorithms in analyzing ARCOS and other data to more proactively identify problematic drug transaction patterns. (Recommendation 1) The DEA Administrator, in coordination with the department-wide efforts on data strategy, should establish and document a data governance structure to ensure DEA is maximizing its management of industry-reported drug transaction data. (Recommendation 2) The DEA Administrator should establish outcome-oriented goals and associated measurable performance targets related to opioid diversion activities, using data it collects, to assess how the data it obtains and uses supports its diversion control activities. (Recommendation 3) The DEA Administrator, in consultation with industry stakeholders, should identify solutions to address the limitations of the ARCOS Enhanced Lookup Buyer Statistic Tool, to ensure registrants have the most useful information possible to assist them in identifying and reporting suspicious orders to DEA. (Recommendation 4) We provided a draft of this report to DOJ, including DEA, for review and comment. In its comments, reproduced in appendix III, DEA agreed with three of the four recommendations, and neither agreed or disagreed with the fourth. DEA also provided technical comments, which we incorporated as appropriate. In response to our first recommendation that DEA should develop and implement additional ways to use algorithms in analyzing ARCOS and other data to more proactively identify problematic drug transaction patterns, DEA concurred and stated it will continue to examine a variety of technologies to analyze ARCOS and other data and implement additional ways to use algorithms to more proactively identify problematic drug transaction patterns. If these and other actions to expand the agency’s analytic capabilities are effectively implemented, DEA would address the intent of our recommendation. DEA also concurred with our second recommendation that DEA, in coordination with the department-wide efforts on data strategy, should establish and document a data governance structure to ensure DEA is maximizing its management of industry-reported drug transaction data. In its response, DEA stated it is currently implementing this recommendation and will continue to mature its data governance structure. The intent of this recommendation is for DEA to establish a formalized data governance structure to manage its collection and use of data used to support the Diversion Control Division’s mission. By establishing such a structure, DEA could better ensure its important data assets are formally managed and fully utilized, and could also help ensure consistent data management across the Diversion Control Division. DEA neither agreed nor disagreed with our third recommendation that DEA should establish outcome-oriented goals and associated measurable performance targets related to opioid diversion activities, using data it collects, to assess how the data it obtains and uses supports its diversion control activities. In its response, DEA stated it recognizes that measurable performance targets related to opioid diversion activities can serve as leading practices at different organizational levels including the program, project, or activity level. However, DEA stated it needs additional clarification on the specific actions needed to fulfill this recommendation. Our recommendation is intended to ensure that DEA can demonstrate the usefulness of the data it collects and uses to support its opioid diversion control activities. We will continue to work with DEA to address the specific actions needed to assess how the data it obtains and uses support its diversion control activities to fully address the intent of this recommendation. Based on our review of DEA’s existing performance goals and targets for its opioid diversion efforts, as well as our previous work on performance measurement, we believe that further development of related performance goals and targets is warranted and could potentially improve the usefulness of the data DEA collects and uses in support of its diversion control program. DEA also stated in its comments that the limited timeframe did not allow GAO to meet with DEA officials responsible for performance metrics for opioid diversion. However, in our interviews with DEA regarding its performance metrics for opioid diversion, we submitted our questions in advance of meeting with DEA officials to allow time for the questions to be reviewed by relevant officials. DEA stated in its comments that it will ensure that GAO meets with the appropriate officials to address metrics. As stated earlier, we will continue to work with DEA to address the specific actions needed to meet the intent our recommendation. DEA concurred with our fourth recommendation that DEA, in consultation with industry stakeholders, should identify solutions to address the limitations of the ARCOS Enhanced Lookup Buyer Statistic Tool, to ensure registrants have the most useful information possible to assist them in identifying and reporting suspicious orders to DEA. DEA stated it has consulted with industry stakeholders and has identified solutions to address the limitations of the tool. We believe such consultation will be beneficial for DEA to understand its industry stakeholders’ needs and that identifying solutions for addressing these needs would help ensure registrants have the information necessary to help identify and report suspicious opioid orders. We are sending copies of this report to the appropriate congressional committees, the Attorney General, the DEA Administrator and the Secretary of Health and Human Services, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-6691 or McneilT@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV. To understand the extent to which DEA obtains and uses industry- reported data, and the opportunities that exist to improve how that data are obtained and used, including the feasibility of real-time reporting, we reviewed applicable laws, regulations, court cases, and DEA internal documentation. We also conducted interviews with DEA headquarters offices, including the Diversion Control Division and DEA field division offices. To determine DEA registrant legal reporting requirements related to prescription drug orders and the meaning of suspicious orders, we reviewed applicable laws and regulations, including the CSA and its subsequent amendments and related DEA regulations and guidance. In addition, we reviewed the recently enacted SUPPORT Act. To identify policies and guidelines DEA uses to obtain and review registrant-reported data, we reviewed DEA procedures for conducting drug-related investigations, information system manuals for data and information systems used by DEA, and DEA written communications to registrants and DEA forms registrants use to report prescription drug transactions to DEA. As part of our work examining the information systems used to obtain and analyze data reported by registrants, we interviewed officials who oversee the management of DEA information systems, such as Automation of Reports and Consolidated Orders System (ARCOS), Controlled Substances Ordering System (CSOS), Registrant Information Consolidated System, and the Suspicious Orders Reporting System (SORS) systems used to obtain and store suspicious order reports at DEA headquarters. We interviewed DEA officials in headquarters and field division offices to determine how information that industry members report to DEA is obtained and used to detect and identify potential diversion activities. The perspectives we gathered from field division offices cannot be generalizable to the entire population of field division offices, but did provide us with insights into the agency’s diversion efforts and use of industry-reported data. To identify what opportunities exist, if any, for DEA to improve these efforts, such as using computer algorithms or real-time reporting, we also interviewed DEA officials responsible for developing analytical products based on industry-reported data. In addition, we interviewed DEA officials at eight field division offices to learn about how diversion investigators use industry-reported data and what, if any, improvements might be needed. To identify which of the 23 DEA field division offices to interview, we prioritized our selection based on four primary criteria: 1) the controlled prescription drug availability rate in their geographic area, according to a 2017 DEA threat assessment report, indicating whether the field division office had a “high” or “moderate” rate of availability; 2) whether the office was within the location of a DOJ Opioid Fraud and Detection Unit task force location; 3) whether the office was located within top ten state with high controlled prescription drug prescribing rate, as identified by the CDC; and 4) whether the office was located within a state that the CDC identified as having a high ER visit rate for opioid overdoses. We also ensured that the DEA field division offices we interviewed represented different geographic areas within the United States. We also conducted interviews with four pharmaceutical distributors and one trade organization whose membership includes wholesale distributors. We interviewed three organizations representing pharmacies, pharmacists, and drug diversion professionals to gather their perspectives and experiences with efforts to detect and report suspicious opioid orders. We based our initial interview selection of distributors based on DEA- provided ARCOS data of opioid-related transactions, which indicated the three largest distributors for opioids. To identify smaller distributors to gather their perspectives, we contacted an industry association representing distributors to facilitate our efforts to arrange for an interview, resulting in an interview with one additional distributor. In addition, we interviewed officials from a state prescription drug monitoring program (PDMP) that collects real-time data, a Bureau of Justice Assistance grant program that supports PDMPs, and a company that operates 44 of the 53 state PDMPs to gain insights on the data they collect. The views of these organizations cannot be generalized to the entire population, but provided important insights and perspectives about suspicious order detection and reporting. We reviewed the data DEA collects to identify possible types of analyses DEA could conduct using ARCOS data to identify unusual patterns. In addition, we reviewed key data governance practices used by organizations and identified through our past work to determine the extent to which DEA has a governance structure in place to manage how it collects and uses data to support diversion control efforts. Additionally, we reviewed the June 2019 Office of Management and Budget Federal Data Strategy which provides a framework of operational principles and practices to help agencies use and manage data. The key practices we identified to compare DEA’s data governance efforts against were: identify data needs to answer key agency questions; provide resources explicitly to leverage assets; prioritize data governance; and support non-federal stakeholders. We selected these practices because they are important to early development of a data governance structure. We also reviewed the February 2019 Data Strategy, released by DOJ, that is to serve as a roadmap for DOJ components to manage their data assets. To understand the extent to which DEA assesses the results of the data it obtains and uses from its ARCOS system and through suspicious order reporting, we reviewed DEA’s performance measures and applicable laws governing performance reporting in the federal government, including the Government Performance and Results Act of 1993 (GPRA), as updated and expanded by the GPRA Modernization Act of 2010 (GPRAMA). Although GPRA and GPRAMA requirements apply to those goals reported by departments (e.g., DOJ), we have previously reported that they can serve as leading practices at other organizational levels, such as component agencies for performance management. We also reviewed related national, DOJ, and DEA strategy documents that are used to communicate diversion control goals and performance. These documents included the 2018 National Drug Threat Assessment and 2019 National Drug Control Strategy, DOJ’s department-wide strategic plan, DOJ Annual Performance Report, DEA’s 360 strategy guide, and DEA congressional budget justification documents. In addition, we evaluated DEA’s performance measures against criteria in Standards for Internal Control in the Federal Government. Furthermore, we reviewed the extent to which DEA defined objectives and outcome-oriented goals, or established measurable performance targets to evaluate the effectiveness of how it obtains and uses data and compared them to GPRAMA requirements, which may serve as leading practices for DEA. To determine what opportunities exist, if any, for DEA to improve its use and collection of industry-reported data, such as using computer algorithms or real-time reporting, we interviewed DEA officials to determine what analytics, if any, DEA is using to detect and identify potential opioid diversion activities. In our interviews with field division offices, we requested information regarding how investigators received suspicious order reports from registrants and how the investigators requested and used ARCOS and other system analysis to conduct or support their investigative work. We also interviewed officials from other entities with opioid diversion prevention responsibilities, such as state level Prescription Drug Monitoring Programs, the Department of Health and Human Services, including the Centers for Medicare and Medicaid Services, and the Department of Justice (DOJ) U.S. Attorney’s Office Opioid Fraud and Abuse Detection Unit. To obtain perspectives of industry stakeholders on how data, such as suspicious orders may be better reported to DEA, we interviewed four industry associations whose memberships include industry stakeholders. We selected these associations based on their roles in representing various DEA registrant communities, such as pharmacists, pharmacies, and distributors. We also reviewed documentation describing the data available to DEA via its ARCOS database, as well as documentation that described examples of unusual patterns of orders. Based on such information, two GAO specialists identified methods that could be implemented using computer algorithms to analyze ARCOS data to identify patterns that might indicate unusual activity. Additionally, these specialists identified related opportunities that DEA could use to analyze ARCOS data combined with data from other sources, such as prescription rate information, to identify these patterns. To address the extent to which DEA collaborates with industry stakeholders to combat opioid diversion, we examined DEA policies and procedures, and interviewed relevant DEA officials, industry associations, and private sector industry members. Specifically, we examined DEA agency-wide directives and guidance, and component management policies and procedures for providing information to industry stakeholders related to industry’s suspicious order reporting requirements, including written communication DEA sent to industry stakeholders related to suspicious order reporting. In addition, DEA officials provided us with a demonstration of SORS, ARCOS, and the ARCOS Enhanced Lookup Buyer Statistic Tool – available to distributors to help them identify and report suspicious opioid orders. We interviewed DEA officials in eight field division offices who interact with industry stakeholders on, among other things, identifying and reporting suspicious orders. These officials provided their perspectives on the usefulness of suspicious order reports to their investigations as well as other industry self-reported data collected in DEA information systems. We interviewed opioid distributors of varying sizes, as noted above, including some of the largest opioid distributors, based on DEA-provided ARCOS data of opioid-related transactions, for their perspectives on the information and tools DEA provides to them, including the Lookup Buyer Statistics Tool and the ARCOS Enhanced Lookup Buyer Statistic Tool. The views of these distributors are not generalizable to the entire population, but provide insights and information on how industry detects and reports suspicious orders through use of ARCOS data and other tools. We conducted this performance audit from January 2019 through January 2020 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Appendix II: Timeline of Selected Events and Legislation Impacting or Related to Industry- Reported Data on Prescription Opioids Pub. L. No. 91-513, 84 Stat. 1242 (Title II of the Comprehensive Drug Abuse Prevention and Control Act of 1970, Pub. L. No. 91-513, 84 Stat. 1236). In addition to the contact above, Tonnye’ Conner-White (Assistant Director), Gary M. Malavenda (Analyst in Charge), David Bruno, Jill Center, Billy Commons, Peter DelToro, Kathleen Drennan, Melissa Hargy, Will Horowitz, Hayden Huang, Eric Hauswirth, Susan Hsu, Nicole Jarvis, Benjamin T. Licht, Amanda Miller, and Jan Montgomery all made key contributions to this report.

Summary: Since 1999, more than 700,000 people have died of a drug overdose in the United States, with about 48,000 dying of an opioid overdose in 2017 alone. The DEA administers and enforces the Controlled Substances Act as it pertains to ensuring the availability of controlled substances, including certain prescription drugs, for legitimate use while limiting their availability for abuse and diversion. The Substance Use-Disorder Prevention that Promotes Opioid Recovery and Treatment for Patients and Communities Act, enacted in 2018 included a provision for GAO to study the reporting of suspicious opioid orders on a real-time basis nationally using computer algorithms. This report examines, among other things, how DEA obtains and uses industry-reported data to identify and address suspicious opioid orders and opportunities for DEA to improve these efforts, such as using computer algorithms or real-time reporting. GAO analyzed program documentation and DEA data, and interviewed DEA and industry officials as well as officials from national associations representing distributors, investigators, state boards of pharmacy, and other federal and state agencies. The Drug Enforcement Administration (DEA) collects industry-reported data on the sale and purchase of controlled substances and prescription drugs, including opioids. It uses these data to support ongoing investigations into the diversion of such substances into the illegal market place and to identify investigative leads for its field division offices. GAO identified deficiencies associated with DEA's drug diversion efforts, including the following: Limited proactive and robust analysis of industry-reported data. While DEA's current data systems are not designed to conduct real-time analysis, and it conducts some analyses of industry-reported data, such as in response to requests from its field division offices, DEA could conduct more analyses using automated computer algorithms to help identify questionable patterns in the data. For example, DEA could analyze data to identify unusual volumes of deleted transactions or unusual volumes of drugs that were disposed of rather than sold. It could also analyze data to identify trends in distribution or drug purchases in a given geographic area. Other analysis DEA could perform is to look for unusual patterns when comparing drug orders in one geographic area with other nearby areas. These analyses could potentially help DEA proactively identify suspicious activities or registrants that may warrant investigation. No data governance structure to manage all drug transaction data. Although DEA has guidance, policies and procedures for the use of some information systems, it has not established a formal data governance structure to manage all data it collects and maintains, which are integral to its diversion control activities. A data governance structure is defined as an institutionalized set of policies and procedures for providing data governance throughout the life cycle of developing and implementing data standards. Industry and technology councils, domestic and international standards-setting organizations, and federal entities endorse the use of a governance structure to oversee the development, management, and implementation of data standards, digital content, and other data assets. While DEA began efforts to develop a governance structure, it is in the early stages of development and does not have additional details or documentation of its efforts. An effective data governance structure could help DEA ensure its important data assets are consistently and fully utilized. GAO is making four recommendations related to DEA's collection and use of industry-reported data. DEA agreed with three of the four recommendations, and neither agreed nor disagreed with the fourth.