DEA establishes quotas for the maximum amount of each basic class of schedule I and II controlled substances—such as amphetamine or morphine—that can be produced each year in the United States. DEA also establishes quotas for individual manufacturers, who must apply to DEA to obtain quotas for specific classes of controlled substances. The CSA and DEA’s implementing regulations specify dates by which DEA must propose and establish its quotas. The quotas that DEA establishes each year are required to provide for the estimated medical, research, and industrial needs of the United States. In setting quotas, DEA considers information from many sources including manufacturers’ production history and anticipated needs from manufacturers’ quota applications and past histories of quota granted for each substance from YERS/QMS, which is DEA’s system for tracking and recording quota applicants and decisions. Both DEA and FDA have important responsibilities in preventing and responding to shortages of drugs containing controlled substances subject to quotas. In addition to preventing diversion, DEA works to ensure that an adequate and uninterrupted supply of controlled substances is available for legitimate medical and other needs. As part of its mission, FDA works to prevent, alleviate, and resolve drug shortages. The Food and Drug Administration Safety and Innovation Act (FDASIA), enacted in 2012, contains provisions that require DEA and FDA to coordinate their respective efforts during shortages of drugs containing controlled substances subject to quotas. When FDA is notified of a supply disruption of certain drugs that contain controlled substances subject to quotas, FDASIA requires that FDA request that DEA increase quotas applicable to that controlled substance, if FDA determines that it is necessary. Similarly, when FDA has determined that a drug subject to quotas is in shortage in the United States, manufacturers may submit quota applications requesting that DEA authorize additional quota for that substance. FDASIA requires that DEA respond to these requests from manufacturers within 30 days. The CSA requires businesses, entities, or individuals that import, export, manufacture, distribute, dispense, conduct research with respect to, or administer controlled substances to register with the DEA. As of December 2014, there were over 1.5 million registered distributors, pharmacies, and practitioners; more than 1.4 million of these registrants were practitioners. DEA registrants must comply with a variety of requirements imposed by the CSA and its implementing regulations. For example, a registrant must keep accurate records and maintain inventories of controlled substances, among other requirements, in compliance with applicable federal and state laws. Additionally, all registrants must provide effective controls and procedures to guard against theft and diversion of controlled substances. Examples of some of the specific regulatory requirements for distributors, pharmacists, and practitioners include the following: Distributors: Registrants must design and operate a system to disclose suspicious orders of controlled substances, and must inform the DEA field division office in the registrant’s area of suspicious orders when the registrant discovers them. Pharmacists: While the responsibility for proper prescribing and dispensing of controlled substances rests with the prescribing practitioner, the pharmacist who fills the prescription holds a corresponding responsibility for ensuring that the prescription was issued in the usual course of professional treatment for a legitimate purpose. Practitioners: Practitioners are responsible for the proper prescribing and dispensing of controlled substances for legitimate medical uses. A prescription for a controlled substance must be issued for a legitimate medical purpose by an individual practitioner acting in the usual course of that person’s professional practice. It is important for registrants to adhere to their responsibilities under the CSA because they play a critical role in the prescription drug supply chain, which is the means through which prescription drugs are ultimately delivered to patients with legitimate medical needs. Although prescription drugs are intended for legitimate medical uses, as shown in figure 1, the prescription drug supply chain may present opportunities for the drugs to be abused and diverted. For example, an individual may visit multiple practitioners posing as a legitimate patient, referred to as a doctor shopper, to obtain prescriptions for drugs for themselves or others. In an example of diversion, criminal enterprises may rob distributors and pharmacies of prescription drugs to sell to others for a profit. Confidential informants provide information and take action at the direction of law enforcement agencies to further investigations. Agencies may rely on confidential informants in situations in which it could be difficult to use an undercover officer. To help ensure appropriate oversight of informants, The Attorney General’s Guidelines Regarding the Use of Confidential Informants (the Guidelines) set forth detailed procedures and review mechanisms to ensure that law enforcement agencies exercise their authorities appropriately and with adequate oversight. Adherence to the Guidelines is mandatory for DOJ law enforcement agencies, including DEA. The Guidelines require each DOJ law enforcement agency to develop agency-specific policies regarding the use of informants, and the DOJ Criminal Division is tasked with reviewing these agency-specific policies to ensure that the policies comply with the Guidelines. The Guidelines require that, prior to using a person as an informant, agencies vet informants to assess their suitability for the work and that agents conduct a continuing suitability review for the informant at least annually thereafter. Additionally, the Guidelines permit agencies to authorize informants to engage in activities that would otherwise constitute crimes under federal, state, or local law if someone without such authorization engaged in these same activities. For example, in the appropriate circumstance, an agency could authorize an informant to purchase illegal drugs from someone who is the target of a drug- trafficking investigation. Such conduct is termed “otherwise illegal activity.” The Guidelines include certain requirements for authorizing otherwise illegal activity and restrictions on the types of activities an agency can authorize. In our February 2015 report, we found that DEA had not effectively administered the quota process, nor had DEA and FDA established a sufficiently collaborative relationship to address shortages of drugs containing controlled substances subject to quotas. Since then, DEA has taken some actions to address the seven recommendations we made in our February 2015 report with respect to the agency’s administration of the quota process and efforts to address drug shortages, but DEA has only fully implemented two of the seven recommendations. As we reported in February 2015, DEA had not proposed or established quotas within the time frames required by its regulations for any year from 2001 through 2014. DEA officials attributed this lack of compliance to inadequate staffing and noted that the agency’s workload with respect to quotas had increased substantially. Manufacturers who reported quota- related shortages cited late quota decisions as causing or exacerbating shortages of their drugs. We could not confirm whether DEA’s lack of timeliness in establishing quotas had caused or exacerbated shortages because of concerns about the reliability of DEA’s data, among other things. However, by not promptly responding to manufacturers’ quota applications, we concluded that DEA may have hindered manufacturers’ ability to manufacture drugs that contain schedule II controlled substances that may help prevent or resolve a shortage. Additionally, our February 2015 report found that DEA had weak internal controls, which jeopardized the agency’s ability to effectively manage the quota process. Specifically: DEA did not have adequate controls to ensure the reliability of YERS/QMS, which it used to track manufacturers’ quota applications and record its quota decisions. DEA officials described some data checks of YERS/QMS, such as managers verifying that information entered into the system was accurate. However, the agency did not have systematic quality checks to ensure that the data were accurate or the checks it had in place were sufficient. This lack of systematic data checks was also concerning because we estimated that 44 percent of YERS/QMS records in 2011 and 10 percent in 2012 had errors. DEA officials said that 2011 was the first year manufacturers applied for quotas electronically and they expected data from 2012 and beyond to be more accurate. DEA lacked critical management information because it did not have performance measures related to setting quotas. In the absence of such performance measures, we concluded that DEA was missing important information for program managers to use when making decisions about program resources, and the agency could not effectively demonstrate program results. DEA did not monitor or analyze YERS/QMS data to assess the performance of the quota process. Absent such analysis, DEA was unable to evaluate its responses to manufacturers’ quota applications or to understand the nature of its workload. DEA did not have reasonable assurance that the quotas it set were in accordance with its requirements and could not ensure continuity of its operations, as it did not have protocols, policies, training materials, or other documentation to manage the quota process. Instead, the agency said it relied on its regulations and the CSA to serve as guidance on how to conduct these activities. However, the need for detailed policies, procedures, and practices is particularly important because the process of setting quotas is very complex, requiring staff to weigh data from at least five different sources that may have contradictory information. To address these deficiencies, our February 2015 report recommended that DEA take four actions to ensure it is best positioned to administer the quota process. Specifically, we recommended that DEA (1) strengthen its internal controls of YERS/QMS, (2) establish performance measures related to quotas, (3) monitor and analyze YERS/QMS data, and (4) develop internal policies for processing quota applications and setting quotas. In commenting on our report, DEA did not explicitly agree or disagree with these four recommendations. As of June 2016, DEA has taken some actions to address these recommendations. Specifically, in response to our first recommendation, the agency stated that it implemented a series of system-generated flags in YERS/QMS that verify the information manufacturers enter into their quota applications and identify entries made by DEA staff that warrant further review within the agency. Additionally, in October 2015, DEA said that it would compare a random sample of manufacturers’ applications and DEA’s responses in YERS/QMS on a quarterly basis starting in fiscal year 2016.