Auditing for Diversion in Healthcare Facilities

I recently received a call from an auditor at a health system who was looking for help with a system-wide drug diversion audit. The auditor was not a clinician and had previously focused on contracts. She had limited time budgeted for the review and was understandably overwhelmed by the complexity of the topic. She had already spent considerable time researching the issue, and was still uncertain about what steps to take next. The essence or her question was: with limited time and resources for a one-time audit, what should she focus on?

My role as a diversion consultant often requires that I discuss in detail the components of a robust diversion prevention, detection and response program, and I am not often asked how to undertake such a limited audit.

Although most healthcare facilities have some type of ongoing auditing process in place, usually involving monthly statistical comparison reports, an audit by an internal auditor can provide a valuable objective analysis of diversion risk.

Unfortunately I don’t have a straightforward answer, since where to concentrate auditing efforts will really depend on the institution and how developed its diversion program is. I can, however, identify some key areas to focus on based on the current legal and regulatory climate.


As straightforward as it may seem, some facilities don’t have a complete separation of duties when ordering, receiving and stocking controlled substances. Some of the recent highly publicized diversion schemes involving the theft of large quantities of opioids have occurred at least in part due to vulnerabilities in the procurement process.


Institutions are accountable for every microgram of every controlled substance they acquire. When diversion issues catch the attention of regulatory authorities, they will almost certainly ask for verification that an institution isn’t missing controlled medications. The expected quantities must actually be present when a controlled substance count is done in the pharmacy and in other areas where the medications are stored. Performing end-of-shift counts is not sufficient diligence; every discrepancy must be thoroughly investigated.

Controlled Substances Used in Research:

While facilities often do a good job in accounting for controlled medications used in the inpatient and outpatient settings, those used in research may be stored and handled in a less secure fashion. One facility I work with was unaware that they used controlled substances in research until a significant quantity went missing.

Procedural Areas:

Procedural areas commonly have workflows that reduce the security of and accountability for controlled medications. They may not store and track controlled substances via automated cabinets, and administration of the medications may be documented via paper records. Ensuring that medications can be accounted for from removal to administration, waste or return, is essential in these areas.

In upcoming posts I will discuss each of these high-risk areas and processes in more detail.

Leave a Reply