A pharmacy, wholesale distributor, or manufacturer holding a DEA registration to handle controlled substances carries an affirmative duty to catch its own suspicious orders before they ship. The duty is not new, but DEA's enforcement record shows the agency treats a weak suspicious order monitoring system as evidence of a knowing violation, not an oversight. For a compliance officer, the exposure includes registration suspension, civil penalties that can reach the tens of millions of dollars, and criminal referral in cases involving apparent diversion. Getting the system design right, and documenting it, is not optional.
The Suspicious Order Monitoring Duty
The core obligation sits in 21 CFR 1301.74(b), which requires every non-practitioner registrant, meaning distributors, manufacturers, and pharmacies that ship to other registrants, to design and operate a system that discloses suspicious orders to the registrant itself, and to inform DEA's local Field Division Office when one is discovered. The SUPPORT Act wrote the same duty into 21 USC 832 in 2018 and added a mechanism for satisfying the notification requirement: reporting through DEA's centralized Suspicious Orders Report System, known as SORS Online. A registrant that reports a qualifying order into SORS Online has met the statutory notification duty under 21 USC 832(a)(3).
Both provisions define a suspicious order the same way: an order of unusual size, an order that deviates substantially from the customer's normal ordering pattern, or an order placed with unusual frequency. Neither the regulation nor the statute sets a numeric threshold. DEA has said a monitoring system is a combination of people, process, and technology, and that individual registrants, not the agency, decide where to set the thresholds that trigger review.
Designing a Defensible SOM System
DEA's guidance leaves the mechanics to the registrant, which means the compliance officer's design choices become the record the government reviews after the fact. A defensible system holds an order rather than shipping it until a flag is resolved. It sets thresholds against the registrant's own order history rather than an industry-wide benchmark, recalibrates those thresholds as the customer base changes, and produces a written investigation file for every flagged order, including the disposition and the reasoning behind it. Ordering-pattern analytics, software that compares each incoming order against a rolling baseline for that customer, has become the practical standard for registrants handling volume a manual review cannot cover. The analytics output is only as defensible as the documented human review behind it.
Where Enforcement Actions Find SOM Gaps
The government's largest suspicious order monitoring cases share a fact pattern: the registrant had a system on paper, but its thresholds were set so high that ordinary orders never triggered review, or flagged orders shipped before anyone investigated them. In January 2017, McKesson Corporation paid a then-record $150 million civil penalty to resolve DOJ and DEA allegations that it failed to design and operate an effective system to detect and report suspicious orders from independent and small chain pharmacy customers, including thresholds calibrated so high that certain pharmacy customers could never trigger a review. The settlement also required McKesson to suspend controlled-substance sales from distribution centers in four states and to operate under an independent compliance monitor for five years.
A suspicious order monitoring system only works if it holds the order and resolves the flag before the shipment goes out.
A finding that a registrant's SOM system failed often becomes the evidentiary record DEA uses for what follows: a DEA inspection, an order to show cause seeking to revoke the registration, or, in cases DEA considers urgent, an immediate suspension order that takes effect at once. The pattern DOJ and DEA look for in every SOM enforcement matter is consistent: shipping first and investigating later, thresholds that exist on paper but never fire, and a missing or thin investigation file behind each flagged order.
Why Early Legal Counsel Is Critical
It is critical that healthcare providers and DEA registrants promptly retain experienced healthcare defense counsel upon receiving a subpoena, audit notice, investigative request, or other government inquiry touching suspicious order monitoring. Early legal intervention can protect the registrant's rights, ensure appropriate responses to government requests, avoid inadvertent admissions, preserve relevant defenses, and allow counsel to communicate with investigators on the registrant's behalf. Delaying legal representation can significantly affect the outcome of a matter and expose the registrant to unnecessary risk.
How Health Law Alliance Can Help
Health Law Alliance represents pharmacies, distributors, and manufacturers in DEA suspicious order monitoring reviews, registration actions, and related federal inquiries. We work with compliance officers to assess whether an existing SOM system will hold up under DEA scrutiny, and we defend registrants once an inquiry has already begun. If your pharmacy or distribution operation is facing a DEA suspicious order inquiry, a registration action, or a related audit, contact us today for a free consultation.
