Section 4: Audit Review and Investigation Protocols

13.4.1 The “Why”: The Critical Transition from Algorithm to Human Accountability

In the previous section, we explored the powerful algorithms that serve as our automated watchdogs, tirelessly scanning millions of transactions for statistical anomalies. The exception report they generate is the starting point, the electronic “tap on the shoulder” that prompts us to look closer. But this is where the role of technology ends and the profound responsibility of the human investigator begins. An algorithm, no matter how sophisticated, cannot understand clinical context, intent, or the immense complexity of patient care. It can identify a deviation from the norm, but it cannot explain it. That is your job.

This section is dedicated to the most critical and sensitive phase of the entire diversion monitoring process: the formal audit and investigation. This is the methodical, step-by-step process of taking a single automated alert and transforming it into a comprehensive, objective, and defensible case file. The stakes at this stage are immense. The career, reputation, and well-being of a colleague are under review. The safety of countless patients is in the balance. The legal and regulatory standing of your institution is on the line. Consequently, this process cannot be informal, haphazard, or subjective. It must be governed by a rigid, standardized protocol that ensures fairness, objectivity, and meticulous documentation.

The “Why” of a formal investigation protocol is threefold. First, it ensures consistency and fairness for every employee under review. Every investigation must follow the same steps, use the same tools, and be held to the same evidentiary standards. Second, it guarantees thoroughness and objectivity. A protocol forces you to look at all the evidence—both incriminating and exculpatory—and to build a case based on a complete narrative, not just a few suspicious data points. Third, and most importantly, it creates a defensible and auditable record. When (not if) your investigation is scrutinized by regulatory bodies like the DEA or the Board of Pharmacy, or by internal legal counsel, you must be able to present a case file that demonstrates a professional, unbiased, and exhaustive process. As the analyst, you are the chief architect of this file. Your ability to translate raw data into a clear, coherent, and impartial narrative is the cornerstone of a successful and ethical diversion prevention program.

13.4.2 Phase 1: Case Initiation and Defining the Audit Scope

An investigation begins the moment you, the analyst, determine through your preliminary review (as outlined in Section 13.3.4) that an automated alert cannot be explained by obvious clinical context. The statistical anomaly is now a formal “case,” and it must be treated with a new level of rigor. The first phase is about laying the groundwork for a structured and efficient investigation by formally initiating the case and clearly defining its boundaries.

Creating the Case File: Your Central Repository of Truth

Every investigation must have a dedicated, secure, and standardized case file. This is not an informal collection of notes; it is a formal document that will serve as the single source of truth for the entire investigation. It should be stored in a secure, access-restricted digital location (e.g., an encrypted network drive accessible only to the diversion committee members).

Defining the Audit Scope: Laser Focus vs. “Boiling the Ocean”

Once the case file is created, your next step is to define a precise audit scope. This is a critical step to prevent “scope creep” and ensure your investigation remains focused and manageable. You cannot audit every single transaction a user has ever made. Instead, you start with a narrow, targeted review based on the specific alert that was triggered.

Masterclass Table: From Alert to Audit Scope

Triggering Alert	Initial Audit Scope	Rationale
User is in the 99th percentile for hydromorphone waste over the past 30 days.	Review all hydromorphone waste transactions for this user over the past 30 days.	The scope directly targets the specific behavior (waste), medication (hydromorphone), and timeframe (30 days) of the alert. It is focused and directly verifiable.
User has a high number of ADC overrides, particularly at the end of their shifts.	Review all override transactions for all controlled substances performed by this user in the last two hours of their shifts over the past 60 days.	The scope is narrowed by transaction type (override) and by the specific time pattern identified in the alert, making the review highly targeted to the suspicious behavior.
A “Waste Buddy” report identifies that Nurse A and Nurse B witness for each other an anomalous number of times.	Review all waste transactions for both Nurse A and Nurse B where they served as the witness for each other over the past 90 days.	The scope includes both individuals and is focused only on the transactions where their activity was linked, allowing for direct analysis of their suspicious partnership.
A patient has complained of poor pain control while under the care of a specific nurse.	Review all controlled substance withdrawals, administrations, and waste transactions performed by that nurse for that specific patient during their entire period of care.	The scope is patient-centric, allowing you to reconstruct the complete medication history for the patient in question to see if the documentation aligns with the complaint.

The key principle is to start with a scope that is directly tied to the initial alert. You can always expand the scope later if your initial findings warrant it. For example, if your audit of hydromorphone waste reveals significant discrepancies, you might then expand the scope to include morphine and fentanyl waste transactions for the same user over a longer period.

13.4.3 Phase 2: The Forensic Chart Audit – Reconstructing the Narrative

This is the investigative core of your work. In this phase, you will move beyond high-level statistics and perform a deep, forensic review of individual transactions. Your goal is to take a single line item from an ADC log and reconstruct its entire story using the EHR as your guide. You are looking for a complete, logical, and clinically plausible narrative. When that narrative breaks down, you have found a potential indicator of diversion.

The Anatomy of a Single Transaction Audit

For each transaction within your defined audit scope, you must systematically gather data from multiple sources to answer a series of critical questions. You will document your findings for each transaction in your case file’s “Detailed Transactional Audit Log.”

The Audit Checklist: Your Question-Based Protocol

For every single transaction you audit, you must ask and answer the following questions. Your audit log should have columns corresponding to these questions.

Masterclass Table: The Transactional Audit Protocol

Audit Question	What You’re Looking For (The “Reconciled” State)	What You’re Looking For (The “Discrepancy” / Red Flag)
1. Was there a valid, active order?	An active, verified order exists in the EHR for the correct patient, drug, and route at the time of the ADC withdrawal.	No order exists. The order was discontinued prior to the withdrawal. The withdrawal was performed under a different patient’s name. The withdrawal was an override.
2. Was the dose administered and documented correctly?	A corresponding administration is documented on the MAR by the same user, for the same patient/drug, within the facility’s approved “matching window.”	No administration is documented at all (an “unlinked transaction”). The administration is documented hours later. The dose on the MAR is different from the ordered dose.
3. Does the waste math add up?	The documented waste amount perfectly matches the following formula: `Amount Withdrawn – Amount Administered = Amount Wasted`	The documented waste is LESS than the calculated expected waste (e.g., Withdrew 4mg, Gave 2mg, Wasted 1mg. Where did the other 1mg go?). Or, the documented waste is MORE than the expected waste (a sign of confusing documentation or an attempt to cover other diversion).
4. Was the waste witnessed and documented appropriately?	A waste witness is documented in the EHR/ADC log. The witness is a different person from the primary user.	No witness is documented. The primary user witnessed their own waste. The same “waste buddy” is used for every transaction.
5. Is the clinical narrative plausible?	Nursing notes and pain scores correspond with the documented PRN medication administration. (e.g., “Patient reports 8/10 pain. Medicated with morphine 2mg IV. Reassessed in 30 mins, patient reports 3/10 pain and is resting.”)	Patient is documented as “sleeping comfortably” yet receives a PRN opioid. No pain score is documented. The patient is non-verbal and sedated, yet receives multiple PRN doses that were not clearly indicated.

13.4.4 Phase 3: Synthesizing Findings and Building the Case File

After methodically auditing the transactions in your scope, the next phase is to synthesize your findings. This involves stepping back from the line-by-line details to identify overarching patterns and to summarize your results in a clear, objective, and data-driven manner. This is where you transform your raw audit log into the formal evidence that will be presented to the diversion committee. The cardinal rule of this phase is to report the facts, and only the facts. Your opinions, feelings, and speculations have no place in the formal case file.

Writing the Summary of Findings: A Guide to Objective Language

The Summary of Findings is the most important section of your report. It must be written with absolute precision and objectivity. It should be a concise summary that allows a committee member to understand the scope and outcome of your investigation in just a few minutes.

Using Data Visualization to Tell the Story

A well-designed chart or graph can often communicate a pattern more effectively than a dense paragraph of text. Your case file should include simple, clear data visualizations to support your findings. These can often be exported directly from your analytics software or created easily in a spreadsheet program.

• For Time-Series Analysis: Use a simple line chart showing the user’s metric (e.g., waste %) on the Y-axis and the date (by month or week) on the X-axis. This will visually demonstrate the trend over time.
• For Peer Comparison: A bar chart showing the user’s total (e.g., total overrides) compared to the peer group mean and the +2 SD and +3 SD thresholds. This provides immediate visual context for how much of an outlier they are.
• For Transaction Summaries: A simple pie chart showing the outcome of your audit. For example, a chart showing that of the 50 transactions reviewed, 5% were reconciled, 15% had minor documentation issues, and 80% were unreconciled discrepancies.

13.4.5 Phase 4: Escalation and Presentation to the Multidisciplinary Committee

This is the final step in your direct investigative role. Once your case file is complete and you have confirmed that significant, unexplained discrepancies exist, the matter must be escalated to the hospital’s formal diversion oversight committee. Your role now shifts from investigator to expert witness. You are there to present your objective findings to a multidisciplinary group of leaders who will collectively decide on the appropriate next steps, which may include a formal interview with the employee, involving Human Resources, and, if necessary, reporting to law enforcement and regulatory boards.

The Diversion Oversight Committee: A Multidisciplinary Approach

A successful diversion program relies on a collaborative committee approach. No single person should be making the final decision. The committee typically includes leaders with varied expertise:

• Pharmacy Leadership (e.g., Director of Pharmacy): Provides expertise on medication handling policies and regulations.
• Nursing Leadership (e.g., Chief Nursing Officer, Unit Director): Provides clinical context for nursing workflows and performance expectations.
• Human Resources (HR): Ensures that any subsequent actions follow established employee policies and legal guidelines.
• Risk Management / Patient Safety: Assesses the potential for patient harm and institutional liability.
• Security / Loss Prevention: May assist with physical surveillance and evidence handling.
• Legal Counsel: Provides guidance on regulatory reporting requirements and legal risk.