Audit of the Controlled Substances Program at Health Canada

Table of Contents

• List of acronyms
• Executive Summary
  • Background
• A - Findings, recommendations and management responses
  • Governance
  • Authorizations
  • Inspections
  • Loss/theft reporting and destruction of controlled substances
  • Sex- and gender-based analysis
• B - Conclusion
• Management response and action plan
• Appendix A - Scorecard
• Appendix B - About the audit
  • Audit objective
  • Audit scope
  • Activities not in scope
  • Audit approach
  • Statement of conformance

List of acronyms

AMP

Administrative Monetary Penalties

C&E

Compliance and Enforcement

CDSA

Controlled Drugs and Substances Act

CSCB

Controlled Substances and Cannabis Branch

CSD

Controlled Substances Directorate, Controlled Substances and Cannabis Branch

CSP

Controlled Substances Program

CSPS

Controlled Substances and Precursors System

HC

Health Canada

L/T

Loss/Theft Reports

LD

Licensed Dealer

OCS

Office of Controlled Substances in CSCB

OECD

Organisation for Economic Co-operation and Development

ROEB

Regulatory Operations and Enforcement Branch

SGBA+

Sex and Gender-Based Analysis Plus

SOP

Standard Operating Procedure

Executive Summary

What we examined

Health Canada (HC) regulates controlled substances through the Controlled Drugs and Substances Act (CDSA) and its regulations. The Controlled Substances Program (CSP) at HC is a shared responsibility between the Controlled Substances and Cannabis Branch (CSCB) and the Regulatory Operations and Enforcement Branch (ROEB).

This audit examined whether the activities of the CSP supported the legitimate use of controlled substances and precursor chemicals and managed the risk of diversion for Illegal purposes.

We specifically examined elements of the program that focused on authorizations, compliance and enforcement activities, namely:

• The governance structure of the Program along with operational monitoring and reporting;
• The process of authorizing the issuance of licenses to handle controlled substances;
• Compliance and enforcement activities including inspections of licensees and, pharmacies and supervised consumption sites;
• Loss/Theft reporting by stakeholders and subsequent analysis by the Program;
• Destruction and disposal of unserviceable controlled substances and precursor chemicals; and
• The use of Sex- and Gender-Based Analysis Plus (SGBA+).

The audit did not include reviewing the analysis of seized controlled substances by HC laboratories, the information technology systems supporting the CSP, the ongoing legislative and regulatory modernization initiative, the monitoring of drug use through surveys nor the activities related to funding provided through grants and contributions.

Why is it important?

Controlled substances are any substance that the federal government has categorized as having an increased risk of problematic substance use.

Ensuring that the CSP supports the legitimate use of controlled substances and manages the risk of diversion for illegal purposes helps to ensure that controlled substances and precursor chemicals are used for valid commercial, medical and scientific activities, while helping to limit illegal use of these substances. This ultimately contributes to the protection of Canadians from harms related to the use of these substances.

What we found

Overall, we found that Controlled Substances Program activities generally support the legitimate use of controlled substances and precursor chemicals. However, we found control weaknesses in managing the risk of diversion.

Specifically, we found controls were sufficient in:

• program governance structure with clear organization charts and logical reporting structures within each of the branches;
• monitoring of operational performance indicators related to the authorization of licences and permits, and inspections completed;
• properly authorizing access to controlled substances and precursor chemicals;
• operational procedures in place to support the inspection of licensed dealers and pharmacies; and
• the approval of destruction/disposal of controlled substances and precursor chemicals in accordance with procedures.

We found control weaknesses in the:

• roles and responsibilities between the two key branches and human resource planning;
• establishment of operational performance indicators to support sound decision-making and Program oversight;
• application of a risk-based approach to inspection planning;
• procedures to address licensed dealer and pharmacist non-compliance;
• timely recording of Loss/Theft reports and regular reporting on lost/stolen substances;
• procedures for monitoring requests for destruction of controlled substances; and
• integration of Sex and Gender Based Analysis (SGBA+) considerations into program activities.

The audit includes eight recommendations to enhance the management of the program.

Background

Controlled substances^Footnote 1 are any type of drug that the federal government has categorized as having an increased risk of problematic substance use, or that pose a risk to public health or safety. These range from illegal (street) drugs to prescription medication. These substances also include precursor chemicals that are essential to the production of controlled substances. Health Canada (HC) regulates these substances to restrict access to authorized persons, minimize their improper use and the potential harms to public health and safety.

The Controlled Drugs and Substances Act (CDSA) prohibits the sale, export, import, possession, or production of controlled substances and precursor chemicals unless authorized by regulations or exempted under the CDSA. Through this legislation, the government aims to reduce the risk that controlled substances and precursors will be used for illegal purposes.

HC is the regulator responsible for administering the CDSA and its regulations. The Department fulfills this responsibility through the Controlled Substances Program (CSP). The objectives of the CSP are to:

• authorize lawful activities with controlled substances or precursor chemicals for medical, scientific, and commercial purposes; and
• reduce the risk that controlled substances or precursors will be diverted for illegal purposes.

The Controlled Substances and Cannabis Branch (CSCB), and the Regulatory Operations and Enforcement Branch (ROEB) work collaboratively to deliver on the objectives of the CSP.

CSCB is responsible for reviewing and updating the regulatory framework of the CDSA as required; issuing authorizations to permit legitimate access to controlled substances and precursor chemicals; monitoring the domestic supply chain for controlled substances; and monitoring the use of drugs through surveys.

ROEB, in partnership with the Compliance and Monitoring Division of OCS, has the responsibility for promoting and monitoring compliance and enforcement of the CDSA and associated regulations among licensed dealers, pharmacists, practitioners and other parties including inspection and compliance verification activities. In addition, ROEB conducts analysis of seized materials (Drug Analysis Services); provides training and scientific knowledge on illegal drugs and precursor chemicals; works closely with provincial colleges of pharmacists in ensuring industry oversight; and works with national and international partners for the recommendation of appropriate and scientifically sound drug analysis procedures.

These activities contribute to the departmental priority of protecting against the diversion of controlled substances.

Appendix B provides details about the audit objective, criteria, scope, and approach.

Findings, recommendations and management responses

Governance

1. Responsibility for the delivery of program compliance and enforcement objectives are divided between the Controlled Substances and Cannabis Branch (CSCB) and the Regulatory Operations and Enforcement Branch (ROEB). Therefore, an appropriate governance framework is required to ensure effective and efficient realization of program objectives.
2. We expected to find a governance framework in place that includes an appropriate governance structure, plans, and operational performance monitoring to provide oversight of the program and support the achievement of program objectives.

Structure and Plans

3. The most significant aspect of recent organizational changes centred on the consolidation of programs related to some regulated substances (opioids, cannabis, and tobacco) under CSCB. In addition, in line with the Department's vision of being a world-class compliance and enforcement leader, most compliance and enforcement activities, including inspections, were consolidated under ROEB in 2016. Because of these organizational changes, some key activities of the program are shared between the two branches, including the development of policies, guidance documents, and performance measures. Large-scale organizational changes such as these often lead to a period of uncertainty and instability that can affect program governance.
4. We found that a number of key elements of governance were in place. These included a governance structure with clear organization charts and logical reporting structures; a Program Risk Profile and high-level performance measures. At the time of the audit, a draft Controlled Substances Program-Controlled Substances and Cannabis Branch (CSP-CSCB) strategic plan for 2019-2025 had been developed. However, as a result of restructuring within CSCB, finalization of the plan has been put on hold. In addition, management has indicated that there is ongoing work at all levels, including regular meetings between the Director OCS-CSCB, and the Director, Controlled Substance Program (ROEB) that have a specific focus on governance.
5. While roles and responsibilities were communicated between the two branches, recent changes have led to confusion at the working level. For example, there were differences in the expectations of each branch with respect to the review and approval of compliance and enforcement policy documents related to inspection of licensed dealers.
6. We found over twenty (20) governance bodies (working groups and committees) that contributed to the oversight of the Controlled Substances Program in some way. Many of these committees and working groups had many of the same individuals. Examples include the Controlled Substances Working Group, Working Group for the implementation of Bill C-37^Footnote 2, Exemptions Working Group, and Licensed Dealer Inspection Review Working Group. Therefore, a significant amount of time may be spent dealing with the administrative responsibilities of preparing for, leading, and reporting on these committees and working groups. An examination of the governance framework would help to ensure that it is operating effectively and efficiently.
7. We also found that CSCB had prepared a program risk profile that included analysis of risks in areas such as information management and technology, finance, human resources (HR), operational intelligence, communication, and reputation. However, there was limited evidence to demonstrate appropriate plans were in place to address the risks related to HR. After examining the draft CSP-CSCB Strategic Plan, risk profile and other governance-related documentation, the only HR-related planning undertaken appeared to relate to the staffing of vacant positions. There was little evidence to demonstrate planning in other areas such as recruitment, retention, learning and development, employee engagement, promotion, succession, and employment equity. As stated in the Treasury Board Secretariat Integrated Planning Handbook for Deputy Ministers and Senior Managers, "human resource planning is a process that identifies current and future human resource needs for an organization to achieve its goals. Human resource planning should serve as a link between human resource management and the overall strategic plan of an organization." Given that management has indicated that they have experienced difficulties in attracting, developing and retaining suitable staff, the lack of strategic HR planning exposes the Program to the risk of not having enough employees with a suitable skillset and experience to enable the successful delivery of its objectives.
8. Overall, a program governance structure was in place. However, given the shared responsibility for the delivery of the program, improvements are required to ensure program governance across the compliance and enforcement function is operating effectively and efficiently, and enhance human resource planning. In addition, management has indicated that work is underway to further clarify the governance across both Branches.

Recommendation 1

Management response

Recommendation 2

Management response

Operational Performance Monitoring and Reporting

9. Operational monitoring is the systematic process of collecting, analyzing and using information to track progress toward reaching objectives and to guide management decisions. It is integral to management oversight and helps to identify issues or areas for management attention.
10. The draft Controlled Substances Program (CSP) Strategic Plan 2019-2025 , states that one of the Office of Controlled Substances' core activities was "…minimizing the potential for diversion to illegal markets by ensuring access to controlled substances and precursor chemicals is limited to only those persons who are properly authorized." Therefore, we expected to find performance indicators and effective operational monitoring and reporting practices in place to support oversight of program performance.
11. The CSP developed a Performance Information Profile (PIP) that describes the program outcomes, outputs, and performance measures. The PIP included performance measures related to the authorization of legitimate activities with controlled substances and precursor chemicals, and managing the risks of their diversion; operational indicators such as number of pharmacy inspections completed, number of licensed dealer inspections completed, percentage of authorizations and exemptions processed within service standards (by type of authorization applications), and percentage of licensed dealers and pharmacies inspected deemed to be compliant with the Controlled Drugs and Substances Act (CDSA) and its regulations.
12. We found that the program historically monitored these operational indicators through the Assistant Deputy Minister, ROEB, and Deputy Minister Dashboards.
13. However, we did not find a performance indicator relating to minimizing the potential diversion of controlled substances. Management indicated that development of such a measure is difficult. For example, loss and theft of controlled substances from pharmacies is an example of how these substances can be diverted to the illegal market, but not all loss/theft of controlled substances are reported by pharmacies. Therefore, it does not provide an accurate picture of the actual amount diverted versus the total amount in the system at any given time. However, given the prominence of this objective, development of such a performance indicator would enhance management's ability to exercise oversight and determine whether the program objective is being met.
14. We also found that there was limited monitoring of operational performance over and above the measures stated in the PIP, and the above noted dashboards. Management did not have ready-access to current operational information with which to make timely, operational decisions with respect to risk assessment and resource allocation. While management indicated that some operational performance indicators were considered during the development of the PIP, we did not find indicators such as the number of inspections conducted by inspector and the percentage coverage of regulated parties. We noted that, at the time of the audit, there were approximately 10,000 pharmacies across Canada. During the 2017/18 fiscal year, 558 pharmacy inspections were conducted, which equated to approximately 5% coverage. Without an appropriate performance indicator, the program is at risk of not knowing the extent to which its activities are contributing to mitigating the risk of diversion.
15. In addition, we found that a labour-intensive process was used to collect and record data to support operational performance monitoring and reporting. This laborious process can lead to inaccuracies of information presented to senior management. For example, we found that each region of ROEB-CSP maintained its own spreadsheet to track the status of inspections. When preparing the quarterly DM dashboard, significant effort is required to collect and validate the data. As a result, there were minor differences between the number of licensed dealer inspections reported by the regions and the numbers appearing in the 2017/2018 quarterly dashboards for the DM.
16. Furthermore, the loss/theft reports received via fax or email must be manually entered into the Controlled Substance and Precursor System. This has contributed to a backlog, which hinders the Program's ability to analyze the loss/theft data and produce reports that inform management oversight.
17. In conclusion, operational performance indicators were monitored. However, improvements are required to ensure appropriate operational performance indicators and tools are in place to support sound decision-making and program oversight.

Recommendation 3

Management response

Authorizations

18. To legally possess controlled substances or precursor chemicals in Canada, organizations must first obtain authorization from Health Canada, which could be a Controlled Drugs and Substances Licence, a Class A Precursor Licence, Class B Precursor Registration, or an exemption. The licence or exemption authorizes the organization to possess specific controlled substances or precursor chemicals and to conduct activities specified by the licence (such as production, packaging, sale, or provision). Note that by virtue of inclusion within the regulations, pharmacists, practitioners and hospitals do not require such authorizations for routine activities.
19. The OCS within the Controlled Substances Directorate (CSD) in CSCB is responsible for issuing licenses, permits, registrations and exemptions. This authorization process is vital to managing the legitimate access to controlled substances and precursor chemicals.
20. We expected that authorizations were issued and managed in accordance with policies and procedures.
21. We examined a sample of 40 applications for licenses (including new and amendment applications) as well as 40 applications for permits (including imports and exports) and found that the licenses and permits were processed in accordance with established procedures.
22. Overall, access to controlled substances and precursor chemicals were properly authorized through the issuance of licenses, permits, exemptions, and registrations.

Inspections

23. Inspections are one of the most important ways to monitor and enforce regulatory compliance. ROEB conducts inspections to ensure regulated parties such as pharmacists, and licensed dealers are compliant with the Controlled Drugs and Substances Act andits regulations.
24. ROEB has two distinct inspection programs aimed at monitoring compliance with the CDSA and its regulations. The first focuses on licensed dealers (LD)^Footnote 3 and the second targets community pharmacies (Community Pharmacy Inspection Program^Footnote 4). With respect to LDs, HC has full authority to enforce compliance up to and including suspension or revocation of licences. However, since HC does not license pharmacies or pharmacists (as this is a provincial responsibility), actions to address non-compliance are generally limited to referral to the respective provincial colleges and HC does not routinely take further actions.
25. We expected that inspections were planned and carried out in accordance with the policies and procedures, and that appropriate follow-up action was taken to address non-compliance.

Risk-Based Inspection Planning

26. A risk-based approach to inspection planning enables the Department to use resources more efficiently by directing inspection activities to areas of greatest risk. Both CSCB and ROEB are involved in the planning of inspections. Under the Program, there are separate planning activities for Licensed Dealers and for Pharmacies.
27. In August 2012, OCS and ROEB developed a risk-based approach to the planning of inspections for Licensed Dealers. The Inspection Cycle: Risk Assessment Procedure for Controlled Substances and Precursors addresses the planning of inspections for licensed dealers (LD). It provided guidance on the implementation of a risk-based inspection scheme for controlled drugs and precursors along with establishing the frequency at which LDs were to be inspected (based on a calculated risk level). It states that, at a minimum, LDs should be inspected every four years.
28. We found that this risk-based approach to planning inspections of LDs had not yet been implemented. Management noted that data collection and analysis was done in an ad hoc manner and typically only used to inform authorization and compliance promotion activities. Management has indicated that some risk factors were considered before the inspection plan was finalized. In addition, management has indicated that a new risk-based approach will be implemented later this fiscal year.
29. We found that the program did not monitor the inspection frequency for all LDs. As previously noted, since the 2012 risk-based approach to the planning of LD was not implemented, there was no set period for targeting all LDs. Therefore, there is a potential that inspection activities may not cover all LDs to ensure that they are still in compliance with the requirements of the Acts and Regulations. Management has indicated that the inspection frequency is based on the number of inspectors on staff during this period.
30. In January 2018, the Compliance and Monitoring Division in OCS began the development of a "Risk Based Approach" for LDs. This new risk assessment methodology would serve as the foundation for changes to the LD inspection program; however, at the time of the audit, this new methodology has not yet been implemented.
31. Similarly, pharmacy inspections were planned using a random approach. While a risk assessment methodology for inspections of pharmacies has been developed, management indicated that it is currently working on putting this in place. Although, at the time of the audit, there was no evidence to demonstrate that the risk assessment methodology has been implemented.
32. In addition, we found no tool to support the planning of inspections (selection of pharmacies and licensed dealers to inspect). While a number of systems were in place, and there was ongoing work to further develop these systems – such as the National Drug Control System for managing authorizations (licenses, permits, registrations), the Controlled Substances Compliance Database for the storage of inspection reports, and the Controlled Substances and Pre-Cursor System for the recording of Loss/Theft reports – none of these were used for inspection planning. We found the planning of inspections was a manual process that relied on the use of spreadsheets. In general, the planning process started with a list of licensees or pharmacies prepared by OCS. This list was then provided to each region of ROEB-CSP. Regional Managers reviewed and adjusted the list by considering various factors such as resource availability and knowledge of regional issues (such as police reports and articles in news media).
33. The systems in place were not integrated to allow for combining of risk factors contained in the separate systems to inform development of the risk-based inspection plan for licensed dealers or pharmacies.
34. A robust risk-based approach to planning of inspections would enable the Department to allocate resources and enhance monitoring of compliance to the Controlled Drugs and Substances Act.

Recommendation 4

Management response

Inspection of Regulated Parties

35. Inspections of regulated parties are conducted to monitor compliance with security, reporting, and record keeping requirements. As noted previously, in paragraph 24, ROEB has two dedicated inspection programs for the CSP – one for licensed dealers, and the other for pharmacies.
36. We expected inspections were carried out and appropriate follow-up of non-compliance was performed, and that operational policies and procedures were in place to support the conduct of inspections and guide follow-up on areas of non-compliance.
37. As per the draft Compliance and Enforcement Policy and the Rating Guide for Inspections involving Controlled Substances and Precursors, a regulated party is considered non-compliant if, at the time of an inspection, it failed to demonstrate that it met the applicable legislative and regulatory requirements, and based on the number and severity of the observations noted was found to not be in control of its regulated activities. In these instances, in which a regulated party was determined to be non-compliant with the requirements, the regulated party is expected to take timely and appropriate corrective actions. HC could use compliance and enforcement measures ranging from requiring regulated parties to develop and implement a corrective action plan to suspension or revocation of licenses to encourage and/or compel compliance.
38. We found that ROEB carried out inspections of regulated parties to monitor compliance with security, reporting, and record keeping requirements.
39. However, for LDs we found that there was no guidance on actions to be taken by HC to address recurring non-compliance. We noted that, although standard operating procedures (SOP) such as the Rating Guide noted above were in place, they did not include specific instructions or guidance on what further action should be taken in the event of multiple non-compliance ratings or when it would be appropriate to suspend or revoke a license. Management has indicated that a Compliance and Enforcement Policy, and a Rating Guide for Inspections, are coming into force December 2019.
40. For LDs, we examined inspection reports for pre-License inspections, and recurring annual inspections. We found that for pre-license inspections, appropriate action was taken by HC to address non-compliance as licenses were not issued when the applicant was found to be in non-compliance with the regulations. However, for cyclical inspections, we found that while LDs submitted corrective action plans to address deficiencies identified through the inspection, there was limited evidence that follow-up inspections were conducted to verify that the proposed corrective actions were implemented.
41. The SOP for Conducting an Inspection of a Community Pharmacy, and the Guide for Determining Risk-based Ratings for Community Pharmacies provides direction on how to carry out inspections and how to classify observations from pharmacy inspections. Through the examination of inspection reports for pharmacies, we found that the inspections were carried out in accordance with the SOP, and observations were classified in accordance with the Guide. We found instances where inspected pharmacies received two consecutive non-compliance ratings. In these instances, the pharmacies had major or critical observations that resulted in a non-compliant rating and the follow-up inspection that was subsequently conducted found that the issue identified in the original inspection had not been corrected. In the sample of 40 inspection reports reviewed, there were nine instances where the pharmacy was found to be non-compliant for two consecutive inspections. Given that HC has limited authorities over pharmacies or pharmacists, follow up action is limited to re-inspection and/or referral to the appropriate provincial colleges for further action.
42. In the instances where the pharmacy received consecutive non-compliant ratings, we found that referral to the appropriate provincial college was not done in a timely manner. OCS is responsible for issuing such referrals. It maintains a log of pharmacy referrals in an MS Excel format that identifies the date the referral to the appropriate provincial college was completed. Through a review of this log, we found that the referrals occurred anywhere between three months and seven months following the inspection report due to a backlog. Management indicated the backlog was caused by a lack of resources, but that the non-compliant inspection reports were triaged so that they quickly refer those pharmacies with a potentially high risk of diversion.
43. In addition, an amendment to the Controlled Drugs and Substances Act in 2017, gave the Department the authority to develop and ultimately issue administrative monetary penalties (AMP) or fines to a regulated party for a violation of certain provisions of the CDSA or its regulations. However, the new system of AMPs had yet to be developed. While management began the work to determine how to implement this new AMP system, they indicated that it would be at least 24 months from June 2019 before it will be in place. Since this new authority is part of the government's overall strategy to modernize legislation to reduce the risk of diversion of controlled substances, it is important to ensure timely implementation of the new AMP system.
44. We also found that community health care facilities (where health care services are delivered and managed by a nurse as part of the nurse's professional practice^Footnote 5), were granted an exemption from certain provisions of the CDSA, the Narcotic Control Regulations and Part G of the Food and Drug Regulations. These exemptions are required to permit nurses working in community health facilities, particularly in remote and/or isolated communities, to possess, deliver, administer, and transport controlled substances.
45. However, this exemption is only applicable if conditions related to record keeping, secure storage, disposal, and loss/theft reporting were met. The exemption could be revoked or suspended at any time. We found that, while on-site audits of community health care facilities were conducted by another part of Health Canada (now another government department), the information from these on-site audits was not shared with HC. Therefore, HC did not know whether the conditions of the exemption were being met. As a result, HC had no assurance that appropriate practices were in place to mitigate the risk of diversion of controlled substances.
46. Overall, operational policies for inspections are in place and communicated within OCS and ROEB. However, there do not appear to be operational policies describing consequences to LDs and pharmacies who fail or are non-compliant for two or more consecutive inspections, nor have the conditions for revoking or suspending licenses and permits been established.

Recommendation 5

Management response

Loss/Theft Reporting and Destruction of Controlled Substances

47. Loss/Theft reporting and destruction of controlled substances and precursors are important requirements of the Controlled Drugs and Substances Act (CDSA). The analysis of Loss/Theft data and the destruction of controlled substances mitigate the risk of controlled substances being diverted for illegal purposes. CSCB is responsible for overseeing loss and theft reporting, and ROEB is responsible for overseeing destruction-related activities.

Loss/Theft Reporting

48. Regulated parties are required to report loss or theft of controlled substances and precursors in accordance with the regulations or the conditions of their exemption. The loss or theft must be reported to HC within the time limits specified by the Regulations. This allows HC to analyze information and assess the risk of controlled substances being diverted to the illegal market.
49. The Office of Controlled Substances (OCS) within the Controlled Substances and Cannabis Branch is responsible for the collection and analysis of Loss/Theft (L/T) reports.
50. We expected that L/T reports were entered in the Controlled Substances and Precursors System (CSPS) and analyzed to assess the risk of diversion for illegal use.
51. We found that L/T reports were submitted, primarily via fax and email, and that approximately 100 reports were received each day. A manual process was used to prioritize and manually enter the L/T reports into the CSPS. Management indicated that the number of L/T reports had increased in conjunction with promotional efforts to raise awareness of loss/theft reporting requirements by pharmacists. At the time of the audit, there were approximately 20,000 L/T reports waiting to be entered into the CSPS. We also found that the number of reports received was not tracked. Therefore, it is possible that the backlog of reports will not represent the total number of reports received as some reports may have been lost or misplaced before they were entered into the system. As a consequence, it was not possible to determine whether all the reports received have been accounted for or entered into the CSPS. Management has made efforts to improve the collection of L/T reports. The Draft 2019-2025 CSP Strategic Plan includes a strategy to adopt modern tools to streamline processes, including allowing licensees to input L/T directly into the CSPS. Implementing modern tools is also one of the key measures of success in the OCS five-year vision.
52. In addition, we found that while efforts were made to collect and record the L/T reports, there was limited evidence to indicate that this information was analyzed and used to inform the planning of inspections. The implementation of Release 1 of CSPS occurred in March 2018. However, this version has limited ability to analyze data and produce timely management reports on a regular basis. CSPS can produce reports to satisfy ATIP or Media requests but does not produce regular reports for management's analysis. The analysis of L/T reports would allow the Program to identify trends that could help focus its limited inspection resources on those licensees or locations with the highest risk of diversion. For example, we analyzed the loss/theft data for FY 2017/2018 provided by OCS and identified that the region with the highest average amount of stolen controlled substances in pharmacies was Newfoundland. Yet according to the FY 2018/2019 inspection log provided by the Program, only 1% of the pharmacy inspections were conducted in Newfoundland.
53. Timely recording of L/T reports and regular reporting on lost/stolen substances, would allow the Program to enhance its operational risk intelligence and monitoring activities so it will be better able to identify substances and locations with the highest reported rate of losses or thefts.
54. Overall, greater efforts are required to ensure timely recording of L/T reports and analysis of this information to monitor and assess the risk of diversion and guide inspection-related activities.

Recommendation 6

Management response

Destruction and Disposal of Unserviceable Stock

55. The proper destruction of controlled substances helps to ensure that they are not diverted to the illegal market. The CDSA requires Licensed Dealers (LD) to obtain HC approval prior to the destruction of controlled substances.
56. ROEB is responsible for approving the destruction of controlled substances and for witnessing the destruction of controlled substances with a total estimated street value greater than $750,000. When the total quantity to be destroyed has a street value of less than $750,000, the destruction can be completed without the presence of a ROEB inspector as a witness to the destruction. CSCB has historically determined the maximum value of products that can be destroyed without a HC witness.
57. We expected that adequate controls were in place to approve the destruction of controlled substances and mitigate the risk of diversion.
58. We examined a sample of 40 destructions and found that destruction requests were approved by appropriate authorities, and the amount destroyed matched the amount approved for destruction.
59. However, we found a number of gaps in the controls for the destruction of controlled substances, which could result in diversion of unserviceable stock to the illegal market.
60. First, as per the procedures for the destruction of controlled substances, a HC inspector was required to witness destructions of unserviceable stock with a street value in excess of $750k. However, there was no requirement for the inspector to test the substance to confirm that it was in fact the controlled substance indicated in the destruction request. Therefore, there is a potential that another substance could be substituted for the controlled substance identified in the destruction request, thereby increasing the risk of diversion of controlled substances to the illegal market. Management indicated that in many cases, there are large quantities of substances to be destroyed, and that analyzing these substances would be difficult and could delay destruction of these substances.
61. In addition, we noted that there were no procedures in place to analyze destruction requests to determine whether the requirement for an HC-witnessed destruction was circumvented. Since inspectors must witness the destruction of controlled substances valued at $750K or more, there is a potential that large destruction requests are split into several smaller ones over a short period. Thereby resulting in a destruction request that falls under the $750K threshold and as a result, could potentially be used to avoid the requirement for a HC witnessed destruction.
62. Finally, pharmacies and hospitals may have unserviceable stock or post-consumer returns that need to be destroyed. Both entities may opt to conduct a local destruction, regardless of the street value, without notifying HC or getting prior approval. While the procedures indicated that destructions must be conducted and witnessed by qualified individuals, we found that there was no requirement for the witness to be a third party. In addition, in the case of post-consumer returns (unused or expired drug substances or drug products returned to the pharmacist for destruction), we found that there was no requirement to record the type and amount of the returned substance. Therefore, there is a potential for diversion of the post-consumer returned substance as there is no record of what was returned. Management indicated that it is not always safe and practical to have pharmacists record returned substances from the public as post-consumer returns of controlled substances are commonly mixed with other prescription and non-prescription medications.
63. These lack of controls may increase the risk of diversion.
64. In conclusion, destructions of controlled substances were approved in accordance with the procedures. However, improvements are recommended to strengthen procedures to minimize risk of diversion.

Recommendation 7

Management response

Sex- and Gender-Based Analysis

65. Sex- and Gender-Based Analysis Plus (SGBA+) is an analytical tool used to assess how various groups of women, men, and gender-diverse people may experience policies, programs, and initiatives. SGBA+ also considers many other identity factors, like race, ethnicity, religion, age, and mental or physical disability.^Footnote 6 The 2009 Health Portfolio Sex and Gender-Based Analysis (SGBA) Policy requires all staff to be responsible for using SGBA+ analysis, as appropriate, in their work and normally assigned duties. In addition, the Organisation for Economic Co-operation and Development (OECD) Regulatory Enforcement and Inspection Toolkit^Footnote 7 notes that targeting of inspections should take into account vulnerability factors such as population served.
66. We expected that management had considered and incorporated SGBA+ in the delivery of the Program. To support this, we expected that relevant training was given to employees.
67. We examined training records and found that approximately 4% of CSCB employees had taken SGBA+ training at the time of the audit. This training would provide employees with the knowledge necessary to determine if SGBA+ is applicable and provide them with the knowledge to effectively integrate SGBA+ into their respective functions.
68. We also found the Program collected and analyzed SGBA+ relevant data for monitoring and surveillance activities in accordance with international reporting requirements. However, there was no documented evidence that SGBA+ was considered in program activities.
69. In conclusion, sex- and gender-based data was collected to support international reporting requirements. However, improvements are recommended to better integrate SGBA+ in program activities.

Recommendation 8

B - Conclusion

70. Overall, we found that Controlled Substances Program activities generally support the legitimate use of controlled substances and precursor chemicals. However, we found control weakness in managing the risk of diversion.
    • Specifically, we found controls were sufficient in:
    • program governance structure with clear organization charts and logical reporting structures within each of the branches;
    • monitoring of operational performance indicators related to the authorization of licences and permits, and inspections completed;
    • properly authorizing access to controlled substances and precursor chemicals;
    • operational procedures in place to support the inspection of licensed dealers and pharmacies; and
    • the approval of destruction/disposal of controlled substances and precursor chemicals in accordance with procedures.
71. We found control weaknesses in the following:
    • roles and responsibilities between the two key branches and human resource planning;
    • establishment of operational performance indicators to support sound decision-making and Program oversight;
    • application of a risk-based approach to inspection planning;
    • procedures to address licensed dealer and pharmacist non-compliance;
    • timely recording of Loss/Theft reports and regular reporting on lost/stolen substances;
    • procedures for monitoring requests for destruction of controlled substances; and
    • integration of Sex and Gender Based Analysis (SGBA+) considerations into program activities.
72. The areas for improvement noted in this audit report, along with the associated recommendations, will collectively strengthen the management practice.

Management response and action plan

Recommendation 1

The Assistant Deputy Minister, Controlled Substances and Cannabis Branch (CSCB), in collaboration with the Assistant Deputy Minister, Regulatory Operations and Enforcement Branch (ROEB), should review the governance framework across the compliance and enforcement function in order to clarify roles and responsibilities.

Risk Rating^Footnote *

Moderate

Management response and planned actions

Management agrees with the recommendation. Management previously identified this issue, and work on the response has been ongoing.

Management notes that the partner Branches have reviewed the governance framework and are actively working to establish a formal governance model including assigned accountabilities and responsibilities across the controlled substances program. This will help to address any gaps, eliminate redundancies and provide clarity to all staff on the respective mandates of each Branch.

In addition, ROEB and CSCB will evaluate the current working-level governance framework as it relates to Compliance and Enforcement functions, including the roles, responsibilities and decision-making authorities of various committees.

Recommendation 2

The Assistant Deputy Minister, Controlled Substances and Cannabis Branch, should develop and implement measures to mitigate human resource risks by developing a human resource plan covering current and future human resource needs and incorporating recruitment, retention, learning and development, employee engagement, promotion, succession, and employment equity.

Risk Rating^Footnote *

Moderate

Management response and planned actions

Management agrees with the recommendation. Management previously identified this issue, and work on the response has been ongoing.

Management that CSCB routinely reviews its staffing plan that includes retention and recruitment strategies, as well as addressing understaffed areas throughout the Directorate.

CSCB has created Extended Management Meetings to promote consistency in approach to HR management issues. The Branch is currently taking steps to create an HR Plan to address these needs over the next 3 years.

In January 2019, the Deputy Minister announced the creation of CSCB. As of September 2019, CSCB has supported training and development activities within the Branch.

Recommendation 3

The Assistant Deputy Minister, Controlled Substances and Cannabis Branch in collaboration with the Assistant Deputy Minister, Regulatory Operations and Enforcement Branch should:

• Provide integrated IM/IT tools and enhance existing tools to support reporting of operational performance indicators
• Implement and monitor appropriate performance indicators to better support management of program objectives including the objective to reduce the risk of diversion

Risk Rating^Footnote *

Significant

Management response and planned actions

Management agrees with the recommendation. Management previously identified this issue, and work on the response has been ongoing.

Management notes that the licensing and monitoring software has been deployed to staff across CSCB and ROEB. In addition, the functionality and use of the Controlled Substances and Precursors System (CSPS) for data collection and analysis will be enhanced.

Work is also underway to articulate ROEB's business requirements for a modern IT system for pharmacy inspections that will schedule inspections, track compliance and enforcement actions and enhance operational monitoring and reporting.

Lastly, the CDSS (Canadian Drugs and Substances Strategy) HI (Horizontal Initiative), the CDSS logic model, and its associated indicators, are being updated. Taken together, these actions will ensure that staff have access to required information in support of compliance and enforcement activities, and will contribute to better and more relevant performance indicators.

Recommendation 4

The Assistant Deputy Minister, Regulatory Operations and Enforcement Branch, in collaboration with the Assistant Deputy Minister, Controlled Substances and Cannabis Branch, should implement a risk-based approach to inspection planning and ensure appropriate tools are developed to support inspection planning.

Risk Rating^Footnote *

Significant

Management response and planned actions

Management agrees with the recommendation. Management previously identified this issue, and work on the response has been ongoing.

Management notes that CSCB and ROEB are working together to develop a risk-based inspection strategy for both pharmacies and Licensed Dealers that optimizes the use of collected information to guide planning and resource allocation. This includes new techniques to target inspection resources to areas where risks of diversion have been identified.CSCB and ROEB have worked together to develop a Risked Based Approach for Licenced Dealers (LDs) and community pharmacies which take into consideration information collected across the program and inform long-term inspection planning.

Recommendation 5

The Assistant Deputy Minister, Controlled Substances and Cannabis Branch, in collaboration with the Assistant Deputy Minister, Regulatory Operations and Enforcement Branch, should

• establish protocols for addressing multiple consecutive non-compliant inspection ratings including consideration of implementation of administrative monetary penalties and suspension and revocation of a licence or permit; and
• obtain assurance that conditions for exemption of community health facilities are being met.

Risk Rating^Footnote *

Significant

Management response and planned actions

Management agrees with the recommendation. Management previously identified this issue, and work on the response has been ongoing.

CSCB and ROEB will develop an internal policy/escalation protocol for addressing non-compliance at licensed dealers, using the full suite of policy and regulatory tools available, up to and including possible suspension and/or revocation of the licence. In addition, CSCB will evaluate the need for administrative monetary penalties as part of the compliance and enforcement toolkit.

In parallel, ROEB and CSCB will work together to define the consequences of initial and subsequent non-compliant ratings at community pharmacies, taking into consideration the boundaries of regulatory oversight over pharmacists. CSCB will also seek assurance that conditions for exemption of community health facilities are being met.

Recommendation 6

The Assistant Deputy Minister, Controlled Substances and Cannabis Branch should ensure timely recording, analysis and reporting of loss/theft reports to support the timely identification of elevated risks and responses.

Risk Rating^Footnote *

Moderate

Management response and planned actions

Management agrees with the recommendation. Management previously identified this issue, and work on the response has been ongoing.

Management agrees with this recommendation, and has taken several steps to more effectively manage the volume of incoming reports. This includes hiring temporary staff to address the backlog, introducing a triage process to ensure that the most important reported losses or thefts are immediately recorded, and developing a system that permits stakeholders to submit loss or theft reports electronically.Compliance promotion has increased awareness and contributed to the reduction in the incidence of significant losses.

Recommendation 7

The Assistant Deputy Minister, Regulatory Operations and Enforcement Branch in collaboration with the Assistant Deputy Minister, Controlled Substances and Cannabis Branch, should establish a process to regularly review and monitor the current destruction process to identify areas of relatively greater risk for diversion.

Risk Rating^Footnote *

Moderate

Management response and planned actions

Management agrees with the recommendation. Management previously identified this issue, and work on the response has been ongoing.

ROEB will review the destruction processes to finalize a standardized national destructions approach and will improve oversight of destructions by implementing standard operating procedures, including compliance verifications for areas of greater risk for diversion.  ROEB will also conduct cyclical review of the National Destructions SOP and implement appropriate changes, including consideration for identifying and addressing areas of relatively greater risk for diversion.  Lastly, ROEB and CSCB will amend the mandate of the Destructions WG to include the review of destructions issues and trends using internal data analysis.

Recommendation 8

The Assistant Deputy Minister, Controlled Substances and Cannabis Branch and Assistant Deputy Minister, Regulatory Operations and Enforcement Branch should consider how Sex- and Gender-Based Analysis Plus could be applied to Program activities.

Risk Rating^Footnote *

Minor

Management response and planned actions

Management agrees with the recommendation.

ROEB will identify whether SGBA+ related risk factors exist in the context of inspections and assess the need to develop mitigation and monitoring strategies.

ROEB will continue to update and modernize learning programs to reflect the SGBA+ lens in both format and content.

ROEB will provide SGBA+ training to its staff, including key staff who inform training content, or who develop and deliver training.

CSCB will explore how SGBA+ could factor into work with a focus on policy.

Introductory online training on GBA+ is available to all CSCB employees and the branch will initiate discussions on designing in-house training courses for CSCB employees, and look at case studies for certain employees.

Appendix A – Scorecard

Appendix B – About the Audit

Audit Objective

To determine whether the activities of the Controlled Substances Program (CSP) supported the legitimate use of controlled substances and precursor chemicals and manage the risk of their diversion for illegal purposes.

The audit criteria were as follows:

• There was effective oversight of CSP operations;
• Access to controlled substances and precursor chemicals was properly authorized (licenses, permits, exemptions, and registrations);
• Inspections of regulated parties were conducted to verify compliance or prevent non-compliance with the provisions of the CDSA in accordance with standard operating procedures;
• Loss, theft and disposition of controlled substances was appropriately monitored and analyzed to assess the risk of diversion; and to inform necessary response; and
• The Controlled Substances Program activities considered Sex and Gender Based Analysis Plus.

Audit Scope

The audit focused on processes and activities related to operational monitoring and enforcing compliance with the CDSA including:

• Providing advice and guidance to stakeholders and licensed parties on changes to the CDSA, and its regulations (e.g. changes in scheduling of substances regulated under the CDSA);
• Authorization (licenses and disposition) processes;
• Conducting inspection activities to monitor and promote compliance;
• Undertaking appropriate enforcement actions for non-compliance; and
• Processes and procedures related to data entry, and analysis to support operational monitoring.

The scope of the audit included activities and data for fiscal years 2016/17, 2017/18 and the period April 1, 2018 to January 31, 2019. The fieldwork occurred at Headquarters in Ottawa.

Activities Not in Scope

The scope did not include:

• examination of the processes and activities related to funding provided through grants & contributions or activities related to lab analysis as these were included in previous audits;
• assessment of the information technology systems supporting the CSP as efforts are underway to replace the current IT system;
• assessment of the Office of Alcohol Policy, Opioid Response Team, Cannabis Legalization and Regulation Branch, and Tobacco Control Directorate;
• assessment of the entire Performance Information Profiles; and
• assessing updates to the regulatory framework, since there is an ongoing legislative and regulatory modernization initiative.

Audit Approach

The audit was conducted in accordance with the Government of Canada's Policy on Internal Audit, examined sufficient and relevant evidence, and obtained sufficient information and explanations to provide a reasonable level of assurance in support of the audit conclusion.

The audit criteria were derived from the Comptroller General's Audit Criteria related to the Management Accountability Framework: A Tool for Internal Auditors (2011) and the Committee of Sponsoring Organizations of the Treadway Commission (COSO), Enterprise Risk Management—Integrating with Strategy and Performance (2017)

The audit approach included but was not limited to:

• interviews with key officials with responsibility related to providing advice and guidance, conducting licensing and approvals processes, carrying out monitoring and compliance activities, and undertaking enforcement actions for non-compliance;
• review of relevant documentation, legislation, regulations, policies, standards, guidelines and frameworks related to the CSP;
• detailed testing of a sample of transactions related to the program;
• testing of selected key controls; and
• analysis of information from interviews, inquiry, document reviews and detailed testing.

The audit was collaborative and the findings were cleared with the parties concerned.

Statement of Conformance

This audit was conducted in conformance with the International Standards for the Professional Practice of Internal Auditing and is supported by the results of the Office of Audit and Evaluation's Quality Assurance and Improvement Program.