15 Red Flags of Drug Diversion
Early recognition is the first line of defense. Drug diversion is substantially underreported — often because warning signs are dismissed or go unnoticed. These 15 indicators, drawn from behavioral research and regulatory guidance, help your team know what to look for.
Important framing: Red flags alone are not proof of diversion. Each indicator warrants a confidential review and documentation — not accusation. Follow your organization's investigation protocol and consult HR and legal counsel before taking adverse action. See the Investigation Playbook for structured next steps.
1–5 Behavioral Warning Signs
Unscheduled absences or unusual arrival/departure times
Frequent call-outs, arriving unusually early or leaving late without clear reason — particularly around shift changes when oversight is lowest.
Frequent unexplained disappearances from the worksite
Leaving the unit or work area repeatedly without clinical justification, especially for brief periods that coincide with controlled substance access opportunities.
Insisting on personally administering injectable medications
Resisting delegation of IV or injectable controlled substance administration to colleagues — a pattern often associated with diversion at point of administration.
Volunteering for overtime near shift-end when oversight is low
Consistently staying after shift end or covering short-staffed periods — legitimate dedication or an opportunity for unobserved access. Context matters.
Reluctance to take breaks or allow others to cover their patients
Declining relief coverage or insisting that only they can manage specific patients — especially when those patients are on continuous controlled substance infusions.
6–10 Documentation & Practice Patterns
Abnormal waste — excessive, incomplete, or unwitnessed waste documentation
High waste volume relative to peers, waste documented without a witness, partial-dose waste that doesn't match the ordered amount, or waste recorded at implausible times.
Frequent discrepancies or overrides on dispense cabinet transactions
Repeated count discrepancies tied to a specific user, or a pattern of overrides (accessing medications before order verification) that exceeds unit norms — especially for high-risk controlled substances.
Medication administration recorded but patient denies receiving it
Patient reports inadequate pain control or sedation despite charted medication administration — a classic indicator that the documented dose was not fully (or at all) administered to the patient.
Unusual patterns of PRN medication use or high-dose frequency
Controlled substance PRN orders administered at maximum frequency across a disproportionate share of an employee's patient population — particularly when peers caring for similar patients show lower utilization.
Charts showing pain or sedation inconsistent with documented medications
Nursing assessments documenting poor pain control or unexpected sedation that contradicts the amount and timing of controlled substances charted as administered.
11–15 Inventory & Access Signals
Missing, broken, or tampered security seals on kits or cabinets
Intact seals are the first physical deterrent. Broken or missing seals without a corresponding controlled substance transaction record — or with inadequate documentation — require immediate investigation.
Discrepancies in controlled substance counts that cannot be reconciled
Count variances that persist across multiple verification attempts, or that occur repeatedly within the same shift or on the same user's counts, without a plausible documentation explanation.
Access to cabinets or drug storage outside assigned duties
Transaction logs showing access to controlled substance storage in areas, units, or patient rooms that are not part of an employee's routine assignment — including after-hours access without clinical justification.
Stockouts of specific controlled substances without explanation
A specific high-risk medication (e.g., a short-acting opioid or benzodiazepine) running out faster than utilization data would predict — particularly if stockouts occur on predictable shifts.
An employee repeatedly present when discrepancies are discovered
Statistical correlation between a specific employee's presence and the occurrence of count variances, documentation errors, or access anomalies — one coincidence is noise; a pattern is a signal.
Spotted a red flag? Start with the Investigation Playbook.
The playbook walks you through initial report handling, evidence preservation, chain-of-custody documentation, HR and legal coordination, and DEA notification requirements — step by step.
Open Investigation PlaybookLast reviewed: September 2026 · Content is educational, not legal advice.