COUNCIL AGENDA : 12/16/2025
FILE : 25-1331
ITEM : 3.3
TO: HONORABLE MAYOR AND FROM: Toni J. Taber, MMC
CITY COUNCIL City Clerk
SUBJECT: SEE BELOW DATE: December 4, 2025
SUBJECT: Fire Department Inventory Controls Over Controlled Substances Audit Report
Recommendation
As recommended by the Public Safety, Finance and Strategic Support Committee on December 4, 2025, accept the report on the audit of the Fire Department's inventory controls over controlled substances.
CEQA: Not a Project, File No. PP17-009, Staff Reports, Assessments, Annual Reports, and Informational Memos that involve no approvals of any City action. (Auditor) [Public Safety, Finance and Strategic Support Committee referral 12/4/2025 - Item (d)1]
Office of the City Auditor
Report to the City Council
City of San José
FIRE INVENTORY
CONTROLS OVER
CONTROLLED
SUBSTANCES:
CLARIFYING POLICIES
AND SEPARATING
DUTIES WOULD FURTHER
IMPROVE SECURITY
Report 25-05
November 2025
PSFSS COMMITTEE AGENDA: 12/4/25
ITEM: (d)1
This page was intentionally left blank
200 E. Santa Clara Street, San José, CA 95113
Telephone: (408) 535-1250 Email: [email protected] Website: www.sanjoseca.gov/auditor/ Office of the City Auditor
Joe Rois, City Auditor
November 24, 2025
Honorable Mayor and Members
Of the City Council
200 East Santa Clara Street
San José, CA 95113
Fire Inventory Controls Over Controlled Subs tances: Clarifying Policies and Separating Duties Would Further Improve Security
To provide Advanced Life Support (ALS), the San Jo sé Fire Department uses two medications regulated by the federal Controlled Substances Act: morphine for pain management and midazolam for seizures and sedation. Each fire engine, truck, or other appara tus that provides ALS services carries these two controlled substances. Before being distributed to fire apparatus, the Fire Department keeps the controlled substances in a safe in a central facility.
The objective of this audit was to assess the Fire Department’s inventory controls over controlled substances. The audit was requested by the Fire Ch ief following an incident involving damage and suspected tampering of controlled substances containers in April 2025.
Finding 1: Policies Require Securing Controlled Substances on Fire Apparatus But Should Be Clarified to Reflect Current Practices. At the time of our audit testing, policies in place for controlled substances kept on fire apparatus required regular monitoring and physical security controls.
However, the Fire Department’s policies do not reflect
current practices in all areas. We found:
No evidence of tampering or theft during our
audits of controlled substances kept on fire
apparatus during the summer of 2025.
Current practices for some aspects of inventory
management should be formalized in policy.
As the Fire Department acquires biometric
safes, policies should be updated to address
access, monitoring, and usage.
Recommendations: To improve
controls over controlled substances on
apparatus, Fire should:
Revise its policy to reflect current
practices regarding daily and periodic
reviews of controlled substances
boxes, reserve apparatus storage, and
remote handoff protocols.
Update its policy to address access and
usage once biometrics safes are
acquired.
4 Finding 2: Separating the Duties for Ce ntral Supply Management Would Strengthen Inventory Controls. The Fire Department’s Controlled Substances Program Manager (CSPM), a Fire Captain in the Bureau of Emergency Medical Servic es (EMS) and Training, manages the central supply of controlled substances. This involves receiving, labeling, securing, distributing, and destroying medications.
We found:
No evidence of theft or tampering during our
audit of the main safe inventory during the
summer of 2025.
The CSPM’s duties are not sufficiently separated
to ensure security of the medications. Re-
assigning some duties would improve the
security of the central supply.
Additional controls, including regular review of
inventory reports, a biometric safe, and periodic
inventory counts, would provide further
controls over the main safe.
This report has seven recommendations. We plan to present this report at the December 4, 2025, meeting of the Public Safety, Finance, and Strate gic Support Committee of the City Council. We would like to thank the Fire Department for their time and insight during the audit process. The Administration has reviewed the information in this report, and their response is shown on the yellow pages.
Respectfully submitted,
Joe Rois
City Auditor
Audit staff: Alison Pauly
Maria Valle
Donovan Torres (Stanford in Government fellow)
cc: Jennifer Maguire Robert Sapien, Jr. Susana Alcala Wood Lee Wilcox Jennifer Schembri Jim Shannon
Bonny Duong Steve Boughey Athena Trede
Patrick Chung Mitch Matlow Brad Morales-McGibben
Marc Gautreau Arlene Silva
This report is also available online at www.sanjoseca.gov/audits Recommendations: To improve
controls over central supply management,
Fire should:
Assign medication handling, system
administration, and certain record-
keeping duties to separate staff.
Increase management oversight and
physical controls over the main safe.
Update its policy to reflect current
practices around inventory
management.
T able of Contents
Cover Letter ........................................................................................................... 3 Background ............................................................................................................. 7 Finding 1
Policies Require Securing Controlled Substances on Fire Apparatus But Should Be Clarified to Reflect Current Practices ............................................. 11 Current Policies Require Securing Controlled Substances on Fire Apparatus .... 11 Some Areas of the Policy Need Clarification to Fully Reflect Current Practices ................................................................................................................................ 13 To Further Enhance the Security of Controlled Substances on Fire Apparatus, the Fire Department Is in the Process of Acquiring Biometric Safes ....................................................................................................................................... 15 Finding 2
Separating the Duties for Central Supply Management Would Strengthen Inventory Controls .......................................................................... 17 The Duties of the Controlled Substances Program Manager Should Be Separated .............................................................................................................................. 17 Additional Controls Would Further Secure the Main Safe Inventory .................... 22 Conclusion ............................................................................................................. 25 Appendix A
Audit Objective, Scope, and Methodology ...................................................... A-1 Administration’s Response ................................................................. yellow pages
T able of Exhibits
Exhibit 1: Ordering, Reconciling, and Recording Duties Should Be Separated and Clarified ........................................................................................... 19 Exhibit 2: Recording and Oversight Duties for Vial Destruction Should Be Formalized ................................................................................................................ 20 Exhibit 3: Biometric Safes and Additional Oversight Would Improve Main Safe Security ............................................................................................................. 22
7 Background
The San José Fire Department (Fire) provides Advanced Life Support (ALS) as part of its emergency medical services (EMS ) under an agreement with the County of Santa Clara EMS Agency.
Per Santa Clara County EMS protocols, Sa n José EMS personnel have supplies of morphine sulphate and midazolam to provide ALS services. Morphine is a narcotic used for pain management. Midazolam is a benzodiazepine used to treat seizures and for sedation. 1 Both substances are kept on fire engines, trucks, and other apparatus providing ALS services. Before be ing distributed to fire apparatus, the controlled substances are kept in a central location, locked in a safe.
This audit was added to the City Audi tor’s Fiscal Year 2024-25 Work Plan following a request from the San José Fi re Chief. In April 2025, containers of controlled substances were found to be damaged and suspected to have been tampered with at a fire station. Following an investigation, the San José Police Department arrested a Fire Captain for burglary at one fire station, child endangerment, and narcotics violations. The objective of this audit was to assess the inventory controls over controlled s ubstances in the Fire Department. This audit focuses on controls in place starting in late April 2025, following the incident. 2 Regulations and Oversight Over Controlled Substances
There are federal, state, and county regulations for controlled substances and their use by the Fire Department.
The Drug Enforcement Agency (DEA) regulates controlled substances through the Controlled Substances Act and the Code of Federal Regulations. The Controlled Substances Act establishes that EMS agencies are permitted to administer controlled substances in accordance with standing orders and procedures. The Code of Federal Regulations outlines inventory control requirements for controlled substances.
The State of California licenses paramedics and regulates EMS generally through counties. This includes re quirements for implementing EMS systems and certifying personnel.
Santa Clara County is the City’s local EMS agency, which sets requirements for the San José Fire Department’s EMS practices. Per the County of
1 The DEA classifies morphine sulphate as a Schedule II substanc e (defined as having high potential for abuse and likelihood of dependence). The DEA classifies midazolam as a Schedule IV substance. 2 The focus of this audit is only on controlled substances acqui red by the Fire Department and used in daily operations. As part of the Strategic National Stockpile, the federal government stores controlled substances at a Fire Department facility and on fire apparatus, but these are held, secured, and recorded separately.
Audit of Fire Department Inventory Controls
8 Santa Clara EMS Agency, an ALS non-transport apparatus must have a minimum of 20mg of morphine sulphate and 15mg of midazolam to be in service. San José Fire Department paramedics get accredited through the County EMS Agency and administer controlled substances based on County protocols.
Acquisition, Use, and Destruction of Controlled Substances The Controlled Substances Program Manager (CSPM), a Fire Captain in the Bureau of EMS and Training, is responsible for overseeing ordering, distribution, and destruction of controlled substances.
Ordering: Based on inventory management system re ports, the CSPM determines when to order more vials of medication. The Department’s Medical Director, a physician from Stanford Health Care, signs the order for more vials. On ce the vials arrive at the Fire Department’s facility, the CSPM is responsible for taking custody of the vials.
Recording and labeling: The CSPM creates a record for each vial in the Department’s inventory management system and tags each vial with an ID number (assisted by other staff as needed). A witness is required to create new records in the system.
Storage: Vials are stored in the main safe at a cent ral Fire Department facility until they are needed by fire stations. The safe is kept locked in a locked room within the locked facility. The CSPM, along with limited other EMS staff, have access to the main safe and the locked room.
Distribution to Fire Stations: The CSPM regularly runs a report from the inventory management system showing the inventory of each fire station. Each ALS unit should have up to 80mg of morphine and 40mg of midazolam. If they get below half that amount, the CSPM restocks them from the main inventory.
Usage and Waste: Paramedics administer
morphine or midazolam when necessary for
patient care. If there is remaining medication in
the vial that was not needed for the patient, the
paramedic disposes of it (“wasting” the rest).
For both usage and wasting, the paramedic
notifies their captain (or someone acting in the
captain’s capacity) and documents it in the
inventory management software with a witness.
Destruction of Expired or Damaged Vials: If
a vial has expired or has some damage that makes
it unsafe to administer, the CSPM collects the vial
from the fire apparatus box and prepares it for
disposal. The reason for disposal is logged in the
inventory management software and a record is
printed to be stored with the vial in a safe until it
is destroyed. Periodically, the contents of the
expired medication safe are destroyed.
Inspection and Security on Fire Apparatus: Controlled substances are kept locked on the fire apparatus. Each box has a unique key, kept by the paramedic assigned to the apparatus.
Every day or whenever there is a transfer of personnel, the paramedic is required to open the box, inspect every vial, and check the inventory against system records.
Background
9 Frequency of Usage
In FY 2024-25, the Fire Department responded to 68,500 medical emergencies, or about 5,700 medical emergencies per month. During the same period, paramedics administered controlled substances at 835 incidents. In total, paramedics administered 865 vials of medication, or about 72 per month. 3 Paramedics administer morphine far more frequently than midazolam; 76 percent of the vials administered during the year were morphine.
Bureau of EMS and Training Provides Oversight Over Usage of Controlled Substances Part of the CSPM’s responsibilities is to review the usage and security of controlled substances by paramedics. Every time a paramedic administers a controlled substance, the CSPM is notified. They ca n review a report on the care provided to the patient and the amount of controlled substance used. They regularly check the contents of controlled substances boxes kept on fire apparatus during random reviews and when boxes are restocked. If paramedics have questions about the security controls for controlled substa nces or how to appropriately use the software system, they can contact the CSPM for assistance.
The EMS Battalion Chief and Bureau of EMS and Training Deputy Chief also provide some oversight. The Deputy Chief is notified when vials are ordered. Both the Deputy Chief and Battalion Chief are involv ed if there is any indication of vial tampering.
Inventory Management Software to Track Inventory, Usage and Waste, and for Oversight of Controlled Substances
Fire uses an inventory management soft ware that requires two users to track transactions relating to controlled subs tances and for oversight. Staff record inventory, distribution to stations, expi red and damaged vials, and amounts used and wasted in the system. The software is available online for a desktop/laptop and via an application for a tablet/iPad for par amedics/firefighters to use in the field.
Fire staff run reports to track the invent ory and where vials ar e stored, identify expiring medication, and ensure that paramedics are conducting daily verifications of controlled substances.
Expected Changes to Security and Staffing
To further secure controlled substanc es and improve oversight, the Fire Department has several expected changes planned or underway. Secured lockboxes: At the time of our audit testing, the Fire Department had acquired lockboxes intended to hold just the controlled
3 In some cases, multiple vials of controlled substances were administered during the same incident.
Audit of Fire Department Inventory Controls
10 substances. City staff planned to inst all the lockboxes on fire apparatus and develop polices relating to their usage.
Biometric safes: In the FY 2025-26 Adopted Operating Budget, the Fire Department received a $200,000 allocation to purchase safes that are secured with a biometric lock. The purpose was to improve security and allow for cloud-based tracking. At the time of the audit, Fire staff reported that they were in the process of procuring the biometric safes. Med30: Med30 was the Fire Department’s EMS field coordinator prior to FY 2023-24. In FY 2023-24, the Med3 0 duties and resp onsibilities were reallocated to a wider range of personnel. The FY 2025-26 Adopted Operating Budget included $748,000 of one-time overtime funding to restore Med30 on a temporary basis. At the time of our audit, the Fire Department was determining the role of Med30.
11 Finding 1 Policies Require Securing Controlled
Substances on Fire Apparatus But
Should Be Clarified to Reflect Current
Practices
Summary
Our audits of controlled substances stored on Fire apparatus during the summer of 2025 found no evidence of theft or tampering. Physical security measures, including a unique key, locked cases, da ily verifications by paramedics, and electronic inventory systems align with or exceed practices in other jurisdictions.
However, some elements of the EMS po licies require clarification to reflect current practice. These include the timing of daily verifications, storage of controlled substances for reserve vehicles, frequency of EMS management random inventory reviews, and protocols for re mote handoffs when a paramedic is unavailable. To further strengthen controls, the Fire Department will be installing new lockboxes and is planning to purch ase biometric safes. The Department should update its policies to address op erational procedures for these safes, including access permissions, backup key storage, and whether daily verifications remain necessary.
Current Policies Require Securing Controlled Substances on Fire Apparatus The audit team did not find evidence of th eft or tampering during our audits of controlled substances boxes stored on fire apparatus.4 The controls in place at the time of our audit testing required that controlled substances be physically secured and monitored for early detection of disc repancies. These controls aligned with, and sometimes exceeded, the controls reported by surveyed jurisdictions.
The San José Fire Department Controlled Substance Control Policy
5.700.21 lays out the procedures for contro lled substances such as receipt, storage, use, daily verifications, repo rting discrepancies, waste, quality improvement, and disposal. Special Bulletins 25-114 and 25-121 , issued in April and May 2025, expanded the physical security of the controlled substances and added more requirements for the daily verifications of controlled substances boxes on fire apparatus.5 Special bulletins are in place for six months. At the time
4 The audit team reviewed 29 controlled substances boxes at 17 of the 34 fire stations. The team conducted reviews at 11 fire stations alongside the Controlled Substances Program Manager as part of his monthly review. The audit team randomly selected the remaining six fire stations for audits, which were conducted unannounced. 5 The Special Bulletins refer to daily verifications as “audits.” To distinguish between these and the audit team’s work, we refer to the paramedics’ reviews as “daily verifications” per the Controlled Substance Control Policy.
Audit of Fire Department Inventory Controls
12 of the audit, the Fire Department wa s working on updates to the Controlled Substances Control Policy.
Case is Locked
with a Unique
Key and
Secured to
Apparatus
At the time of our audit testing, controlled substances boxes on fire apparatus were kept in a locked case with a unique key. The crew member (usually the paramedic) assigned responsibility for the key is expected to carry the key at all times. This security measure was first required in Ap ril 2025. The locked case was then secured to the apparatus with a cable that was locked. This security measure was first required in May 2025. This aligns with the types of physical security co ntrols of other jurisdictions surveyed. Other jurisdictions re ported that their cases are attached to the apparatus and have a unique key or pin to open.
Daily Full
Verification of
the Boxes on
the Apparatus
A full verification at the statio ns is required when there is a transfer between personnel, or a new day begins. This process includes breaking the plastic safety seal, inspecting each vial for evidence of tampering, compar ing vial information against the records in the inventory management system, and replacing the plastic safety seal. The paramedic and the company officer as a witness are required to inventory the controlled substances box together. The policy requires a daily verification of the controlled substances box and the number of vials; however, the expansion to a complete review of every vial began in April 2025.
To ensure that all companies conduct a daily verification, the Controlled Substances Program Manager reports getting
notifications if crews have not conducted their verification by 12 p.m. Additionally, battalion chiefs can view reports on daily verifications and follow up with companies that have not conducted a verification by 12 p.m. each day. In our surveys of other jurisdictions, regular verifications of the controlled substances boxes on apparatus was a common control.
Electronic
Records for
Inventory
Management
Since 2023, the Fire Departme nt has used an electronic inventory management system. Most jurisdictions surveyed used an electronic inventory system, but some reported that all logs were kept on paper.
Each Vial Has an
Identification
Number and is
Tracked in the
System
The Fire Department tracks each vial in the system through an individual identification number. This allows for precise inventory reconciliation. While some jurisdictions reported tracking each vial individually, others do not. Those jurisdictions report monitoring only the total amount of each controlled substance against inventory records.
Finding 1
13 The Fire Department Will Store Controlled Substances in Individual Lockboxes The Fire Department purchased new lockboxes to further secure narcotics. At the time of our audit testing, staff planne d to install the lockboxes on every fire apparatus. Per the Fire Department, the current approach is difficult operationally for the paramedics. The large case that holds the controlled substances also contains many other supplies that paramedics use to care for patients. Regardless, the entire case is cabled to the apparatus. Removing the case from the apparatus— which must be done even if the required materials are not controlled substances— takes additional time.
The new lockboxes will only contain controlled substances and be bolted to the apparatus. This will provide easier access to the case of medical supplies.
Some Areas of the Policy Need Clarification to Fully Reflect Current Practices Some current practices, as reported by EMS staff or fire station crews, are not reflected in the Fire Department’s EMS policies and special bulletins. In some cases, there is a difference in written policy and current practice. In others, the policy is unclear or does not exist. Formally re cording expectations in the Controlled Substances Control Policy would ensure consistency among staff and continuation.
Timing of Daily
Verifications by
Paramedics
If a paramedic has not conducted a daily verification of their controlled substances by noon, the CSPM receives a notification.
The CSPM then contacts the crew. In our review, some
verifications were not conducted in the morning, or they happened several hours after a transfer had occurred. The Fire Department should clarify in the policy when the daily verifications s h o u l d b e d o n e a n d t h a t t h e y should happen as soon as is practicable after a transfer. Cal Fire’s Santa Clara Unit policy requires verifications to be performed by 11 a.m.
Storage and
Access of
Controlled
Substances for
Reserve
Vehicles
The May 2025 Special Bulletin on new controlled substance security measures requires that paramedics always maintain custody of the key to the controlled substances. At one station, the controlled substances for a reserve apparatus were kept in a lockbox at the station, but the key to the lockbox was kept in a cabinet for which all staff had the code. This appears to be in violation of the Special Bulletin requirement that requires the key to be held by the person responsible for the controlled substances at all times.
Fire staff report that this particular instance has been corrected, and that all keys should be held by the responsible paramedic. The policy should clarify where the co ntrolled substances for reserve vehicles should be stored and who should have access to the key.
Audit of Fire Department Inventory Controls
14 Monthly
Inventory
Reviews of
Controlled
Substances on
Apparatus by
the CSPM
Currently, the CSPM reviews 25 percent of all controlled substances boxes on fire apparatus every month. The purpose of these reviews is to check the in ventory and inspect for evidence of tampering. The Fire Department’s policy is that EMS Division staff will physically compare the controlled substances on fire apparatus with inventory records “at random intervals.” The Fire Department should clarify in the policy the quantity or percentage of apparatus boxes that need to be reviewed, the frequency of these reviews, and how the reviews should be documented.
Incident Report
Required for
Remote
Handoffs
When controlled substances are transferred between paramedics, the standard policy is that both paramedics should be present to inspect the contents and record the transfer in the software system. The policy also states: “If the off going paramedic needs to leave prior to a face-to-face handoff with the oncoming paramedic due to the operational needs of the department, the procedure of ‘picking up from crew’ will be acceptable.” “Pick up from crew” is a function in the inventory management system that allows for a remote handoff.
EMS Division staff report that “pick up from crew” should be used as little as possible and that when it is used, an incident report should be filed. However, that is not explicitly stated in the policy and not all paramedics reported doing so. The policy should clarify when using “pick up from crew” is appropriate and whether an incident report is required.
Recommendation:
1: To ensure the Controlled Substances Control Policy reflects current practices, the Fire Department should update the policy to provide further clarity on:
a. Timing of daily verifications performed by paramedics of controlled substances boxes on fire apparatus;
b. Storage and access for contro lled substances on reserve apparatus;
c. Frequency, scope, and required documentation of
Emergency Management Serv ices Division inventory
reviews of controlled substances boxes across fire
stations; and
d. Allowable uses and requirements for remote handoffs of controlled substances (“pick up from crew”).
Finding 1
15 To Further Enhance the Security of Controlled Substances on Fire Apparatus, the Fire Department Is in the Process of Acquiring Biometric Safes The purpose of the biometric safes is to improve the security of controlled substances kept on fire a pparatus. Biometric safes record who has accessed the medications. Fire Department staff report that it will take time to procure the new safes.
The City of Santa Clara has biometric safes for every apparatus and their central supply. The City of Mountain View and Ca l Fire’s Santa Clara Unit use safes that are locked with unique pin codes. Ther e are policies and practices that these jurisdictions reported that are affected by using biometric or pin-coded safes. As the Fire Department acquires biometric sa fes, staff should clarify the Controlled Substances Control Policy to reflect the new operating environment. This includes:
Personnel that Have Access to Apparatus Safes: Fire should clarify in the policy which personnel have access to the biometrics safes on the fire apparatus. The City of Santa Clara grants access to Emergency Medical Technicians (EMTs) so that if the paramedic is with the patient, the EMT can open the safe and bring the contro lled substances to the paramedic.
On the other hand, Cal Fire’s Santa Clara Unit does not grant access to EMTs.
Backup Access if Electronic Component Fails: Fire should include procedures for what should be done if the electronic component fails and who will have access to any backup physical keys. The City of Mountain View, which uses pin-coded safes, keeps backup keys at their Police Department.
Evaluating Daily Verifications: Fire should evaluate if daily verifications by paramedics are still required, or if they should only be required when there is a handoff between personnel. The City of Santa Clara requires daily verifications at each shift change with both the incoming and outgoing paramedic present, though staff typi cally work a 24-hour shift. Mountain View and Cal Fire’s Santa Clara Unit require a daily verification even if the same paramedic maintains possession, such as day two of a 48- or 72-hour shift.
Audit of Fire Department Inventory Controls
16 Recommendation:
2. To enhance the security of controlled substances on apparatus, once biometric safes are acquired, the Fire Department should update the Controlled Substances Control Policy to address access and usage, including:
a. Who should have access to the apparatus safes,
b. The storage and access to backup keys, and
c. Whether daily verifications by paramedics are still
needed.
17 Finding 2 Separating the Duties for Central Supply
Management Would Strengthen
Inventory Controls
Summary
Our audit of the main safe inventory in th e summer of 2025 revealed no evidence of theft or tampering. However, the current duties of the Fire Department’s Controlled Substances Program Manager (CSPM) are not sufficiently separated to ensure security of the medication. The CSPM manages the central supply of controlled substances, which involves ordering, receiving, securing , distributing, and destroying medications.
Re-assigning system administration and certain record-keeping duties would improve the security of the central supply. There are also some practices, including the review of potential tampering, that should be wri tten into the policy to ensure continuation and compliance. In addition, updated inventory reports, a biometric safe, and periodic inventory counts of the main safe would pr ovide additional controls over the main safe.
The Duties of the Controlled Substances Program Manager Should Be Separated During our audit, the audit team conducte d an unannounced review of the main safe inventory for new controlled substances an d expired controlled substances. All vials were accounted for and in the sample of vials we inspected, there was no evidence of tampering.
The Controlled Substances Program Manager (CSPM), a Fire Captain in the Bureau of EMS and Training, is responsible for man aging the central supply of controlled substances. Those responsibilities include:
physically handling the controlled substances,
updating records for new, expiring, and damaged substances, and managing system access for the Fire inventory management system.6 Best practices on inventory control fr om the Government Accountability Office require that:
Management divides or segregates key duties and responsibilities among different people to reduce the risk of error, misuse, or fraud.
This includes separating the re sponsibilities for authorizing transactions, processing and recording them, reviewing the
6 All parts of the process, except as noted later in this section, are required to have a witness by policy and/or by the inventory management system.
Audit of Fire Department Inventory Controls
18 transactions, and handling any related assets so that no one individual controls all key aspects of a transaction or event.
The current duties of the CSPM include all these categories: authorizing and review of transactions, processing and recording tr ansactions, and handling of the assets.
Separating the duties among other staff would improve security and reduce the risk of theft.
System Administrators Should Not Handle Medication Vials As noted in the Background, the Fire De partment uses an electronic inventory management system. Because staff use the system to record witnessing, administering, and transferring vials, ensuring appropriate access is essential.
Currently, the CSPM is a system administrator with broad permissions in the system.
The CSPM can create new users, alter user permissions, and log-in to secondary accounts besides his own.
Every control that relies on a second witness in
the system is significantly weaker when one
person can access multiple user accounts.
Separating the duties of system administration from
handling the medication would reduce the risk that
someone could sidestep cont rols requiring a second
witness. To strengthen the current controls, any staff
with access to controlled substances should only have
one log-in and no ability to create new log-ins.
When the CSPM creates new users in the inventory management system, EMS Division management expects the CSPM to alert them. However, this is not in the policy. When new users need access to the system, the policy should require that EMS Division management approve those users and their permission settings.
Reconciling and Recording New Medication Orders Should be Performed by Separate Staff
When new shipments of controlled substances arrive, the CSPM receives the vials, logs them into the system, labels, and insp ects them. Separating these duties reduces the risk that vials could go missing and related records be altered.
One person can take
vials, update the
inventory records, and
approve their own
changes—without a
second witness present.
Finding 2
19 Exhibit 1: Ordering, Reconciling, and Recording Duties Should Be Separated and Clarified
Source: Auditor observations and analysis of San José Fire Department EMS policies and procedures.
A designated record-keeper should compare orders, invoices, and receipts against the records they enter into the inventory manage ment system for each vial. The system can then print individual labels for each vi al. This ensures that every vial that was ordered has a record in the system and that every vial is appropriately labeled.
The current policy requires that staff retain documents for medication orders, invoices, and receipts. It doesn’t specify whether anyone should reconcile the actual vials received against those documents. Comparing order information, actual received vials, and vials logged into the inventory management system helps prevent the theft of vials when they are first received.
CSPM
Duty
Witness/
Approval Control Weakness Improved Control
Identify
need to
order vials
Order signed
by Medical
Director
None.
The CSPM initiates the ordering process, but orders must be signed by the Medical Director, which is a strong control.
Receive
vials
Witness per
policy
One person handles the
vials and updates the
records.
Having one person create the
records for new vials and
handle the vials creates an
opportunity for theft. This is
even more risky as the CSPM
also has the ability to approve
his own transactions in the
inventory management
system. Additionally,
witnessing of vial receipt is
not documented.
Current policy requires that
staff retain receipts, shipping,
tracking forms, and any
necessary DEA forms. The
policy does not specify if
anyone should be reconciling
received vials to the order
forms to check that all
ordered vials were entered
into the system.
Separate record-keeping duty
from the responsibility of
handling medication vials.
Record-keeper should have
no access to the inventory
and only one log-in for the
inventory management
system.
Additionally, the policy should
specify that the record-
keeper should reconcile
order forms, receipts, and
new entries into the
inventory management
system.
Record
vials in the
system
Witness
required by
system
Label and
inspect vials
Witness per
policy
Audit of Fire Department Inventory Controls
20 Oversight and Re-Assignment of Duties Would Strengthen Controls over Vial Destruction
If a vial is not used—whether because it was damaged or it expired—the CSPM oversees the destruction process. This in cludes handling vials that are potentially damaged, overseeing vial destruction, an d recording that vials were damaged or destroyed.
Exhibit 2: Recording and Oversight Duties for Vial Destruction Should Be Formalized
Source: Auditor observations and analysis of San José Fire Department EMS policies and procedures.
CSPM Duty Witness/
Approval Control Weakness Improved Control
Retrieve and
inspect
damaged vials
Approval
required in
practice, not
by policy or
system
settin
gs
One person handles the
vials and updates the
records.
Having one person
responsible for recording
that a vial was damaged and
handling the damaged vial
creates a risk for theft.
The current practice is that
the Deputy Chief, Battalion
Chief, and CSPM review
damaged vials to determine
if there is evidence of
tampering. However, this is
not specified in the policy.
Separate record-keeping duty
from the responsibility of
handling the medication vials.
Record-keeper should have
no access to the inventory
and only one log-in for the
inventory management
system.
Additionally, the policy should
specify who should be
reviewing damaged vials and
require that management
approves the decision of
whether a vial has been
tampered with. This would
separate the approval role
from the role of day-to-day
medication handlin
g.
Record
damaged vials
Witness
required by
system
Destroy
medication
Witness
required in
practice
One person handles the
vials and updates the
records.
Having one person
responsible for recording
medication destruction and
overseeing the physical
destruction of medication
creates a risk for theft.
The policy does not require
a witness to be present for
the destruction of expired
medications, though this is
the current
practice.
Separate record-keeping duty
from responsibility of handling
the medication vials. Record-
keeper should have no access
to the inventory and only one
log-in for the inventory
management system.
Additionally, the policy should
require a witness for
medication destruction.
Record
medication
destruction
Witness
required by
system
Finding 2
21 Separating responsibilities for handling me dication vials and record-keeping ensures that damaged or expired vials are destroye d as expected. Additionally, updating the policy to require a witness for vial destru ction and oversight over vial tampering reviews would formalize the current practices into necessary controls.
Fire Department Policy Should Clarify Variance Reporting Requirements The County of Santa Clara EMS Agency’s policy requires that local EMS providers notify the County of Level A variances i mmediately via verbal communication and within 24 hours via a written form.7 This requirement is not in the Fire Department’s policy. After the suspected tampering was discovered in April 2025, the County sent a letter to the City alleging that the Fire Department did not send notification as required.
Recommendations:
3: To separate critical duties for management of the central supply of controlled substances, the Fire Department should:
a. Assign system administration duties, primarily the ability to create new users in the system and change user permissions, to personnel that do not have controlled substance handling or record management duties.
b. Assign certain duties for record management, such as reconciling ordered medication, logging new medication into the inventory, and logging the removal of medication upon destruction to personnel that do not have controlled
substance handling or system administrator privileges.
c. Disallow multiple log-in credentials to the inventory management system for any staff that have access to
controlled substances.
4: The Fire Department should update policies to formalize central supply oversight, including:
a. The process for reviewing vials for evidence of tampering; b. Approval for the creation of new inventory management system users;
c. A requirement for reconciliation of orders, invoices, and receipts of controlled substances;
d. A requirement to have a witness for medication destruction; and
7 Per the County of Santa Clara Emergency Medical Services System Policy #108: “Level A Variances are any incident that result in a threat to public safety, patient, by-stander or resp onder harm.” This includes: “Violating or attempting to violate any federal or state statute or regulation that regulates narcotics, dangerous drugs, or controlled substances.” Audit of Fire Department Inventory Controls
22 e. A requirement to notify the County of Santa Clara Emergency Medical Services Agency of variances per County policy.
Additional Controls Would Further Secure the Main Safe Inventory Beyond separating existing duties over the central supply, further controls would help ensure the security of the medication vial s in the main safe. This includes oversight controls as well as additional physical security.
The main safe can be physically accessed without two people present, though any changes to the inventory are expected to be recorded in the inventory management system. Periodic inventory counts, a bi ometric or camera-monitored safe, and management review of inventory reports woul d all improve the security of main safe medication.
Exhibit 3: Biometric Safes and Additional Oversight Would Improve Main Safe Security
CSPM
Duty
Witness/
Approval Control Weakness Improved Control
Access main
safe
Current
practice is to
have a witness,
but not
required by
policy
Main safe can physically be
accessed without a second
person present.
A biometric safe or a camera
positioned on the main safe
are mitigating controls if main
safe can be accessed single
individuals.
Periodic inventory counts of
the safe would detect theft or
mismanagement of vials.
Lastly, the policy should
clarify that a witness should
always be present when the
safe is opened.
Remove vials
from main
safe for
restocking
Witness
required by
system
Main safe can physically be
accessed without a second
person present. CSPM and
other designated EMS staff
remove vials from the safe
to restock a
pparatus boxes.
Inventory reports reviewed
by management provide
oversight to detect
unauthorized activity.
Restock
apparatus
boxes
Specific
witness
required by
system
None.
To restock a controlled substance box on an apparatus, the paramedic assigned to the box is required by the system to be the witness. This prevents the person restocking from falsifying that they put a vial into a paramedic’s box.
Source: Auditor observations and analysis of San José Fire Department EMS policies and procedures.
Finding 2
23 Periodic Inventory Counts Help Detect Theft
Periodic inventory counts are a best practice for inventory management to detect any theft or diversion. The DEA requires that controlled substances registrants inventory all controlled substances at least every two years. The San Francisco Fire Department and the City of Santa Clara Fire Department report counting their main safe inventory monthly. The Cal Fire Santa Clara Unit’s policy is also to count the inventory monthly.
The Oakland Fire Department reports that they count their inventory every four to five months.
Biometric Safes Provide Records of Main Safe Access
A biometric safe would provide a record of who has accessed the main safe. The current Fire Department practice is that one individual can access the main safe independently—that is, one person can a ccess all the keys without another person having to be physically present. 8 A biometric safe, as discussed in Finding 1, records the specific person who opened the safe. This allows for oversight of safe access.
An alternative is a camera to record who is accessing the safe. If there is a discrepancy or concern about the inventory, staff could use the recordings to review who opened the safe, whether there was a witness, and what activity took place.
The San Francisco, Oakland, County of Los Angeles, and City of Los Angeles Fire Departments all reported having cameras re cording activity for their main safe. The City of Santa Clara reported that they have biometric safes for their main supply.
Management Should Review Inventory Reports
Several Fire Department staff have keys to the main safe. Though the CSPM plays the primary role in controlled substances over sight and distribution, other staff can and do remove vials from the safe.
Regular reviews of the inventory records would help detect unauthorized activity and keep management informed of the changes to the main safe inventory. Currently, there are no reports available that chronicle wh o took medications from the main safe and when. Requiring the regular review of thes e reports ensures that there is direct oversight over the decisions and actions of the CSPM and other staff with keys to the main safe.
8 All changes to the inventory, including moving vials from the main safe into a distribution box to deliver to fire apparatus, are expected to be recorded in the inventory management system.
Audit of Fire Department Inventory Controls
24 Recommendations:
5: To improve detection of tamperin g or theft of controlled substances kept in the central supply, the Fire Department should update the Controlled Substances Control Policy to require periodic inventory counts of the main safe and reconciliations to inventory records. 6: To improve the security of main safe access, the Fire Department should:
a. Update the Controlled Substances Control Policy to require a witness to be present any time the safe is opened, and b. Position a camera on the main safe to record activity or acquire biometric safes that log access.
7: To improve oversight over the main safe inventory, the Fire Department should develop inventory management system reports that detail main safe inventory changes and update the Controlled Substances Control Policy to require periodic review of those reports by management overse eing the Emergency Medical Services Division.
25 Conclusion
The San José Fire Department has controls in place to manage the inventory of controlled substances. This audit found no evidence of tampering or theft, but there are areas where policies could be improved to reflect current practices and strengthen controls. For controlled substanc es on fire apparatus, policies should clarify timing and requirements for inve ntory reviews, access, and storage, particularly as the Fire Department transi tions to the use of biometric safes. For the central supply, duties for handling me dication, updating records, and system administration are overly concentrated in one role, creating risk. Separating duties among staff with appropriate oversight, documentation, and updated policies would enhance security.
RECOMMENDATIONS
Finding 1: Policies Require Securing Controlled Substances on Fire Apparatus But Should Be Clarified to Reflect Current Practices
Recommendation #1: To ensure the Controlled Substances Control Policy reflects current practices, the Fire Department should update the policy to provide further clarity on:
a. Timing of daily verifications performed by pa ramedics of controlled substances boxes on fire apparatus;
b. Storage and access for controlled substances on reserve apparatus; c. Frequency, scope, and required documentat ion of Emergency Management Services Division inventory reviews of controlled substances boxes across fire stations; and d. Allowable uses and requirements for remote ha ndoffs of controlled substances (“pick up from crew”).
Recommendation #2: To enhance the security of controlled substances on apparatus, once biometric safes are acquired, the Fire Depart ment should update the Controlled Substances Control Policy to address access and usage, including:
a. Who should have access to the apparatus safes,
b. The storage and access to backup keys, and
c. Whether daily verifications by paramedics are still needed.
Finding 2: Separating the Duties for Ce ntral Supply Management Would Strengthen Inventory Controls
Recommendation #3: To separate critical duties for management of the central supply of controlled substances, the Fire Department should:
a. Assign system administration duties, primarily the ability to create new users in the system and change user permissions, to personnel that do not have controlled substance handling or record management duties.
Audit of Fire Department Inventory Controls
26 b. Assign certain duties for record management, such as reconciling ordered medication, logging new medication into the inventory, and logging the removal of medication upon destruction to personnel that do not have controlled substance handling or system administrator privileges.
c. Disallow multiple log-in credentials to the inventory management system for any staff that have access to controlled substances.
Recommendation #4: The Fire Department should update policies to fo rmalize central supply oversight, including:
a. The process for reviewing vials for evidence of tampering; b. Approval for the creation of new inventory management system users; c. A requirement for reconciliation of orders, invoices, and receipts of controlled substances; d. A requirement to have a witness for medication destruction; and e. A requirement to notify the County of Santa Clara Emergency Medical Services Agency of variances per County policy.
Recommendation #5: To improve detection of tampering or theft of controlled substances kept in the central supply, the Fire Department should update the Controlled Substances Control Policy to require periodic inventory counts of the main safe and reconciliation to inventory records.
Recommendation #6: To improve the security of main safe access, the Fire Department should:
a. Update the Controlled Substances Control Polic y to require a witness to be present any time the safe is opened, and
b. Position a camera on the main safe to record activity or acquire biometric safes that log access.
Recommendation #7: To improve oversight over th e main safe inventory, the Fire Department should develop inventory management system report s that detail main safe inventory changes and update the Controlled Substances Control Policy to require periodic review of those reports by management overseeing the Emergency Medical Services Division.
APPENDIX A
Audit Objective, Scope, and Methodology
A-1
The mission of the City Auditor’s Office is to id entify ways to increase the economy, efficiency, effectiveness, equity, and accountability of City gove rnment by independently assessing and reporting on City operations and services. The audit function is an essential element of San José’s public accountability, and our audits provide the City Council, City manage ment, and the public with independent analysis, reliable information, and recommendations for impr ovement of City operations and services. In accordance with the City Auditor’s Fiscal Year (F Y) 2025-26 Audit Work Plan, we have completed an audit of Fire Department’s inventory controls over controlled substances. Th e audit was conducted in response to a request from the Fire Chief following an incident involving damage and suspected tampering of controlled substances containers in April 2025.
We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reason able basis for our findings and conclusions based on our audit objectives.
The objective of this audit was to assess inventory controls over controlled substances in the Fire Department. We sought to understand the relevant internal controls over the Fire Department’s controlled substances, and have performed the following to achieve the audit objective:
• To verify the inventory of controlled substances and check for evidence of tampering, we:
o Visited 11 fire stations with the Controlled Substances Program Manager. Visits were conducted on one day in July 2025 in two battalio ns selected by the au dit team. Vials were compared to inventory records and reviewed for evidence of tampering. o Conducted unannounced audits of controlled substa nces at six fire stations over three days in August 2025, with the accompaniment of a battalion chief. The stations were randomly selected by the audit team. Vials were compared against inventory records and reviewed for evidence of tampering.
o Conducted an unannounced audit of the main safe inventory. This included both the safe for new medications and the safe for expired medications. The entire inventory was counted and compared to records from the inventory manage ment system, and a random sample of vials were individually reviewed for evidence of tampering.
• To understand the process for ordering, receivin g, distributing, administering, wasting, and destroying controlled substances, we:
o Interviewed the Controlled Substances Progr am Manager, EMS Battalion Chief, and Deputy Chief over EMS and Training.
o Interviewed paramedics at five fire stat ions during unannounced audits about their administration and wasting processes.
o Observed the process for ordering morphine sulfate with the Fire Department Medical Director.
o Observed the process for recording new vial s in the inventory management system and labeling vials.
A-2
o Observed the restocking process of the Controlled Substances Program Manager. o Observed the destruction of medication from expired and damaged vials. • To observe the physical controls over controlled substances on fire apparatus and the main safe, we:
o Observed the main safe locks and key access.
o Observed the locks, cables, and location of controlled substances boxes on fire apparatus that were in place during our audit testing.
• To understand compliance with policies, procedures, and regulations, we:
o Reviewed relevant sections of the federal Code of Regulations, U.S. Controlled Substances Act, California Code of Regulations, California Health and Safety Code, and County of Santa Clara Emergency Medical Services Agency policies.
o Reviewed relevant sections of the San José Fire Department policies and procedures manual and special bulletins.
o Used inventory management system records on selected days to verify that daily audits were performed by paramedics.
o Used inventory management system records to review historical data from 2025 to ensure all transactions were witnessed in accordance with policy and that witnesses were San José Fire Department employees.
• To ensure appropriate access to the inventor y management system, we reviewed user group permissions and level of access of the Controlled Substances Program Manager. • Benchmarked with other jurisdictions to understan d their practices and policies, including: the cities of Santa Clara, Oakland, Los Angeles, Sacramento, and Mountain View; the counties of Santa Clara and Los Angeles; the city and county of Sa n Francisco; and the California Department of Forestry and Fire Protection (Cal Fire) Santa Clara Unit.
We would like to thank the Fire Department for their time and insight during the audit process.
11/19/2025
TO: JOE ROIS
CITY AUDITOR
FROM: Robert Sapien, Jr.
SUBJECT: See Below DATE: November 20, 2025
Approved Date:
SUBJECT:
Fire Inventory Controls Over Controlled Substances: Clarifying Policies and Separating Duties Would Further Improve Security
BACKGROUND
The Fire Department (Department) has reviewed the report from the City Audit or (Fire
Inventory Controls Over Controlled Substances: Clarifying Policies and Separating Duties Would Further Improve Security) and agrees with the seven (7) recommendations identified in the report. This memorandum captures the Fire Department’s response to each recommendation and presents an overview of the work required to fully implement the recommendations, and the associated timeframes for completion. The Fire Department greatly appreciates the work of the City Auditor and audit staff for this evaluation and looks forward to fortifying its operational readiness, aligning itself with industry best practices, and safeguarding its personnel and the greater San José community when delivering emergency medical services.
The Fire Department’s mission is to protect life, property, and the environment through prevention and response. Response capabilities include fire suppression, rescue, hazardous materials/hazardous condition response, and emergency medical services (EMS) at the basic life support and advanced life support (ALS) levels. The Department has been providing ALS EMS response services since 1995. EMS demand has increased over time, and today, the Department is a substantial provider of medical care for the community, responding to 68,492 medical-only requests in Fiscal Year 2024- 2025 and providing medical care at many of the 42,880 incidents in other categories, including fires, rescues, and vehicle accidents. The Department provides ALS as part of its emergency medical services under an agreement with the County of Santa Clara Emergency Medical Services Agency (County EMS). ALS is the highest level of care paramedics provide when someone has a serious medical emergency, using advanced
JOE ROIS, CITY AUDITOR
November 20, 2025
Subject: Fire Inventory Controls Over Controlled Substances
skills such as breathin
g support with tools like airway tubes, heart monitoring, intravenous treatments, and emergency medications to keep the patient safe and stable until they reach definitive care. Per County EMS protocols, the Department maintains supplies of morphine sulphate and midazolam to provide ALS standard of care.
Morphine is a narcotic used for pain management. Midazolam is a benzodiazepine used to treat seizures and for sedation. Both substances are kept on field companies, including fire engines, trucks, and other apparatus providing ALS services. The Department’s EMS Division manages department-wide inventories, including a supply of controlled substances at a central location for distribution to frontline resources.
In April 2025, during a routine controlled substance inventory audit at a fire station, containers of morphine sulphate were found to have been damaged with suspicion of tampering. Upon discovery of the anomalies in the controlled substance inventory, the Department notified law enforcement, including the San José Police Department and the United States Drug Enforcement Agency, and initiated a department-wide assessment of controlled substance inventories to ensure ongoing operational readiness. The Department fully cooperated with law enforcement investigation efforts.
Additionally, the Department launched an internal review and implemented interim controls to strengthen accountability and chain of custody at all phases of inventory control, including the following actions:
1. Daily Close Inspection of Inventories: Department directive issued April 25, 2025, establishing full daily verifications of all controlled substance boxes on every vehicle that carries ALS equipment and required that all audits include breaking and resealing tamper-evident locks with a Company Officer as witness.
Additionally, the directive required immediate documentation of verification results in the Department’s inventory software system (Operative IQ) and reporting of any discrepancies through the chain-of-command.
2. Redundant Locking Systems: Department directive issued May 23, 2025, introduced a new cable-lock system that physically secured the medication cases to the ALS vehicle using a standardized locking system with two matching keys.
This measure eliminated the possibility of a case being removed or accessed by unauthorized individuals, standardized key control practices, and strengthened compliance with the United States Drug Enforcement Agency and County EMS security expectations.
3. Hardened Stowage and Access Monitoring: The Fiscal Year 2025-2026 Adopted Budget allocated one-time funding of $200,000 to procure biometric access control narcotics safes for each ALS response vehicle to restrict access to authorized personnel and maintain a precise automated record of activities.
4. External Review of Department Controlled Substance Program: The Fire Chief requested that the City Auditor’s Fiscal Year 2025-2026 work plan include an audit of Fire Department controlled substance procedures and practices.
JOE ROIS, CITY AUDITOR
November 20, 2025
Subject: Fire Inventory Controls Over Controlled Substances
On June 23, 2025, the City Auditor convened the Fire Inventory Controls Audit entrance meeting with the Department. The Department welcomed the audit and supported the effort throughout. As the audit progressed, the City Auditor provided periodic updates, which served to allow the Department to validate and/or refocus efforts toward adopting inventory control best practices.
As the audit proceeded, the Department advanced additional inventory control measures, including:
1. Chain of Custody Procedure Refinements: On October 2, 2025, the Department issued a directive formalizing custody transfer procedures and tracking within Operative IQ, specifying required steps for all controlled substance custody changes and specific exceptions when the off going custodian paramedic cannot be present for the transfer. The directive also prohibited storing controlled substances in fire station safes and clarified expectations for reserve apparatus, ensuring that controlled substances and their keys always remain under the custody of an authorized individual.
2. Interim Hardened Stowage Solution: On October 16, 2025, the Department issued a directive transitioning stowage of controlled substances to steel lock boxes securely mounted in each ALS vehicle, accessible by a single key held by an authorized individual. Controlled substances remain secured in the lock box with the individual identified as responsible in Operative IQ. The interim stowage solution was fully implemented on October 28, 2025. These steel lock boxes are anticipated to be upgraded to a biometric-controlled access system within Fiscal Year 2025-2026.
The Department appreciates the collaboration of the City Auditor’s Office and concurs with the two (2) findings and seven (7) recommendations. The Department has already completed several corrective actions and continues to evaluate and monitor its controlled substance security program to ensure alignment with best practices and regulatory requirements.
FINDINGS, RECOMMENDATIONS, AND ADMINISTRATION RESPONSES
Finding 1: Policies Require Securing Controlled Substances on Fire Apparatus but Should Be Clarified to Reflect Current Practices
JOE ROIS, CITY AUDITOR
November 20, 2025
Subject: Fire Inventory Controls Over Controlled Substances
Recommendation #1: To ensure the Controlled Substances Control Policy reflects current practices, the Fire Department should update the policy to provide further clarity on:
a.) Timing of daily verifications performed by paramedics of controlled substances boxes on fire apparatus.
b.) Storage and access for controlled substances on reserve apparatus. c.) Frequency, scope, and required documentation of Emergency Management Services Division inventory reviews of controlled substances boxes across fire stations; and
d.) Allowable uses and requirements for remote handoffs of controlled substances (“pick up from crew”).
Administration Response: The Administration agrees with this recommendation.
Green – 1(a): On October 16, 2025, the Department issued its directive transitioning stowage of controlled substances to steel lock boxes. This directive specified that daily controlled substance inventory verifications (audits) shall occur at the start of each calendar day, and at every instance of custody transfer between individuals. The directive included audit procedures and recordkeeping requirements within Operative IQ. This directive was reinforced at department-wide in-person training in October 2025.
Department Policy and Procedure Manual section 5.700.21 – Controlled Substance Control Policy will be revised to reflect current requirements by December 1, 2025.
Green – 1(b): On October 2, 2025, the Department issued a directive formalizing custody transfer procedures and tracking within Operative IQ, specifying required steps for all controlled substance custody changes and specific exceptions when the off going custodian paramedic cannot be present for the transfer (“pick up from crew” procedure).
The directive also prohibited storing controlled substances in station safes and clarified expectations for reserve apparatus, ensuring that controlled substances and their keys always remain under the custody of an authorized individual. The implementation of the steel box control system, effective October 28, 2025, specified that controlled substances assigned to reserve apparatus are to be stowed and securely locked in the steel box on the reserve apparatus. The responsible paramedic now carries the key to the box on their person. If a reserve apparatus is taken in for repair or maintenance, the controlled substances are locked in the safe at the EMS Division. Department Policy and Procedure Manual section 5.700.21 – Controlled Substance Control Policy will be revised to reflect current requirements by December 1, 2025.
Green – 1(c): The EMS Division conducts monthly department-wide random audits of 25 percent of controlled substance caches. This audit includes verification of the
JOE ROIS, CITY AUDITOR
November 20, 2025
Subject: Fire Inventory Controls Over Controlled Substances
controlled substances seal, the inventory of each cache and inspection for evidence of tampering, and verification of the lot number and the expiration date. In addition, each time an authorized EMS Division officer handles a cache for restock, a complete audit is conducted. On October 16, 2025, the Department issued its directive transitioning stowage of controlled substances to steel lock boxes. Upon implementation of this directive on October 28, 2025, 100 percent of the controlled substance caches were audited. Department Policy and Procedure Manual section 5.700.21 – Controlled Substance Control Policy will be revised to reflect current requirements by December 1, 2025.
Green – 1(d): On October 2, 2025, the Department issued a directive formalizing custody transfer procedures and tracking within Operative IQ, specifying required steps for all controlled substance custody changes and specific exceptions when the off going custodian paramedic cannot be present for the transfer (“pick up from crew” procedure).
When the “pick up from crew” procedure is exercised, an Incident Report must be generated in Operative IQ explaining the circumstances. The “pick up from crew” procedure was reinforced in department-wide in-person training conducted in October 2025. Department Policy and Procedure Manual section 5.700.21 – Controlled Substance Control Policy will be revised to reflect current requirements by December 1, 2025.
Target Completion Date: June 30, 2026
Recommendation #2: To enhance the security of controlled substances on apparatus, once biometric safes are acquired, the Fire Department should update the Controlled Substances Control Policy to address access and usage, including:
a.) Who should have access to the apparatus safes,
b.) The storage and access to backup keys, and
c.) Whether daily verifications by paramedics are still needed.
Administration Response: The Administration agrees with this recommendation.
Yellow – 2(a, b, c): The Fiscal Year 2025-2026 Adopted Budget allocates one-time funding of $200,000 to procure biometric access control narcotics safes for each ALS response vehicle to restrict access to authorized personnel and maintain precise automated record of activities. The Department has initiated procurement for biometric safes. Once deployed, the Department will evaluate user access levels, backup key security, and the potential modification of daily verification requirements. Department Policy and Procedure Manual section 5.700.21 – Controlled Substance Control Policy will be revised to reflect current requirements upon deployment of biometric safes.
Undetermined time factors include procurement and installations.
JOE ROIS, CITY AUDITOR
November 20, 2025
Subject: Fire Inventory Controls Over Controlled Substances
Target Completion Date: December 31, 2026
Finding 2: Separating the Duties for Central Supply Management Would Strengthen Inventory Controls.
Recommendation #3: To separate critical duties for management of the central supply of controlled substances, the Fire Department should:
a.) Assign system administration duties, primarily the ability to create new users in the system and change user permissions, to per sonnel that do not have controlled substance handling or record management duties
b.) Assign certain duties for record m anagement, such as reconciling ordered medication, logging new medication into t he inventory, and loggi ng the removal of medication upon destruction to personnel that do not have controlled substance handling or system administrator privileges.
c.) Disallow multiple log-in credentials to the invent ory management system for any staff that have access to controlled substances.
Administration Response: The Administration agrees with this recommendation.
Green – 3(a): The Department will disaggregate responsibilities of the existing Controlled Substances Program Manager (Fire Captain) and ensure separation of new user account creation, password management and system permissions functions from handling of controlled substances and/or controlled substance records management.
These functions will be assigned to other staff. This change occurred on November 14, 2025. Department Policy and Procedure Manual section 5.700.21 – Controlled Substance Control Policy will be revised to reflect current requirements by December 1, 2025.
Green – 3(b): The Department is currently proceeding with the assignment of records management and order reconciliation responsibilities to the EMS Division Manager (Battalion Chief). The EMS Division Manager does not have controlled substance or system administrator privileges. This change occurred on November 14, 2025. The effectiveness of this assignment of responsibilities will be monitored and adjusted as deemed appropriate, maintaining the outcomes as recommended. Department Policy and Procedure Manual section 5.700.21 – Controlled Substance Control Policy will be revised to reflect current requirements by December 1, 2025.
Green – 3(c): Multiple log-in credentials in Operative IQ for staff who have access to controlled substances have been disallowed. When the system was first implemented, the fictitious users were created to simplify system development. Practice in the EMS Division is that no controlled substance transactions are allowed to use fictitious user
JOE ROIS, CITY AUDITOR
November 20, 2025
Subject: Fire Inventory Controls Over Controlled Substances
credentials. The fictitious user profiles in the system have been inactivated, and the ability to create new user profiles has been removed from anyone who has access to controlled substances. In addition, the EMS Division Manager now has increased oversight for the entire process. This change occurred on November 14, 2025.
Department Policy and Procedure Manual section 5.700.21 – Controlled Substance Control Policy will be revised to reflect current requirements by December 1, 2025.
Target Completion Date: December 1, 2025
Recommendation #4: The Fire Department should update policies to formalize central supply oversight, including:
a.) The process for reviewing vials for evidence of tampering, b.) Approval for the creation of new inventory management system users, c.) A requirement for reconc iliation of orders, invoices, and receipts of controlled substances,
d.) A requirement to have a witness for medication destruction; and e.) A requirement to notify the County of Santa Clara Emergency Medical Services Agency of variances per County policy.
Administration Response: The Administration agrees with this recommendation.
Green – 4(a): Procedures for close daily inspection of vials have been communicated through official directives and reinforced at department-wide in-person training conducted in October 2025. Department Policy and Procedure Manual section 5.700.21 – Controlled Substance Control Policy will be revised to reflect current requirements by December 1, 2025.
Green – 4(b): As noted in the Department’s response to recommendation 3(a), the Department will disaggregate responsibilities of the existing Controlled Substances Program Manager and ensure separation of new user account creation, password management, and system permissions functions from handling of controlled substances and/or controlled substance records management. The Department is drafting revised procedures, including approval requirements for the creation of new inventory management system users. Department Policy and Procedure Manual section 5.700.21 – Controlled Substance Control Policy will be revised to reflect current requirements by December 1, 2025.
Green – 4(c): As the Department disaggregates responsibilities of the current Controlled
Substances Program Manager, activities related to the reconciliation of orders, invoices, and receipts of controlled substances will be reassigned, and requirements will be
JOE ROIS, CITY AUDITOR
November 20, 2025
Subject: Fire Inventory Controls Over Controlled Substances
specified in the Controlled Substance Control Policy. This change occurred on November 14, 2025. Department Policy and Procedure Manual section 5.700.21 – Controlled Substance Control Policy will be revised to reflect current requirements by December 1, 2025.
Green – 4(d): All tasks in Operative IQ require a witness. Department Policy and Procedure Manual section 5.700.21 – Controlled Substance Control Policy will be revised to reflect requirements of witnesses at all stages of controlled substance custody with targeted completion by December 1, 2025.
Green – 4(e): Santa Clara County EMS Policy 108
1, requires that any deviation from
established controlled substance laws be immediately reported to the County EMS Duty Chief through County Communications. Department Policy and Procedure Manual section 5.700.21 – Controlled Substance Control Policy will be revised to reflect this requirement by December 1, 2025.
Target Completion Date: December 1, 2025
Recommendation #5: To improve detection of tamper ing or theft of controlled substances kept in the central supply, the Fire Department should update the Controlled Substances Control Policy to require periodic inventory counts of the main safe and reconciliations to inventory records.
Administration Response: The Administration agrees with this recommendation.
Green – 5: Quarterly inventory counts and verification of both new and expired medication safes are now being conducted, with reconciliation against Operative IQ records. These counts are done by the Distribution Manager (Fire Captain 2313) and witnessed by either the Inventory Control Manager (Battalion Chief 2314) or the System Administrator (Analyst II 1632). Department Policy and Procedure Manual section
5.700.21 – Controlled Substance Control Policy will be revised to reflect current requirements by December 1, 2025.
Target Completion Date: December 1, 2025
1https://files.santaclaracounty.gov/exjcpb1541/migrated/Policy108.pdf?VersionId=44F9WNyucz1VvSVw7 7LLVdOjYOgQQiNv
JOE ROIS, CITY AUDITOR
November 20, 2025
Subject: Fire Inventory Controls Over Controlled Substances
Recommendation #6: To improve the security of main safe access, the Fire Department should:
a.) Update the Controlled Substances Control Policy to require a witness to be present any time the safe is opened, and
b.) Position a camera on the main safe to record activity or acquire biometric safes that log access.
Administration Response: The Administration agrees with this recommendation.
Green – 6(a): A two-person access rule is currently in practice for all main safe openings. The Department has determined biometric safes to be the more effective long-term solution and has initiated steps for procurement. Department Policy and Procedure Manual section 5.700.21 – Controlled Substance Control Policy will be revised to reflect current requirements by December 1, 2025.
Yellow – 6(b): The Department has initiated procurement for biometric safes, including a main safe.
Target Completion Date: December 31, 2026
Recommendation #7: To improve oversight over the main safe inventory, the Fire Department should develop inventory management system reports that detail main safe inventory changes and update the Controlled Substances Control Policy to require periodic review of those reports by management overseeing the Emergency Medical Services Division.
Administration Response: The Administration agrees with this recommendation.
Green – 7: As previously stated in the response to Recommendation #5, the Department has initiated quarterly counts and verification of the contents of the main safe. As stated in the response to Recommendation #4, the duties of system management have been separated to allow for better security. The EMS Division is currently reviewing the capabilities of Operative IQ for the generation of reports that “detail main safe inventory changes.” Once those reports are developed, they will be automated and sent to the Inventory Control Manager monthly. Department Policy and Procedure Manual section 5.700.21 – Controlled Substance Control Policy will be revised to reflect current requirements by December 1, 2025.
Target Completion Date: December 1, 2025
JOE ROIS, CITY AUDITOR
November 20, 2025
Subject: Fire Inventory Controls Over Controlled Substances
COORDINATION
This memorandum has been coordinated with the City Attorney’s Office and the City Manager’s Budget Office.
CONCLUSION
The Department appreciates the City Auditor’s comprehensive review of the Department’s inventory controls over controlled substances. The audit report recommendations will guide the Department’s continued improvement of its Controlled Substances Program. The Department has completed significant corrective actions, including the transition to steel lock boxes, and is working to implement remaining policy and oversight updates within the proposed timelines. The Department values the recommendations and would like to thank the City Auditor and staff for this review.
Robert Sapien, Jr.
Fire Chief, Fire Department
For questions, please contact Brad Morales-McGibben, Battalion Chief, EMS Division, at [email protected] or (408) 794-7020.