CVS Pharmacy Case:

On October 14, 2010, the United States (US) Attorneys Office for the Central District of California announced that CVS Pharmacy, Inc. (CVS Pharmacy) was fined $77.5 million (which included a $75 million civil penalty and the forfeit of $2.5 million profit) for its unlawful sales of pseudoephedrine to organized crime between September 2007 and November 2008 (US Department of Justice, 2011). Pseudoephedrine is a regulated drug used to treat nasal and sinus congestion. The company was charged for its failure to comply with laws that limited the quantity of the drug sold to individual customers. The sales, according to the Attorneys Office, directly caused an increase in the production of methamphetamine in California.

CVS Pharmacy is the retail pharmacy subsidiary of CVS Caremark Corporation (hereinafter collectively referred to as CVS). In addition to retail pharmacies, CVS also operates pharmacy services, retail clinics, and mail-order pharmacy businesses. In fiscal year 2010, CVS had net revenues of more than $96 billion and a net profit of more than $3 billion (CVS Caremark Corporation, 2010a). In 2010, CVS was the 18th largest company in the Fortune 500, according to its annual report, and one of the largest retail pharmacy chains in the United States (US). As of December 31, 2010, it operated more than 7,100 retail pharmacy stores in the US.

The markets in which CVS had a presence also increased from 36 states in 2004 to 44 states in 2010. Like other companies in the industry, CVS had to efficiently and effectively manage various risks, such as regulatory compliance and economic downturns, in order to deliver strong growth and returns to shareholders (CVS Caremark Corporation, 2010a).

CVS Pharmacys compliance practices

According to the investigation by the DEA and other law enforcement agencies (US Attorneys' Office, 2010), CVS Pharmacy had implemented certain measures in order to comply with the CMEA. These measures included physical control of pseudoephedrine, a paper-based logbook, and subsequently, an electronic logbook (which replaced the paper-based logbook).

1.2.1. Physical control To comply with the CMEA, CVS Pharmacy moved all products containing pseudoephedrine behind cash register counters in its

retail stores. The company also provided written materials to train and educate employees about the new federal requirements and the problem of using pseudoephedrine to make methamphetamine.

1.2.2. Paper logbook CVS Pharmacy initially implemented paper-based logbooks, which were deemed CMEA-compliant. By using the paper logbook,

cashiers at each store were able to track and prevent excessive pseudoephedrine sales. The paper logbooks recorded customer names alphabetically and past purchases made by customers.

However, the paper logbooks had some limitations, as CVS Pharmacy suggested (US Attorneys' Office, 2010). The limitations included:

1. Store clerks had to review the logbooks and make manual calculations of daily and monthly purchases by customers; 2. Recording sales in the paper logbooks and verifying quantity limits caused delays at the cash register counter and caused in-

convenience for customers; 3. Use of the logbooks caused some privacy concerns because customers would have to sign the logbook in front of others; and 4. Each individual retail store had its own logbook, and data was difficult to aggregate across stores.

1.2.3. Electronic logbook In 2007, CVS Pharmacy decided to replace the paper logbooks with a computer system called MethCheck.1 The system allowed

CVS Pharmacy stores to track pseudoephedrine sales and provided information to law enforcement agencies when needed. The system was to be implemented at all CVS Pharmacy stores across the US.

The key feature of the MethCheck system was called LookBack, which was designed to track and review customer purchases of pseudoephedrine and prevent any sales that violated federal and state limits. Without the LookBack feature, the system would be dysfunctional. The feature, however, needed to be turned on for all states, regardless of whether a state had daily or monthly limits on pseudoephedrine purchases by individuals (some states, e.g. California and Nevada, do not set monthly limits).2

CVS Pharmacy implemented the MethCheck by disabling the LookBack features in those states that did not impose monthly limits.3 By doing so, the company was essentially unable to prevent aggregated purchases by an individual that exceeded the daily limit of 3.6 g imposed by the CMEA. As a result of implementing the MethCheck, the sales of pseudoephedrine at CVS Pharmacy stores increased significantly from late 2007 to late 2008, particularly in California and Nevada. During that time, some CVS Pharmacy employees raised concerns about excessive purchases of the drug by individuals. Management, however, did not respond promptly by investigating the suspicious increases in sales. Instead, employees were instructed to rely on the MethCheck system to determine whether or not to block a customer purchase. After the government started its investigation of the companys compliance, CVS Pharmacy changed the configuration of the MethCheck system by enabling the LookBack feature at stores in California and Nevada in late 2008 and all other states in February 2009.

1.3. Post-investigation remedial measures

During the governments investigation, CVS Pharmacy accepted the responsibility for unlawful sales of pseudoephedrine (US Attorneys' Office, 2010). More specifically, the company acknowledged some unlawful conduct in the California and Nevada stores: (1) employees at certain CVS Pharmacy stores knowingly sold the drug over the legal limits; (2) the stores that oversold the drug had reasonable knowledge that the drug would be used to make methamphetamine; and (3) the companys distribution center was in a position to monitor and report the excessive sales of pseudoephedrine, but failed to do so.

1 The MethCheck system was designed and marketed by Appriss, Inc., http://www.appriss.com. A brief description of the system can be found on the software vendors website: http://www.appriss.com/sitedocs/MethCheckWhitePaper.pdf (accessed October 20, 2010). 2 Federal laws are different from state laws. According to the US Attorneys Office (2010), the CMEA (a federal law) does not preempt state law but leaves in place

varying state requirements governingmonthly sales of PSE to individual customer.. 3 These states included: Alabama, Arizona, California, Colorado, Connecticut, District of Columbia, Florida, Georgia, Kansas, Maine, Maryland, Massachusetts,

Michigan, Nevada, New Hampshire, New Jersey, New York, North Dakota, Ohio, Pennsylvania, Rhode Island, South Carolina, Texas, Virginia, and Vermont.

K.H. Guo, B.L. Eschenbrenner Journal of Accounting Education 42 (2018) 1726

As part of the non-prosecution agreement with the government, CVS Pharmacy was required to establish and maintain a Compliance and Ethics Program. This program required the company to exercise due diligence to prevent criminal conduct, promote and encourage ethical conduct, maintain procedures for an anonymous reporting mechanism, and discipline employees who violated company policies.

Please answer the following table based on the case and IT risk

Using the COBIT 5 framework, perform an analysis of CVS Pharmacys adoption of the MethCheck system immediately prior to the governments investigation. Identify IT risks (e.g. configuration deficiencies) that may influence CVS Pharmacys implementation

COBIT Processes/Domains	IT risk
Governance
1) Evaluate, Direct, and Monitor
Management
2) Align, Plan & Organize
3) Build, Acquire & Implement
4) Deliver, Service & Support
5) Monitor, Evaluate, & Assess