Pillard, Circuit Judge

Richard T. Lauer argued the cause for petitioner. With him on the briefs were John A. Gilbert Jr., Karla L. Palmer, and Andrew J. Hull, Washington, DC.

Nicolas Riley, Attorney, U.S. Department of Justice, argued the cause for respondent. With him on the brief were Benjamin C. Mizer, Principal Deputy Assistant Attorney General, and Mark B. Stern, Attorney. Anita J. Gay and Lena D. Watkins, Attorneys, entered appearances.

Gregory G. Garre, Philip J. Perry, Andrew D. Prins, Alexandra Shechtel, Richard L. Frank, David L. Durkin, Washington, DC, and Donald L. Bell II were on the brief for amici curiae Healthcare Distribution Management Association and National Association of Chain Drug Stores in support of neither party.

Larry P. Cote, Washington, DC, was on the brief for amicus curiae Generic Pharmaceutical Association in support of neither party and in support of neither affirmance nor reversal.

Before: Srinivasan and Pillard, Circuit Judges, and Edwards, Senior Circuit Judge.

Pillard, Circuit Judge:

Breakthroughs in the development of prescription opioid painkillers have vastly increased their popularity. But that popularity has taken a toll. Opioids are heavily addictive and often lethal in high doses. The Drug Enforcement Administration (DEA or agency) has therefore listed opioids such as hydrocodone and oxycodone as controlled substances so that DEA can monitor and restrict their sale. Over the past two decades, DEA has been battling a steep increase in prescription opioid abuse—a problem that DEA views as an "epidemic." U.S. Dep't of Justice, Drug Enf't Admin., Order to Show Cause (Aug. 9, 2013), J.A. 8-9. The Department of Health and Human Services (HHS), too, sees the rising abuse of prescription opioids as "a serious and challenging" public health issue. DEP'T OF HEALTH & HUMAN SERVS., OPIOID ABUSE IN THE U.S. AND HHS ACTIONS TO ADDRESS OPIOID-DRUG RELATED OVERDOSES AND DEATHS (2015). Since 1999, the number of deaths from prescription painkillers in the United States has more than quadrupled. CENTERS FOR DISEASE CONTROL AND PREVENTION , Opioid Overdose: Understanding the Epidemic , https://www.cdc.gov/drugoverdose/epidemic/index.html (last visited June 12, 2017). Prescription opioids now kill an average of 44 Americans per day. U.S. DEP'T OF HEALTH & HUMAN SERVS. , About the Epidemic , https://www.hhs.gov/opioids/about-the-epidemic (last visited June 12, 2017).

Masters Pharmaceuticals, Inc., (Masters) supplies prescription medications in bulk to pharmacies across the United States. Before this litigation began, Masters was registered with DEA as a vendor of controlled substances, including opioids. As a registrant, Masters had an obligation to report to DEA suspicious orders for controlled substances and to take other precautions to ensure that those medications would not be diverted into illegal channels.

This case challenges DEA's 2014 decision to revoke Masters' certificate of registration, without which Masters cannot sell controlled substances. The revocation order turned on DEA's conclusion that Masters had shirked its legal obligation to report suspicious orders for controlled substances. Masters challenges the factual basis of DEA's revocation decision, and claims it exceeded DEA's authority under its existing regulations, effectively broadening them in a manner that was inconsistent with the Administrative Procedure Act (APA). In addition, Masters suggests, DEA improperly relied on arguments and evidence that were not presented during the administrative trial, in violation of the Due Process Clause. Because we see no prejudicial error in DEA's decision, we deny Masters' petition for review.

I.

A.

The Controlled Substances Act authorizes commercial distribution of certain controlled substances for therapeutic use, but requires all distributors to register with DEA. See 21 U.S.C. § 823(b), (e) ; 28 C.F.R. § 0.100. The Administrator of DEA (the Administrator) closely observes registered distributors to ensure that their operations are "[ ]consistent with the public interest." 21 U.S.C. § 824(a)(4) ; see also 28 C.F.R. § 0.100 ; 21 C.F.R. § 1301.71. In evaluating a distributor's operations, the Administrator considers: (1) whether the distributor has maintained "effective control[s] against diversion of particular controlled substances into other than legitimate medical, scientific, and industrial channels"; (2) whether the distributor has complied with applicable state and local laws; (3) whether the distributor has previously been convicted under federal or state laws for a crime related to the sale of controlled substances; (4) the distributor's past experience with controlled substances; and (5) "such other factors as may be relevant to and consistent with the public health and safety." 21 U.S.C. § 823(b), (e). The Administrator is "not required to make findings as to all of the[se] factors," and "may give each factor the weight he deems appropriate." Morall v. DEA , 412 F.3d 165, 173-74 (D.C. Cir. 2005) (internal quotation marks omitted). If the distributor's operations fail to live up to the public-interest standard, the Administrator may "suspend[ ] or revoke [ ]" the distributor's certificate. 21 U.S.C. § 824(a)(4).

Where, as here, the Administrator considers the first factor—the maintenance of "effective controls" against the "diversion" of controlled substances—the Administrator must determine whether the registrant complied with DEA's "security requirements." 21 C.F.R. § 1301.71(a). The "security requirement" at the heart of this case mandates that distributors "design and operate a system" to identify "suspicious orders of controlled substances" and report those orders to DEA (the Reporting Requirement). 21 C.F.R. § 1301.74(b). The Reporting Requirement is a relatively modest one: It requires only that a distributor provide basic information about certain orders to DEA, so that DEA "investigators in the field" can aggregate reports from every point along the legally regulated supply chain and use the information to ferret out "potential illegal activity." Southwood Pharm., Inc. , 72 Fed. Reg. 36,487, 36,501 (Drug Enf't Admin. July 3, 2007). Once a distributor has reported a suspicious order, it must make one of two choices: decline to ship the order, or conduct some "due diligence" and—if it is able to determine that the order is not likely to be diverted into illegal channels—ship the order (the Shipping Requirement). See id. at 36,500.

B.

On October 17, 2008, a DEA Deputy Assistant Administrator issued an order to show cause why DEA should not revoke Masters' certificate of registration (the 2008 Order to Show Cause, or 2008 Order). U.S. Dep't of Justice, Drug Enf't Admin., Order to Show Cause (Oct. 17, 2008). That Order alleged that Masters had "failed to maintain effective controls against diversion" of hydrocodone, a powerful opioid. Id. ; see also Masters Pharm., Inc ., 80 Fed. Reg. 55,418, 55,421 (Drug Enf't Admin. Sept. 15, 2015). "Throughout 2007 and 2008," Masters violated the Reporting Requirement by failing to notify DEA when "rogue Internet pharmacies" placed suspicious hydrocodone orders. 80 Fed. Reg. at 55,421 -22. In addition, Masters allegedly filled those hydrocodone orders without performing adequate due diligence, in violation of the Shipping Requirement. See 80 Fed. Reg. at 55,421 -22.

On April 1, 2009, DEA and Masters agreed to settle the charges in the 2008 Order. The settlement agreement required Masters to pay $500,000 to the agency and bring the company into compliance with DEA regulations by implementing a compliance system "to detect suspicious orders" for controlled substances and "prevent diversion of controlled substances" into illegal channels. Settlement and Release Agreement and Administrative Memorandum of Agreement at 2 (Apr. 1, 2009), J.A. 899. Masters further promised that orders "identified as suspicious" by the compliance system would "be reported to ... DEA." Id.

To fulfill its obligations under the settlement agreement, Masters created a compliance system called the "Suspicious Order Monitoring System" or "SOMS," consisting of a computer program (the Computer Program) and a protocol for Masters' employees (the Compliance Protocol, or Protocol). The Computer Program was designed to identify any order for controlled substances that "me[t] or exceed[ed]" the criteria for suspicious orders set out in 21 C.F.R. § 1301.74(b). J.A. 1436. In other words, the computer program was designed to identify orders of an unusual "size," "frequency," or "pattern." 21 C.F.R. § 1301.74(b). Thus, for each of the controlled medications that Masters sold, the Computer Program tracked the number of doses that Masters' customers ordered over the preceding six calendar months. Each customer's highest monthly total would then be treated as the customer's "Controlled Substance Limit." 80 Fed. Reg. at 55,423 n.12 ; see also J.A. 1395-96. If a customer ordered enough doses in any 30-day period to exceed its Controlled Substance Limit, the Computer Program would hold the customer's most recent order for the medication so it could be reviewed by Masters' staff. The Computer Program also held the most recent order placed by a customer if the customer submitted more order forms in a 30-day period than it had in any of the prior six calendar months, or if the timing of the order did not comport with the customer's general ordering pattern over those six months. J.A. 1397.

Once an order was held, Masters' staff would implement the SOMS Protocol, which required Masters' staff to take specified steps to investigate the order and determine whether it was legitimate. The SOMS Protocol required Masters' staff to initiate the investigation by "call[ing] the customer" that placed the held order, "request[ing] ... [a]n explanation," documenting the customer's response, and then "independently verify[ing]" the information that the customer provided. J.A. 1213, 1436. In addition, Masters' staff was required to obtain a "current utilization report" from the ordering pharmacy—i.e. , a list all of the controlled and non-controlled medications that the pharmacy dispensed in the most recent calendar month. Id. at 1436. Masters' employees would then "examine[ ]" the pharmacy's "entire file," including its order history, survey responses, and records of any "site visit[s]"—i.e. , occasions on which Masters' staff physically observed customers' premises for signs that they participated in the black market, id. at 1436, 1441, such as a long line of customers awaiting prescriptions at an odd time of day, 80 Fed. Reg. at 55,484, or multiple cars in the pharmacy parking lot with out-of-state license plates, id. at 55,490. If the customer provided all of the information that Masters' staff requested, and Masters determined that: (a) the held order was "consistent with the customer's utilization report"; and (b) the "customer's entire file, including survey responses and site visits, [was] consistent with legitimate business practices," Masters' staff could deem the order non-suspicious and ship it. J.A. 1436. Otherwise, Masters would treat the order as "suspicious," report it to DEA as required by 21 CFR 1301.74(b), and decline to fill it.

In the four years after Masters signed the Settlement Agreement, DEA grew concerned that Masters' staff was failing to detect and report to DEA suspicious orders of oxycodone products, in violation of 21 C.F.R. 1301.74(b). On August 9, 2013, a Deputy Assistant Administrator of DEA issued a second order to show cause why Masters' certificate of registration should not be revoked (the 2013 Order to Show Cause, or 2013 Order), alleging that "Masters consistently ignored and/or failed to implement" its controlled substance policies and failed to comply with the Reporting Requirement. U.S. Dep't of Justice, Drug Enf't Admin., Order to Show Cause (Aug. 9, 2013), J.A. 10. The 2013 Order further alleged that Masters violated the Shipping Requirement by filling orders for millions of dosage units of oxycodone for eight illegitimate pharmacies in Florida and Nevada: Tru-Valu Drugs; The Drug Shoppe; Medical Plaza Pharmacy; Englewood Specialty Pharmacy; City View Pharmacy; Lam's Pharmacy; Morrison's RX; and Temple Terrace Pharmacy, doing business as Superior Pharmacy.

Administrative Law Judge Gail Randall (the ALJ) tried the noncompliance allegations. She first concluded that Masters had substantially complied with the Reporting Requirement. From her perspective, Masters had a duty to report an order held by the Computer Program only if Masters' staff determined that the pharmacy placing the order was "likely diverting controlled substances." Recommended Findings of Fact, Conclusions of Law, and Decision of ALJ, Masters Pharm., Inc. , No. 13-39, at 156 (June 19, 2014) (ALJ Decision). She thought Masters had shirked that duty on only one occasion, and that failure to report a single suspicious order did not warrant revocation of Masters' certificate of registration. Id. at 201.

For similar reasons, the ALJ also concluded that Masters had substantially complied with the Shipping Requirement. The ALJ held that, under the Shipping Requirement, a pharmaceutical distributor like Masters could ship an order for controlled substances if it conducted enough due diligence to guard against any likelihood that the order would be diverted into unlawful channels. ALJ Decision at 201 (quoting Southwood , 72 Fed. Reg. at 36,502 ). And Masters' investigation into orders held by the Computer Program was, in her view, sufficient to satisfy that standard.In an eighty-three page Decision and Order published in the Federal Register, the Acting Administrator rejected the first part of the ALJ's recommendation, and concluded that Masters had repeatedly violated the Reporting Requirement. The Administrator explained that the ALJ's suspicious-order analysis was legally flawed because it misapprehended the "standard for reporting an order as suspicious." 80 Fed. Reg. at 55,478. The ALJ insisted that an order was suspicious only if Masters had found it "likely" that the order would be diverted away from legitimate medical or scientific channels, but the amount of evidence needed to raise a "suspicion" is "far lower" than the amount of evidence needed to show that something is "likely." Id. A suspicion is merely "[t]he apprehension or imagination of the existence of something wrong based ... on inconclusive or slight evidence." Id. (quoting Black's Law Dictionary 1,585 (9th ed. 2009)). With that definition in mind, the Administrator reviewed Masters' SOMS manual and determined that any order held by the Computer Program was held due to its unusual size, frequency, or pattern, and DEA regulations expressly provide that deviations in size, frequency, or pattern are the sort of indicia that give rise to a suspicion and, unless the suspicion is dispelled, the obligation to report. See id. at 55,479 ; 21 C.F.R. § 1301.74(b).

The record evidence showed that, on hundreds of occasions, Masters neither reported orders held by the SOMS Computer Program nor implemented the SOMS Protocol to dispel the suspicion surrounding held orders. For example, on numerous occasions, rather than conducting the investigation contemplated by the Protocol, Masters' employees deleted held orders or reduced their size so that they would no longer trigger the hold. At other times, Masters' employees did contact their customers to obtain explanations for held orders, but simply accepted whatever the pharmacies told them, without taking (or documenting) requisite steps to determine whether the explanations were accurate or even plausible. Perhaps most problematically, when customers provided information that confirmed the suspicion surrounding orders held by the SOMS, Masters still failed to report the orders to DEA. The Administrator ultimately concluded that Masters' frequent violations of the Reporting Requirement warranted revocation of Masters' certificate of registration; he therefore had no need to consider whether Masters additionally violated the Shipping Requirement.

II.

Masters claims that the Administrator's key factual findings are unsupported by the record. As Masters acknowledges, we must accept the Administrator's findings so long as they are supported by "substantial evidence." 21 U.S.C. § 877. The substantial evidence test is "[h]ighly deferential to the factfinder," New Valley Corp. v. Gilliam , 192 F.3d 150, 154 (D.C. Cir. 1999), requiring only such evidence that a "reasonable mind might accept as adequate to support a conclusion," S.C. Pub. Serv. Auth. v. FERC , 762 F.3d 41, 54 (D.C. Cir. 2014) (quoting Murray Energy Corp. v. FERC , 629 F.3d 231, 235 (D.C. Cir. 2011) ). We cannot reverse the Administrator's factual findings even if, had we been in his position, we "would have weighed the evidence differently." Cumberland Coal Res., LP v. Fed. Mine Safety & Health Review Comm'n , 717 F.3d 1020, 1028 (D.C. Cir. 2013).

Accepting that we view the Administrator's factfinding deferentially, Masters still sees insufficient evidence to support some of his factual conclusions. Masters contends that the record contains inadequate evidence to support the Administrator's conclusions that: (1) whenever an order for controlled substances was held by the SOMS Computer Program, that order was presumptively "suspicious" under 21 C.F.R. § 1301.74(b) ; and (2) Masters' employees rarely undertook the investigation required to dispel the suspicion surrounding held orders. After full consideration of the parties' briefs and arguments, and examination of the record and the careful and detailed decisions of the ALJ and the Administrator, we believe the Administrator's conclusions are well founded.

A.

Masters first challenges the Administrator's conclusion that any held order was suspicious under 21 C.F.R. § 1301.74(b) —at least unless Masters dispelled the suspicion through investigation. That conclusion, Masters insists, is inconsistent with the language of Masters' Comprehensive Compliance Policy Manual, which provides that the Computer Program will flag all orders that have even the potential to be suspicious. According to Masters, the Manual contemplates that the Computer Program will "hold[ ] every order that is suspicious as defined in 21 C.F.R. § 1301.74(b)," as well as "many orders that are not suspicious." Pet'r Br. 33. As a result, Masters insists, an order will "only be deemed" suspicious under Masters' policies if it is held by the Computer Program and a Masters employee follows up and separately makes a determination that it is suspicious. Pet'r Br. 34-35.

As an initial matter, Masters offers a strained reading of its Comprehensive Compliance Policy and Manual. The manual expressly states that the Computer Program "[h]olds all orders for controlled drugs that meet or exceed the [suspicious order] criteria set out in 21 C.F.R. § 1301.74(b)"—rather than orders that potentially meet or exceed those criteria. J.A. 1436. In other words, the Computer Program was designed to hold orders that are suspicious within the meaning of the regulation, even as it gave Masters' employees the opportunity—through the due-diligence investigation contemplated by the Compliance Protocol—to dispel the suspicion surrounding held orders.

More fundamentally, the key question in this case is not whether held orders qualified as "suspicious" under Masters' policies; the question is whether they qualified as "suspicious" under 21 C.F.R. § 1301.74(b). Thus, while Masters frames its challenge on this point in substantial-evidence terms, the relevant inquiry is more legal than factual: It asks how far the language of the regulation reaches. Undertaking that legal exercise, the Administrator reasonably determined that all held orders were "suspicious" within the meaning of the regulation. Section 1301.74(b) provides that "[s]uspicious orders include orders of unusual size, orders deviating substantially from a normal pattern, and orders of unusual frequency." Apparently tracking that regulatory language, the Computer Program held an order if: (a) that order—combined with other orders placed in the same 30-day period—requested more doses of a controlled medication than the pharmacy had requested in any of the previous six calendar months; (b) the pharmacy ordered a controlled medication more frequently in a 30-day period than it had in any of the previous six calendar months; or (c) the pharmacy's ordering pattern for a controlled medication deviated in some other notable way from its ordering pattern over the previous six months. As a matter of common sense and ordinary language, orders that deviate from a six-month trend are an "unusual" and not "normal" occurrence. It was therefore entirely reasonable for the Administrator to hold that orders held by the Computer Program met the regulatory definition of "suspicious orders" unless Masters' staff dispelled the suspicion. 80 Fed. Reg. at 55,479 n.164 ; see Auer v. Robbins , 519 U.S. 452, 461, 117 S.Ct. 905, 137 L.Ed.2d 79 (1997) (explaining that courts must defer to an agency's reasonable interpretations of its own regulations).

Finally, Masters contends that it is impossible to identify whether a held order is suspicious within the meaning of DEA regulations until a Masters employee has completed the SOMS Protocol. But if we were to credit Masters' assertion that "the SOMS ... holds many orders that are not suspicious," Pet'r Br. 33, it would be even clearer that Masters failed to "operate" a "system" for sorting suspicious from non-suspicious orders, in violation of 21 C.F.R. § 1301.74(b). By taking the position that orders initially held by the SOMS Computer Program are not thereby identified as suspicious, Masters' case that it complied rests entirely on whether the company carried out some other process that would identify suspicious orders. The process Masters contends it used to do that is the SOMS Protocol. Under that theory, an order can only be suspicious once an employee has run the SOMS Protocol from beginning to end. But, as the next section describes, the record contains overwhelming evidence that Masters' employees routinely failed to implement the SOMS Protocol.

B.

Masters also contends that there is insufficient evidence to support the Administrator's finding that Masters repeatedly failed to report orders held as suspicious, or to conduct the sort of investigation that could dispel the suspicion that such orders were at risk of diversion. We conclude that, to the contrary, the Administrator's decision contains ample support for his specific findings of Masters' failures, in violation of the regulations, to report suspicious orders.

More particularly, as noted above, when the Computer Program held an order, Masters' written Compliance Protocol required that a Masters employee call the pharmacy that placed the order, request an explanation and a current utilization report, and conduct an investigation to independently verify the pharmacy's information and explanation. J.A. 1436. According to the written testimony of Wayne Corona, a full-time consultant for Masters who helped develop the SOMS, the Compliance Protocol required the investigating employee to document the results of his or her inquiry "in the due diligence file [ ]" for the pharmacy that placed the order, "specifically in the Memos for Record (‘MFR’)." J.A. 1213. Indeed, Corona emphasized that "documentation was the linchpin of th[e] whole system." 80 Fed. Reg. at 55,427 n.19. In light of the essential documentation requirements, the Administrator scoured Masters' files on the Florida-based pharmacies listed in the 2013 Order to Show Cause in an effort to discern what Masters' staff had done to verify that held orders were not suspicious and so need not be reported.

Those files are replete with evidence that Masters routinely failed to investigate held orders. Most strikingly, in lieu of reporting all held orders, Masters' employees deleted some and edited others so that they appeared to be of a normal size and pattern, and then proceeded to fill them. While deleting or editing orders may have limited the amount of oxycodone flowing to Masters' customers, that practice subverted the Reporting Requirement. The law requires registered suppliers like Masters to alert DEA when their retail-pharmacy customers attempt to obtain unusual amounts of a controlled substance, because such attempts are powerful evidence that the pharmacies are operating illegally.

In other instances, Masters' employees simply released orders from hold and filled them as written, again without reporting them to DEA or investigating to see whether they might dispel the suspicion that caused the order to be placed on hold. For many of those orders, Masters had no record that any employee even took the initial investigative step of calling the ordering pharmacy. Records were absent despite Masters' representation to DEA that "[d]ocumentation on all orders held for review and their disposition are permanently retained." 80 Fed. Reg. at 55,428. As the Administrator noted, the lack of documentation was evidence that the phone calls never took place: "The absence of an entry [in business records], where an entry would naturally have been made if a transaction had occurred, should ordinarily be equivalent to an assertion that no such transaction occurred, and therefore should be admissible in evidence for that purpose." Id . (quoting 5 Wigmore, Evidence § 1531, at 463 (Chadbourn rev. 1974) (emphasis added)).

Even when Masters' employees took some steps to probe the reasons orders were held, their efforts were too tentative, pro forma, and incomplete to dispel suspicion, yet Masters failed to report the orders to DEA. Many of Masters' files contain entries suggesting that a Masters employee called a pharmacy to request an explanation for a held order, but either failed to obtain any explanation or, if it got one, to make corresponding entries showing that the employee verified that explanation. In Masters' file for City View pharmacy, for example, there are notes documenting Masters' repeated calls to the pharmacy, see 80 Fed. Reg. at at 55,494, and notes documenting City View's assertion that it needed large amounts of oxycodone because it was "servicing two small nursing homes and was near a medical center." Id. at 55,493. But there is no record that a Masters employee "even obtain[ed] the names of the homes, let alone inquire[d] as to how many residents they had." Id. Similarly, Masters determined that Superior Pharmacy had justified its request for large amounts of oxycodone because "Superior was filling prescriptions for a juvenile in-patient facility. However, [Masters] obtained no information as to the type of treatment being provided by the facility, the number of patients it had, and whether its patients would even be treated with drugs such as oxycodone 30." Id. at 55,499 (internal quotation marks omitted). In the same vein, Masters accepted Medical Plaza's claim that it was ordering large amounts of oxycodone in part because it was "[i]n a medical building of 60 doctors," without conducting any "inquiry into the practice specialties of these physicians and whether they would be prescribing such powerful narcotics as oxycodone 30 in the course of their medical practices." Id. at 55,458, 55,495 (internal quotation marks and brackets omitted).

What limited investigative records Masters maintained also show that Masters' employees rarely got customers' recent utilization reports to place held orders in context. Without those reports (or some comparable information), Masters could not know what proportion of a pharmacy's prescription business was controlled substances. It therefore could not confirm that the pharmacy's dispensing practices were consistent with those of a legitimate business.

Further, Masters' records show that investigations into held orders often ended with an employee recording a demonstrably false explanation for the order, or with the employee's harboring unresolved doubts about the order's validity, yet failing to share those doubts with DEA. For instance, Masters' employees often concluded that an order for controlled substances was justified because it was consistent with the pharmacy's utilization report, even where there was no current utilization report on file or when the utilization report showed "highly suspicious" dispensing patterns. See, e.g. , id . at 55,486, 55,500. In other cases, Masters' employees said that orders were justified because they were within the Controlled Substance Limit established by the SOMS computer program, despite the fact that the orders had been held because they violated that limit. See id. at 55,500.

Finally, Masters' employees frequently ended their investigations by noting that they were filling controlled substance orders "with reservation." See, e.g. , 80 Fed. Reg. at 55,427, 55,432 -33, 55,437-38, 55,448, 55,459. Such "reservation[s]" suggest that Masters' employees were dissatisfied with the explanations they received for particular controlled substance orders. Yet they repeatedly failed to report those orders to DEA. See id.

Masters urges us to disregard the overwhelming evidence that it failed to conduct meaningful investigations into held orders, pointing to some contrary evidence in the record. In particular, Jennifer Seiple, Masters' chief compliance officer, testified that Masters investigated all orders held by the Computer Program (even orders it edited or deleted). But the Administrator carefully considered evidence that Masters cited in its favor, including Ms. Seiple's testimony, and found that the evidence was either implausible or unresponsive to the government's evidence. See, e.g. , 80 Fed. Reg. at 55,420 n.5, 55,471 n.152, 55,483 n.174.

In sum, the Administrator painstakingly explained the factual bases for his conclusions. He found that, when SOMS held an order, Masters routinely neither reported to DEA nor took even a single investigative step. Faced with orders that were suspicious for the core reasons in the regulation—unusual size, pattern, or frequency—Masters' employees frequently simply brushed suspicion under the rug by deleting orders or paring them down and shipping them without reporting them to DEA. They also, time and again, simultaneously acknowledged their own concerns while behaving in ways that ensured those concerns would not be addressed: They filled suspicious orders with expressed "reservations," without notifying DEA. On occasions when Masters took a stab at investigating in response to a SOMS hold, it accepted, without seeking to verify, the half-baked or implausible explanations its customers supplied. We have considered each of Masters' challenges to the sufficiency of the evidence. Our review gives us no ground to disturb the Administrator's carefully documented conclusions. See Cumberland Coal Res., LP , 717 F.3d at 1028.

III.

Masters further contends that the Administrator's decision effectively amended existing DEA rules in violation of the APA. When an agency creates rules on a blank slate, it generally has the option of choosing whether to establish new policies through notice-and-comment rulemaking or adjudication. See, e.g. , POM Wonderful, LLC v. FTC , 777 F.3d 478, 497 (D.C. Cir. 2015) ("[T]he choice between rulemaking and adjudication lies in the first instance within the agency's discretion." (quoting Cassell v. FCC , 154 F.3d 478, 486 (D.C. Cir. 1998) )). But Masters contends that, once an agency promulgates a rule following public notice and comment, it may not amend or repeal the rule in an administrative adjudication. See Pet'r Br. 49 (citing Marseilles Land & Water Co. v. FERC , 345 F.3d 916, 920 (D.C. Cir. 2003) ). In Masters' view, the Administrator amended two notice-and-comment rules in adjudicating this case: 21 C.F.R. § 1301.74(b) (the regulation defining suspicious orders) and 21 C.F.R. § 1301.71(a) (the regulation defining effective controls against the diversion of controlled substances). We need not opine on DEA's statutory authority to use an adjudication to modify a rule enacted through notice and comment because the Administrator neither created nor imposed any new duties. He relied on the existing Reporting Requirement.

A.

As already noted, section 1301.74(b) defines "[s]uspicious" orders to "include orders of unusual size, orders deviating substantially from a normal pattern, and orders of unusual frequency." 21 C.F.R. § 1301.74(b). According to Masters, the rule creates an exhaustive list of the characteristics that make an order for controlled substances suspicious, so that the Administrator could not treat an order as "suspicious" for any reason other than its size, pattern, or frequency without effectively expanding the rule. For example, the Administrator pointed to the fact that several pharmacies mostly sold controlled substances, rather than the mix of controlled and non-controlled medications typical for a bona fide retail pharmacy, as among the indicia that the pharmacy might be involved in illegal diversion. See, e.g. , 80 Fed. Reg. at 55,484 (Administrator explaining that orders placed by Tru-Valu pharmacy were suspicious, in part because 60 to 80 percent of Tru-Valu's medication sales were for controlled substances); id. at 55,488 (Administrator explaining that orders placed by Englewood Specialty Pharmacy were suspicious, in part because "controlled substances prescriptions comprised nearly 70 percent of all prescriptions the pharmacy dispensed"); id. at 55,491 -94 (Administrator explaining that orders placed by City View Pharmacy were suspicious, in part because "60 percent of the prescriptions filled by the pharmacy were for controlled substances"). The Administrator also concluded that several orders were suspicious because an unusually high percentage of the pharmacy's customers paid for controlled substances with cash (the preferred payment method for illegitimate prescriptions), rather than traceable methods such as credit cards or health insurance. See id. at 55,488 (Administrator explaining that orders placed by The Drug Shoppe were suspicious, in part because "85 percent of the controlled substance prescriptions it filled were paid for with cash"); id. at 55,484 (Administrator explaining that orders placed by Tru-Valu pharmacy were suspicious, in part because Tru-Valu did not accept insurance for all of its oxycodone products). Similarly, orders from pharmacies that bought oxycodone from Masters at a price higher than insurance would reimburse, but did not also sell enough other medications or products to offset such losses, raised suspicions that they sold oxycodone to the black market at a higher price. See id. at 55,494 (Administrator explaining that orders placed by City View Pharmacy were suspicious, in part because Masters' staff had documented concerns about the pharmacy's ability to "ma[k]e a profit"); id. at 55,497 (Administrator explaining that orders placed by Medical Plaza Pharmacy were suspicious, in part because it was not clear "how the pharmacy could be making a profit when insurance reimbursed at a lower rate ($32) than what Master[s] charged for oxycodone ($39)").

Contrary to Masters' suggestion, the Administrator did not impermissibly amend section 1301.74(b) when it held that the rule does not exhaustively list characteristics that might make a retail pharmacy's order for large quantities of controlled substances "suspicious." See 80 Fed. Reg. at 55,473 -74. Section 1301.74(b) defines suspicious orders as "includ[ing]" orders of an unusual size, pattern, or frequency, and it is well established that the word "include" often precedes a list of "illustrative" examples, rather than an exclusive list of indicia of an identified wrong. Fed. Land Bank of St. Paul v. Bismarck Lumber Co. , 314 U.S. 95, 99-100, 62 S.Ct. 1, 86 L.Ed. 65 (1941) ; accord Alabama v. North Carolina , 560 U.S. 330, 340-41, 130 S.Ct. 2295, 176 L.Ed.2d 1070 (2010). The Administrator noted that Masters' reading of section 1301.74(b)"would have ill-served the CSA's purpose of preventing the ‘illegal ... distribution ... possession and improper use of controlled substances' " by failing to require the reporting of an order so long as it was of typical size, pattern, or frequency, even if a supplier actually knew "that a customer was ordering controlled substances from it for the purpose of diverting them." 80 Fed. Reg. at 55,473 (quoting 21 U.S.C. 801(2) ). Reading section 1301.74(b)'s listed characteristics as exemplary rather than exhaustive, DEA reasonably concluded that other indicia may also raise suspicions about an order for controlled substances. That conclusion was entirely consistent with the text of the regulation, as well as agency precedent. See, e.g. , Southwood , 72 Fed. Reg. at 36,497, 36,501 -02 (internet pharmacy's orders were suspicious because the pharmacy was buying an unusual mix of controlled and non-controlled substances, dominated overwhelmingly by controlled substances, which was not consistent with what legitimate pharmacies typically ordered); id. at 36,501 (supplier should have reported pharmacy's orders as suspicious after the supplier's agent visited the pharmacy and saw signs relating to mail-order business tied to an internet pharmacy that mailed prescriptions out of state, suggesting that the pharmacy was "filling ... illegitimate prescriptions").

B.

Second, Masters argues that the Administrator impermissibly amended section 1301.71(a) without notice and comment. That section imposes a general duty on pharmaceutical distributors to "provide effective controls ... against [the] diversion" of controlled substances. 21 C.F.R. § 1301.71(a). The regulation requires the Administrator to "use the security requirements set forth in §§ 1301.72-1301.76 as standards for the physical security controls and operating procedures necessary to prevent diversion." Id. Thus, in Masters' view, sections 1301.72 through 1301.76 set out the only standards the agency may use to measure the effectiveness of controls against diversion:

These specifically enumerated "physical security controls and operating procedures" do not require a distributor to perform due diligence on its customers; the only requirement is that distributors make a "good faith inquiry" to verify that a customer has a valid DEA and state registration. Id . § 1301.74(a). Distributors also have an obligation to identify and report to DEA "suspicious orders," which "include orders of unusual size, orders deviating substantially from a normal pattern, and orders of unusual frequency." Id . § 1301.74(b).

Pet'r Br. 46. Masters insists that the Administrator unlawfully used this proceeding to create new legal obligations by expansively reading existing law. Foremost, Masters complains that the Administrator elaborated on the Shipping Requirement. As noted above, the Shipping Requirement mandates that pharmaceutical companies exercise "due diligence" before shipping any suspicious order. 72 Fed. Reg. at 36,500. DEA first articulated that requirement in Southwood , 72 Fed. Reg. at 36,501, and Masters claims that the Administrator expanded on it here. See 80 Fed. Reg. 55,476. First in Southwood and then in this case, Masters contends, the Administrator amended the regulatory scheme by tacking the Shipping Requirement onto the settled list of "security requirements" stated in sections 1301.72–1301.76.

Notably, however, the Administrator's holding rests on Masters' violation of the Reporting Requirement, not the Shipping Requirement. The Administrator's Decision and Order summarized his reasoning and "conclude[d] that [Masters] ha [d] not substantially complied with 21 CFR [§] 1301.74(b)"—the Reporting Requirement. 80 Fed. Reg. at 55,500 -01. Consequently, even if the Administrator expansively read the Shipping Requirement, that reading had no effect on his ultimate decision, and so provides no basis for relief. See 5 U.S.C. § 706.

Similarly, Masters insists that the Administrator used this proceeding to create a handful of highly specific security requirements that are unrelated to the Shipping Requirement. Specifically, Masters protests that the Administrator announced that

[1] "[A] distributor must use the URs in evaluating whether a customer's [ratio of controlled to non-controlled drug sales] is suspicious" (JA 555); [2] "[e]ven if the Agency's regulations do not require a distributor to document the reason provided by a customer to justify a suspicious order, documenting that reason is still an essential part of maintaining effective controls ..." (JA 563 n.21); ... [3] "the distributor must conduct ‘additional investigation to determine whether [its customer is] filling legitimate prescriptions' " (JA 612) ... ; and [4] "investigation [into a suspicious order] must dispel all red flags indicative that a customer is engaged in diversion ..." (JA 613).

Pet'r Br. 47-48.

Contrary to Masters' suggestion, however, none of those statements created new security requirements. Rather, the statements collectively explained what a distributor in Masters' position must do if, instead of immediately reporting to DEA all orders of an unusual size, frequency, or pattern, it chooses to use the SOMS—or an equivalent program—to seek to dispel the suspicion surrounding such orders and report only those that still appear suspicious after investigation. As we have emphasized throughout this opinion, it is not necessary for a distributor of controlled substances to investigate suspicious orders if it reports them to DEA and declines to fill them. But if a distributor chooses to shoulder the burden of dispelling suspicion in the hopes of shipping any it finds to be non-suspicious, and the distributor uses something like the SOMS Protocol to guide its efforts, then the distributor must actually undertake the investigation. For example, when an employee uses the SOMS Protocol to confirm or dispel suspicion based on the amount of controlled medication the pharmacy is selling, the employee must request a "UR," i.e. , a document showing the pharmacy's "actual dispensing[s] ... of each drug." 80 Fed. Reg. at 55,420. Moreover, the investigating employee must "document" customers' explanations for suspicious orders, so that he or she can verify those explanations and make sure they are consistent over time. Id. at 55,428 n.21. Additionally, if a customer's explanation for its order is "inconsistent with other information the [investigator] has obtained about or from the customer, ... the [investigator] must conduct ‘additional investigation to determine whether [its customer is] filling legitimate prescriptions.’ " Id. at 55,477. Finally, the investigation must dispel all of the "red flags" that gave rise to the suspicion that the customer was diverting controlled substances. Id. at 55, 478. The Administrator recognized that, if investigating employees fail to take such basic steps, the SOMS (or similar protocol) does not function as an effective tool for dispelling suspicion.

IV.

Next, Masters contends that the Administrator's decision violates its rights under the 2009 Settlement Agreement with DEA. In that agreement, DEA released Masters from liability and agreed to refrain from filing new administrative claims against it based on conduct alleged in the agreement and the 2008 Order to Show Cause, all of which occurred before April 1, 2009. J.A. 898-99. DEA also committed to reviewing Masters' "diversion compliance program" (i.e. , the SOMS) within the first 180 days that the Settlement Agreement was in effect to determine whether it satisfactorily guarded against diversion. Id. at 901-02. Masters contends that DEA reneged on both of those promises, so cannot now rely on Masters' pre-April 2009 conduct or inadequacies in the SOMS to support its revocation of Masters' certificate of registration.

A.

Masters asserts that it is being penalized for failing to report suspicious orders placed before April 1, 2009, in violation of the Settlement Agreement. See J.A. 899. As Masters notes, the Administrator repeatedly cited Masters' pre-April 2009 interactions with customers. The Administrator, however, only referred to those interactions to demonstrate Masters' knowledge of its customers' suspicious business practices, which should have prompted Masters to be especially scrupulous in reporting suspicious orders placed by those customers after April 1, 2009. For example, the Administrator noted that, in September 2008, Englewood Specialty Pharmacy requested that Masters increase its oxycodone purchasing limit. 80 Fed. Reg. at 55,488. In making that request, Englewood's staff told Masters that 30 per cent of the prescriptions it filled were for controlled substances—a figure belied by Englewood's then-current utilization report showing that nearly 70 per cent of the prescriptions Englewood filled were for controlled medications. Id. Just two months later, in November 2008, Masters sent a consultant to visit Englewood, who reported that Englewood "appear[ed] to be doing a larger narcotic business than [it] admit[ed]." Id. at 55,488 -89. In light of the strong evidence that Englewood had a history of lying to Masters to obtain narcotics, the Administrator concluded that Masters should have reported as suspicious Englewood's unusually large post-settlement-period orders for oxycodone. See id. That conclusion was entirely consistent with the Settlement Agreement. J.A. 903 (reserving DEA's right to admit evidence of pre-settlement conduct "for proper evidentiary purposes" to establish Masters' liability "for non-covered conduct").

B.

Masters also claims that it detrimentally relied on DEA's commitment to review the SOMS and inform Masters if it found either component of the SOMS (the Computer Program or the Compliance Protocol) to be inadequate. As noted above, DEA represented in the Settlement Agreement that, within 180 days of the agreement's April 1, 2009, effective date—i.e. , by July 30, 2009—DEA would visit Masters' "distribution center" and "conduct a review of the functionality of Master[s]' diversion compliance program" (the Compliance Review). J.A. 901-02. DEA further represented that, "[a]t the conclusion of the Compliance Review, DEA [would] conduct an exit interview with appropriate Masters representatives to provide DEA's preliminary conclusions regarding the Compliance Review." Id. at 902. Finally, DEA agreed that, if the Compliance Review was unsatisfactory, DEA would "provide[ ] written notice with specificity to Masters on or before 220 days from the [e]ffective [d]ate of [the Settlement Agreement]." Id.

It is undisputed that the Compliance Review did not completely fulfill the parties' expectations. "[B]ecause the new policies had been implemented on August 14, 2009, only four days before the Compliance Review, there was not enough time to determine if the policies were being properly implemented." 80 Fed. Reg. at 55,425. DEA nonetheless conducted a Compliance Review on August 17 and 18, 2009. DEA's Diversion Investigators provided Masters' personnel some training regarding distributors' obligations under the Controlled Substances Act, discussed specific concerns about certain of Masters' past practices and customers and warned Masters not to continue such dealings, and gave some additional guidance on how to detect illegitimate dispensing of controlled substances. Id. at 55,422 -23. Masters, for its part, briefed the investigators on its drug handling policies and procedures, including its SOMS. Id. at 55,423 -25. The SOMS had been put in place so recently that neither party could rely on the formal "exit interview" contemplated by the Settlement Agreement as assurance that the SOMS, as Masters actually operated it, brought the company into compliance with its obligations under the Controlled Substances Act. Id . at 55,425. Instead, what an investigator told Masters was that its written "policies and procedures" for the SOMS, "if properly implemented" by Masters' personnel, "could promote an effective system to detect and prevent diversion of controlled substances." Id.

According to Masters, much of the conduct on which the Administrator relied in these proceedings should have been apparent to DEA investigators during the Compliance Review. Because Masters did not receive the written notice that DEA promised to provide if it found the Compliance Review to be "not satisfactory," J.A. 902, and because of "DEA's silence following the Compliance Review," Masters says that it presumed that it was operating within the letter of the law. Pet'r Br. 53-59. Masters therefore asserts that it was deprived of a key benefit of the Settlement Agreement: an opportunity to correct any shortfalls in its controlled substances program before they triggered administrative action to revoke its certificate. Masters contends that DEA is contractually bound and equitably estopped from holding it responsible for any deficiencies in the SOMS of which the agency did not previously notify Masters in writing. See id. at 57-59.

As the Administrator noted, the Settlement Agreement provided no remedy for Masters in the event that DEA failed to provide written notice of any observed deficiencies in Masters' SOMS; the key question is thus whether, in light of the Settlement, DEA should be equitably estopped from holding Masters to account for inadequacies in its diversion-detection policies and practices that, according to Masters, were reasonably observable in 2009 but not identified by DEA in the Compliance Review. See J.A. 564 (citing Dantran, Inc., v. U.S. Dep't of Labor , 171 F.3d 58, 66 (1st Cir. 1999) (holding that an agency was not equitably estopped from imposing liability on a party who relied on a "clean bill of health" from government investigators)).

To estop the government, a regulated entity must show that: (1) the government made a "definite representation"; (2) on which the entity "relied ... in such a manner as to change [its] position for the worse"; (3) the entity's reliance was reasonable; and (4) "the government engaged in affirmative misconduct." Morris Commc'ns, Inc. v. FCC , 566 F.3d 184, 191 (D.C. Cir. 2009) (quoting Graham v. SEC , 222 F.3d 994, 1007 (D.C. Cir. 2000) ). In this case, assuming that the government made a "definite representation" to Masters that it would identify problems with the SOMS within 220 days of an inspection, see 80 Fed. Reg. at 55,425, Masters has demonstrated neither reasonable reliance on the statement nor affirmative government misconduct.

There is no evidence of reliance on Masters' part. If Masters had waited 220 days after the effective date of the Settlement Agreement to ensure that DEA had no quarrels with the SOMS, and then rigorously implemented the SOMS as a compliance strategy, Masters might be able to claim that it relied on DEA's statement about "written notice." But that is not what happened. Instead, following the Compliance Review—at which Masters presented and promised to follow its brand-new SOMS—Masters' employees consistently failed to implement the SOMS Protocol. Consequently, Masters cannot claim that it relied to its detriment on DEA's review.

Even if Masters had shown that it actually relied on the Administrator's undertaking to provide written notice of any problems with the SOMS, there are several reasons why it would have been unreasonable to place great weight on such a promise. At the time of the Compliance Review, the SOMS was only three or four days old; consequently, Masters' employees had no track record to show how they were operating the SOMS in practice. The most DEA's Diversion Investigators were in a position to do is comment on the adequacy of the SOMS Compliance Protocol on paper. Thus, Masters could not reasonably believe that DEA's failure to provide written follow-up after the Compliance Review amounted to approval of the way that Masters' employees were implementing—or failing to implement—the SOMS. In any event, the Settlement Agreement expressly cautioned Masters not to rely on the results of the Compliance Review, stating: "A finding of ‘satisfactory’ [after the Review] does not otherwise express DEA's approval of Masters' compliance program." J.A. 902.

And even if the DEA review addressed the SOMS in operation, and even if Masters had reason to and did rely on that review, there is no evidence suggesting that the government engaged in the "affirmative misconduct" necessary to sustain a claim of estoppel against the government. Morris Commc'ns, Inc. , 566 F.3d at 191. The bar for establishing "affirmative misconduct" is high, requiring a showing of "misrepresentation or concealment, or, at least, behav[ior] ... that ... will cause an egregiously unfair result." GAO v. Gen. Accounting Office Pers. Appeals Bd. , 698 F.2d 516, 526 (D.C. Cir. 1983). Generally, "ordinary negligence" does not qualify as egregiously unfair conduct. See Bowman v. D.C. , 496 F.Supp.2d 160, 164 (D.D.C. 2007). Nor does a simple failure to perform under a contract. See Morris Commc'ns, Inc. , 566 F.3d at 191-92 (government did not engage in "affirmative misconduct" when it promised to act on a waiver request in 30 days, but failed to do so for three years). Here, Masters has not identified any governmental misconduct, let alone extraordinary misconduct.V.

Masters further contends that the Administrator's decision violated the APA insofar as it was based on Masters' refusal to accept responsibility for its alleged misconduct. Masters believes the Secretary decertified it for refusing to accept responsibility "before the hearing and before DEA had established its prima facie case." Pet'r Br. 52. Such adverse action would be inconsistent with DEA rules that guarantee regulated parties an evidentiary hearing. 21 C.F.R. §§ 1301.41 -46 (DEA hearing regulations). Thus, Masters concludes, the Administrator violated the provisions of the APA that require agency decisions to be "in accordance with law" and to follow the "procedure[s] required by law." See 5 U.S.C. § 706 (2)(a), (d).

Contrary to Masters' suggestion, the Administrator did not decertify Masters for putting DEA to its proof. As the Administrator recently explained, DEA has "never held"—in Masters' case or any other—that "a respondent must admit to [its] misconduct prior to even being able to test the Government's evidence at [a] hearing." Hatem M. Ataya, M.D. , 81 Fed. Reg. 8,221, 8,224 (Drug Enf't Admin. Feb. 18, 2016). Rather, under longstanding DEA precedent, once DEA presents enough evidence at a hearing to show that a registered vendor or distributor of controlled substances has "committed acts inconsistent with the public interest," the "registrant must present[ ] ... mitigating evidence" including evidence that it has "accept[ed] responsibility for its actions and demonstrate[d] that it will not engage in future misconduct." Medicine Shoppe—Jonesborough , 73 Fed. Reg. 364, 387 (Drug Enf't Admin. Jan. 2, 2008) (internal quotation marks omitted). In this case, the government came forward with ample evidence that Masters committed acts inconsistent with the public interest by failing to report suspicious orders. Masters presented no responsive evidence showing that it had recognized the consequences of its misconduct. In fact, before trial, Masters went so far as to stipulate that it did "not accept responsibility for any alleged wrongdoing." J.A. 153.

Furthermore, Masters' refusal to admit fault played only a minor role in the Administrator's decision to revoke Masters' certificate. The Administrator emphasized that, because Masters' Compliance Protocol was "rarely, if ever followed," Masters failed to investigate "hundreds of suspicious orders" for opioids. 80 Fed. Reg. at 55,501. That failure amounted to an "extensive and egregious" violation of DEA regulations. Id. The Administrator found that the "egregiousness" of the violation was "exacerbated" by the fact that Masters' officials were "well aware of the oxycodone epidemic." Id. Finally, the Administrator noted "the Agency's interest in deterring future misconduct." Id. In light of all those considerations, we conclude that, regardless of whether Masters accepted responsibility for its misconduct, the Administrator would have revoked its certificate of registration. Given the evidence of Masters' failure to maintain effective controls against diversion of controlled substances and the absence of mitigating evidence of Masters' acceptance of responsibility, the Administrator's decision to revoke Masters' certificate of registration was reasonable and supported by substantial evidence.

VI.

Finally, Masters contends that the Administrator violated its due process rights by relying on arguments and evidence that were not presented during the administrative trial. The Due Process Clause gives regulated parties the right to fair notice of the arguments and evidence against them. NLRB v. Blake Constr. Co. , 663 F.2d 272, 279 (D.C. Cir. 1981). An agency may not rely on evidence or arguments that were not discussed at a hearing as a basis for punishing a regulated party. See id. Masters contends that the Administrator impermissibly did just that: He relied on arguments DEA had forfeited and evidence the ALJ had excluded as grounds to revoke Masters' certificate of registration.

A.

In particular, Masters claims that the Administrator relied on two points that DEA failed to preserve: (1) by April 1, 2009, Masters had gathered information that the seven Florida-based pharmacies listed in the 2013 OSC were potentially selling opioids illegally; and (2) certain orders placed by those pharmacies were suspicious because of their size, pattern, or frequency, rather than the characteristics of the pharmacy placing the order. Masters insists that those arguments were not presented to the ALJ or the Administrator, depriving Masters of any opportunity to refute them. Once again, Masters' argument is belied by the record.

Contrary to Masters' suggestion, DEA never forfeited the argument that, by April 1, 2009, Masters was on notice that the seven pharmacies might be selling opioids illicitly. DEA argued pretrial that "pre-April, 2009 evidence [would] be offered [at trial] to show that Masters had knowledge of potential problems with certain customers." Order Granting in Part Respondent's Motion in Limine to Preclude Admission of Irrelevant, Immaterial, and/or Incompetent Evidence and to Adopt Findings at 5, Masters Pharm., Inc. , No. 13-39 (Feb. 7, 2014), J.A. 161. The ALJ then ruled that DEA could use pre-April, 2009, evidence. Following that ruling, Masters admitted in evidence its 2008 business records. DEA witness James Rafalski then testified that, given the information in Masters' 2008 records, Masters should have known that the Seven Pharmacies engaged in patterns of conduct suggesting that they might be involved in illicit opioid sales, including: telling Masters that it was dispensing a relatively low quantity of controlled substances during periods when utilization reports showed that it was in fact dispensing suspiciously high quantities of controlled substances; conducting a high percentage of its controlled substance sales with cash; and selling an unusually high ratio of controlled to non-controlled medications. For example, Diversion Investigator Rafalski provided written testimony that, in light of Masters' 2008 records for Englewood, Masters should have been cautious about any of Englewood's orders for controlled substances. See J.A. 1151-54. As noted above, those records contain a report from a Masters investigator noting that Englewood's pharmacist seemed to be lying about his controlled substance sales. Id . at 1153. In addition, Englewood's utilization report dated September 22, 2008, "revealed that approximately 80% of all pharmaceuticals [it] dispensed were controlled substances." Id. at 1154. According to Rafalski, Masters' 2008 files for other customers raised similar concerns, yet Masters paid no special attention to those customers' orders for controlled medications. Thus, in its proposed findings of fact and conclusions of law, DEA argued that Masters' customer files—which included the 2008 records—"revealed numerous red flags ... that were regularly ignored." Id. at 297. On this record, Masters cannot credibly claim that DEA forfeited its arguments based on pre-April 2009 evidence, or that it lacked fair notice that DEA would rely on that evidence. Cf. Katz v. SEC , 647 F.3d 1156, 1161-62 (D.C. Cir. 2011) (regulated party had fair notice that the SEC would rely on "false account statements," where an administrative hearing officer denied a motion to strike those statements and the statements were later introduced at the administrative trial).

Masters makes a similarly unsupported assertion that "DEA never identified in its [2013 Order to Show Cause], prehearing statements, or written or oral testimony[,] a single order for controlled substances ... that DEA deemed suspicious due to its unusual size, its deviation from a usual pattern, or its unusual frequency." Pet'r Br. 31. "Likewise," Masters protests, "DEA never alleged that every order held for review by [the Computer Program] was per se suspicious ... unless Masters obtained and independently verified the reason for the order." Id. Masters accordingly objects to the Administrator's reliance on Masters' inadequate response to held orders.

We are somewhat mystified by this argument. Before the administrative trial began, DEA provided Masters a copy of the written testimony of DEA Diversion Investigator Rafalski. In that testimony, Rafalski stated that, in his conversations with Masters' staff, he learned that the SOMS computer program was designed to hold orders of an unusual size, pattern, or frequency. J.A. 1124. That testimony was confirmed by Masters' policy manual, which states that the SOMS Computer Program was designed to hold "all orders for controlled drugs that meet or exceed the criteria set out in 21 C.F.R. [§] 1301.74(b)," i.e. , orders of unusual size, pattern, or frequency. Id. at 1436. Echoing that evidence, DEA's proposed findings of fact and conclusions of law: (a) noted that the Computer Program held orders of an unusual "size, pattern, or frequency"; and (b) asserted that Masters' failure to follow its own policies—including the policy requiring Masters to "discern the reason for [an order's] deviation in size, pattern, or frequency"—rendered Masters' system for complying with DEA regulations ineffective. Id. at 296. Thus, Masters had ample opportunity to consider and rebut the proposition that orders held by the Computer System were orders of a suspicious size, pattern, or frequency, which Masters had a legal obligation to report or investigate.

B.

1.

Masters also insists that the Administrator violated its due process rights by relying on excluded evidence. Specifically, Masters claims that the ALJ ordered the exclusion of "information Masters gathered" before April 1, 2009, but that the Administrator nonetheless relied on the excluded information in determining that Masters should have questioned orders placed by the Seven Pharmacies. Pet'r Br. at 27-29. Masters points to the Administrator's reliance on information that Masters gathered in December 2008 to support his conclusion that Masters should have been suspicious of later orders placed by Tru-Valu, and similar reliance on information Masters gathered "prior to April 1, 2009" to support his conclusion that Masters should have suspected The Drug Shoppe, Englewood, City View, Superior, and Morrison's. Id .

The ALJ's ruling specifically permitted DEA to rely on pre-April 1, 2009, information to "show that Masters had knowledge of potential problems with certain customers" that should have informed its later interactions with those customers; Masters' contrary contention fails to acknowledge the role the ALJ reserved for evidence of Masters' earlier exposure to certain pharmacies. J.A. 161. What the ALJ ruled off-limits was any administrative liability on Masters' part for alleged violations of DEA regulations before April 1, 2009. But the ALJ held that the Administrator could—and he did—introduce evidence of Masters' long-held knowledge that certain pharmacies had been operating in ways strongly suggesting that they were diverting controlled substances, including its knowledge of operations reaching back before April 2009. Evidence of Masters' pre-April 2009 experiences highlighted that Masters should have been particularly diligent in reviewing orders placed by certain known, rogue pharmacies. That evidence permissibly bolstered the Administrator's conclusions that, when Masters failed to investigate and report suspicious orders those same pharmacies placed after August 18, 2009, it violated the regulations. That use of pre-April 1, 2009, information was expressly permitted by the ALJ's pretrial order.

2.

Masters further contends that the Administrator violated its due process rights by relying on evidence that the ALJ excluded regarding Masters' misconduct between April 1, 2009, and August 18, 2009. That was the post-settlement period when Masters was setting up its new compliance program and DEA was evaluating the program. The Administrator determined that the ALJ should not have excluded that evidence; as he explained, "[n]othing in the [Settlement Agreement] provided [Masters] with immunity for potential violations [of the Controlled Substances Act] during [that time]."See 80 Fed. Reg. at 55,429 n.22. Consequently, the Administrator's decision repeatedly refers to Masters' failure to report suspicious orders of controlled substances between April and August of 2009.

On this point, we conclude that Masters' claim of error is well founded. Even though the Administrator permissibly held that the ALJ's evidentiary ruling was wrong, the Administrator could not proceed to rely on the excluded evidence of Masters' misconduct during the post-settlement review period. Doing so would be in derogation of Masters' right to respond to it. Because the ALJ had excluded the evidence, however, Masters had no need or opportunity during the administrative trial to exercise its right to respond.

The Administrator's error did not, however, rise to the level of a due process violation. Crucially, the Administrator recognized that reliance on that transition-period evidence might be impermissible. Id . at 55,501 n.198. He was thus careful to note that any discussion of that evidence was dicta: Even setting the disputed evidence aside, the Administrator explained, "the scope of [Masters'] failure to report suspicious orders following the [C]ompliance [R]eview [was] so extensive and egregious that I would come to the same conclusion that the revocation of [Masters'] registration is warranted to protect the public interest." Id. Because the Administrator did not base his holding on the excluded evidence, Masters was not unlawfully deprived of its right to contest it. Cf. SEC v. Whittemore , 659 F.3d 1, 13 (D.C. Cir. 2011) (erroneous admission of evidence did not violate "substantial rights" where the evidence "was not determinative" of the outcome).

3.

Masters contends that the Administrator also erred in considering other excluded evidence. As is relevant here, the ALJ's pretrial order instructed the government not to rely on paragraphs 6 and 24 of DEA Diversion Investigator Kyle Wright's declaration. Nevertheless, Masters asserts, the Administrator cited those paragraphs in his decision. Even if the Administrator erroneously cited the excluded paragraphs from Investigator Wright's testimony, both of those paragraphs address Masters' alleged misconduct before August 2009. See J.A. 163. As discussed above, the Administrator's decision was fully supported by evidence of Masters' failure to report suspicious orders after that date. See 80 Fed. Reg. at 55,501 n.198. Thus, for the reasons stated in the previous section, the Administrator's mention of the excluded portions of Investigator Wright's testimony was consistent with Masters' due process rights.

* * *

Because Masters has not identified any prejudicial errors in the Administrator's decision, we deny Masters' petition for review.