A method for identifying medical diverters includes identifying users having similar job functions. Use data indicative of user access to a medication dispensing system is retrieved and is analyzed to identify periods of use of the system for users. Boundaries of work shifts are determined and users are organized into work shifts based on periods of use. A comparison period is determined. Diversion data indicative of behavior associated with diversion for each user is identified. A diversion score indicative of a likelihood that a user is diverting medication is generated by averaging the data by shifts worked for each user and statistically comparing the averaged data. Diversion scores are combined for a medication type to generate a group score. A consistency factor is determined and an overall score is generated. A determination whether any overall scores exceed an overall threshold is made. Users whose score exceeds the threshold are flagged.
