Controlled Substance Recordkeeping and Inventory Requirements

Controlled substance recordkeeping and inventory requirements come from the Drug Enforcement Administration, and they apply to every registrant from the day the registration takes effect. In short: take an inventory when you start, take another at least every two years, log every receipt and disbursement in between, use the right order forms for Schedule I and II substances, keep the paperwork for at least two years at the registered location, and report thefts or significant losses on a tight clock. Miss any of that and you face civil penalties of up to $25,000 per violation, criminal exposure for knowing violations, and possible loss of your registration.

The Initial and Biennial Inventory

The inventory is the anchor of the whole system. A registrant must conduct an initial inventory on the very first day it begins handling controlled substances, then a follow-up inventory at least once every two years. The biennial inventory can fall on any date within two years of the previous one.¹ Each inventory record must note whether the count was taken at the opening or the close of the business day, because that timestamp determines which transactions fall on either side of the snapshot.

Every inventory entry identifies the substance by name and finished form, such as “oxycodone 5 mg tablet” or “morphine sulfate 10 mg/mL oral solution.” The registrant records the number of commercial containers on hand and the quantity within each container. Precision depends on the schedule:

Schedule I and II substances require an exact physical count or measure, regardless of container size.¹
Schedule III, IV, and V substances allow an estimated count, unless an opened container holds more than 1,000 tablets or capsules, in which case an exact count is required.¹

One boundary worth noting up front: registration and, with it, these obligations attach to a specific physical location and a specific activity. A hospital pharmacy and the hospital’s research lab in the same building each need their own registration, and each keeps its own inventory and records.² A 200-store chain pharmacy keeps 200 separate sets.

When an Extra Inventory Is Required

Two situations trigger an inventory outside the normal cadence, and both are easy to miss.

The first is a new scheduling action. When the DEA adds a substance to a controlled substance schedule for the first time, every registrant with that substance in stock must take an inventory on the effective date of the scheduling action.¹ A substance that needed no tracking yesterday needs the same meticulous accounting as every other controlled substance today. Watch the Federal Register for final rules on substances you stock.

The second is a business transfer or closure. When a registrant sells or transfers its business, a complete inventory of all controlled substances must be taken on the date of transfer. That inventory serves as the final inventory for the seller and the initial inventory for the buyer, and both keep a copy.³ The buyer also assumes custody of the seller’s prior records, though the seller remains responsible for the accuracy of entries made before the transfer. The seller must notify the DEA’s Special Agent in Charge at least 14 days before the transfer.

Receipt and Disbursement Records

Between inventories, transactional records fill the gaps. Every registrant maintains a current, complete record of each controlled substance manufactured, received, sold, delivered, exported, or otherwise disposed of at the registered location.⁴ The regulation does not demand a perpetual inventory, but the records must be detailed enough that an investigator can reconstruct the flow of substances in and out of the facility at any point.

For incoming shipments, registrants keep invoices or shipping documents showing the date of receipt, the supplier’s name and address, the name and quantity of each substance, and the number of commercial containers.⁵ Outgoing transfers to other registrants get the same treatment: date, recipient name and registration number, and specific quantities. Substances sent to a reverse distributor for disposal require retention of the associated shipping paperwork.

The date recorded is the date the substance was actually received, distributed, or destroyed, not the date the paperwork was generated. An invoice dated Monday means nothing if the shipment sat in transit until Wednesday; Wednesday goes in the record.⁴

Ordering Schedule I and II Substances

Schedule I and II substances carry extra documentation. To order them, a registrant uses either a paper DEA Form 222 or an electronic order signed with a DEA-issued digital certificate through the Controlled Substance Ordering System (CSOS).⁶

On a paper Form 222, only one item appears on each numbered line, and each line covers the same substance in the same finished form and quantity. The registrant signs and dates the form and notes the total number of completed lines at the bottom. Completed forms are filed separately from other business records so DEA agents can locate them quickly during an inspection.⁷

An electronic order through CSOS must include the purchaser’s DEA registration number, the supplier’s name and DEA number, the date, and the name and quantity of each substance. The supplier verifies the digital signature and confirms the certificate has not expired before filling the order.⁶ Electronic orders can include Schedule III through V substances and non-controlled items on the same order, which makes them more practical for day-to-day operations.

A registrant does not have to sign every order personally. A power of attorney can authorize one or more individuals to sign Form 222 or electronic orders on the registrant’s behalf. The document must be signed by the registrant (or a partner or officer, depending on the entity type), the person receiving the authority, and two witnesses, and it stays in the registrant’s files alongside the executed order forms.⁸ Revocation requires a written notice signed by the registrant and two witnesses.

Prescription Records

Every controlled substance prescription must include the patient’s full name and address; the drug name, strength, dosage form, quantity, and directions; the date issued; and the practitioner’s name, address, and DEA registration number.⁹ The practitioner signs the prescription on the same day it is dated.

Pharmacies keeping paper prescriptions need a way to separate controlled substance records from the rest. For Schedule III through V prescriptions, federal regulations offer two approaches. A computer system that can pull up prescriptions by patient name, prescriber name, drug dispensed, or date filled satisfies the “readily retrievable” standard on its own. Without such a system, the pharmacist stamps a red letter “C” at least one inch tall in the lower right corner of each controlled substance prescription at the time of filing. Schedule I and II prescription records must always be filed separately from all others.¹⁰

Reporting Theft or Significant Loss

When a registrant discovers a theft or significant loss of any controlled substance, the clock runs fast. Notify the DEA’s local Field Division Office in writing within one business day of discovering the loss. Within 45 calendar days, submit a complete DEA Form 106 electronically through the DEA’s Diversion Control Division secure network application.¹¹ Paper submissions are no longer accepted. The obligation to report applies whether or not the substances are later recovered or the responsible person identified.

“Significant” is doing real work in that regulation, and misjudging it is where registrants get into trouble. The DEA expects registrants to weigh:

The quantity lost relative to the type of business. Five missing tablets means something different at a small clinic than at a wholesale distributor.
The substance involved. Losses of highly diverted drugs like oxycodone or fentanyl carry more weight.
Access patterns, including whether the loss can be traced to specific individuals or activities.
Loss history. A pattern of small losses over time can be more significant than a single event.
Local diversion trends for the substance in question.¹²

In-transit losses belong to the supplier to report, not the recipient. If a common carrier loses a shipment, the registrant who sent it must file within one business day of discovery.¹³

Documenting Destruction

Expired, damaged, or otherwise unusable controlled substances cannot simply be thrown away. The registrant documents destruction on DEA Form 41 and, depending on the situation, may need authorization from the Special Agent in Charge before proceeding.¹⁴ The Special Agent in Charge will direct one of three methods: transfer to a registrant authorized to transport or destroy controlled substances, delivery to a DEA agent or office, or on-site destruction in the presence of a DEA agent or other authorized person.

On-site destruction requires two employees of the registrant to handle or observe the handling of the substance and to personally witness the destruction until the substance is rendered completely non-retrievable.¹⁵ Both employees must be present from handling through final destruction. Registrants who dispose regularly can seek standing authorization from the Special Agent in Charge that removes the need to apply for each disposal, but destruction records and periodic summary reports still have to be filed.

A common exception: when a practitioner administers a controlled substance and a residual amount remains in the vial or syringe, wasting that remainder does not require Form 41. The practitioner records the waste through normal dispensing records instead.⁴

How Long and Where to Keep Records

All controlled substance records and inventories must be kept for at least two years from the date of the entry or transaction, and they must be available for inspection and copying by DEA agents at any time during that period. Schedule I and II records are maintained separately from all other records at the facility. Schedule III through V records can be mixed with general business records as long as they are readily retrievable, meaning an agent can identify and separate them in a reasonable time.¹⁶

Central Recordkeeping

Certain financial and shipping records can be stored at a central location rather than at each registered site, but only after notifying the DEA. The notification goes by registered or certified mail, in triplicate, to the Special Agent in Charge, and describes the nature of the records, the exact central location, and the registrant’s DEA information. If the Special Agent in Charge does not deny permission within 14 days of receiving the notification, the registrant may proceed.¹⁷

Hard limits apply. Executed order forms (DEA Form 222) and inventories must always remain at the registered location. Records stored centrally must be deliverable to the registered location within two business days of a DEA request. Failure to meet these conditions lets the Special Agent in Charge cancel the central recordkeeping authorization without a hearing.¹⁷

Electronic Records

Digital recordkeeping is permitted, but the registrant must be able to produce printed copies on request during an inspection. Records stored on microfilm, in a database, or in any format requiring special equipment need that equipment made available alongside the records. Any coding system used in the records requires a key so investigators can read the data.

Penalties for Noncompliance

The Controlled Substances Act establishes a civil penalty of up to $25,000 for each violation of the recordkeeping, inventory, and reporting requirements.¹⁸ For manufacturers or distributors whose recordkeeping failures involve suspicious opioid orders or inadequate diversion controls, the cap rises to $100,000 per violation. These figures are adjusted for inflation periodically, so the actual maximums in a given enforcement action may be higher than the base statutory amounts.

Knowing violations move the case into criminal territory. A first knowing offense carries up to one year of imprisonment. After a prior conviction for a knowing violation, the penalty rises to up to two years.¹⁸ The DEA can also revoke or suspend the registration itself. For a pharmacy or medical practice, losing that registration ends the ability to prescribe or dispense most medications, which is often the most costly consequence of all.

1
eCFR. 21 CFR 1304.11 – Inventory Requirements
2
eCFR. 21 CFR Part 1301 – Registration of Manufacturers, Distributors, and Dispensers of Controlled Substances
3
eCFR. 21 CFR 1301.52 – Termination of Registration; Transfer of Registration; Distribution Upon Discontinuance of Business
4
eCFR. 21 CFR 1304.21 – General Requirements for Continuing Records
5
eCFR. 21 CFR 1304.22 – Records for Manufacturers, Distributors, Dispensers, Researchers, Importers, Exporters, Registrants That Reverse Distribute, and Collectors
6
eCFR. 21 CFR Part 1305 – Orders for Schedule I and II Controlled Substances
7
eCFR. 21 CFR Part 1305 Subpart B – DEA Form 222
8
eCFR. 21 CFR 1305.05 – Power of Attorney
9
eCFR. 21 CFR 1306.05 – Manner of Issuance of Prescriptions
10
eCFR. 21 CFR 1304.04 – Maintenance of Records and Inventories
11
Federal Register. Reporting Theft or Significant Loss of Controlled Substances
12
Drug Enforcement Administration (DEA) Diversion Control Division. Theft or Loss Q&A
13
Drug Enforcement Administration. Theft/Loss Reporting
14
eCFR. Disposal of Controlled Substances by Registrants
15
Federal Register. Disposal of Controlled Substances
16
eCFR. 21 CFR Part 1304 – Records and Reports of Registrants
17
eCFR. 21 CFR 1304.04 – Maintenance of Records and Inventories
18
Office of the Law Revision Counsel. 21 USC 842 – Prohibited Acts B