Inventory Requirements Under 21 CFR 1304
Initial Inventory
Under 21 CFR 1304.11, every pharmacy must conduct an initial inventory of all controlled substances on hand on the date the pharmacy first engages in dispensing. This inventory serves as the baseline for all subsequent recordkeeping and must include every controlled substance in the pharmacy's possession, including samples, outdated stock, and damaged goods.
Biennial Inventory
After the initial inventory, pharmacies must conduct a complete inventory of all controlled substances at least every two years (biennially) per 21 CFR 1304.11(c). The biennial inventory date becomes your pharmacy's "inventory date" going forward, and subsequent biennial inventories should be conducted within two years of the previous one.
Critical details for biennial inventories:
- The inventory must be taken on either the opening or closing of business on the inventory date
- For Schedule II substances, an exact count is required
- For Schedules III-V, an estimated count is permitted unless the container holds more than 1,000 dosage units, in which case an exact count is required
- The inventory must include the drug name, dosage form, strength, number of dosage units, and total quantity
- Record whether the inventory was taken at opening or closing of business
Perpetual vs. Periodic Inventory for Schedule II
While the DEA requires only biennial inventories, maintaining a perpetual (running) inventory for Schedule II substances is strongly recommended and required by many state boards of pharmacy. A perpetual inventory tracks every receipt and dispensing in real time, making discrepancy detection immediate rather than discovering shortages months later during a biennial count.
Recordkeeping for Schedules II Through V
Under 21 CFR 1304.04, every pharmacy must maintain complete and accurate records of all controlled substances received, dispensed, and disposed of. These records must be readily retrievable and maintained for a minimum of two years from the date of the transaction - though many states require longer retention periods (five years or more).
Schedule II Records
Schedule II records carry the most stringent requirements:
- Receiving: Each receipt of Schedule II substances must be documented on DEA Form 222 (for paper orders) or through the CSOS electronic ordering system. The form must include the date received and the actual quantity received. Three-part DEA Form 222 copies must be retained by both the supplier and purchaser.
- Dispensing: Prescription records must include the patient name, prescriber name and DEA number, drug name and strength, quantity dispensed, date filled, and the dispensing pharmacist's initials or identification.
- Separate filing: Schedule II records must be maintained separately from Schedules III-V records or in a system where Schedule II records are readily distinguishable (such as marking with a red "C" stamp).
Schedules III-V Records
Records for Schedules III-V substances are maintained through the pharmacy's standard prescription filing system, but they must be readily retrievable. The DEA's "three-file" or "two-file" system options provide structure:
- Three-file system: Separate files for Schedule II prescriptions, Schedule III-V prescriptions, and non-controlled prescriptions
- Two-file system: One file for Schedule II prescriptions, and a second file for all other prescriptions - but Schedule III-V prescriptions must be stamped with a red "C" for identification
CSOS Electronic Ordering
The Controlled Substance Ordering System (CSOS) replaced paper DEA Form 222 for electronic ordering of Schedule II substances. Under 21 CFR 1305.21-1305.29, CSOS uses digital certificates issued by the DEA to authenticate electronic orders.
Key CSOS requirements:
- Only individuals with a valid CSOS digital certificate may place orders
- The certificate is linked to the pharmacy's DEA registration
- Digital certificates must be kept secure - compromised certificates must be reported to the DEA immediately
- Electronic records of CSOS orders must be maintained and readily retrievable for DEA inspection
- Pharmacies must verify that their wholesale suppliers are authorized to distribute controlled substances by confirming valid DEA registrations
Theft and Loss Reporting - DEA Form 106
Under 21 CFR 1301.76(b), pharmacies must report any theft or significant loss of controlled substances to the DEA using DEA Form 106. This form must be submitted upon discovery of the loss.
What constitutes a reportable loss:
- Any theft, regardless of the quantity
- Losses due to a break-in, robbery, or employee pilferage
- Significant unexplained inventory discrepancies discovered during routine counts
- Losses during transit or shipping
What is generally NOT reportable:
- Minor discrepancies attributable to normal dispensing errors (such as a count being off by one or two tablets) that are corrected through standard pharmacy operations
- However, a pattern of small discrepancies warrants investigation and potentially a report
Filing requirements:
- Submit DEA Form 106 online through the DEA Diversion Control Division website
- Notify local law enforcement if theft or robbery occurred
- Maintain copies of all theft and loss reports
- Conduct an internal investigation to determine the cause
- Some states require separate notification to the state board of pharmacy
The Corresponding Responsibility Doctrine
This is the area where more pharmacies encounter DEA enforcement problems than any other. Under 21 CFR 1306.04(a), a pharmacist has a "corresponding responsibility" with the prescriber to ensure that a controlled substance prescription is issued for a legitimate medical purpose by a prescriber acting in the usual course of professional practice.
This means pharmacists cannot simply fill every controlled substance prescription that appears technically valid. You must exercise professional judgment and refuse to fill prescriptions when red flags indicate the prescription may not be legitimate.
Red Flags That Require Investigation
The DEA and courts have identified numerous red flags that a pharmacist should investigate before dispensing:
- Prescriptions from distant prescribers when comparable practitioners are nearby
- Cash-only payments when the patient has insurance (particularly for controlled substances)
- Combination prescriptions - the "holy trinity" of opioid, benzodiazepine, and muscle relaxant
- Early refill requests or patterns of lost/stolen medications
- Multiple patients from the same address or presenting together
- Prescriptions for maximum quantities of high-dose formulations
- Prescriptions from prescribers known to be under investigation
- Patient behavior suggesting intoxication, drug-seeking, or diversion
- Identical prescriptions for the same regimen from the same prescriber to multiple patients
Documenting Your Professional Judgment
When you investigate a red flag and decide to fill the prescription, document your reasoning. Note that you identified the concern, what steps you took (called the prescriber, checked the PDMP, spoke with the patient), and why you determined the prescription was legitimate. If the DEA later reviews that prescription, your documentation demonstrates that you exercised your corresponding responsibility.
When you refuse to fill, document that as well. Record the reason for refusal, any communication with the prescriber, and the date.
PDMP Utilization
Prescription Drug Monitoring Programs are now operational in all 50 states, and most states mandate that pharmacists check the PDMP before dispensing controlled substances. Even in states where PDMP checks are not mandatory for every dispensing, the DEA expects pharmacists to use the PDMP as part of exercising corresponding responsibility.
Best practices for PDMP utilization:
- Check the PDMP before dispensing any new controlled substance prescription
- Check for all refills of Schedule II substances
- Document PDMP checks in the patient profile or prescription record
- Flag and investigate patients with multiple prescribers or pharmacies
- Use PDMP data to support clinical conversations with prescribers when patterns are concerning
Reverse Distribution and Disposal
When controlled substances need to be destroyed - whether due to expiration, damage, or patient returns - they must be handled through an authorized reverse distributor or DEA-approved disposal method per 21 CFR 1317.
Authorized disposal methods:
- Reverse distribution: Send controlled substances to a DEA-registered reverse distributor using the appropriate DEA form. The reverse distributor handles the actual destruction and provides documentation.
- On-site destruction: With prior DEA authorization and in the presence of required witnesses, pharmacies may destroy controlled substances on-site. This requires meticulous documentation.
- Patient drug take-back: Pharmacies registered as collection sites under 21 CFR 1317.40 may collect controlled substances from patients for disposal.
Never dispose of controlled substances in regular trash, down drains, or through non-DEA-authorized methods. Document every step of the disposal process, including the substances destroyed, quantities, method of destruction, witnesses, and dates.
Staff Training on Controlled Substance Procedures
Every individual in your pharmacy who handles, dispenses, or has access to controlled substances should receive documented training on your controlled substance policies and procedures. This training should cover:
- Proper storage and security - Controlled substances must be stored in a securely locked, substantially constructed cabinet or distributed throughout non-controlled stock in a manner that obstructs theft (21 CFR 1301.75). Staff should understand access controls and who holds keys or combinations.
- Inventory procedures - Train staff on how to conduct counts, what to do when discrepancies are found, and the importance of documenting every variance.
- Recognizing diversion - Internal diversion by employees is a persistent risk. Staff should know the warning signs: unexplained inventory shortages, a coworker who insists on handling certain medications alone, behavioral changes, or discrepancies between dispensing records and inventory counts.
- Prescription verification - Technicians and pharmacists alike should be trained on identifying forged or altered prescriptions, verifying prescriber credentials, and understanding when to escalate a suspicious prescription to the PIC.
- Reporting obligations - Staff must know that they are required to report suspected theft or diversion internally and that the pharmacy has a legal obligation to file DEA Form 106. Creating an environment where staff feel safe reporting concerns without fear of retaliation is essential.
Document all controlled substance training with attendance records and signed acknowledgments. When a DEA investigator visits your pharmacy, one of the first questions will be whether staff have been trained on your controlled substance procedures. Having documented training records ready demonstrates operational maturity.
For more detail on preparing for a DEA inspection, see our guide on How to Prepare for a DEA Pharmacy Inspection. Many of these same areas are also reviewed during state board of pharmacy inspections, making strong controlled substance compliance a cornerstone of your overall regulatory readiness.
