Controlled substance inventory management, explained.

Controlled substance inventory management: a paper trail that has to match the shelf

A vial's paper trail: order form, usage log, count, inventory, disposal record

1. It is ordered and receivedSchedule I and II drugs need DEA's order form, Form 222, or its electronic equivalent. The lab records how many containers came and on what date.3,4
2. Each use is written downWho took how much, when and for what. DEA's list for researchers calls this the dispensing log. Labs usually call it the usage log.1
3. A count is compared with the recordsThe expected balance meets the measured one. Any difference gets an explanation, or an assessment as a possible loss. This is the step this guide is about.
4. The inventory is taken and keptA complete list of everything on hand, at least every two years, dated as of opening or close of business.5
5. Leftover stock leaves on paper tooDestroyed on site with two employee witnesses and recorded on DEA Form 41, or transferred to a reverse distributor, a registered firm that takes unwanted stock for return or disposal. Every record stays available for at least two years.6,7,1

Federal rules set these steps. Your state and your institution may add more.

No required running balance, no defined "significant": what surprises new registrants

Registrant, reconciliation, significant loss and non-retrievable, each in a few lines

Fourteen terms are defined in the summary at the end of this guide.

Which DEA records rules reach a researcher, and the one exemption people misread

In shortEvery registrant keeps the records and inventories in Part 1304 unless an exemption applies. The law counts a scientific investigator as a practitioner, so the theft and loss rule written for practitioners applies to researchers. DEA's plain-language guide for this audience is its Researcher's Manual, dated June 15, 2022, which is nonbinding and a year older than the current Form 106 rule.

The statute's definition of "practitioner" includes a "scientific investigator" who is registered to conduct research with a controlled substance.12 That one phrase connects a lab to rules whose titles seem written for clinics. Part 1304 then says what each kind of registrant keeps. Section 1304.22(c) groups "dispensers and researchers" together, and section 1304.11(e)(6) does the same for inventories.13,5

There is one exemption worth reading slowly. It covers a registered person using controlled substances at "a registered establishment which maintains records", either in preclinical research or teaching, or under an FDA investigational exemption, which lets a drug be studied before it is approved. That person does not have to keep their own records if they tell DEA, in an attachment to the application, which establishment keeps them.9 The records still have to exist. They sit with the establishment.

The same section lets a researcher keep "one consolidated record system" across activities under one registration, and store everything in one place, with one inventory every two years.9 Separate records are required per registered location and per independent activity.6

This guide covers federal paperwork. It leaves out storage hardware, security design and laboratory handling, which belong with your institution's program and your DEA field office.

A DEA researcher registration: two rows, one year, and what the 2025 fentanyl law changed

In shortResearch in Schedule I and research in Schedules II to V are separate registrations, each on Form 225, renewed yearly on Form 225a at $296. The HALT Fentanyl Act of July 16, 2025 added a faster notice route for some Schedule I research, and let more of a lab's staff and sites work under one registration. It told the Attorney General to issue rules within six months. We found none as of November 3, 2026.

Each research row in the rule's table shows the same terms: new application on Form 225, renewal on Form 225a, a $296 fee and a one-year period.8 DEA's forms page links both.23 Because a registration renews every year, a lab holding two has two dates to watch.

A Schedule I registration also rests on a research protocol, with the investigator's details, the substances and amounts, the research described, and the institutional approvals.15 DEA's Schedule I page points to the protocol as the thing to amend or supplement when the work changes.24

What Public Law 119-26 changed for research registrations, in the statute's own terms

One open question sits on the calendar. The law gave the Attorney General six months for these rules, which ran out on January 16, 2026.26 An advocacy group for drug policy wrote on July 16, 2026 that "no interim rules have been published".31

DEA's list of new items, read November 3, 2026, runs back to June 2026 and shows none, and the White House's list of rules under review showed no such DEA rule that day.29,32 We did not read the eCFR or the Federal Register's own search, so read this as not found. Until they appear, check with your DEA field office how to send a notice under the new routes.

The DEA biennial inventory: what 21 CFR 1304.11 requires, line by line

In shortTake an initial inventory the day you start, even if it reads zero. Take a new one at least every two years, on any date within two years of the last. Take one on the day a substance you hold becomes controlled. In an opened container, count Schedule I and II exactly and estimate Schedules III to V, unless the container holds more than 1,000 tablets or capsules. Say whether it is as of opening or close of business, keep it on site, and do not send it to DEA.

An inventory is "a complete and accurate list of all stocks and forms of controlled substances in the possession of the registrant as determined by an actual physical count", in the manual's words.1

Several details in the rule catch people out. It must be "in written, typewritten, or printed form at the registered location". A separate inventory is made for each registered location and each independent activity. And stock held somewhere the registrant is not registered still goes on the inventory of the location responsible for it.5 UCLA's program puts it plainly: "A usage log is not a substitute for a biennial inventory."33

What each line of a researcher's inventory has to carry

Section 1304.11(e)(6) borrows the manufacturers' list for finished forms, and DEA's manual turns it into eight items.5,1

University programs often add their own habits. The University of Miami asks for a hands-on count rather than a database check, completed in one business day, with at least two authorized people.38 Those are one program's practices. They make the record easier to defend, because a count taken by two named people on one date is hard to dispute.

21 CFR Part 1304 for researchers: the records, their fields and how long they stay

In shortRecords are kept "on a current basis", dated by when things actually happened, for at least two years, and ready to hand over. Schedule I and II records are kept apart from everything else. Schedule III to V records may be separate or readily retrievable from ordinary records. Inventories and executed order forms stay at the registered location, even where other records are centralized. An in-house computer system needs no notice to DEA.

The nine kinds of record DEA's manual expects a researcher to hold

Current, dated, separate, retrievable: what four record words require

Two years is the federal floor, and your institution's schedule may run longer

Every inventory and record stays available "for at least 2 years from the date of such inventory or records, for inspection and copying".7 Executed Form 222 copies have the same two years and must be kept separately; an electronic copy counts as separate if it can be retrieved separately.16

A registrant may hold some financial and shipping records centrally after written notice, but executed order forms and inventories remain at each registered location.7 Registrants "need not notify" DEA to keep records on an in-house computer.7 Local schedules can be longer. UCLA's page gives three years after the end of the fiscal year in which the substance is disposed of.33

Controlled substance reconciliation, worked through with three fictional containers

In shortExpected balance equals received, less withdrawn, less wasted, less transferred or destroyed. Compare it with a count. Then trace any difference through the records, one line at a time. A transcription error, an unlogged waste and an unexplained shortfall can all produce a red number on the same day. Only the records can tell them apart.

Container 1: a witnessed waste that never reached the usage log

Cobbleford Pharma's lab received a 20.0 mL vial of a Schedule II fentanyl citrate solution, and five logged withdrawals total 3.2 mL. Expected is 16.8 mL, and the count finds 16.4 mL: a variance of −0.4 mL. The usage log for October 3 says 0.6 mL withdrawn. The surgery notebook for the same day says 1.0 mL drawn, 0.6 mL given and 0.4 mL wasted, with a named witness. Add a late waste line and expected becomes 16.4 mL, which matches.

Container 2: one number typed differently in two places

A Schedule I research compound, CBF-7731 HCl: received 500.0 mg, withdrawn 87.0 mg, wasted 0.4 mg, so expected 412.6 mg. The count finds 409.8 mg, a variance of −2.8 mg. The usage log for October 5 says 25.0 mg. A balance printout shows the vial going from 23.4973 g to 23.4695 g, a difference of 27.8 mg, and the notebook also says 27.8 mg. Three records agree. Correcting that one line accounts for the whole 2.8 mg.

UCLA's program gives the reason to record what you actually measure: note the amount visibly removed from the container, and skip the amount you calculated you would need.33 A scientist who plans for 25 mg and weighs 27.8 mg has two true numbers in mind and one line to fill in.

Container 3: a difference no record explains

Pentobarbital 390 mg/mL, Schedule II, in a 100 mL bottle: 100.0 mL received and 58.5 mL withdrawn across six logged entries, so 41.5 mL expected. A witnessed count finds 37.0 mL, a variance of −4.5 mL, or 1,755 mg of the drug (4.5 × 390). Every log line matches a protocol record, and nothing explains the gap. This is the moment the next section is about.

Theft or significant loss: the one-business-day notice and DEA Form 106 within 45 days

In shortA theft or significant loss of any controlled substance, in any schedule, takes two steps. First, a written notice to your DEA Field Division Office within one business day of discovery. Second, a complete and accurate Form 106, filed online within 45 days after discovery. If your investigation then finds no loss, you do not file the form, and you write to DEA to close the first notice. Miscounts, clerical errors and witnessed spills do not go on a Form 106.

The rule reads: "The registrant shall notify the Field Division Office of the Administration in his area, in writing, of the theft or significant loss of any controlled substances within one business day of discovery of such loss or theft."10

It goes on: "The registrant must also file a complete and accurate DEA Form 106 with the Administration through DEA's Diversion Control Division secure network application within 45 days after discovery of the theft or loss."10 The form's full name is Report of Theft or Loss of Controlled Substances, and DEA takes it through Theft/Loss Reporting Online.41,23

Worked dates for the fictional pentobarbital shortfall

The six factors DEA lists for judging whether a loss is significant

When DEA set the one-business-day deadline in 2005, it said no single objective standard could apply to all registrants, and that "when in doubt, registrants should err on the side of caution".42 It also said that discovery can come in stages, and that its overriding interest is immediate notice of "suspected or actual" theft or significant loss.42

Here is the list in the rule, with the records a registrant usually turns to for each. The pairing is our reading. One factor uses DEA's word diversion, which means controlled substances moving out of legitimate channels.22

Situations DEA treats differently from a loss

In a lab or clinic with several registrants, DEA said in 2023 that each registrant whose stock was affected is responsible for the notice, and that stock and records should be kept apart to make that clear.21 DEA's manual also says a registrant should tell local law enforcement and state regulators, although federal rules do not specifically require it.1

DEA Form 41: when a destruction record is required, who witnesses it, and when a log line is enough

In shortDEA Form 41 is now titled Registrant Record of Controlled Substances Destroyed. On-site destruction takes two employees and a Form 41 with their names and signatures. It stays in your files for at least two years, and is sent to DEA only on request. Stock transferred to a reverse distributor moves on an order form or a distribution record instead. Residue left after immediate administration is recorded in the usage log, without a Form 41.

The rule gives a practitioner four ways out for unwanted stock: destroy it promptly on site, deliver it to a reverse distributor, return it to the supplier or manufacturer, or ask your DEA field office for help, using a Form 41.19 A controlled substance to be destroyed must be "rendered non-retrievable".11

Four ways out for unwanted stock, and the paper each one takes

Which record each disposal event calls for, and who signs it

What two witnesses declare on the current Form 41, and where the form stays

The form's page states three things plainly. Two authorized employees "must declare by signature, under penalty of perjury" that they personally watched the destruction. "You are not required to submit this form to DEA, unless requested to do so." And it "must be kept as a record of destruction" and be available "for at least two years".43

The 2022 manual still uses an old title for this form and describes a reverse distributor filing it with DEA, so read the form's own page first.1,43 The manual also warns that a Form 41 should not record the transfer between a researcher and a reverse distributor.1

Where a running balance starts: DEA Form 222, CSOS and receipts for Schedules III to V

In shortA Schedule I or II transfer takes a DEA Form 222 or a digitally signed electronic order through DEA's Controlled Substance Ordering System, CSOS. The form is single-sheet, valid for 60 days, and the purchaser keeps a copy and writes down containers received and dates. Schedules III to V move on invoices or packing slips. Your account's first number comes from those records, so an error here carries through every later count.

A Form 222 is required "for each distribution of a Schedule I or II controlled substance", with listed exceptions.3 The buyer copies the form and sends the original to the supplier. No form is valid more than 60 days after the buyer signs it. When containers arrive, the buyer "must record on its copy" how many containers came on each item and the date they arrived.4

DEA's March 20, 2026 technical amendment removed the old triplicate transition text and clarified who may sign a power of attorney: the registrant, a partner, or an officer of a registrant corporate entity. DEA calls these conforming revisions with no substantive change.17

It is easy to treat a researcher's transfer to a colleague as informal. Distributing to another registrant calls for the same paper: an order form for Schedule I or II, and a record with the recipient's name, address and registration number for all schedules.3,1

What alleged DEA recordkeeping failures have cost, from a fertility clinic to a research company

In shortRecordkeeping can carry a civil penalty per violation, and small failures multiply. The largest published cases we found are clinical, and their announcements allege missing basics: initial inventories, destruction records, order forms and loss notices. The nearest research case, Charles River as successor to Explora BioLabs, turned on work allegedly beyond researcher registrations, with recordkeeping alongside it. All three were announced as resolving allegations.

What news reports say each settlement announced, and only that

The other errors programs report, and why they happen

Beyond the settlements, public data on research labs is thin. We found no count of researcher inspections, findings or Form 106 filings. The University of Miami tells its investigators that one of the most common discrepancies is in initial and biennial inventories, and that "a majority of DEA registrants either maintain incomplete inventories or maintain no inventories at all".38 That is one university's statement, with no count behind it. The errors below recur because of how the work is arranged, so you can check for them yourself.

Writing up a controlled substance discrepancy without accusing anyone

In shortA variance is a fact about records. It says nothing yet about a person. DEA's third factor does ask whether a loss can be associated with access by specific individuals, so people will come into it, but in an investigation run by the registrant, with care, and with the evidence kept apart from the arithmetic. A hospital study shows how often such a flag can be wrong: at one medical center, most flagged staff were false positives.

Picture the scientist in the example. If the first thing anyone says about 0.4 mL is "where did it go?", she will remember that question long after she has found the notebook page. A red number on a screen can feel like an accusation, and a program that treats it as one teaches people to hide small errors. DEA's own text starts elsewhere: the manual says the question depends on "the likelihood of a rational explanation".1 Most reconciliation work is the search for that explanation.

The same care applies when an explanation does not appear. A published comparison at one academic medical center looked at three kinds of report used to flag staff for possible diversion. False positives were 96.72%, 93.18% and 76.12%, and the authors concluded that accurate software still needed significant improvement.51 Those are hospital dispensing data, on inpatient units, and nothing like them has been published for research labs. They still make the point for anyone reading a flag: it is a reason to look and nothing more.

Four habits that keep a loss file fair

Electronic controlled substance records, signatures and AI: what each rule covers

In shortDEA lets you keep records on an in-house computer system without telling it, and they must still be complete, accurate, retrievable and available for copying. FDA's Part 11 covers records under FDA's own rules, and we found no text applying it to DEA records as such. On our reading, it reaches the same record only where that record also serves an FDA requirement, such as a good laboratory practice study. We found no DEA text on AI in records. Software can read, post and compare; the registrant judges significance.

Why reading the records by machine helps, and how far that goes

That measurement comes from clinic glucose results, and the authors' lesson was to interface instruments when you can.58 The same logic applies to a balance: a printout captured directly removes one chance to mistype. Software that reads usage logs, printouts and notebook scans can compare every line, show where two records disagree, and draft the paperwork. It cannot decide that a loss is significant, because the rule places that judgment on the registrant.1 And it should never infer a quantity nobody wrote down, or suggest a culprit.

Paper logs, spreadsheets and a binder: how research labs keep controlled substance records today

In shortA registrant answers for the records. A lab manager or senior scientist keeps them, research staff write the usage lines, and a university or company program often checks them. The usual tools are paper logs, a spreadsheet and a binder. No public figure exists for hours per inventory or how many labs count monthly, so measure your own before you believe anyone else's number.

Who holds the registration, the log and the signature in a research lab

DEA's visit before a new registration shows what an agency investigator wants to understand. The University of Cincinnati's guide lists items commonly requested, among them who receives and reconciles orders, how often physical counts are done, and the "recordkeeping method and location", with examples ranging from paper records in a room to a spreadsheet on a shared drive.59 Decide your answers before anyone asks.

What a spreadsheet, a general inventory system and purpose-built software each do for these records

A controlled substance count entered at 10:12 am and closed green at 10:14 am

In shortEvery storage location is a block and every container a line with its running balance. The lab manager enters a fentanyl count, and the line turns red at once. Five software agents, each with one job, read nine records and find a witnessed waste in a scanned surgery notebook. The registrant signs a late waste line, the person who wasted it co-signs, and the line closes. The one-business-day notice clock never starts.

Correcting a usage log line while the original stays visible

In shortSafe A is off by 2.8 mg on a Schedule I compound. The usage log says 25.0 mg, while the balance printout and the notebook both say 27.8 mg. The agents show the three records side by side and propose a correction. It takes two signatures, and the original stays visible, struck through.

A 4.5 mL shortfall: the significant-loss assessment, the written notice and the Form 106 draft

In shortPentobarbital in Cabinet V1 is 4.5 mL short and no record explains it. The agents set out what they found, walk through DEA's six factors, and recommend reporting. The clock runs from discovery at 7:52 am. The notice and Form 106 fields are drafted, and nothing goes anywhere until the registrant signs. The screen names no one: "that is for your investigation".

The biennial inventory a named registrant signs, and the inspection pack behind it

In shortThe inventory is drafted from the day's counts, as of opening of business, by schedule, with exact counts for open Schedule I and II containers. A named registrant signs it. Destruction, receipts, transfers, loss reports and corrections sit in one place, and one pack per registration gathers them, flagging what is still unsigned.

From reading a balance printout to a signed inventory: five agents, and where the registrant takes over

In shortFive agents read records, post movements, compare counts, assess shortfalls and draft paperwork. Each one has a place it stops. The registrant decides every difference and signs every correction, loss decision, inventory and destruction record. The solution gives you controls that support your compliance with DEA's rules.

Who signs what in the October count, and who checks it

Compliance with DEA's rules, and with any FDA rule your records also serve, remains yours to show through your own records and procedures. Botminds' own credentials are SOC 2 Type II, audited, and information security managed to ISO 27001.

The people in the October count, in their own words

Usage logs and printouts going in, signed DEA records coming out

Works with the records a controlled-substance program already keeps

Built for an enterprise program: role-based access per registration, maker-checker signatures (one person prepares, another approves) on every correction, a full audit trail of people and agents, read-only access for investigators, and connections to the systems above.

4 hours, 1.7 hours and 94%: the design targets for a research lab's DEA records

A difference found weeks late: what it costs a DEA registrant, and how to price it in one week

In shortYour reconciliation hours are easy to count, and the larger costs are harder: an explanation lost because the person and the printout have moved on, an inspection question the records cannot answer, and a civil penalty counted per violation. We found no public benchmark for hours per count or per inventory in research labs, so measure your own. A week of plain counting gives you the inputs for the calculator below.

Where your count, trace and inventory hours hide, and how to count them

A scientist's name, a stopped study, your standing with DEA: costs a spreadsheet does not count

Hours back on counts, inventories and traced differences: does tracking software pay for itself?

In shortThree things can pay for this: hours saved reconciling counts, hours saved preparing inventories, and hours saved tracing differences. A loss caught early and a penalty avoided are real and unpriced. Every input below is an assumption until you replace it. If you hold one registration and a few containers, a good paper log and a spreadsheet may be all you need.

What your counts, inventories and traced differences add up to after your yearly cost

How ready your DEA records are for automation: score inventories, logs, counts and signatures, then pick one old difference

In shortScore each question 0, 1 or 2 for one registration, or for your program. A low score points you to work that pays back even if you buy nothing: an initial inventory on file, one usage log format, and a written procedure for shortfalls.

Choosing DEA recordkeeping software: nine questions on records, signatures and claims, and an eight-week trial

In shortAsk any vendor, us included, to show it on your own usage logs. The answers that matter concern what the software reads, what it does when records disagree, who decides, how it speaks about people, and what it claims about DEA. Then run a pilot beside your current counts, with known test errors in a copy of the records, and measure.

An eight-week trial on one or two DEA registrations

What researchers ask about the DEA biennial inventory, Form 106 and Form 41

In shortEach answer below stands alone. For your own program, check with your DEA field office, your state and your institution.