When a controlled substance is stolen or goes missing, the clock starts immediately. Federal law requires a two-step reporting process: a written preliminary notification to the DEA field division within one business day of discovery, followed by the formal DEA Form 106 submission within 45 days. Many registrants confuse the two — or miss the first deadline entirely while trying to perfect the second. Here's how the framework works.

Two Steps, Two Deadlines

The reporting framework exists to do two different jobs. The preliminary notification puts the DEA on alert quickly, preserving the integrity of any ensuing inquiry and minimizing the window for ongoing diversion. The Form 106 then provides the formal, detailed record of what was lost and what you know about it.

  • Step 1 — Preliminary written notification: Notify the local DEA field division office in writing within one business day of discovering the theft or significant loss (21 C.F.R. §1301.76(b); 21 U.S.C. §830(b)(1)(C)).
  • Step 2 — DEA Form 106: Complete and submit DEA Form 106 electronically within 45 days of discovery, per the June 22, 2023 final rule (88 Fed. Reg. 40707).

Both deadlines run from the date of discovery, not from the date of the theft itself. That makes prompt, documented discovery procedures part of your compliance obligation — if a discrepancy is noticed on a Friday afternoon, the one-business-day clock includes the following Monday.

Theft vs. Loss: What Must Be Reported

A common point of confusion is the difference between theft and loss, and whether each is reportable.

  • All thefts are reportable. There is no threshold, no minimum quantity, and no ambiguity — if controlled substances are stolen, you report it.
  • Losses are reportable when "significant." A loss that cannot be attributed to theft may still require reporting if it rises to the level of a significant loss.

Because "significant loss" is not rigidly defined in federal regulations, registrants must apply the fact-specific factors in 21 C.F.R. §1301.74(c) to make the determination. The six factors are:

  1. The actual quantity of controlled substances lost in relation to the type of business
  2. The specific controlled substances lost (Schedule II opioids and other high-diversion-risk substances weigh more heavily)
  3. Whether the loss can be associated with access by specific individuals or attributed to unique activities involving the substances
  4. Patterns of loss over time — whether losses appear random, how often they recur, and the results of efforts to resolve them
  5. Whether the missing controlled substances are likely candidates for diversion
  6. Local trends and other indicators of diversion potential for the missing substances

The full analysis, including a practical rule-of-thumb, appears in the Tough Issues page's "How to Determine Significant Loss" section.

Why the One-Business-Day Rule Matters

The one-business-day preliminary notification is the step registrants most often get wrong — and it is the step with the most operational consequence. A delay here can:

  • Expand the window for ongoing diversion. If an employee is diverting, every day of delay is another day of theft.
  • Complicate the investigation. Timely notification preserves evidence, access logs, and witness memory.
  • Create a compliance violation on top of the loss. Failing to report a significant loss — or delaying notice — is itself a citable violation that can compound the original problem.
  • Undermine the registrant's position. Regulators view prompt reporting as evidence of a good-faith compliance culture; delay reads as concealment.

Common Mistakes to Avoid

  • Waiting for the investigation to finish before notifying. You do not need certainty — preliminary notification comes first, details follow.
  • Treating the preliminary notice as optional when a loss seems small. If it meets the significant-loss factors, the clock applies.
  • Submitting an incomplete Form 106. Missing drug details, quantities, or circumstances delays the process and invites follow-up.
  • Assuming an internal-only report is enough. Internal incident reports do not satisfy the federal requirement.
  • Losing track of the 45-day window. Calendar it at discovery — the deadline is real.

The Practical Rule: When in Doubt, Report

If you are uncertain whether a loss rises to "significant," the safest course is to report. Filing a preliminary notification and, where required, a Form 106 is far less costly than the alternative: a failure-to-report finding layered on top of the loss itself. Document your analysis and rationale when you make the determination — the written record protects the registrant and supports the investigation.

Further Reading

For the complete filing workflow, see the DEA Form 106 Filing Guide. The step-by-step DEA Form 106 guide walks through the form itself, and the Tough Issues page covers the significant-loss determination in depth. If you are building the policies to support these deadlines, the policy templates are a starting point.