A DEA inspection of your controlled substance program is not a routine administrative event — it is a formal regulatory review with the potential to result in civil or criminal enforcement action. Pharmacies that treat inspections as a surprise are pharmacies that fail them. A strong diversion prevention program, documented and maintained continuously, converts an inspection from a threat into a demonstration of competence. This guide explains what triggers an inspection, what DEA investigators examine, what state board surveyors consistently cite, and how to structure your program so it is always ready.

What Triggers a DEA Inspection

DEA Diversion Investigators conduct inspections under several different circumstances. Routine cyclic inspections are scheduled as part of the DEA's oversight program and may occur at any time during normal business hours without advance notice. Complaint-driven inspections are initiated when a complaint is received — from a patient, an employee, a law enforcement agency, or another regulatory body — alleging a controlled substance violation. Follow-up inspections occur after a prior inspection identified deficiencies and the registrant was given an opportunity to correct them. Inspections may also be triggered by a DEA Form 106 filing (theft or significant loss report), a pattern of suspicious order reports from a distributor, or a referral from state law enforcement.

The practical implication is that a DEA inspection can happen at any time. Registrants who maintain their records, security, and procedures as if an inspection might occur today are the ones who survive inspections without significant findings. Registrants who intend to "clean things up" before the next inspection cycle routinely discover that the inspection arrives before the cleanup is complete.

Security Requirements: What Investigators Check

Physical security is one of the first areas DEA investigators assess. The governing regulations are 21 CFR 1301.71, which establishes the general security obligation that all DEA registrants take reasonable measures to prevent the theft and diversion of controlled substances, and 21 CFR 1301.72, which specifies the physical security controls required for Schedule I and II controlled substances — including vault and safe specifications, alarm systems, access controls, and construction standards for storage areas.

In practical terms, investigators will examine whether Schedule II controlled substances are stored in a vault, safe, or locked cabinet that meets the applicable specifications; whether alarm systems are functional and have been tested; whether access to controlled substance storage is restricted to authorized personnel; whether access logs or electronic credential records exist; and whether surveillance cameras cover the controlled substance storage and dispensing areas. Camera coverage gaps — blind spots over a dispensing station or a storage cabinet — are a finding that investigators note specifically because they remove accountability at exactly the point where diversion most commonly occurs.

21 CFR 1301.74 addresses employee screening and the obligation to report suspicious orders. Investigators may review whether the pharmacy has a documented process for screening employees with access to controlled substances, and whether the pharmacy has complied with reporting obligations when suspicious order patterns were identified.

Under 21 CFR 1301.76(b), a registrant must notify the DEA of theft or significant loss of a controlled substance within one business day of discovering the loss. Investigators will check DEA Form 106 filing history to determine whether any reported discrepancies were escalated appropriately and whether required notifications were timely. A pattern of discrepancies with no corresponding Form 106 filings — or filings that were delayed — is a serious compliance finding. Review the DEA Form 106 guide for the significant-loss threshold analysis.

Recordkeeping Requirements: The Documentary Backbone

DEA recordkeeping regulations are detailed and schedule-specific. Investigators will review records for both completeness and accessibility — records that technically exist but cannot be produced promptly during an inspection are treated as a compliance failure.

The foundational recordkeeping authority is 21 CFR 1304.21, which sets out general requirements applicable to all registrants: records must be maintained for two years, must be kept at the registered location, and must be readily retrievable for inspection. 21 CFR 1304.22 requires that Schedule I and II records be maintained separately from all other controlled substance records — comingling Schedule II transaction records with Schedule III–V records is a citable violation.

The biennial inventory is governed by 21 CFR 1304.11 and is one of the first documents investigators request. They will verify that a biennial inventory was conducted within the required two-year window, that it was taken on a day the pharmacy was open for business, that the date and time are recorded on the document, that Schedule II substances were counted exactly (not estimated), and that opened Schedule III–V containers were also counted exactly. Inventory records reconstructed from transaction data rather than conducted as a contemporaneous physical count are not compliant.

Investigators will also examine DEA Form 222 or CSOS electronic order records for Schedule II purchases, DEA Form 41 records for disposal events, and DEA Form 106 filings for reported losses. Each of these record categories has specific retention and content requirements. Missing, incomplete, or inaccessible records in any of these categories represent individual findings that accumulate into the overall compliance picture.

What Investigators Typically Review During the Inspection

A structured DEA inspection of a pharmacy typically covers the following areas in sequence or in parallel:

  • Biennial inventory: Date, time, scope, and accuracy. Investigators may conduct a spot count of specific substances and compare it to the recorded inventory balance and intervening transaction records.
  • Schedule II order records: DEA Form 222 paper forms or CSOS electronic records. Every Schedule II purchase must be documented. Investigators check that executed copies (showing quantities received) are retained and match purchase receipt records.
  • DEA Form 106 filing history: Whether any losses have been reported, whether the filings were timely, and whether the narrative descriptions are consistent with the pharmacy's internal investigation records.
  • Disposal and Form 41 records: Confirming that expired and waste controlled substances were disposed of through an authorized method, that the Form 41 documents the disposal, and that the quantities destroyed are consistent with what was removed from inventory.
  • Physical security: Storage cabinet or vault specifications, alarm functionality, access controls, camera coverage, and access log records.
  • Employee screening documentation: Background check records, compliance training records, and any documentation of prior disciplinary actions related to controlled substances.
  • Diversion prevention program documentation: Written policies and procedures, training records, surveillance and monitoring documentation, and committee or review meeting records. A pharmacy that cannot produce its diversion prevention policies has effectively told the investigator that no program exists.
  • Waste documentation: Particularly for injectable controlled substances — waste logs with witness signatures, consistency between waste volume and expected volume based on the dispensed dose, and any patterns of high waste rates for specific practitioners or locations.
  • Prescription records and corresponding responsibility: Under 21 CFR 1306.04(a), the corresponding responsibility doctrine requires pharmacists to refuse to fill a controlled substance prescription that they know or reasonably should know is not issued for a legitimate medical purpose. Investigators may review prescription records for evidence of fills that should have triggered a refusal — prescriptions with red-flag indicators that were filled without documented review.

State Board Citation Categories: Practical Warning Signs

State pharmacy board inspections run in parallel to DEA oversight and cover a broader range of operational compliance areas. The categories that state boards most consistently cite provide a useful checklist of vulnerabilities that also concern DEA investigators when they overlap with controlled substance handling. Common state board citation categories include:

  • Expired medications on the shelf. Expired controlled substances that have not been segregated from active dispensing stock represent both a patient safety risk and a compliance failure. They suggest that inventory review processes are not functioning.
  • Improper Schedule II prescription filing. Federal regulations require Schedule II prescriptions to be maintained in a separate, readily retrievable file. Comingling them with Schedule III–V or non-controlled prescriptions is a recurring citation.
  • Pharmacist-to-technician ratios exceeded. State-specific supervision ratios vary, but exceeding them is a consistent finding — and it correlates with diversion risk, because supervision gaps are the conditions under which diversion most often goes undetected.
  • Missing counseling documentation (OBRA 90). Patient counseling requirements for new prescriptions have applied since 1993. Missing or incomplete counseling records suggest process failures that may extend to controlled substance handling.
  • Incomplete temperature logs. Refrigerated medications must be stored at 2–8°C; most room-temperature medications require 20–25°C storage. Temperature log gaps indicate that monitoring processes are not consistently followed — a finding that extends to controlled substance storage monitoring as well.
  • Outdated policies and procedures. Policies that have not been reviewed and updated within the timeframe specified in the document itself, or that reference regulations or standards that have since changed, are a consistent citation. Investigators use policy review dates as a proxy for whether the pharmacy's leadership is actively managing compliance.
  • Unlicensed personnel performing restricted tasks. Technicians or other staff performing functions that require pharmacist authorization, or operating beyond the scope of their license or registration, are cited by state boards and may also implicate DEA accountability requirements.
  • Prescription transfer errors. Errors in the transfer of controlled substance prescriptions between pharmacies — particularly for Schedule III–V substances where transfers are permitted — indicate documentation process failures.
  • Pseudoephedrine log gaps. The Combat Methamphetamine Epidemic Act requires purchase logs for pseudoephedrine-containing products. Gaps in those logs are a consistent finding, and the logs are also subject to DEA inspection.
  • Immunization records not reported to the state immunization information system. A pharmacy-specific process requirement that, when missed, indicates that compliance workflows for externally reported records are not operating reliably.

How a Strong Diversion Prevention Program Makes Inspections Smoother

The pharmacies that fare best in DEA inspections are not the ones that prepare for inspections — they are the ones that run their programs continuously as if an inspection is always imminent. The difference is visible immediately: records are current and organized, investigators can access requested documents without delay, staff can explain procedures without coaching, and discrepancies have documented investigation records rather than unexplained gaps.

A few structural investments make the largest difference:

A written, up-to-date policy manual. Policies that are reviewed and updated on a documented schedule signal to investigators that leadership is actively managing the program. Policies that are outdated, inconsistent with actual practice, or reference superseded regulations signal the opposite. Use the policy templates on this site as a starting baseline and document your review dates.

A documented training program. Training records showing that every employee with access to controlled substances received diversion awareness training — including what to do if they observe suspicious behavior — are among the most favorable things an investigator can see. See the training materials for pharmacy-specific content.

Consistent surveillance and monitoring. If your pharmacy conducts regular controlled substance reconciliation, cycle counts, waste audits, or override reviews, document those activities and retain the records. An investigator who can see that your program produces regular monitoring output — and that discrepancies trigger investigation — will treat your program as credible.

A scored, maintained checklist. The DivertGuard diversion prevention checklist provides a weighted scoring framework that maps directly to the categories DEA and state board inspectors examine. Running the checklist quarterly and retaining the results gives you both a management tool and an inspection-ready demonstration that your program is structured, measured, and actively maintained.

Organized, accessible records. Before an inspection occurs, ensure that all required record categories — biennial inventory, Form 222/CSOS orders, Form 41 disposal records, Form 106 filings, waste logs, prescription records — are organized, labeled, and accessible at the registered location. An investigator who must wait while staff search for records starts the inspection with a negative impression that is difficult to recover from.

After an Inspection: Responding to Findings

If an inspection produces findings — whether formal citations or informal observations — respond in writing promptly and specifically. A corrective action plan that identifies the root cause of each finding, the specific corrective measure taken, and the timeline for verification is a stronger response than a general statement of intent to comply. Retain a copy of the inspection report, your response, and all documentation of completed corrective actions with your compliance records. A subsequent inspection that finds the same deficiencies corrected demonstrates program integrity; one that finds the same deficiencies uncorrected converts an administrative matter into an escalation risk.

If an inspection uncovers evidence that may constitute a reportable theft or significant loss that has not yet been reported, consult your compliance counsel promptly regarding voluntary disclosure. Self-reporting before DEA initiates formal action is treated more favorably than a failure to report discovered through an inspection. The DEA Form 106 guide covers the significant-loss determination and the reporting process.