Controlled substance recordkeeping is the backbone of every diversion prevention program — and the first thing a DEA investigator examines during an audit. A complete, well-organized record set does more than satisfy a legal checklist: it creates the audit trail that makes discrepancies visible, supports investigations, and protects your registration when regulators come knocking. This guide covers every category of record that 21 C.F.R. Part 1304 requires, what each must contain, and how the pieces fit together into a balanced accounting.

The Regulatory Foundation: 21 C.F.R. Part 1304

The primary federal authority governing controlled substance records is 21 C.F.R. Part 1304. This regulation defines who must maintain records, what those records must contain, how long they must be kept, and where they must be stored. Every DEA registrant — pharmacies, hospital dispensaries, dispensing practitioners, distributors, and manufacturers — is subject to its requirements, though the specific records required vary by registrant type.

Part 1304 also establishes the "readily retrievable" standard: controlled substance records must be organized so that a DEA investigator can locate and review any specific record during an inspection without unreasonable delay. Unsorted files, records stored off-site, or records comingled with general business documents fail this standard regardless of whether the documents themselves are complete and accurate.

Biennial Inventory Records

The biennial inventory is the anchor document from which all reconciliation begins. It establishes a known, physically verified quantity of every controlled substance on hand at a fixed point in time. Requirements for what the inventory must contain, when it must be conducted, and the difference between Schedule II and Schedule III–V counting rules are covered in detail in our controlled substance inventory requirements guide.

From a recordkeeping perspective, each inventory document must show:

  • The date and time the count was conducted
  • The name, dosage form, strength, and quantity of every controlled substance on hand
  • The signature of the person who conducted the count
  • An indication of whether Schedule II quantities were exact counts or estimates (exact counts are always required for Schedule II)

The inventory record must be retained at the registered location for a minimum of two years and must be kept separate from — or readily separable from — all other business records.

Records of Receipt: Invoices, Form 222, and CSOS

Every time controlled substances enter your registered location from an outside source, a record of receipt must be created and retained. The form this record takes depends on how the substances were ordered:

  • Schedule II — paper DEA Form 222: The registrant's retained copy (Part 3 of the three-part form) serves as the record of order. When the shipment arrives, the receiving date and actual quantity received are annotated on this copy. The annotated Part 3 is the receiving record and must be kept for two years.
  • Schedule II — CSOS electronic order: The electronic order record and the supplier's shipping confirmation together constitute the receipt record. These must be retained in a retrievable format for two years.
  • Schedules III–V: A supplier invoice noting the drug name, strength, dosage form, quantity, and date of receipt is the required record. Many facilities annotate the invoice with the date received and the initials of the person who verified the shipment. This invoice is the legal record of receipt and must be retained for two years.

A receiving record that does not reflect what was actually delivered — because a shipment was short, damaged, or substituted — must document the discrepancy at the time of receipt, not retroactively. Receiving discrepancies are among the earliest indicators of supply chain diversion.

Dispensing Records

For every controlled substance dispensed, the dispensing record must capture the information required by 21 C.F.R. §1304.22 (for practitioners and pharmacies). The required data elements include:

  • Date of dispensing
  • Name and address of patient (for prescriptions)
  • Drug name, strength, and dosage form
  • Quantity dispensed
  • Prescriber name and DEA number
  • Pharmacist or dispenser identifier

In hospital and institutional settings, the medication administration record (MAR) and barcode medication administration (BCMA) logs serve as the dispensing record for bedside administration, while pharmacy dispense records capture the transaction at the point of dispense from the pharmacy. Both layers of documentation are subject to DEA recordkeeping obligations and must be maintained with the same care as outpatient prescription records.

Waste records — documenting controlled substance administered doses that were partially used, wasted in front of a witness, and recorded — are part of the dispensing record chain. Missing or incomplete waste documentation is one of the most consistent findings in DEA inspections of hospital pharmacies and a primary red flag in diversion investigations.

Power of Attorney Records

Any person other than the DEA registrant who signs DEA Form 222, CSOS electronic orders, or other controlled substance authorization documents must do so under a validly executed Power of Attorney (POA). The POA must:

  • Be in the format specified by the DEA (21 C.F.R. §1305.05 for Form 222 POAs)
  • Be signed by the registrant granting authority and by the designated individual accepting it
  • Remain current — the POA is revoked automatically when the designated person leaves the role or when the registrant issues a revocation
  • Be retained at the registered location and available for immediate inspection

POA records must be kept as long as the designated person exercises ordering authority, plus two years after the authority ends. During a DEA inspection, investigators routinely check whether every Form 222 or CSOS order signed by a non-registrant is covered by a current, on-file POA. A signed order without corresponding POA documentation is a citable deficiency.

The Two-Year Retention Rule

Under 21 C.F.R. §1304.04, the minimum federal retention period for all controlled substance records is two years from the date the record was created. This applies uniformly to inventory records, receiving records, dispensing records, Form 222 copies, CSOS electronic records, POA documents, and destruction records (Form 41).

Two years is the federal floor — many state pharmacy boards mandate longer retention, with five and seven years common in numerous jurisdictions. Always apply the more stringent standard between federal and state law. A seven-year state requirement supersedes the two-year federal minimum for any facility registered in that state.

Electronic records satisfy the retention requirement provided they remain retrievable in a format accessible at the registered location. Cloud storage is permissible but records must be producible during an inspection, not pending a download request that takes days.

Balancing: Making the Records Match

The legal requirement to maintain individual records — inventory, receipt, dispense, waste, destruction — is inseparable from the practical obligation to ensure those records balance. Balancing is the process of verifying that:

Beginning inventory + receipts − dispenses − waste − returns − destructions = current on-hand quantity

When a physical count deviates from this calculated balance, the difference is a discrepancy that must be investigated and documented. The investigation record — including the identified cause (or the conclusion that the cause could not be determined) — must be retained alongside the underlying records that produced the discrepancy.

Unresolved discrepancies that accumulate without investigation or documentation are among the most serious findings in a DEA audit and the most common precursor to a criminal diversion investigation. A program that discovers frequent unexplained discrepancies without escalating them is, from the DEA's perspective, either failing its monitoring obligation or concealing a diversion problem.

The Importance of Audit Trails

An audit trail is a chronological record of every transaction that changed the quantity or location of a controlled substance. Modern pharmacy information systems and controlled substance management platforms generate audit trails automatically, but the completeness of that trail depends on how well the system is configured and how consistently staff document every transaction at the time it occurs.

Audit trails serve two purposes in a diversion prevention program. First, they enable prospective surveillance — automated reports that flag statistical anomalies, overrides, excess waste events, or unusual access patterns. Second, they enable retrospective investigation — when a discrepancy is identified or a staff member is suspected of diversion, the audit trail allows investigators to reconstruct every relevant transaction and identify the mechanism and approximate timing of the diversion.

A fragmented audit trail — where some transactions are captured in the pharmacy system, others in the ADC log, and others only on paper — is an inherent weakness that both diverters exploit and investigators find frustrating. Building a unified audit trail that captures every controlled substance transaction in a single, query-able data source is a hallmark of a mature diversion prevention program.

How Diversion Programs Use Recordkeeping in Investigations

When a diversion investigation is initiated — whether triggered by a discrepancy, an anonymous report, or a behavioral concern — the controlled substance record set becomes the evidentiary foundation of the inquiry. Investigators will use records to:

  • Establish the baseline quantity at the start of the suspected diversion period (from inventory records)
  • Account for all receipts during that period (from receiving records and Form 222/CSOS)
  • Reconstruct expected quantities from dispense and waste records
  • Identify the gap between expected and actual quantities (the potential diversion quantity)
  • Narrow the list of individuals who had access to the substances during the relevant period (from access logs and dispense records)
  • Identify behavioral anomalies in the transaction records — excess waste by a specific individual, unusual override patterns, or corrections that systematically adjust quantities in one direction

A record set that cannot support this kind of reconstruction — because records are missing, incomplete, or inconsistent — makes the investigation harder, the evidentiary case weaker, and the regulatory defense more difficult. Complete, balanced, readily retrievable records are not just a compliance obligation: they are your program's most powerful investigative tool.

Common Recordkeeping Audit Findings

  • Records not retained for the full two-year minimum (or applicable state minimum)
  • Records comingled with general business files and not readily separable during inspection
  • Waste records missing witness signatures or documented retrospectively
  • Form 222 Part 3 copies not annotated with actual receiving date and quantity
  • POA not on file for a designee who signed Form 222 or CSOS orders
  • Discrepancies documented but not investigated, or investigations conducted without written findings retained in the record
  • CSOS electronic records not backed up, resulting in gaps after system migration
  • Inventory records reconstructed from transaction data rather than from a contemporaneous physical count

Further Reading

For the specific requirements governing the biennial inventory, see our controlled substance inventory guide. The full workflow for DEA Form 222 ordering records — including the three-copy structure and common errors — is at the Form 222 guide. For CSOS-specific recordkeeping, see the CSOS guide. If your record review has revealed a discrepancy that may qualify as a reportable theft or significant loss, the DEA Form 106 guide covers the reporting requirements and timelines.