Guide

Controlled inventory: the cabinet, the log, the biennial count

Summary

DEA requires effective, locked storage for controlled substances, a complete initial inventory when you first stock them, and a new count at least every two years afterward — the biennial inventory — broken out by drug and schedule. Schedule II substances need their own separate, exact records; Schedules III through V can often share your regular records if readily retrievable. Any theft or significant loss must be reported to DEA and local police, not just logged internally.

By Gale Editorial · Updated 2026-07-27. Every figure cited to a dated source. How we write.

What DEA expects for storage security

DEA requires practitioners to provide 'effective controls and procedures' against theft and diversion of controlled substances, which in practice means a securely locked cabinet or safe, limited-key access, and storage that isn't left accessible to patients or unauthorized staff 1Ref 1Drug Enforcement Administration (2026).Diversion Control Division.DEA's practitioner registration and controlled-substance recordkeeping/inventory rules — storage security, the initial and biennial inventory, schedule-based recordkeeping differences, and theft/loss reporting.. DEA doesn't hand solo practices a single approved cabinet model — it holds you to the standard of a substantially constructed, locked storage location matched to what you actually keep on hand.

For a solo prescriber, that usually means a dedicated locked cabinet or drawer, keyed differently from general office storage, with access limited to the prescriber and perhaps one trusted staff member — never a shared key on the same ring as the supply closet. Write down who has access and why, because that access list is exactly what a diversion investigator asks for first after a loss.

The initial inventory: day one, everything on hand

The first inventory happens when you begin possessing controlled substances under your registration — a complete, dated count of every controlled substance on hand, by schedule, that becomes the baseline every later inventory measures against 1Ref 1Drug Enforcement Administration (2026).Diversion Control Division.DEA's practitioner registration and controlled-substance recordkeeping/inventory rules — storage security, the initial and biennial inventory, schedule-based recordkeeping differences, and theft/loss reporting.. Storage and inventory duties apply regardless of whether you also prescribe controlled substances by telehealth, which is governed by its own separate rule set worth reading on its own terms.

Do the initial count before you see your first patient with a stocked supply, not retroactively once you realize you should have. A missing or reconstructed initial inventory is a bad foundation for every count that follows it, since each later inventory is only as reliable as the number it's compared against.

The biennial count: what it has to include

After the initial inventory, DEA requires a new inventory at least every two years — the biennial inventory — covering every controlled substance you have on hand on the count date, broken out carefully by schedule and by individual drug name, every cycle 1Ref 1Drug Enforcement Administration (2026).Diversion Control Division.DEA's practitioner registration and controlled-substance recordkeeping/inventory rules — storage security, the initial and biennial inventory, schedule-based recordkeeping differences, and theft/loss reporting..

Pick a date you'll actually remember — many practices anchor it to the registration renewal cycle so the two obligations land together — and count on that date every time rather than letting 'around this time of year' drift. Keep the inventory record itself for the same retention period as your other controlled-substance records, since it's one of the first documents requested if your registration is ever reviewed.

Schedule II gets stricter bookkeeping than III through V

DEA's recordkeeping rigor isn't uniform across schedules: Schedule II substances generally need their own separate inventory and readily retrievable records, while Schedule III through V substances can often be tracked within your regular records as long as they're readily retrievable when asked for 1Ref 1Drug Enforcement Administration (2026).Diversion Control Division.DEA's practitioner registration and controlled-substance recordkeeping/inventory rules — storage security, the initial and biennial inventory, schedule-based recordkeeping differences, and theft/loss reporting..

For a solo prescriber writing mostly Schedule II stimulant or opioid prescriptions alongside some Schedule IV benzodiazepines, that split matters operationally — know which drugs on your shelf sit in which schedule, and keep the Schedule II count separate and exact rather than folded into a general medication log.

Report theft or significant loss — don't just note it and move on

A theft or significant loss of controlled substances is a reportable event, not an internal matter to quietly document and forget — DEA and, separately, local law enforcement both expect to hear about it, and the reporting obligation exists independent of whether you've figured out how it happened 1Ref 1Drug Enforcement Administration (2026).Diversion Control Division.DEA's practitioner registration and controlled-substance recordkeeping/inventory rules — storage security, the initial and biennial inventory, schedule-based recordkeeping differences, and theft/loss reporting..

Report promptly rather than waiting until you've completed your own investigation; the reporting duty and the investigation run in parallel, not in sequence. A solo practice's realistic risk here is smaller-scale than a pharmacy's, but a missing bottle of a Schedule II medication is exactly the kind of loss that has to surface, not disappear into an unreported inventory discrepancy at the next count.

The storage-security question is also a workplace-violence question

Whether osha and the solo office intersect at all is worth settling generally, but on this specific point the answer is yes: a visibly or predictably stocked controlled-substance supply is a real robbery target, and OSHA's healthcare-specific workplace-violence guidance treats that risk as part of the same occupational-safety picture as any other threat a clinician seeing patients alone has to plan for 2Ref 2Occupational Safety and Health Administration (2026).Workplace Violence.OSHA's workplace-violence guidance for healthcare settings treats a stocked controlled-substance supply as part of the robbery/security risk a solo clinician plans for..

The fixes overlap: a locked, low-visibility storage location that doesn't advertise what's behind the door serves both the DEA security expectation and basic robbery deterrence at once. If you're building a workplace-violence plan for other reasons, fold your controlled-substance storage into that same conversation instead of treating it as an unrelated, DEA-only checkbox.

Write the inventory habit down

A short, dated controlled-substance policy — where things are stored, who has a key, when the biennial count happens, and what you do if something doesn't add up — is exactly the kind of documented compliance basic OIG's guidance recommends even for a practice of one 3Ref 3HHS Office of Inspector General (2023).General Compliance Program Guidance.OIG's compliance-program guidance recommends documented, written policies scaled to a practice of one, the frame for writing a controlled-substance storage and inventory policy down..

You don't need outside help to write it. A single page naming your storage location, your counting schedule, and your loss-reporting trigger is enough to keep the routine consistent even on a week you're busy with patients. Treat it as one piece of your broader DEA-registration housekeeping alongside things like the mate act eight hours training requirement, and revisit it whenever your prescribing volume changes enough that your storage setup no longer matches what you actually keep on hand.

Common questions

DEA holds practitioners to an 'effective controls and procedures' standard rather than a single approved cabinet model — in practice, a securely locked, substantially constructed cabinet or safe with limited key access, never left accessible to patients or untrained staff. Write down who has a key and why; that access list is typically the first thing asked for after any loss.

It's the count DEA requires at least every two years after your initial inventory — every controlled substance on hand on the count date, broken out by schedule and by drug. Pick a memorable date, often tied to your registration renewal cycle, and count on that date every cycle rather than letting the timing drift year to year.

Generally yes. Schedule II substances typically need their own separate inventory and exact, readily retrievable records, while Schedule III through V substances can often be tracked within your regular records as long as they stay readily retrievable when requested. Know which of your drugs sit in which schedule and keep the Schedule II count separate rather than folded into a general log.

Report it — to DEA and to local law enforcement — rather than treating it as an internal matter to quietly investigate first. The reporting duty runs alongside your own investigation, not after it. Even a small, solo-practice-scale loss, like one missing bottle, is the kind of discrepancy that has to surface rather than get absorbed into the next inventory count.

Yes. A predictably stocked controlled-substance supply is a real robbery target, and OSHA's healthcare workplace-violence guidance treats that risk alongside other threats a clinician seeing patients alone has to plan for. A locked, low-visibility storage location serves both the DEA security expectation and basic robbery deterrence at the same time.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

1.Drug Enforcement Administration (2026). Diversion Control Division. U.S. Drug Enforcement Administration. link ✓DEA's practitioner registration and controlled-substance recordkeeping/inventory rules — storage security, the initial and biennial inventory, schedule-based recordkeeping differences, and theft/loss reporting.
2.Occupational Safety and Health Administration (2026). Workplace Violence. U.S. Occupational Safety and Health Administration. link ✓OSHA's workplace-violence guidance for healthcare settings treats a stocked controlled-substance supply as part of the robbery/security risk a solo clinician plans for.
3.HHS Office of Inspector General (2023). General Compliance Program Guidance. HHS Office of Inspector General (OIG). link ✓OIG's compliance-program guidance recommends documented, written policies scaled to a practice of one, the frame for writing a controlled-substance storage and inventory policy down.

https://www.gale.care/for-providers/os-dea-storage-inventory · 3 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers