In 38 years of hospital pharmacy inventory work, I have seen a lot of things go wrong. But nothing creates more immediate, serious consequences for a pharmacy — and for the health system it serves — than a DEA controlled substance compliance failure.

I am not talking about minor paperwork gaps. I am talking about federal investigations, six-figure fines, DEA registration suspensions, and in the most serious cases, criminal referrals. These are not hypothetical outcomes. They happen to real pharmacies, at real hospitals, every year.

The good news is that DEA compliance failures are almost always preventable. They are the result of process gaps, documentation lapses, and inadequate oversight — not malicious intent. And with the right systems in place, they can be caught and corrected before they become federal problems.

Here is what every hospital pharmacy director needs to know.

Every hospital pharmacy that handles controlled substances must maintain a valid DEA registration. This seems obvious, but the details matter.

Your DEA registration is specific to a physical location. If your health system operates satellite pharmacies, each location that independently stores or dispenses controlled substances needs its own registration. A single hospital-wide registration does not cover off-site locations.

Registration renewal is required every three years. I have seen pharmacies operate on expired registrations — not out of negligence, but because the renewal process fell through the cracks during a leadership transition or system conversion. An expired DEA registration is a federal violation, regardless of intent.

Maintain a calendar reminder 90 days before your registration expiration. Assign a specific person to own the renewal process. Do not let this fall into the category of "someone will handle it."

The DEA requires every registered pharmacy to conduct a complete physical inventory of all controlled substances every two years. This is not optional, and it is not the same as your routine cycle counts.

The biennial inventory must:

• Include every Schedule II through V controlled substance in your possession
• Be conducted on a specific date (or within two days of that date)
• Document the exact quantity of each item — not an estimate
• Be signed by the pharmacist-in-charge
• Be retained for a minimum of two years from the inventory date

The biennial inventory is also your baseline for the DEA's running balance requirement for Schedule II drugs. Every acquisition and every dispensing must be reconcilable back to your last biennial inventory. If your records cannot support that reconciliation, you have a compliance problem.

For Schedule II controlled substances, the DEA requires a perpetual inventory — a running record of every acquisition and every dispensing, maintained in real time.

In practice, this means:

• Every Schedule II receipt must be documented with the DEA Form 222 (paper) or CSOS electronic equivalent, including the date received, quantity received, and supplier information
• Every Schedule II dispensing must be documented with the patient name, prescriber name, date, drug, and quantity
• The running balance must be updated with every transaction
• Physical counts must be reconciled to the running balance on a defined schedule — I recommend weekly for high-volume items, monthly at minimum for all Schedule II drugs

Discrepancies between your physical count and your running balance must be investigated and documented. A discrepancy that cannot be explained is a reportable event under DEA regulations.

ADCs have transformed pharmacy operations, but they have also created new compliance complexity for controlled substances.

Every controlled substance pocket in every ADC is, in effect, a satellite controlled substance storage location. The DEA's documentation requirements apply to every transaction — every removal, every return, every waste event — that occurs at an ADC.

Common ADC-related compliance gaps I find in hospital pharmacies:

Override documentation. When a nurse overrides an ADC to access a controlled substance before a pharmacist has verified the order, that transaction must be reviewed and documented. Many pharmacies have override rates that are far too high, and the documentation of those overrides is often incomplete.

Waste documentation. Every partial use of a controlled substance must be wasted and documented with a witness signature. Missing waste documentation is one of the most common DEA audit findings. Your ADC system should be generating waste alerts — make sure someone is acting on them.

Discrepancy resolution. ADC systems flag count discrepancies automatically. The problem is that in busy pharmacy environments, those flags can accumulate without being investigated. I have seen pharmacies with hundreds of unresolved ADC discrepancies — each one a potential compliance finding.

Pocket audits. Physical counts of ADC controlled substance pockets should be conducted on a defined schedule, independent of the ADC system's electronic records. The physical count is the ground truth. The electronic record is what you are reconciling against.

If you discover that controlled substances have been stolen or that a significant loss has occurred, you are required to report it to the DEA within one business day of discovery. This is not a discretionary reporting obligation — it is mandatory.

The report is made on DEA Form 106. It must include the drug name, strength, dosage form, quantity lost, and the circumstances of the loss.

"Significant loss" is not precisely defined in the regulations, which creates some ambiguity. My guidance: when in doubt, report. The consequences of failing to report a significant loss are far more serious than the consequences of reporting a loss that turns out to be a documentation error.

The pharmacies that navigate DEA audits successfully are not the ones that scramble to get their records in order when an investigator shows up. They are the ones that maintain audit-ready documentation as a matter of routine.

What does audit-ready look like?

Current, complete perpetual inventory records for all Schedule II drugs, reconciled to physical counts within the last 30 days.

Resolved discrepancy documentation — every discrepancy investigated, every resolution documented, no open items older than 30 days.

Complete waste logs — every partial controlled substance use documented with dual signatures, no gaps.

Current biennial inventory — conducted on schedule, signed, retained.

Staff training records — every pharmacist and pharmacy technician with controlled substance access has documented training on DEA requirements.

ADC audit logs — regular physical counts of ADC controlled substance pockets, reconciled to system records.

If you can produce all of that documentation on 24 hours' notice, you are in good shape for a DEA audit. If you cannot, you have work to do.

One of the most valuable things an outside pharmacy inventory firm can do for a hospital pharmacy is provide an independent, objective assessment of controlled substance compliance.

When my team conducts a pharmacy inventory audit, we are not just counting drugs. We are reviewing documentation, reconciling records, identifying discrepancies, and flagging compliance gaps — before a DEA investigator does.

The value of that independent perspective is hard to overstate. Internal staff are often too close to their own processes to see the gaps. An experienced outside team brings fresh eyes and a deep knowledge of what DEA investigators look for.

If your pharmacy has not had an independent controlled substance compliance review in the past 12 months, I would strongly encourage you to schedule one. The cost of a professional review is a fraction of the cost of a DEA investigation.

Michael Samojla is the CEO of IMC Pharma and a nationally recognized expert in hospital pharmacy inventory management with 38 years of experience serving more than 1,000 healthcare facilities. IMC Pharma holds active DEA and EPA licenses and serves Premier Inc. member hospitals and VA Medical Centers nationwide.