Preparing Your Diversion Program for a DEA Inspection

In a 2025 hospital pharmacy survey, 66% of respondents reported a diversion event within the past year. Each of those events leaves a record, and a Drug Enforcement Administration (DEA) inspection is when your drug diversion program has to produce it. The smoothest inspections come from routine work done all year. Keep records where DEA expects them, close discrepancies before they age, and witness every waste. Track theft and loss filings against their deadlines, complete investigation files as cases move, and rehearse the visit before investigators arrive.

Confirm Every Required Record Is Readily Retrievable

When an investigator asks for a record, you need to know where it lives and how fast you can produce it. DEA requires controlled substance records to be kept for at least two years and available for inspection. Where each record can sit depends on its type:

• At each registered location: Inventories and executed order forms stay on site at the location the registration covers.
• At a central location: Financial and shipping records, such as invoices and packing slips, can be kept centrally after you notify DEA in writing. DEA can require them at the registered location within two business days of a written request.
• On an in-house computer system: Keeping records electronically in-house doesn’t require DEA approval.

If your system holds more than one DEA registration, each registered site keeps its own inventories and order forms. National guidelines call for applying the same diversion policies to every registration, and that consistency keeps DEA compliance hospital-wide instead of site by site.

Hospitals answer to a second records rule. Centers for Medicare & Medicaid Services (CMS) rules require current and accurate records of each scheduled drug you receive and what happens to it afterward.

A periodic controlled substance compliance check confirms you can produce four sets of records on any given day:

• Core documentation: Procurement and disposition records, inventories, surveillance findings, discrepancy investigations, and reports to DEA, kept for the legally required timeframe.
• Tested reports: Reports you’ve run ahead of time to confirm the data is complete and accurate.
• Ordering and authority records: Backed-up Controlled Substance Ordering System (CSOS) files, plus DEA registrations and power-of-attorney designations re-evaluated at least annually.
• Biennial inventory: A count documented per DEA or state requirements, whichever is stricter.

Your state board of pharmacy’s rules on who may handle controlled substances and how diversion gets reported belong in that check too.

Reconcile Every Dispense to an Administration, Waste, or Return

Reconciliation keeps you inspection-ready between visits by matching each dispensed dose to a prescriber’s order and confirming the amount dispensed equals the amount given plus any amount wasted or returned. Anything that doesn’t balance is a discrepancy, and the sooner you close it, the less you’ll have to explain later.

A clear escalation path keeps discrepancies from sitting unresolved:

1. Staff report the discrepancy to the supervisor in charge, who resolves it as soon as possible, preferably by the end of the shift.
2. The supervisor reviews any discrepancy marked resolved to confirm the resolution is legitimate.
3. Unresolvable discrepancies go to the pharmacy immediately for joint review with patient care leadership and resolution within 24 to 72 hours.
4. Any discrepancy that can’t be resolved is treated as a possible diversion and escalated to an investigation.

On the purchasing side, match each invoice to its order and receipt, then check invoices against wholesaler statements to catch any invoice removed to hide diversion. Pharmacy and nursing supervisors should also compare each controlled substance order with what the chart shows was given, at least in the units where diversion risk is highest.

National guidelines strongly recommend diversion monitoring software with advanced analytics for this work. ControlCheck brings the reconciliation into one system:

• It connects automated dispensing cabinets (ADC), electronic health record (EHR), wholesaler, and vault data for closed-loop dose reconciliation.
• It auto-reconciles 95% of transactions and leaves your staff to review only the remaining discrepancies.
• It records how each discrepancy was resolved as part of the audit trail.
• At UCSF Health, it auto-reconciled 95% of controlled substance vault transactions and cut reconciliation time by 74%.

Close Gaps in Waste Documentation

Every controlled substance waste needs an independent witness who can confirm the right drug and amount were discarded, and at least one witness should be licensed. Have the witness watch the drug drawn up and wasted, then confirm the label, the amount, and that the product matches the record. The clinician who gave the dose should record the waste immediately afterward, at the same ADC the drug came from whenever possible.

Send random samples of wasted drugs from high-risk areas to a lab to confirm they contain the drug’s record names. Do the same at least quarterly for waste from sterile preparations that pharmacy compounds, and have a second staff member cosign each of those wastes.

Fentanyl led all drugs in variances (24%) and made up nearly a quarter of more than 16 million wasted packages in hospital diversion monitoring data. Review your own waste reports on a regular schedule, looking at witness patterns, time to document waste, and delays between administration and waste documentation.

Check Theft and Loss Reports Against Federal Deadlines

A theft or significant loss starts two federal clocks the moment you discover it:

• Written notice: Notify your DEA Field Division Office in writing within one business day of discovery.
• DEA Form 106. File the complete report within 45 days of discovery: DEA accepts Form 106 only electronically, through its Theft/Loss Reporting Online system.

Record the discovery date and both filing dates in the incident file, and anyone reviewing it can confirm both deadlines at a glance.

The DEA doesn’t set a fixed threshold for a significant loss. It lists factors instead, and your organization should turn them into a written definition you apply the same way every time. DEA’s factors include:

• The quantity lost relative to the type of business
• The specific controlled substances lost
• Whether the loss ties to access by specific individuals

Your policy should also set when an unresolved discrepancy triggers a Form 106, and it should require DEA notice even when a loss can’t be quantified. Inside the hospital, CMS requires abuses and losses of controlled substances to be reported to the pharmacy director and, when appropriate, the chief executive officer.

Document Every Investigation From Flag to Outcome

An investigation file built as the case moves is your clearest proof that the program acts on what it detects. A complete file shows:

• Who coordinated the investigation and who served on the team
• When leadership and legal counsel were notified
• A written record of the investigation itself
• What was reported internally and externally
• Which reviewers came from outside the affected area, to keep bias out of the findings

Significant diversions should also trigger a quality improvement review with a root cause analysis. Your diversion committee should report to senior leadership at least quarterly. Audit core program controls on a set schedule, too, such as once a year.

With investigations up 61% from 2023 to 2024 and software-initiated cases open an average of 63 days, each file has to stay complete for months at a time. ControlCheck keeps each case in one record, including the investigation checklist, notes, attachments, linked transactions, and observed behavior reports.

Rehearse With a Mock Inspection and Named Roles

A mock inspection lets you find gaps on your own schedule instead of an investigator’s. Before a DEA inspection, pharmacy and compliance leads should start by naming who will:

• Check investigator credentials and ask the reason for the visit.
• Notify the registrant right away. The registrant signs the Notice of Inspection (DEA Form 82), which serves as informed consent.
• Pull requested records and give investigators a place to work.
• Copy any records investigators take and get a DEA Form 12 receipt for originals taken offsite.

During the visit, investigators may audit selected controlled substances by tracking usage from the last inventory or purchase invoice. Your mock inspection should do the same. The self-assessment guide in national diversion guidelines gives your mock inspection a checklist for drug diversion prevention controls, starting with four core checks:

• Tracer audits: Follow inventory from the last biennial count to a random day.
• Area audits: Pair self-audits within each area with scheduled audits by people from outside it.
• Pharmacy controls: Arrange an external review of internal pharmacy controls at least twice a year.
• Ownership: Confirm that a designated diversion officer leads the committee and that the pharmacy holds a leadership role.

Round out the checklist with the overlooked DEA compliance areas a former DEA agent flagged, such as registered address management and record-keeping.

DEA inspections are often unannounced, but mock inspections run on your schedule. Before you run your next one, request a ControlCheck demo to see how automated reconciliation and single-record case files change what it turns up.