DEA Compliance Guide
Controlled Substance Policy & SOPs: What a Veterinary Practice Needs (2026)
Most practices don’t fail an inspection because they’re careless. They fail because their controlled-substance handling lives in people’s heads instead of on paper — so it drifts, varies by who’s on shift, and falls apart the moment a key person leaves. A written controlled-substance program is what turns “how we usually do it” into “how it is always done,” and it’s one of the first things a DEA investigator looks for.
This guide lays out what a complete controlled-substance policy and its supporting SOPs should cover for a veterinary practice — the full set of written procedures that keep you compliant, consistent, and defensible.
Why a written program matters
A written program does three jobs at once.
- It creates consistency. When the procedure is documented, every staff member handles controlled substances the same way, regardless of who trained them or how busy the day is.
- It demonstrates good faith. An investigator who sees a current, followed written program reads a practice that takes its obligations seriously — which shapes how minor gaps are treated.
- It protects the owner. When something goes wrong, the difference between “we had a procedure and followed it” and “we had nothing written down” is often the difference between a corrective action and a serious finding.
A policy alone isn’t enough, and neither are loose habits. What you need is a policy (the standards your practice commits to) supported by SOPs (the step-by-step procedures that carry the policy out day to day).
The components of a complete program
A controlled-substance program should cover every point in the drug’s life in your practice — from the registration that lets you hold it to the disposal that removes it. Here is the full set.
1. Registration and authority
Who holds the DEA registration, where it’s kept, when it renews, and the rule that each separate location storing controlled substances needs its own registration. This is the foundation everything else sits on.
2. Personnel screening and authorization
Who is allowed to access controlled substances, how staff are screened before being granted access, and a current written list of authorized people. Access should be limited to the minimum number of staff who genuinely need it.
3. Storage and physical security
How and where controlled substances are stored — a securely locked, substantially constructed cabinet or safe — kept locked except during active access, with controlled keys and codes that change when someone with access leaves.
4. Key and access control
Who holds keys, combinations, and access codes; how they’re issued and returned; and the requirement to change combinations when an authorized person departs. Access control is where storage security either holds or quietly fails.
5. Ordering and receiving
How controlled substances are ordered — including the Form 222 / CSOS channel for Schedule II — who is authorized to order, the power of attorney behind that authority, and the “verify, record, secure” routine when a shipment arrives.
6. Recordkeeping and the controlled-substance log
How every use is logged — date, patient, amounts administered, dispensed, or wasted, running balance, and the person responsible — updated immediately, with Schedule II records kept separate from the rest.
7. Administering, dispensing, and witnessing waste
How drugs move from the safe to the patient and back to the record, and how partial doses and waste are witnessed and documented by a second authorized person. Waste and witnessing are among the most commonly missed steps.
8. Inventory
The initial inventory at registration, the complete biennial inventory at least every two years, signed and dated, and the periodic internal counts that catch problems long before the biennial comes due.
9. Disposal
How expired or unwanted controlled substances are segregated, secured, recorded, and lawfully destroyed — through a reverse distributor, a lawful return, or witnessed on-site destruction — never flushed or trashed.
10. Theft, loss, and diversion
The obligation to notify the DEA in writing within one business day of discovering a theft or significant loss, to file a DEA Form 106, and a written procedure for responding to suspected diversion.
11. Staff training
How staff are trained on all of the above, that the training is documented, and that acknowledgment forms are signed and kept. Training is both a control and a record an investigator can ask to see.
12. Self-audit
A recurring internal review that works through each inspection category honestly and fixes what fails before it matters — turning an external inspection into a confirmation rather than a discovery.
Free download: Want to see where your current program stands against all of this? Our DEA Self-Audit Checklist turns every category above into a self-scoring worksheet. Get the free Self-Audit Checklist →
Policy versus SOP: how they fit together
It helps to keep the two layers distinct:
- A policy states the standard — for example, “controlled substances are stored in a locked safe accessible only to authorized staff.”
- An SOP states the steps — who unlocks the safe, how each access is logged, how the count is reconciled at the end of the day, and who witnesses waste.
The policy tells an investigator (and your team) what you’ve committed to. The SOP makes it repeatable. A program with policies but no SOPs is aspirational; SOPs without a policy have no anchor. You need both.
What makes a program actually work
Writing the documents is the start, not the finish. Programs hold up when they’re:
- Specific to your practice — your drugs, your storage, your staff roles, your state’s requirements, not a generic template left unedited.
- Current — reviewed periodically and updated when drugs get reclassified, staff change, or rules move.
- Followed — the written procedure and the actual behavior match. A binder that describes a process no one uses is worse than none, because it documents the gap.
- Trained and acknowledged — staff have read the procedures and signed for them.
- State-aware — built to meet whichever rule is stricter, federal or state.
Frequently asked questions
Does the DEA require a written controlled-substance policy? The DEA expects registrants to maintain proper security, records, and procedures. A written program is how practices demonstrate and consistently meet those obligations — and it’s what investigators look for.
What’s the difference between a policy and an SOP? A policy sets the standard you commit to; an SOP is the step-by-step procedure that carries it out. You need both — the policy to anchor it, the SOP to make it repeatable.
Can I use a template? A template is a strong starting point, but it must be adapted to your practice and your state. An unedited generic policy that doesn’t match what you actually do can create more exposure than it removes.
How often should the program be reviewed? At least annually, and whenever drugs are reclassified, staff with access change, or federal or state requirements move.
From scattered habits to one documented system {#lead-magnet}
If your controlled-substance handling is mostly habit and memory right now, you’re not unusual — but you are exposed. The fix isn’t more effort, it’s a written system everyone follows the same way.
Run the free DEA Self-Audit Checklist to see which of the twelve components above your practice already has and which are gaps. And when you want the whole program built, the Vet Compliance HQ DEA Controlled Substance Compliance System gives you all of it — the SOPs, logs, training records, and acknowledgment forms — white-label and ready to put your clinic’s name on, built around federal DEA recordkeeping concepts and ready to adjust to your state.
Get the free DEA Self-Audit Checklist →
Vet Compliance HQ provides educational compliance resources for veterinary practices. This article is not legal advice. DEA and state requirements change and vary by state — verify current requirements with the DEA and your state veterinary board.