Diversion doesn't look like a break-in.
It's almost always someone the facility already trusts, and it almost never announces itself. It shows up first as a small discrepancy in the record, and the honest facility ends up paying for it twice: once in the loss and again in the paperwork.
What a poorly documented loss actually costs
- $19,246 Per recordkeeping or reporting violation, as of the 2025 DOJ inflation adjustment
- 1 business day To notify your local DEA Field Division of a theft or significant loss (21 CFR 1301.76(b))
- 45 days To file DEA Form 106 electronically after a significant loss (2023 DEA final rule)
Warning signs show up in the records first
Diversion rarely announces itself. It shows up as small, explainable-looking gaps that only become a pattern when someone's watching for one.
- Discrepancies and negative balances — the log says more is on hand than the count supports.
- Late entries — a dispense logged well after the fact, backfilled from memory.
- Waste that doesn't add up — documented waste that's inconsistent dose to dose.
- Overfill that vanishes — a vial's natural overfill margin disappearing instead of being accounted for.
- Small drift over weeks — nothing wrong on any single day, until you look at a month.
No single line proves anything. The pattern is the signal.
Warning signs show up in people too
Diversion-awareness guidance flags behavioral patterns worth a second look: not a reason to accuse anyone, but a reason to ask questions and document.
- Behavioral changes — shifts in mood, attendance, or reliability that are out of character.
- Volunteering for drug duties — consistently seeking out inventory or waste tasks.
- Frequent solo access — being alone with the cabinet more often than the role requires.
Any one of these can have a perfectly innocent explanation. Watch for the combination, not the single data point.
When you discover a theft or significant loss
-
Secure and document
Secure the cabinet and the area, and document exactly what you found before anything is moved or corrected.
-
Notify the DEA within one business day
Written notice to your local DEA Field Division is required within one business day of discovery (21 CFR 1301.76(b)).
-
File DEA Form 106 within 45 days
Form 106 must be filed electronically within 45 calendar days. Paper Form 106 is no longer accepted.
-
Notify local law enforcement
Facilities typically report stolen controlled substances to local law enforcement as well as the DEA.
-
Review what control failed
Once the immediate reporting is done, review which control let it happen. That's the fix that prevents a repeat.
The locked cabinet is the floor, not the whole answer
A securely locked cabinet is the legal floor (21 CFR 1301.75(b)). Effective controls against theft and diversion are the actual requirement (21 CFR 1301.71(a)), and a shared key across a dozen research technicians satisfies the floor without doing much for the requirement.
- Per-person credentials — an RFID badge and PIN identify who opened the cabinet; a shared key can't.
- Two-person authorization — Multi User Authentication makes the two-witness principle the DEA already expects an everyday dispensing rule, not a special case.
- Weighed, not eyeballed — per-dispense weighing catches the milliliter-level skimming a volume log never would.
- The answer already exists — user-access reports mean who/what/when is a report away, not a reconstruction project.
Common questions
-
Is a locked cabinet enough?
No. A securely locked, substantially constructed cabinet is the legal floor (21 CFR 1301.75(b)). The actual requirement is effective controls and procedures against theft and diversion (21 CFR 1301.71(a)): who can open it, whether access is individually traceable, and whether dispenses are measured, not just recorded.
-
What counts as a "significant loss"?
The DEA weighs factors like the quantity involved, whether a pattern is emerging, and whether specific individuals are implicated (21 CFR 1301.76(b)). It's a judgment call, not a fixed threshold. When you're not sure, document what you found and assess it against those factors rather than assuming it's too small to matter.
-
Do we have to report small losses?
Reporting requirements apply to significant loss or theft: written notice to your local DEA Field Division within one business day, and DEA Form 106 filed electronically within 45 calendar days. If a discrepancy doesn't clearly rise to that level, document it and assess it against the same factors rather than letting it go unrecorded.
-
What's the penalty exposure?
Recordkeeping and reporting violations carry civil penalties of $19,246 per violation, as of the 2025 DOJ inflation adjustment. That figure is per violation, not per inspection, and a pattern of gaps compounds quickly.
-
How does the CSI-360 help?
It replaces a shared key and a handwritten log with per-user credentials, weighed dispenses, and reports that already exist when someone asks for them. See the CSI-360 product page for the full system, or the DEA audit readiness and syringe accuracy articles for the recordkeeping and measurement side of the same problem.
References
- Locked-cabinet requirement — 21 CFR 1301.75.
- Effective-controls requirement — 21 CFR 1301.71.
- Theft/significant-loss reporting (one-business-day notice; electronic Form 106 in 45 days) — 2023 DEA final rule.
- Civil-penalty amount ($19,246 per violation, as of the 2025 adjustment) — 2025 DOJ inflation adjustment.
- Practitioner compliance resources — DEA Diversion Control Division.
Build prevention into dispensing, not just the cabinet.
The CSI-360 ties every dispense to the person who did it and the exact amount they took. Give us a call and we'll walk through how it fits your current controls.