Controlled Medicines: Custody, Counts & a Record That Survives Questioning
Controlled and high-value medicines need a different standard of custody from the rest of a clinic store — not because the quantities are large, but because the questions asked about them are specific and after the fact. What a defensible record looks like, and where a general inventory system stops.
Most stock questions in a clinic are about quantity — do we have enough, when do we reorder, what expires next month. For a small subset of the store the question is entirely different: who took this, when, on whose authority, and for which patient. Quantity is almost irrelevant, because the amounts involved are tiny.
That difference is why controlled medicines defeat ordinary stock discipline. A system built to answer "how many" applied to a problem that asks "who" produces records that are accurate and useless.
Scope, stated plainly
This article is about custody discipline, not about regulatory requirements. What must be kept, in what form, for how long, and who may handle controlled substances in Kenya are matters for the Pharmacy and Poisons Board, your superintendent pharmacist and your own legal adviser. We state no requirements. Where a regulator specifies a register, that register governs — this is about making your internal records match it rather than contradict it.
Four questions, and they are all about people
| The question | What has to be recorded at the time |
|---|---|
| Who is responsible for this stock right now? | A named custodian, not a department or a room |
| Who removed this, and when? | Person, quantity, date and time — at the moment of removal |
| On whose authority? | The prescriber or authorising clinician, named |
| What was it for? | The patient reference, held wherever your clinical records live |
The second row is where discipline lives or dies. A removal recorded at the end of a shift, from memory, covering six events, is not a custody record — it is a reconstruction, and it will not survive being questioned. The value of the record is entirely a function of when it was written.
A controlled-stock entry written at the end of a shift from memory is not a record. It is a reconstruction, and its whole purpose was to be something a reconstruction is not.
Two-person discipline, and where to spend it
The standard control for high-risk stock is that two people are present and both sign — for removals, for counts, for disposals of expired items. It is genuinely effective and it is also expensive in a small clinic where two staff may be the entire shift.
So spend it deliberately rather than universally. The three moments where a second signature does the most work are the periodic count, the disposal of expired stock, and any adjustment that reduces quantity without a patient behind it. Those are precisely the three events where a single person can otherwise resolve a discrepancy alone — which is the definition of the risk.
-
Count controlled lines far more often than the rest of the store
Weekly or per shift-change rather than monthly. The population is small, so the count takes minutes, and frequency is what keeps a discrepancy small enough to explain.
-
Investigate every discrepancy, however small
This is the opposite of general stock practice, where small variances are absorbed. Here the size is not the signal — the existence is.
-
Record disposals as their own event, witnessed
Expired controlled stock destroyed without a witnessed record is indistinguishable from stock that left another way.
-
Reconcile against the regulator's register, not instead of it
Where a statutory register exists, your system is the operational mirror of it. Two records that disagree is a worse position than one record, so reconcile them on a fixed rhythm.
Batches, expiry and the recall question
Beyond custody, high-value and controlled lines carry the same batch discipline as the rest of the pharmacy, and for the same reason: a recall or a quality alert asks which units you received and where they went.
Batch allocation recorded when stock is received and again when it is dispensed makes that answerable. Expiry management is a separate discipline with its own rhythm — the horizon report, supplier return terms and rotation — covered in pharmacy expiry management, and the general clinic store discipline in clinic and pharmacy inventory.
What the system contributes, and where it stops
Being precise about this matters more here than in most subjects, because the consequences of assuming a control exists are regulatory rather than commercial.
What AWRA OpsHub does today
- Named custody on assets and stock movements, with who, what and when recorded at the moment of the transaction.
- Check-out and check-in with approval, so removal from a store can require authorisation before it happens.
- Batch and expiry tracking, with allocations recorded on receipt and on depletion.
- Counts with variance recorded, so a weekly controlled-lines count produces a documented result.
- Adjustments with reasons and approval, so a quantity reduction carries an explanation and a second person.
- A full audit trail with actor, action, subject, IP address and time on the underlying records.
What it does not do
- No statutory controlled-drugs register. Whatever register your regulator specifies is not produced by this system, and nothing here should be presented as satisfying that obligation.
- Not an EMR. There are no patient records, so a dispensing event cannot be linked to a patient here — that link lives in your clinical system.
- No prescriber authorisation workflow. Approval controls are general operational approvals, not a clinical prescribing chain.
- No physical security. Cabinets, keys, safes and who holds them are outside any software, and they remain the first control.
Read the first and second lines together. This is an operational custody layer that reconciles against your statutory register and your clinical system. Presenting it as either of those to an inspector would be a mistake.
The organizational part
Two things determine whether any of this works, and neither is a system setting.
The first is that a named person owns the controlled store on each shift, and the handover between them is an event with a count in it. Custody that transfers informally is custody nobody holds, and "the store" cannot be asked a question.
The second is that discrepancies are investigated calmly and consistently, including the trivial ones. A clinic that investigates a single missing tablet the same way it would investigate a hundred sends an unmistakable message, and — more usefully — finds the process fault while it is still a process fault. Clinics that only investigate large discrepancies never see the small pattern that preceded them.
Our take
Name a custodian per shift and make the handover a counted event. Record every removal at the moment it happens, not at the end of the shift. Spend your two-person discipline on counts, disposals and adjustments. And keep your operational records reconciled to whatever register your regulator requires — the system supports the discipline, it does not discharge the obligation.
See check-in, check-out and adjustments
Named custody with approval on removals, batch and expiry tracking, counts with recorded variance and adjustments that carry a reason.
Explore custody controlsFrequently asked questions
Does this system satisfy controlled-drugs record requirements?
No, and this should not be ambiguous: whatever register your regulator specifies is not produced here, and this should never be presented to an inspector as discharging that obligation. What the system provides is an operational custody layer — named custody, approved removals, batch tracking, counted variances, an audit trail — that should reconcile against your statutory register. Confirm your specific requirements with the Pharmacy and Poisons Board and your superintendent pharmacist.
Can we link a dispensing event to a patient?
Not here — there are no patient records, because this is not an EMR. The patient link lives in your clinical system, and the operational record answers the stock-side questions: who removed it, when, in what quantity, on whose authorisation. Where the two must be tied together, the practical pattern is a shared reference recorded on both sides rather than an integration.
How often should controlled lines be counted?
Far more often than the rest of the store — weekly at minimum, and at every shift handover in clinics that run one. The population of controlled lines is small enough that a count takes minutes, and frequency is what keeps any discrepancy recent enough to explain. Monthly counting on controlled stock means a discrepancy is discovered a month after the event that caused it, when nobody can account for it.
Is a two-person rule realistic in a small clinic?
Not for every transaction, and pretending otherwise produces a rule staff quietly abandon. Spend it where it does the most work: the periodic count, the disposal of expired stock, and any adjustment that reduces quantity with no patient behind it. Those are exactly the events where one person could otherwise resolve a discrepancy alone, which is the risk the control exists to address.
Should we investigate a single missing tablet?
Yes, and consistently — this is where controlled stock differs from general inventory practice. With ordinary stock a small variance is absorbed because investigation costs more than the item; here the size is not the signal, the existence is. Investigating small discrepancies calmly and routinely finds process faults while they are still process faults, and it sets an expectation that is far harder to establish after something serious has happened.
