What a controlled substance supplier agreement has to track

Scheduled material brings a registration, security and recordkeeping regime that the commercial supply agreement is expected to carry but rarely operationalizes.

What should a controlled substance supplier agreement require?

A controlled substance supplier agreement should do four things beyond specifying product and price. It should require each party to hold and maintain the registrations its activity demands, with a duty to notify the other of any lapse, restriction or enforcement action. It should state the security and storage commitments that apply to the material in transit and at rest, and give the buyer a right to verify them. It should address the quota and allocation reality of scheduled material, including what happens when supply is constrained. And it should specify the recordkeeping, reconciliation and loss-reporting duties each party owes, with retention periods stated explicitly.

Last updated: September 30, 2026 · Reviewed by the Aavenir Life Sciences & Pharma practice

Key takeaways

  • ✓Registration status is a live dependency, not a onboarding checkbox; an expired or restricted registration can halt supply immediately.
  • ✓Security and storage commitments need a verification right, otherwise the buyer holds a promise it cannot test.
  • ✓Quota-constrained material makes allocation language materially more important than in ordinary supply agreements.
  • ✓Loss, theft and significant discrepancy reporting has short windows and named recipients; both belong in the obligation calendar.

A supply agreement for scheduled material reads like any other supply agreement for most of its length. Product specification, quantity, price, delivery terms, quality provisions, liability. The clauses that make it different are usually short, sometimes a single sentence each, and they are the ones that determine whether the arrangement works in practice.

Those clauses deal with registration, security, quota and records. Each creates a continuing dependency rather than a one-time requirement. A registration lapses on a date. A security commitment has to be verified periodically or it is just an assertion. Quota constrains what the supplier can deliver regardless of what it promised. Records have retention periods enforced by a regulator, not by the counterparty.

Compliance teams generally know all of this. What is usually missing is the connection between the knowledge and the contract record, so registration expiry dates live in a spreadsheet, verification is done when someone remembers, and the reporting windows are looked up from the regulation each time rather than sitting on a calendar. This datasheet sets out the contract data worth holding and the evidence each item has to produce.

The contract data worth holding as fields

Five categories of structured data turn a controlled substance supply agreement from a document into something an operations team can run against.

  • Registration identifiers and expiry, each party's registration number, the schedules and activities it covers, its expiry date and the notification lead time before renewal is due.
  • Schedules supplied, the specific schedules covered by the agreement, since security, recordkeeping and quota treatment differ by schedule and a single agreement may span several.
  • Security verification cadence, the date of the last site verification or accepted third-party assessment, the next due date and the accepted evidence form.
  • Reconciliation and reporting cycles, inventory reconciliation frequency, periodic report due dates, and the named recipient and window for loss, theft and discrepancy reporting.
  • Retention and retrieval terms, the retention period stated in the agreement, where records are held, the retrieval window promised and the post-termination position.

Held as fields rather than as prose, these five categories answer the questions that actually arise: whose registration expires next quarter, which suppliers are overdue for security verification, which reconciliations are outstanding, and where the records for a five-year-old shipment can be found. Held as prose, none of them are answerable without reading the agreement.

Registration expiry is a supply risk, not a paperwork date

An expired or restricted registration stops shipments, regardless of the contract. Tracking expiry with the same seriousness as a renewal notice window, and requiring notification of any adverse change, is the difference between a planned renewal and an unplanned interruption.

Controls that make the obligations operable

Five controls cover the failures that recur when scheduled-material agreements are managed as ordinary supply paper.

  • Track registrations as dated obligations. Load each registration expiry with advance notification for both your own and the supplier's registrations. Add a standing obligation on the supplier to notify any suspension, restriction or enforcement action, and record receipt of those notifications rather than filing them.
  • Make verification a scheduled event. Set the security verification cadence in the agreement and put the next due date on the calendar with an owner. Accepting a recent third-party assessment in place of a site visit is reasonable and should be stated as an option rather than negotiated each cycle.
  • Diarize short-window reporting. Loss, theft and significant discrepancy reporting windows are measured in days. Put the window, the named recipient and the escalation path in the obligation record so the clock is not being researched while it runs.
  • Reconcile inventory against contract terms. Compare physical reconciliation results against the quantities and schedules the agreement covers. Discrepancies between what was contracted and what is on hand are the leading indicator that something in the custody chain needs attention.
  • State retention explicitly. Write the retention period, the holding location and the retrieval window into the agreement, and record them as fields. Post-termination retention responsibility should be named, because that is the gap that appears when a supplier relationship ends.

A five-step implementation path

Step 1, Inventory agreements by schedule

List every active agreement involving scheduled material and tag each with the schedules it covers. Most organizations find agreements that cover a schedule nobody realized, usually because a product moved or a new presentation was added without the contract being revisited.

Step 2, Load registration data and expiry dates

Capture registration numbers, covered activities and expiry dates for both parties, with notification leads set generously. Renewals that require an inspection need months of lead time, not weeks, and that difference belongs in the notification setting.

Step 3, Set the verification and reconciliation calendar

Assign owners to security verification and inventory reconciliation cycles. Where the agreement is silent on cadence, set an internal one and propose contract language at the next amendment rather than waiting for the renewal.

Step 4, Build the reporting playbooks

For each short-window reporting duty, record the trigger, the window, the recipient, the form and who signs. A playbook that can be executed without interpretation is what makes a compressed window achievable.

Step 5, Reconcile the portfolio quarterly

Review registration status, overdue verifications, outstanding reconciliations and any notifications received. This quarterly view is also what supports the supplier qualification file, so the work serves two purposes rather than one.

See regulated supply obligations tracked

Walk through registration expiry, verification cadence and reporting windows on live agreements.

Book a demo

Where this overlaps supplier qualification

Much of this data already exists in the supplier qualification file, which is why maintaining two registers is wasteful and tends to produce disagreement between them. The qualification file holds assessment dates, audit findings and approval status; the contract record holds the commitments those assessments test. Keeping both against the same supplier record, as described in GxP supplier qualification, contract controls that hold, means a registration lapse or an overdue verification surfaces in the same review that covers quality performance. That consolidation is usually a bigger practical gain than any individual control, and it is the pattern obligation management for life sciences is built around.

Obligations, windows and evidence

The table below sets out the recurring obligations in a controlled substance supply relationship, with the event that starts each one and the artifact that closes it.

ObligationOwnerWindowEvidence to retain
Registration renewal and verificationComplianceAhead of stated expiryCurrent registration certificate on file, dated check record
Notification of registration changeSupplier, received by compliancePrompt, per agreementNotification received, internal assessment of supply impact
Security verification or assessmentQuality or compliancePer agreed cadenceSite verification report or accepted third-party assessment
Inventory reconciliationOperationsPer agreed frequencyReconciliation record and explanation of any variance
Loss, theft or discrepancy reportComplianceDays, per regulationFiled report, acknowledgement, internal investigation record

The clauses that make a scheduled-material agreement different from an ordinary supply contract are short, and that brevity is what causes them to be treated as boilerplate. Extracted into fields, given owners and put on a calendar, they stop being a source of surprise. The work is a few days of abstraction per portfolio and a standing quarterly review, which is a modest cost against an interruption nobody saw coming. The wider benefit is that the same register answers the questions a regulator, an internal auditor and a supply planner each ask in different language, and answers them from one record rather than three reconstructions.

For related guidance, see The quality leader’s guide to pharma quality agreements, The sponsor’s guide to CRO master service agreements and Biospecimen supply agreement obligations.

FAQ

Controlled substance supply questions, answered

How is a controlled substance supplier agreement different from an ordinary supply contract? +
The commercial structure is similar, but three things change. Both parties' ability to perform depends on regulatory registrations that can lapse or be restricted, which makes registration status a continuing contractual condition rather than a qualification step. The material carries security, storage and recordkeeping requirements that attach to it regardless of what the parties agree. And supply may be constrained by manufacturing quota for certain schedules, so allocation and shortfall language does real work rather than sitting unused.
Why does registration status need continuous verification? +
Because a registration that was valid at onboarding may not be valid at the next shipment. Registrations expire on fixed cycles, can be surrendered, suspended or restricted following an inspection, and may be limited to particular schedules or activities. A buyer that discovers a lapse only when a shipment is refused has a supply interruption it could have anticipated. Holding expiry dates as tracked fields with advance notification, and requiring the supplier to notify any adverse change, converts a latent risk into a managed one.
What security commitments belong in the agreement? +
State the storage requirements that apply to the material's schedule, the access controls and separation expected at the supplier's site, the requirements for material in transit including carrier vetting and signature at delivery, and the buyer's right to verify by audit or by accepting a recent third-party assessment. Where the supplier holds material on the buyer's behalf, add inventory reconciliation frequency. The verification right is the part most often omitted, and it is what turns the commitments into something testable.
How should allocation and shortfall be handled? +
For quota-constrained material, an ordinary best-efforts supply clause gives the buyer very little. More useful terms include a stated basis for allocation among customers, notice requirements when the supplier anticipates constraint, a commitment to seek any additional quota available, and an agreed order of priority across the buyer's own products where relevant. None of this creates supply that does not exist, but it makes the constraint visible early enough to plan around, which is usually the achievable goal.
What reporting duties should be tracked? +
The recurring ones are loss or theft reporting, which carries short windows and named recipients; significant discrepancy reporting following reconciliation; periodic inventory and reconciliation records; and notification of any regulatory inspection, enforcement action or registration change affecting either party. Each should sit in the obligation calendar with an owner, a window measured in days rather than months, and a defined evidence artifact, because these are the duties whose timeliness is examined most closely.
How long do the records have to be kept? +
Retention for controlled substance records is set by regulation and is typically measured in years from the transaction, with requirements about where records are held and how quickly they can be produced. The practical point for contract teams is that the agreement should state retention explicitly rather than relying on a general records clause, should address who retains what after termination, and should require that records remain retrievable within a stated period. Agreements silent on retention leave both parties guessing at the point an inspector asks.

Hold every supply commitment in one place

See how Aavenir tracks registration expiry, security verification, reconciliation cycles and reporting windows as owned obligations with evidence attached.

  • ✓Registration expiry tracking with advance notification
  • ✓Reporting windows with owners and evidence artifacts
  • ✓Standalone or native on ServiceNow