CQC controlled drugs 2025 is not a pharmacy-only story. CQC's 2025 controlled-drugs annual update is an oversight report, not a new rulebook. But for any CQC-regulated service that prescribes, stores, administers, carries, reconciles or communicates about controlled drugs, it is a useful signal.
The question for a small provider is simple: if CQC followed one controlled-drug decision from start to finish, could the record show that the risk was controlled?
That might mean an independent ambulance service carrying medicines on a vehicle. It might mean a GP or private clinic prescribing Schedule 2 or 3 medicines. It might mean a care provider supporting prescribed medicines in people's homes. It might mean a specialist service where private prescribing, shared care, cannabis-based products for medicinal use or ADHD medicines sit inside a more complex clinical pathway.
The exact controls differ by service. The evidence principle is the same. A provider needs to show who is responsible, what is held or prescribed, how it is secured or communicated, what happens when something goes wrong, and how leaders know the system still works.
Why the 2025 report matters
CQC published the 2025 update on 9 July 2026. The report says the data mainly relates to calendar year 2025, with some relevant information from early 2026. It also says CQC's controlled-drugs oversight sits under the Controlled Drugs (Supervision of Management and Use) Regulations 2013, alongside its wider regulatory work under the Health and Social Care Act 2008.
The report does not create a separate inspection framework for small providers. It does, however, show where CQC sees pressure and risk.
Private prescribing of Schedule 2 and 3 controlled drugs increased by 64% in 2025, from 540,227 items in 2024 to 886,582 items in 2025. CQC also reported a steep increase in private prescribing of unlicensed cannabis-based products for medicinal use, and continued growth in NHS and private prescribing of medicines licensed for ADHD.
Those trends matter because controlled-drug governance is not only about a locked cupboard. It is also about clinical scope, patient monitoring, communication between providers, prescribing scrutiny, competence and follow-up.
For a small provider, that turns into a practical governance question. If a controlled drug is prescribed, carried, stored or administered, can the provider show the whole safety trail rather than one isolated record?
The evidence CQC can follow
A good controlled-drugs evidence trail usually answers six questions.
- What controlled-drugs activity does the service actually carry out?
- Who is responsible for prescribing, ordering, receipt, storage, administration, reconciliation, disposal and incident review?
- Which staff are trained and assessed as competent for their part of the process?
- How are controlled drugs secured, recorded, reconciled and transferred where relevant?
- What happens if there is a discrepancy, concern, prescribing issue, communication failure or incident?
- How does the registered manager or provider review patterns and take action?
This is where Regulation 12, safe care and treatment, and Regulation 17, good governance, meet. Regulation 12 is about safe care, medicines, risk and competence. Regulation 17 is about systems, records, oversight and improvement. Controlled drugs often sit across both.
A policy can describe the standard, but the records show whether the standard is alive. The strongest evidence connects the policy, staff training, medicines records, incident review, risk register, audit and governance meeting.
Storage and reconciliation are only part of the picture
For services that hold controlled drugs, storage and reconciliation still matter. CQC's care-home guidance is specific about policies or standard operating procedures covering ordering, storing, administering, recording and disposal. It also expects the procedure to explain what to do if there is a discrepancy, including who may need to be informed.
The same logic applies more widely, adjusted to the service. A clinic that holds controlled-drug stock needs secure storage, a register where required, running balances, stock checks, key-control arrangements, expiry checks and disposal records. An ambulance provider needs to know how medicines move between base, vehicle, crew, patient and destination. A service that does not hold stock but prescribes controlled drugs still needs a safe prescribing and communication trail.
The weak point is often handover between systems. A paper controlled-drugs register may be accurate, but if discrepancies do not become incidents, risks or actions, leaders cannot see the pattern. A prescribing record may be clinically sound, but if monitoring responsibility is unclear after referral or shared care, the governance trail is thin.
Controlled-drugs evidence should therefore be more than "the cupboard was locked" or "the prescription was issued". It should show the provider understood the risk and controlled it across the whole pathway.
Private prescribing and shared care need clear communication
CQC's 2025 recommendations put strong emphasis on communication between health and care professionals and providers. That is especially relevant where care crosses NHS, private, secondary care, tertiary care, mental health or GP boundaries.
For a small provider, this is not an abstract recommendation. It affects everyday records.
If a private clinic prescribes a controlled drug, the record should show why prescribing was clinically appropriate, what information was available, what monitoring was needed, what was communicated to the GP or other relevant clinician, and what follow-up was agreed. If the provider is asked to take over monitoring or repeat prescribing, the record should show what responsibility it accepted and what information it requested before doing so.
ADHD medicines are a good example because the report highlights increased prescribing and concerns around transition, monitoring and communication. A provider does not need to turn every ADHD pathway into a bureaucratic file. It does need to show scope of practice, competence, prescribing rationale, monitoring arrangements, communication with other services and action when information is missing.
Cannabis-based products for medicinal use bring a similar evidence challenge. CQC's recommendation is not only about the prescription itself. It points to prescribing scrutiny, the role and operation of multi-disciplinary teams, ongoing oversight and communication between services. If a provider is in this space, the evidence trail needs to show those controls clearly.
Incidents and discrepancies should not disappear into local fixes
Controlled-drug discrepancies are easy to treat as a stock problem. Sometimes they are. But a discrepancy can also point to training gaps, poor witness practice, unclear key control, weak handover, diversion risk, delayed escalation or a wider culture issue.
The useful test is whether a controlled-drug concern can move from local correction into governance when it needs to.
For example:
- A missing running balance entry is corrected and staff are reminded.
- A repeated balance mismatch becomes an incident and a medicines audit action.
- A damaged or expired item creates a disposal record and a stock-control review.
- A vehicle medicines discrepancy triggers immediate containment and a manager review.
- A prescribing communication failure becomes a shared-care action, not only an email apology.
CQC does not expect a provider never to have a medicines problem. It expects the provider to recognise risk, act safely, record the decision and learn. That is why controlled-drugs arrangements should connect to the incident register, complaints, safeguarding where relevant, risk, training and improvement actions.
If the incident meets statutory notification criteria, the provider also needs to consider whether CQC must be notified. The controlled-drugs record and the statutory notification decision should not contradict each other.
What small providers should check now
The fastest useful response to the 2025 report is not a full rewrite of every medicines document. It is a gap check against the work the service actually does.
Start with scope. List whether the service prescribes, stores, administers, transports, disposes of, monitors or communicates about controlled drugs. If the answer is "not usually", check the exceptions. Emergency medicines, vehicle medicines, end-of-life medicines, private prescriptions, ADHD medicines, CBPMs and shared-care requests are all places where the exception can become the risk.
Then test one pathway. Pick one controlled-drug item, one prescription, one stock movement, one vehicle kit, one discrepancy or one shared-care communication. Follow it from start to finish. Look for the evidence that shows:
- who made the decision
- what information they used
- what record was created
- what check or witness happened
- what communication was sent or received
- what incident, risk or action was created if anything went wrong
- who reviewed the outcome
Finally, put the result into governance. If the check finds no issues, record that assurance. If it finds a gap, create an improvement action with an owner and due date. If it finds a pattern, add it to the risk register or monthly oversight review.
That is the difference between having a controlled-drugs policy and being able to show controlled-drugs governance.
Related guidance
- Sample policy: CQC medication policy template
- Sample policy: Ambulance controlled drugs and vehicle medicines
- Sample policy: GP safe prescribing and high-risk drug monitoring
- Checklist: CQC medicines management audit checklist
- Checklist: Primary care prescribing and medicines audit checklist
- Guide: Ambulance and patient transport compliance guide
- Guide: GP and primary care compliance guide
- Regulation explainer: Regulation 12 safe care and treatment
- Regulation explainer: Regulation 17 good governance