Cannabis Compliance Checklist
A comprehensive checklist covering every major compliance area for cannabis operators. Use this to audit your operations and identify gaps.
Licensing & Permits
- State cannabis license current and displayed
- Local/municipal permits obtained
- Business license and tax registrations active
- All owners/officers passed background checks
- License renewal dates calendared
- Change of ownership procedures understood
Testing & Quality
- All products tested by a state-licensed lab before sale
- Certificates of Analysis (COAs) on file for every batch
- COAs available to customers upon request
- Failed test remediation procedures documented
- Product recall procedures in place
- Lab selection based on accreditation (ISO 17025)
Seed-to-Sale Tracking
- METRC or state tracking system account active
- All plant tags applied and scanned
- Inventory reconciled daily/weekly
- Transfer manifests completed for all shipments
- Destruction/waste procedures documented and followed
- Staff trained on tracking system procedures
Labeling & Packaging
- THC/CBD content accurately displayed
- Required state warnings included
- Child-resistant packaging used
- Batch/lot numbers on all products
- No health claims or unapproved marketing
- Universal symbol displayed (where required)
Security
- 24/7 video surveillance operational
- Camera footage retained per state requirements (typically 30-90 days)
- Alarm system installed and monitored
- Limited access areas properly secured
- Visitor log maintained
- Cash handling procedures documented
- Transportation security procedures in place
Employee Requirements
- All employees hold required state badges/permits
- Background checks completed for all staff
- Responsible vendor training completed
- Employee handbook includes cannabis-specific policies
- OSHA workplace safety standards met
- Workers compensation insurance active
Financial & Tax
- Cannabis-specialized CPA retained
- 280E-compliant accounting system in place
- COGS properly allocated and documented
- State and federal tax filings current
- Sales tax collected and remitted
- Financial records maintained for audit readiness
- Banking relationship established (if available)
Record Keeping
- Business records retained for minimum period (typically 7 years)
- SOPs documented for all operations
- Incident reports filed and archived
- Regulatory correspondence organized
- Inspection results and corrective actions documented
- Insurance policies current and accessible
Cannabis Compliance FAQ
What are the top cannabis compliance risks?+
The highest-risk areas are: seed-to-sale tracking errors (METRC reconciliation failures), inventory discrepancies that trigger investigations, product testing failures not properly remediated, expired COAs on retail shelves, background check violations from unreported ownership changes, and cash-handling/tax reporting gaps that create audit exposure. Most state license suspensions stem from one of these six categories.
How often should I review my cannabis compliance program?+
At minimum quarterly, with a full annual audit. Regulations change frequently - most state cannabis control boards update rules multiple times per year. A compliance calendar should track license renewal dates, rule change effective dates, internal audits, training refreshers, and third-party compliance reviews. High-risk operations review monthly.
Do I need a compliance consultant?+
Strongly recommended, especially in the first 12-24 months of operation and in high-scrutiny states. A compliance consultant costs less than one missed inspection or failed audit. They typically handle mock inspections, SOP drafting, METRC reconciliation, staff training, and preparing responses to regulator inquiries. For multi-state operators, a compliance consultant is effectively required.
What is METRC and do I need it?+
METRC is the seed-to-sale cannabis tracking system used by most US cannabis-legal states (California, Colorado, Oregon, Michigan, and many others). Every plant and every product batch is tagged and tracked from cultivation through retail sale. If your state uses METRC, you are legally required to maintain an active account, apply tags, and reconcile inventory in the system. Other states use BioTrack or state-built equivalents.
What happens if a cannabis business fails an audit?+
Consequences range from warnings and monetary penalties to license suspension and permanent revocation. Most states follow a progressive enforcement model: minor violations trigger corrective action, repeat violations trigger fines, serious violations trigger suspension. The key to survival is proactive self-reporting, documented corrective actions, and working with an attorney experienced in your state's administrative enforcement process.
Need compliance help?
Find cannabis compliance consultants, attorneys, and CPAs in your state.