Cannabis Compliance Audit Checklist: Prepare Before an Inspection

Quick answer: A cannabis compliance audit should verify that the business is operating within its license, the physical premises matches approved plans, regulated inventory reconciles across systems, required security controls work, product and production records are complete, employees can explain their responsibilities and corrective actions are documented through closure.

This checklist provides a practical audit structure for licensed operators. It is educational, not legal advice, and it must be adapted to the business’s state, local jurisdiction, license type and approved operating plans.

How to use this checklist

Review both design and execution. A policy may look compliant while the floor, records or system entries tell a different story. For each item, record the evidence reviewed, the finding, risk level, responsible owner and corrective-action deadline.

• Green: requirement is met and supported by reliable evidence
• Yellow: partial control, inconsistency or emerging risk
• Red: material gap, repeat failure or immediate exposure
• Not applicable: outside the license or operating scope, with rationale documented

1. License and authorization audit

• State and local licenses are active and posted where required.
• Licensed activities match the work actually performed.
• Renewal, fee and reporting deadlines are assigned and monitored.
• Ownership and financial-interest disclosures remain accurate.
• Local permit conditions are reflected in operating procedures.
• Seller’s permits, tax registrations and other agency approvals are current.
• Required labor, environmental, water or fire obligations are tracked.

Start here because a strong operating control cannot cure activity outside the scope of an active license.

2. Premises and facility audit

• The current layout matches the approved premises diagram.
• All regulated activity occurs within the licensed boundary.
• Limited-access, storage, quarantine and waste areas are identified.
• Doors, locks, walls and access points match the approved security design.
• Equipment, utilities, ventilation and production flows support safe operation.
• Unapproved construction, equipment relocation or use changes are absent.
• Required maintenance, sanitation and pest-control records are available.

Walk the site with the filed premises diagram. Mark every physical difference and determine whether it requires correction, documentation or regulatory approval.

3. Security audit

• Alarm, access-control and surveillance systems are operational.
• Camera views cover required activities and contain no critical blind spots.
• Date and time display are accurate.
• Required footage can be retrieved promptly for the full retention period.
• Visitor, employee and contractor access records are complete.
• Keys, badges and codes are inventoried and promptly revoked.
• Opening, closing, theft, loss and emergency procedures are followed.
• Limited-access rooms and security equipment are appropriately protected.

Test the system rather than relying on a vendor invoice. Retrieve historical footage, trace an access event and verify that employees know the escalation process.

4. Inventory and track-and-trace audit

• All cannabis and cannabis products are properly identified and located.
• Physical inventory agrees with state track-and-trace records.
• Point-of-sale, production and internal inventory systems reconcile.
• Receipts, rejections, production, packaging, transfers, testing and waste are timely recorded.
• Tag inventory is secured, assigned and accounted for.
• Required periodic inventory reconciliations are documented.
• Adjustments include clear reasons and approval.
• Negative inventory, duplicate packages, open transfers and aged exceptions are investigated.
• System users have appropriate access and training.

Select several packages or batches from the floor and trace them into the systems. Then select system records and locate the physical inventory. Audit in both directions.

5. Receiving, storage and transfer audit

• Incoming transfers involve authorized licensees and transporters.
• Manifests, quantities, package identifiers and physical goods agree.
• Acceptance, rejection and discrepancy records are complete.
• Quarantined, failed, returned or expired inventory is segregated.
• Storage conditions protect product quality and prevent unauthorized access.
• Outgoing transfers are approved, manifested and reconciled.
• Delivery or transport records remain accurate throughout the trip.

6. Production and cultivation audit

• Only approved activities, products, formulas and processes are used.
• Current procedures are available where work occurs.
• Batch or cultivation records are completed during the activity.
• Inputs, outputs, yields, losses and waste are reconciled.
• Required monitoring values and equipment settings are recorded.
• Deviations are documented, investigated and approved.
• Pesticide, water, environmental or extraction requirements are satisfied when applicable.
• Cleaning, sanitation and line-clearance records are complete.

For manufacturers, compare each batch record with the approved Master Manufacturing Protocol and Product Quality Plan. For cultivation, compare plant, harvest and package records with canopy, pesticide, water and waste documentation.

7. Product, testing, packaging and labeling audit

• Required testing was completed before eligible retail sale.
• Certificates of Analysis match the correct batch.
• Failed or quarantined product is controlled.
• Packaging and labels match current approvals and product specifications.
• Required warnings, symbols, cannabinoid information and dates are accurate.
• Packaging and label issuance and reconciliation are documented.
• Quality review is complete before product release.
• Complaints, adverse events, holds and recalls are traceable.

8. Waste and destruction audit

• Waste is identified, weighed and recorded.
• Waste storage is secure and limited to authorized personnel.
• Destruction makes the material unusable and unrecognizable when required.
• Track-and-trace, waste logs and third-party records agree.
• Hazardous or universal waste follows applicable rules.
• Witness, video or vendor documentation is retained when required.

9. Personnel and training audit

• Each regulated task has an assigned, trained role.
• New-hire and recurring training records are complete.
• Employees use the current version of procedures and forms.
• System permissions match job responsibilities.
• Training effectiveness is verified for high-risk tasks.
• Retraining follows procedure changes, deviations and findings.
• Employees know how to escalate theft, loss, injury, product and system incidents.

Interview employees separately. Ask them to explain and demonstrate the process using the real equipment, forms and systems.

10. Records and financial-control audit

• Required records are legible, attributable and retrievable.
• Retention periods are defined and followed.
• Changes to controlled records remain traceable.
• Sales, inventory, accounting and tax data reconcile.
• Cash access, counts, deposits and adjustments use appropriate segregation of duties.
• Vendor, customer and license status checks are documented.
• Management reviews exceptions, not only summary totals.

11. Corrective-action audit

• Every finding has a clear requirement and evidence reference.
• Immediate containment protects inventory, records or consumers.
• Root cause addresses why the control failed.
• Corrective and preventive actions have owners and deadlines.
• Completion evidence is attached.
• Effectiveness is tested after implementation.
• Repeat findings are escalated to leadership.

Closing a task is not the same as correcting the system. Verify that the fix works in practice and did not create a new gap elsewhere.

Build an inspection-ready evidence file

Maintain a controlled index of documents that can be produced promptly:

• Licenses, permits and approved premises plans
• Current SOP index and revision history
• Training matrix and competency records
• Inventory reconciliation and exception reports
• Security testing and footage-retrieval evidence
• Batch, cultivation, testing and quality records
• Waste, incident, complaint and recall records
• Maintenance, sanitation, calibration and pest-control records
• Prior findings and corrective-action evidence

Frequently asked questions

How often should a cannabis compliance audit be performed?

Use a risk-based schedule, with additional audits before inspections, renewals, major facility or process changes, product launches and after significant incidents or repeat deviations.

What is the difference between an audit and an inspection?

An internal audit is a structured review performed by or for the business to identify and correct gaps. An inspection is performed by a regulator or other authority to evaluate compliance.

What should be audited first?

Prioritize active license status, activity scope, premises integrity, security, inventory and track-and-trace accuracy, product safety, testing and any issue that could affect consumers or indicate diversion.

How should audit findings be ranked?

Rank findings by regulatory exposure, consumer or employee risk, inventory or financial impact, likelihood, detectability and whether the issue is isolated or systemic.

Should employees be interviewed during the audit?

Yes. Interviews and demonstrations help verify whether written procedures are understood and followed. Use role-specific questions and compare answers with records and direct observation.

Is a regulator’s self-inspection checklist enough?

It is an excellent starting point but may not be exhaustive. Add license-specific regulations, local permit conditions, facility and process risks, tax requirements and the company’s approved plans.

Official California resources

• DCC guidance and checklists
• DCC cultivator self-inspection checklist
• DCC manufacturer self-inspection checklist
• DCC compliance action records
• DCC CannaConnect compliance resources

Last reviewed: August 2026. Confirm current state, local and license-specific requirements before acting on this checklist.