When Investigators Talk to Your Team: Why Training and Audits Protect Everyone in the Building

The short answer: When an enforcement action starts at a California cannabis operation, the record often gets made by the people on the floor, not by the owner or the lawyer. Employees answer questions in real time, from memory, with no preparation. Good training and honest internal audits are what turn that moment from a liability into a non-event, and they protect the employee as much as the company. They also matter later, because a single set of facts can turn into a licensing action, a criminal case, or both, and the interests of the company and an individual employee do not always stay aligned.

Enforcement is picking up, and the front line is your staff

California has been directing more resources toward cannabis enforcement. For licensed operators, that means a higher likelihood of an inspection that escalates, an investigation that widens, or an administrative action that arrives alongside a law enforcement referral.

When that happens, most operators picture a conference room, a lawyer, and a stack of documents. What actually happens first is much less formal. Someone in a polo shirt asks your inventory lead where the destruction log is. Someone asks a budtender how returns are handled. Someone asks a cultivation employee who has keys to limited access areas.

Those answers become part of the record. They get written down. They are compared against your SOPs, your track-and-trace data, and each other. And they are given by people who had no idea that morning that they were about to become witnesses.

This is not a reason to be afraid of your employees. It is a reason to prepare them.

What an unprepared answer actually costs

An employee who does not know the procedure will not say “I don’t know.” Most people, put on the spot by someone with a badge or a clipboard, will try to be helpful. They will guess. They will approximate. They will describe what usually happens rather than what the written procedure requires. That creates three problems at once.

• It creates a discrepancy. If the binder says one thing and three employees describe three different things, an investigator has found an inconsistency before lunch. That inconsistency does not have to reflect an actual violation to cause real trouble. It only has to look like one.

• It can make things sound worse than they are. A guess about a procedure the employee does not perform, or a date they do not actually remember, can put something into the record that is simply not accurate. Correcting it later is harder than getting it right the first time.

• It puts the employee in an uncomfortable position. They were trying to help. Nobody told them what to do when someone official starts asking questions, and nobody told them it was completely acceptable to say “I want to get you the right answer, let me get my manager.”

Training is protection for the person, not just the company

The usual argument for training is compliance. The better argument is that training is the thing that lets an employee answer confidently and correctly about their own job.

An employee who has been trained on the SOP for their station knows what the procedure is, knows that they follow it, and can say so plainly. That is a good moment for the company and a good moment for them. An employee who has never read the SOP, or who was trained once at hire and never again, is being asked to perform without a script.

A few things that make the difference:

• Train on the SOP the employee actually uses. Not the full manual. The sections that govern the work they do, in language that matches how the work is described on the floor.
• Document it. Sign-in sheets, dates, what was covered, who trained. Training you cannot prove is training you will have a hard time relying on.
• Retrain when the procedure changes. A revised SOP that nobody was told about is not a procedure. It is a document.
• Tell your team what to do if someone shows up. Who to notify. That they should be courteous and truthful. That it is fine, and in fact preferable, to say they will get the person who can answer accurately rather than guess. That nobody will be in trouble for not knowing something outside their role.

That last point is worth its own line: an employee should never feel pressure to invent an answer to protect the company. That helps no one, and it is exactly how a manageable situation becomes a much bigger one.

Audits close the gap between the binder and the floor

Written procedures drift. Someone finds a faster way to do a step. A shift changes a workflow to accommodate a broken piece of equipment and it becomes permanent. A regulation is updated and the SOP is not.

None of that is unusual, and most of it is not sinister. But the gap between what is written and what is practiced is exactly the gap an investigator finds by asking three people the same question. An internal audit, done honestly, finds those gaps while you still have the option to fix them quietly. It also tells you something more useful than whether the paperwork is correct: it tells you whether your team can describe what they do and whether that description matches your documents.

A caution worth understanding, though. Internal audits create records. Depending on how the audit is conducted, who conducts it, and whether counsel is involved, those records may or may not be protected. That is a conversation to have with a lawyer before you start, not after you have generated a written list of your own problems.

What good preparation actually looks like

None of this requires a massive compliance department. It requires a handful of things being true before anything happens:

• Current SOPs that match how the work is actually performed
• Training that is role-specific, documented, and refreshed when procedures change
• A simple, written protocol for what employees do when someone official arrives
• Periodic internal review, scoped with counsel where privilege matters
• One point of contact who is notified immediately, every time
• Counsel who can see the licensing exposure and the individual exposure at the same time, before either one has been shaped by a well-intentioned answer

The goal is not to make your team defensive. It is to make sure that on the worst day, the people in your building are describing a system that exists, that they know, and that matches what your documents say.

Frequently asked questions

Should we do an internal audit if we think something is wrong?

Often yes, but talk to counsel about how it is structured before you begin. How an audit is conducted affects what protections may apply to the records it creates.

Do we need two different lawyers for the licensing matter and a criminal matter?

Sometimes. But the tracks are related, and what happens on one affects the other, so what matters most is that someone is looking at both from the start rather than handling them in isolation. Kocot Law handles both tracks.

---

Ryan Kocot is a cannabis attorney licensed in California, New York, and Massachusetts. He handles licensee administrative matters as well as criminal and asset forfeiture matters arising from cannabis operations, and he built his practice on a criminal defense background before moving into cannabis licensing and compliance.

Attorney advertising. This article is general information about California cannabis enforcement and is not legal advice. Reading it does not create an attorney-client relationship. Every situation depends on its own facts, and you should speak with a lawyer about yours.