I keep telling operators to build a federal file: your application, your correspondence, your records, one place, ready to produce. This is mine. It is the public home of the Kocot Law Compliance Operating System, the framework I use with clients on local, state, and federal compliance.
Most compliance content is a one-time download that is stale within a quarter. This page is the opposite: one address, kept current, with a dated change log. Bookmark it. Come back to it before every renewal, every inspection, and every rule change.
Last updated September 17, 2026. Maintained by Ryan Kocot.
Cannabis compliance audit framework
A starting point for your compliance audit. State, local & federal.
109 Checks
26 Sections
6 Parts
Free Print it if you like
Part 1 · The state layer
01 Licensing and renewalsEvery license and permit current, with renewal deadlines tracked and a renewal reminder or warning set.
02 Corporate and LLC complianceEntity filings current in the state of formation and every state of operation, with registered agent and annual or biennial report filings tracked. Governing documents (operating agreement or bylaws) current, signed, and matching the ownership disclosed to the regulator. Capitalization table current and reconciled to issued equity, options, and convertible instruments. Member, manager, or board actions documented by minutes or written consents; equity transfers papered and consistent with the governing documents.
03 Ownership, control, and financial interestsEvery owner disclosed through the whole chain (holding company to operating company) at the state’s threshold, plus officers, directors, managers, and anyone who directs or controls the business regardless of equity. Every financial-interest holder disclosed at the state’s threshold: profit-share and royalty recipients, lenders with control rights, qualifying lessors, and management, consulting, or brand-licensing counterparties whose fees are tied to revenue or profit. Equity, conversion rights, control rights, financing, and economic arrangements evaluated under the applicable ownership and financial-interest definitions, with the analysis documented per holder. Disclosures reconciled against the governing documents, intercompany agreements, and actual economic flow; changes reported within the state’s window. Background checks and suitability complete for every required person, with the re-check cadence tracked. Ownership and license caps re-tested across the whole footprint, including affiliates and multi-state parents, before every new investment or license. Third-party arrangements (management, white label, brand license, consulting) reviewed for undisclosed ownership, illegal control, and licensed-activity boundaries.
04 Premises, security, and surveillanceSecurity plan on file matches the premises as operated: limited-access areas, locks and access logs, visitor log, after-hours procedures, and a tested response to alarm, theft, and diversion. Video surveillance covers every required area at the required resolution, with retention at or above the state minimum, a tested backup, and logged access to footage. Alarm system installed, monitored, and tested on a schedule. Building, fire, health, and accessibility inspections passed; corrective items closed and documented; the certificate of occupancy matches the use. Environmental permits and reviews on file where required (water, discharge, energy, odor, waste), with monitoring records current. For each physical change (walls, rooms, cameras, storage), determine whether it requires advance approval, notice, or only an updated internal record, and satisfy that process on the applicable timeline. Theft, loss, or diversion reported to the regulator within the state’s window, with the internal investigation documented.
05 Personnel and agentsEvery person who must be registered, badged, or fingerprinted (agents, key employees, handlers) is, with renewal dates tracked; departures reported within the state’s window. Employee roster matches badge inventory and track-and-trace user list; departed employees deactivated in every system the same day. Cannabis-specific training documented for every role: handling, track-and-trace, security, age and ID verification, delivery, recall, and any state-mandated responsible-vendor course, with dates, content, and sign-off. Employment-law baseline current: wage and hour, harassment prevention, workplace-violence or safety plan, leave, and any state off-duty cannabis-use protections reconciled with the fitness-for-duty policy. Handbook, offer letters, and contractor agreements current and consistent with the SOPs; no contractor performing work the state requires an employee or registered agent to do.
06 Track-and-trace and inventoryPhysical inventory reconciled to the state track-and-trace system on the schedule the state requires; any more frequent company standard identified separately as an internal control. Entries made within the state’s timeframe for each transaction type; adjustments carry a written reason. Every transfer travels on a manifest that matches the physical shipment. Plant, harvest, and package tags applied at the point the state requires. Waste and destruction entered with the reason, witnessed where required, and rendered unusable per the state’s method. Data-entry and integration errors identified and corrected within the applicable legal deadline, with monitoring frequent enough to meet it. Track-and-trace users match current personnel with role-appropriate permissions.
07 Operations by activityCultivation: crop plan current; canopy or plant-count limits verified; pesticide use limited to permitted products with complete application records; water, discharge, and energy requirements met; post-harvest handling meets sanitation standards. Manufacturing: batch production records for every batch; master formulas version-controlled; permitted ingredients and additives verified; extraction safety certified; equipment and scale calibration current; storage conditions and expiration dating enforced. Distribution and transport: quality-assurance and testing verification before product moves; vehicle, driver, route, and transport-security requirements met and written into the SOP. Retail: age and ID verification on every sale; transaction, daily, rolling-period, patient-allotment, and product-equivalency limits verified and enforced by the system, as applicable; exit packaging and receipt requirements met. Delivery and online ordering, where licensed: license-specific SOPs, ID verification, geographic limits, and local restrictions applied. Medical channel: patient and caregiver verification and medical-only tax treatment applied; qualifying documentation checked against the federal content requirements. Samples, donations, discounts, loyalty, and promotions reviewed against the state’s rules for each sales channel. Outage plan for power, surveillance, alarm, and track-and-trace failures: when operations must stop, who is notified, and what authorizes resumption.
08 Testing, packaging, and labelingProduct release checked against the applicable testing requirements, exemptions, product categories, and transfer stages; sampling authority, laboratory authorization, COA authenticity, and batch and package matching verified; permitted remediation or retesting documented. Labels reviewed against current requirements before initial release and after any relevant change, with periodic sampling as an additional control; record whether label approval is internal or a legally required agency approval. Packaging child-resistant, tamper-evident, opaque where required, and not attractive to minors; serving and package limits for edibles enforced. Quality-assurance process for incoming product, verified at receiving. Marketing and advertising reviewed against the state’s rules, including social media, influencers, loyalty programs, health claims, and youth-appeal restrictions.
09 Complaints, recalls, and incidentsProduct complaint log with required fields; complaints reviewed for adulteration or misbranding and investigated to root cause, with the decision documented. Written recall plan naming triggers, responsible people, regulator notification, downstream and consumer notification, retrieval, and disposition; traceability, notification, and stop-sale execution tested, at least annually as an internal control. Recall clocks calendared: the regulator-notification window and the downstream-notice window written on the plan, not looked up during the event. Incident reporting procedure (theft, loss, diversion, security breach, contamination, employee injury involving product) with the notification window calendared and a template ready. Consumer returns separated from licensee-to-licensee returns; returned product segregated, documented, and handled under applicable return and disposal rules; resale only where legally permitted (California, for example, prohibits resale of consumer-returned cannabis goods, 4 CCR § 15410(c)). Product holds applied across every sales channel, including online ordering and delivery queues.
10 Records and retentionRequired records kept at or above the state’s minimum period and readily retrievable at the licensed premises or the location the state allows, with a written retention schedule by record type. Video surveillance retained for the state minimum; personnel, wage, tax, pesticide, waste, and testing records at the longest applicable period. Regulator inspection reports, notices, correspondence, and corrective-action evidence filed in one place in date order. A single source of truth for records (SharePoint, Google Drive, or another system) keeps documents readily accessible; nothing critical exists only in a text thread or one person’s inbox.
11 Taxes and reportingState cannabis excise, cultivation, or gross-receipts taxes registered and remitted at the current rate; local cannabis taxes registered and remitted where imposed; proof of payment retained. Sales and use, payroll, and income tax filings current in every state of operation; delinquencies, disputes, liens, defaults, and payment plans identified and their consequences assessed under the applicable tax and licensing rules. Regulator reports filed: annual, license-specific, material-change, and any equity, community-benefit, or environmental reporting the state requires. Financial statements, cost-of-goods allocation, and the § 280E position documented contemporaneously; reconciled and supportable across state and federal returns. Cash handling and deposit procedures written: counting, transport, storage, and reconciliation controls, with proof of deposit retained.
12 Enforcement readinessStaff recognize every enforcement instrument the state uses (notice of violation, deficiency, notice to comply, citation, embargo or hold, summary suspension, order to show cause, accusation); same-day routing to counsel maintained as an internal control. For each instrument type, the actual response trigger recorded (issuance, mailing, service, receipt, or discovery), with calendar or business-day treatment, filing method, recipient, and proof of timely submission; the shortest clock written on the front of the plan. Holds, embargoes, and quarantines obeyed literally: no movement, sale, or destruction of held product without written regulator authorization. Written inspection protocol: who greets the inspector, who calls counsel, who produces documents, what staff say and do not say. Corrective action documented with evidence of completion; conditions of any settlement, probation, or stipulated resolution tracked to the day.
Part 2 · The local layer
13 Local authorization and conditionsThe actual local permits, conditions of approval, approved plans, development agreements, and host-community or local agreements collected and audited obligation by obligation, with the responsible city, county, district, or other authority identified for each. Permitted uses, operating and delivery hours, security staffing, odor and noise controls, signage, and parking conditions verified against operations as run. Fire, occupancy, hazardous-material storage, waste, and sewer requirements current, with inspections and approvals on file. Local taxes registered and remitted; local renewal conditions and required reports calendared with owners. A current state license is not treated as evidence that local conditions are satisfied; local compliance verified independently.
Part 3 · The federal layer (DEA)
14 Registration postureWritten federal posture for each entity and premises, using the full status set: not applied / pending with interim operating authority under § 1301.13(k)(7) (application submitted within 60 days of publication, submission evidence preserved, application still pending) / pending without interim authority / registered / denied / withdrawn / suspended / expired / surrendered. Required registrations verified by premises and activity, with expiration and renewal tracked; separate-location requirements and registration-transfer restrictions checked before any relocation, ownership transaction, or closure. Underlying facts reconciled across federal and state filings, with each agency’s disclosure requirements independently satisfied; amendments to pending applications and modifications to issued registrations filed under the correct provision. Channel map: every place medical and adult-use share rooms, inventory, systems, staff, or records, with the authority supporting each required separation. One named owner for all DEA correspondence, a designated backup, and a federal correspondence file in date order.
15 The state-license dependencyEvery state medical license current, with renewals calendared and a named owner; suspension, revocation, or expiration of the underlying state medical license automatically suspends the associated DEA registration. DEA registration scope checked against state license scope (activities, premises, product types); nothing conducted federally exceeds the state authorization. State enforcement documents (notice, hold, embargo, order, accusation) treated as triggers for immediate federal-risk assessment; same-day counsel escalation maintained as an internal control.
16 Records and inventory (Part 1304)State records mapped to federal obligations and identified gaps supplemented. Track-and-trace reconciled to physical count on a written cadence; discrepancies investigated and documented the same day.
17 Security and employee screeningPhysical security complies with state law; the plan on file matches the floor as operated. For covered dispensers: agents and employees with controlled-substance access identified and screened for controlled-substance felony convictions, DEA application denials, registration revocations, and registrations surrendered for cause; access restrictions and any approved exception documented; a pending exception request is not approval. Screening tailored to registration type (non-practitioner screening is addressed separately); counsel reconciles screening, access decisions, background-check procedures, and applicable employment protections. Theft or significant loss: written notification to the DEA field division within one business day of discovery, and the complete electronic Form 106 within 45 calendar days after discovery; theft distinguished from a loss evaluated for significance; separate state and local reporting deadlines maintained.
18 Labeling, packaging, and medical certificationThe federal labeling, packaging, and sealing accommodation is conditional: state labeling compliance verified product by product. Evaluate transfer-warning applicability under 21 C.F.R. § 290.5. Qualifying medical documentation audited for the federally required content: issuance date and signature, the user’s full name and address, and the signing practitioner’s name, address, and state license number; a process exists for resolving missing information; a state patient card is not assumed sufficient.
19 Inspection and enforcement readiness (DEA)Written inspection protocol with logged floor training; every staff member can describe how a DEA visit is handled. Document pull list ready: registration file, state licenses, inventories, reconciliation records, security plan, screening records, labeling samples, correspondence file.
20 Tax, cash reporting, and banking§ 280E position documented: legal basis, tax periods, medical and adult-use allocation, inventory methodology, and state conformity adjustments; reconciled and supportable across returns; operative guidance distinguished from announced transition plans. Reportable cash transactions identified and aggregated; Form 8300 filed within 15 days when more than $10,000 in cash is received in one or related transactions; required annual customer statements and records retained. Cash handling and deposit procedures written; banking relationship with a cannabis-serving institution current; the business understands it is the subject of the bank’s suspicious-activity reporting, not the filer. Federal and state tax filings current with proof of payment; delinquencies and disputes assessed under the applicable rules.
Part 4 · The federal layer beyond DEA
21 FDA, FTC, and product claimsFDA applicability reviewed for each product and activity: FD&C Act status, therapeutic claims, and covered FDA-approved product distinctions; DEA registration does not establish FD&C Act compliance. Advertising, endorsements, testimonials, and influencer arrangements reviewed under FTC standards alongside state advertising rules.
22 Workplace safetyHazard assessment covers cannabis dust and allergens, solvents, compressed gases, ventilation, machinery, and PPE, with controls and training documented; OSHA identifies occupational allergy and asthma risks in cannabis production. Injury and illness recording and reporting responsibilities assigned and calendared.
23 Environmental, pesticide, and transportationFederal pesticide, waste, and discharge obligations reviewed alongside state permits. Transportation and shipping requirements reviewed for each product and route, including hazardous-material rules for solvents and batteries.
Part 5 · Privacy and cybersecurity
24 Privacy, data security, and AIPatient and customer records, identification scans, and employee background information inventoried, with lawful retention and deletion schedules. Access permissions, vendor access, backups, and breach response tested; breach-notification clocks identified. AI use policy: which tools, what data may go in, and a rule that material compliance answers are checked against current authoritative sources and approved procedures, not only the SOP, which may itself be outdated.
Part 6 · Program hygiene and audit execution
25 Program hygieneEvery SOP reviewed at a regular, determined cadence, version-controlled, and matching what the floor actually does; superseded versions preserved under the retention schedule and any applicable preservation obligation. Training records for every role: new-hire and annual refresher, with dates, content, trainer, and sign-off. Written retention schedule covering every record type at the longest applicable period. Compliance calendar: every license, permit, registration, tax filing, report, and renewal with its due date, an owner, and an early warning.
26 Audit execution and follow-throughThe audit tests performance, not just policy existence: selected transaction, batch, employee, and record-retrieval tests run and documented. Each finding recorded with severity, interim containment, root cause, corrective action, accountable owner, due date, and verification that the correction worked. Preservation procedures applied to relevant records and footage when an incident, claim, or enforcement matter is reasonably anticipated. Re-audit triggers defined: legal changes, operational changes, incidents, and enforcement developments.
The rest of the file
Everything else I have published for state-licensed operators, grouped the way the checklist is. New pieces are added here the day they publish; the change log records it.
▸ The federal file (DEA)▸ California enforcement▸ The operating systemChange log
September 17, 2026. First published. 87 checks across the state layer, the federal DEA layer, and program hygiene.
Attorney advertising. This is an audit framework and starting point, not an exhaustive list, and it is not legal advice. Federal, state, and local requirements vary by operation, license type, and jurisdiction and change often; confirm the current text of every authority before acting. The federal situation is fluid and many legal and tax questions remain unanswered. Reading or using this framework does not create an attorney-client relationship. © 2026 Kocot Law.