TLDR: An overview of the six-part, 109-check compliance audit framework: the state layer, the local layer, the federal DEA layer, the federal layer beyond DEA, privacy and AI, and program hygiene. Check only what you can prove with a record you could produce quickly.
Last issue: I said the federal pathway is built on deference to your state compliance program, and that the practical move is to audit that program through a federal lens. To keep things practical, I put together an expanded, jurisdiction-agnostic compliance checklist as a solid starting point for your internal audits.
When this issue went out, the full 109-check framework was published on this site. It has since moved: it is now part of the Cannabis Reference Library, published separately by cannabislaw.ai, which is not a law firm and is not a service of Kocot Law. Where to find it is on the resources page.
Overview
Here’s an overview:
- The state layer. Twelve sections, from licensing and corporate compliance through enforcement readiness. Sample: “Physical inventory reconciled to the state track-and-trace system on the schedule the state requires; any more frequent company standard identified separately as an internal control.”
- The local layer. Sample: “A current state license is not treated as evidence that local conditions are satisfied; local compliance verified independently.”
- The federal layer (DEA). Registration posture, the state-license dependency, Part 1304 records, screening, labeling, inspection readiness, tax and cash reporting. Sample: “Written federal posture for each entity and premises, using the full status set: not applied, pending with interim operating authority under § 1301.13(k)(7), pending without interim authority, registered, denied, withdrawn, suspended, expired, surrendered.”
- The federal layer beyond DEA. FDA and FTC, workplace safety, etc. Sample: “Advertising, endorsements, testimonials, and influencer arrangements reviewed under FTC standards alongside state advertising rules.”
- Privacy and AI. Patient and customer data, ID scans, vendor access, breach clocks, and an AI use policy. Sample: “Material compliance answers are checked against current authoritative sources and approved procedures, not only the SOP.”
- Program hygiene and audit execution. Sample: “The audit tests performance, not just policy existence: selected transaction, batch, employee, and record-retrieval tests run and documented.”
How to use it
The checklist is a starting point, not a compliance program. Your local jurisdiction, state regulator, and federal law set every threshold, deadline, and rule, so confirm the current text where you operate before you act on any line.
Check only what you can prove with a record you could produce quickly. What you can’t check off the list is something to work on.
Thanks for reading,
Ryan
Keep reading
Attorney advertising. This issue and the framework it describes are general information about federal, state, and local cannabis law, not legal advice, and reading them does not create an attorney-client relationship. Requirements vary by operation, license type, and jurisdiction and change often; confirm the current text of every authority before acting.