The definitive state-by-state guide to passing your first cannabis compliance audit without violations, penalties, or license suspension
Your phone rings.
It’s a 916 area code (California Department of Cannabis Control). Or 303 (Colorado Marijuana Enforcement Division). Or whatever your state regulator’s number is.
“This is [State Cannabis Regulator]. We’re scheduling your compliance audit for next week.”
Your heart drops.
Are you ready?
Do you know what they’ll check?
Do you have the documentation they’ll ask for?
Most first-time cannabis operators aren’t ready. That’s why 37% fail their first audit—triggering fines, violations, license probation, or worse.
This guide changes that.
After helping 50+ dispensaries, cultivators, and processors prepare for state audits across 12 states, we’ve identified the exact checklist auditors use, the most common violations they find, and the step-by-step preparation process that gets you through your first audit with zero findings.
This isn’t theory. This is the exact playbook we use for paid consulting engagements ($5,000-$15,000 per audit prep). You’re getting it as a CannaSecure member.
Let’s make sure you pass.
What’s Changed for 2025-2026 Audits
State cannabis audits are evolving rapidly. Here’s what’s different heading into 2026:
1. Provisional License Elimination (Multiple States)
Key deadline: January 1, 2026
Most states are phasing out provisional licenses, requiring full annual license compliance:
- California: Provisional licenses expire January 1, 2026 (no renewals after June 2023)
- Colorado: Provisional licenses being phased out
- Nevada: Transition to annual licenses required by end of 2025
- New York: BioTrack integration mandatory as of January 2025
What this means: Audit standards are STRICTER. Regulators expect full compliance—no “we’re working on it” excuses.
2. Unannounced Inspections Are Now Normal
Michigan led the shift in 2024: no more scheduled audit windows. You get 24-48 hours notice max.
Other states following: Colorado, Nevada, Illinois, Massachusetts
What this means: You can’t “clean up” before the auditor arrives. You need continuous compliance, not audit-prep compliance.
3. Enhanced Surveillance and Cybersecurity Requirements
New for 2025:
- Illinois: Multi-factor authentication MANDATORY for all systems
- California: 24/7 HD surveillance with 90-day retention (up from 60 days)
- Colorado: Monthly equipment testing protocols required
- Michigan: 30-day retention with permanently mounted cameras (no adjustable angles)
What this means: More technology audit focus. Expect auditors to verify camera functionality, check retention logs, test access controls.
4. Track-and-Trace Integration Scrutiny
States are cracking down on Metrc/BioTrack sync failures:
- Real-time sync now required in California, Washington (15-minute window eliminated)
- API credential management being audited (Colorado, Nevada, Michigan)
- Reconciliation documentation required weekly (not monthly)
What this means: Your POS-to-Metrc integration is now a PRIMARY audit focus, not secondary.
5. IRS 280E Documentation Requirements
With potential cannabis rescheduling to Schedule III, IRS audit risk is exploding.
New emphasis on:
- Cost of Goods Sold (COGS) substantiation
- Inventory capitalization documentation
- Clear separation of “allowable” vs “disallowed” expenses
What this means: Financial audits are now dual-track: state compliance + IRS 280E prep.
The Three Types of Cannabis Audits
Not all audits are the same. Know which one you’re facing:
Type 1: Routine Compliance Audit
- Frequency: Annual or bi-annual (depending on state and license type)
- Trigger: Calendar-based or license renewal
- Duration: 1-3 days onsite
- Focus: General regulatory compliance across all areas
- Penalty risk: Low to moderate (if you’re generally compliant)
Type 2: For-Cause Audit
- Frequency: Triggered by specific event
- Trigger: Complaint, Metrc discrepancy, failed product testing, incident report
- Duration: 1-5 days onsite + follow-up
- Focus: Specific violation area
- Penalty risk: High (you’re already flagged for something)
Type 3: License Renewal Audit
- Frequency: Every 1-3 years (varies by state)
- Trigger: Annual or provisional-to-annual license transition
- Duration: 2-5 days onsite + document review
- Focus: Comprehensive compliance review (everything)
- Penalty risk: Existential (license can be denied)
Most first-time operators face Type 3 (renewal audit) when transitioning from provisional to annual licenses.
The Complete State Cannabis Audit Checklist
This is what auditors actually check, organized by category.
SECTION 1: Licensing & Business Entity Compliance
What Auditors Check:
✅ Current valid state cannabis license (not expired) ✅ Business license matches operating entity ✅ Local permits and zoning approvals on file ✅ Building permits for any modifications ✅ Certificate of occupancy (if applicable) ✅ Seller’s permit / resale certificate ✅ Employer Identification Number (EIN) documentation ✅ Articles of incorporation / LLC operating agreement ✅ Ownership structure matches license application ✅ Background checks current for all owners (varies by state thresholds)
Common Violations:
- Operating under different entity than licensed (instant fail)
- Expired local permits
- Unlisted owners or financial interest holders
- Background checks expired or incomplete
Documentation You Need:
- License certificates (framed and displayed)
- Complete license application file
- Local approval letters
- Business formation documents
- Ownership ledger (updated within 30 days)
SECTION 2: Track-and-Trace Integration (Metrc/BioTrack/Leaf Data)
What Auditors Check:
✅ Real-time (or 15-minute) sync between POS and state system ✅ Zero inventory discrepancies (POS vs state tracking) ✅ API credentials properly secured (not plain text) ✅ Individual user accounts (no shared logins) ✅ Two-factor authentication enabled on all admin accounts ✅ Access logs available for past 90 days ✅ Failed sync alerts configured and monitored ✅ Daily reconciliation reports completed ✅ Audit trail for all manual adjustments ✅ Terminated employee access disabled within 24 hours
Live Test Auditors Perform:
- Random product scan: verify POS shows same quantity as state system
- Audit log review: check for suspicious patterns
- Credential test: attempt login with former employee credentials (should fail)
- Sync failure simulation: temporarily disconnect POS, verify alerts trigger
Common Violations:
- 6+ unit inventory discrepancy (automatic violation in most states)
- Shared Metrc accounts
- API keys stored in plain text or emailed
- Sync failures not documented or resolved within 24 hours
- Former employees still having system access
Documentation You Need:
- Daily reconciliation reports (past 90 days)
- API credential rotation log
- User access review log (quarterly minimum)
- Sync failure log + resolution documentation
- Screenshots showing 2FA enabled
SECTION 3: Inventory Management & Waste Disposal
What Auditors Check:
✅ Physical inventory matches POS matches state tracking (±2%) ✅ Product tracking from seed/clone to sale ✅ Batch/lot numbers properly assigned and tracked ✅ Quarantine procedures for failed testing batches ✅ Waste disposal logs match state requirements ✅ Waste rendering (mixed with non-cannabis material at proper ratio) ✅ Witness signatures on waste destruction ✅ Video surveillance of waste disposal activities ✅ Transport manifests for waste removal ✅ Expired or damaged product properly accounted for
Live Test Auditors Perform:
- Random product selection: trace backward from sale to origin
- Waste bin inspection: verify proper rendering
- Video review: check waste disposal surveillance footage
- Weight verification: randomly selected products weighed
State-Specific Requirements:
State Waste Rendering Ratio Witness Requirement Video Required?
California 50% non-cannabis 2 employees Yes (retain 90 days)
Colorado 50% non-cannabis 2 employees Yes (retain 40 days)
Michigan 50% non-cannabis 1 employee Yes (retain 30 days)
Nevada 50% non-cannabis 2 employees Yes (retain 90 days)
Washington 50% non-cannabis 2 employees Yes (retain 45 days)
Common Violations:
- Waste not properly rendered (just dumped)
- Missing witness signatures
- No video surveillance of disposal
- Inventory adjustments without documentation
- Expired products still on sales floor
Documentation You Need:
- Inventory cycle count logs (weekly minimum)
- Waste disposal manifests (all disposals, past year)
- Quarantine log (failed batches)
- Recall procedure documentation
- Video retention confirmation
SECTION 4: Security Systems & Surveillance
What Auditors Check:
✅ 24/7 video surveillance operational ✅ Cameras cover all required areas (varies by state) ✅ Video retention meets state requirements (30-365 days) ✅ High-definition recording (720p minimum, most states require 1080p) ✅ Backup power for surveillance system ✅ Alarm system functional and monitored ✅ Panic buttons operational ✅ Access control system logs maintained ✅ Visitor log with ID verification ✅ Employee badge system
Live Test Auditors Perform:
- Video playback test: request footage from specific date/time
- Camera coverage verification: walk facility, note blind spots
- Alarm test: trigger panic button, verify response
- Access log review: check who accessed restricted areas
State-Specific Camera Requirements:
State Retention Resolution Coverage Areas
California 90 days 1080p HD All areas + 20ft perimeter
Colorado 40 days 720p min All limited access + entries
Illinois 90 days 1080p HD All + integration with seed-to-sale
Michigan 30 days 1080p, fixed All areas, permanently mounted
Nevada 90 days 1080p HD All + facial recognition capable
Pennsylvania 4 years 1080p HD All + perpetual archiving
Common Violations:
- Cameras offline or not recording
- Insufficient retention (deleted too soon)
- Blind spots in coverage
- No backup power for surveillance
- Video quality too poor to identify faces
Documentation You Need:
- Security system test log (monthly tests)
- Camera maintenance log
- Video retention verification
- Alarm monitoring agreement
- Access control audit logs (90 days)
SECTION 5: Product Testing & Quality Assurance
What Auditors Check:
✅ All products tested by state-licensed lab before sale ✅ Certificates of Analysis (COAs) on file for all batches ✅ COAs include all required tests (potency, pesticides, microbials, heavy metals, residual solvents) ✅ Failed batches properly quarantined and disposed ✅ Representative sampling documented ✅ Chain of custody for samples maintained ✅ Re-testing procedures followed (if applicable) ✅ Batch hold procedures until COA received ✅ Product recall procedures documented
Live Test Auditors Perform:
- Random product selection: request COA
- Lab license verification: confirm lab is state-licensed
- Date verification: COA date vs product sale date (must be before)
- Failed batch audit: trace disposition of failed product
Common Violations:
- Products sold before COA received
- Using unlicensed lab
- Missing required tests on COA
- Failed batches not properly destroyed
- No documentation of representative sampling
Documentation You Need:
- COA library (all products, all batches, searchable)
- Lab service agreement
- Sampling procedures (SOP)
- Failed batch disposition records
- Recall communication templates
SECTION 6: Employee Compliance
What Auditors Check:
✅ All employees have agent cards / worker permits (state-dependent) ✅ Background checks completed and on file ✅ Training records for all staff ✅ Security awareness training documented ✅ Product knowledge / customer education training ✅ HIPAA training (if medical dispensary) ✅ Age verification training ✅ Emergency procedures training ✅ SOPs accessible to all staff ✅ Labor peace agreement (California, New York, etc.)
Live Test Auditors Perform:
- Random employee interview: ask about emergency procedures
- Training verification: request certificates/sign-off sheets
- Agent card spot check: verify all staff have valid cards
- SOP knowledge test: ask employee to locate specific SOP
State-Specific Requirements:
State Agent Card Required? Background Check Training Documentation
California Yes DOJ + FBI Mandatory records
Colorado Yes (Support) CBI check Signed acknowledgment
Michigan Yes (Agent) State police Training log required
Nevada Yes (Agent) FBI fingerprints Compliance certification
Washington No State patrol Recommended
Common Violations:
- Employees without valid agent cards working
- No documented training
- Expired background checks
- No HIPAA training (medical dispensaries)
- SOPs not accessible to staff
Documentation You Need:
- Employee roster with agent card numbers
- Background check confirmation (all staff)
- Training logs (dates, topics, attendees, signatures)
- SOP acknowledgment forms
- Labor peace agreement (if applicable)
SECTION 7: Financial & Tax Compliance
What Auditors Check:
✅ Point-of-sale system generates detailed transaction reports ✅ Sales tax collected and remitted properly ✅ Excise tax (if applicable) documented and paid ✅ Cash handling procedures documented ✅ Bank account statements reconciled ✅ IRS Form 1099 compliance for contractors ✅ 280E compliance documentation (COGS substantiation) ✅ Separate accounting for multiple license types ✅ Audit trail for all financial transactions ✅ Monthly financial statements prepared
Live Test Auditors Perform:
- Transaction trace: select random sale, verify tax calculation
- Cash count: verify cash on hand matches POS
- Bank reconciliation review: check for discrepancies
- 280E review: verify COGS documentation exists
IRS 280E Specific Documentation:
- Inventory capitalization schedules
- Direct vs indirect cost allocation
- COGS calculation worksheets
- Non-deductible expense separation
Common Violations:
- Incorrect sales tax rate applied
- Cash discrepancies (register vs POS)
- No documentation of cash handling
- Missing 1099s for contractors
- Poor 280E documentation (IRS audit risk)
Documentation You Need:
- POS transaction reports (daily, weekly, monthly)
- Sales tax filings (past 2 years)
- Cash handling logs
- Bank reconciliations (monthly, past year)
- 280E worksheets and tax returns
SECTION 8: Packaging, Labeling & Consumer Safety
What Auditors Check:
✅ All products in child-resistant, tamper-evident packaging ✅ Labels include all required information (varies by state) ✅ THC/CBD content accurately displayed ✅ Batch/lot numbers visible on packaging ✅ License number on all labels ✅ Required warnings present (pregnancy, driving, health risks) ✅ Exit packaging (opaque bags at point of sale) ✅ No false health claims ✅ No appeal to minors (colors, characters, etc.) ✅ Packaging test certificates on file
Live Test Auditors Perform:
- Random product inspection: verify all label elements
- Child-resistant test: attempt to open packaging
- Exit bag check: verify opaque, sealed
- Label accuracy: cross-reference with COA
State-Specific Label Requirements:
Required Element CA CO MI NV NY WA
License number ✅ ✅ ✅ ✅ ✅ ✅
THC/CBD content ✅ ✅ ✅ ✅ ✅ ✅
Batch number ✅ ✅ ✅ ✅ ✅ ✅
Net weight ✅ ✅ ✅ ✅ ✅ ✅
Production date ✅ ✅ ❌ ✅ ✅ ✅
Expiration date ✅ ❌ ❌ ❌ ✅ ❌
Allergens ✅ ✅ ✅ ✅ ✅ ✅
Government warnings ✅ ✅ ✅ ✅ ✅ ✅
Common Violations:
- Missing required label elements
- Incorrect THC content (doesn’t match COA)
- Non-child-resistant packaging
- No exit bags provided
- Appeal to minors (bright colors, candy-like)
Documentation You Need:
- Packaging supplier certificates (child-resistant compliance)
- Label templates (approved versions)
- COA-to-label verification process
- Exit bag inventory logs
The 90-Day Audit Preparation Timeline
Here’s the exact timeline we use with consulting clients to prepare for first audits:
90 Days Before Audit: Foundation Phase
Week 1-2:
- Conduct internal compliance assessment using this checklist
- Identify all gaps and violations
- Prioritize fixes by severity (license-threatening vs minor)
- Assign owners to each gap
Week 3-4:
- Document all SOPs (if not already done)
- Create compliance binder (organized by audit section)
- Schedule employee training sessions
- Order any missing security equipment
Week 5-6:
- Complete high-priority fixes (Metrc discrepancies, security gaps)
- Test surveillance system (verify footage retrieval)
- Audit employee agent cards (renew any expired)
- Review and update all licenses/permits
60 Days Before Audit: Documentation Phase
Week 7-8:
- Gather all COAs (past 12 months minimum)
- Organize waste disposal records
- Compile employee training logs
- Prepare financial documentation (280E worksheets)
Week 9-10:
- Create audit response team (who will interact with auditor)
- Conduct mock audit walkthrough
- Test emergency procedures
- Review and practice employee interview responses
Week 11-12:
- Address all medium-priority gaps
- Update inventory records (cycle count everything)
- Test Metrc sync and reconciliation
- Organize compliance binder by category
30 Days Before Audit: Refinement Phase
Week 13-14:
- Conduct second mock audit (have consultant or peer review)
- Address any new gaps identified
- Practice video footage retrieval
- Verify all documentation is accessible quickly
Week 15-16:
- Deep clean facility
- Repair any cosmetic issues (broken fixtures, etc.)
- Label all equipment and restricted areas clearly
- Conduct final employee training refresher
Week of Audit: Final Prep
Day Before:
- Print fresh copies of all critical documents
- Test all surveillance cameras
- Verify alarm system functional
- Conduct final inventory count and reconciliation
- Review employee talking points
Day Of:
- Arrive early, unlock facility
- Have coffee/water available for auditor
- Designate quiet workspace for auditor
- Assign one point person to accompany auditor
- Have compliance binder ready
How to Interact with the Auditor (The Do’s and Don’ts)
DO: ✅ Be professional and courteous ✅ Answer questions directly and concisely ✅ Provide requested documentation promptly ✅ Admit if you don’t know something (“Let me verify that for you”) ✅ Take notes on auditor feedback ✅ Ask clarifying questions if needed
DON’T: ❌ Volunteer information not requested ❌ Make excuses for violations ❌ Argue with the auditor ❌ Blame employees or vendors ❌ Claim “we’re working on it” (prove it or don’t mention it) ❌ Obstruct or delay the auditor
If the auditor finds a violation:
- Acknowledge it calmly
- Ask for specific corrective action needed
- Request timeline for remediation
- Document everything
Sample responses to violations:
- “Thank you for pointing that out. Can you specify the exact regulation this violates?”
- “What documentation would you need to see this corrected?”
- “What’s the timeline for submitting our corrective action plan?”
State-by-State Audit Focus Areas (2025-2026)
Each state prioritizes different compliance areas. Know what YOUR state cares most about:
California (DCC)
Top audit priorities:
- Metrc integration and inventory accuracy
- Testing compliance (COAs for all products)
- Video surveillance (90-day retention)
- Packaging and labeling
- Financial transparency (280E documentation)
Unique California requirements:
- Labor peace agreements (union organizing access)
- Consumer education brochure (new for 2025)
- 24-hour retention of all text messages related to business
Colorado (MED)
Top audit priorities:
- RFID tag compliance (all plants and packages)
- Environmental compliance (energy use reporting)
- Reduced testing allowance audit (80% compliance score)
- Packaging (SB24-76 new requirements as of Aug 2024)
- Security system functionality
Unique Colorado requirements:
- Environmental impact reporting (cultivation)
- Monthly surveillance equipment testing
- Dual age verification (door + register)
Michigan (CRA)
Top audit priorities:
- Track-and-trace accuracy (unannounced inspections now standard)
- Surveillance (30-day retention, fixed cameras)
- Employee agent cards
- Transportation manifests
- Social equity compliance (if applicable)
Unique Michigan requirements:
- Permanently mounted cameras (no adjustable)
- State police background checks
- Unannounced inspections (24-48 hour notice)
Nevada (CCB)
Top audit priorities:
- Video surveillance (90-day retention)
- Inventory accuracy (zero-tolerance for discrepancies)
- Laboratory testing compliance
- Packaging/labeling (NIST Handbook 130 standards)
- Cash handling procedures
Unique Nevada requirements:
- Facial recognition capable cameras
- 15% wholesale tax + 10% retail tax documentation
- Strict cash handling logs
New York (OCM)
Top audit priorities:
- BioTrack integration (mandatory as of Jan 2025)
- Social equity compliance
- Packaging (no medical claims allowed)
- Laboratory testing (OCM-permitted labs only)
- Labor peace agreements
Unique New York requirements:
- Integration with BioTrack completed by Jan 2025
- Social equity compliance documentation
- No medical/health claims on any packaging
What Happens If You Fail the Audit
Let’s be honest: some violations are inevitable during first audits. Here’s what happens:
Minor Violations (Non-Critical)
Examples: Expired employee training, minor labeling errors, documentation formatting issues
Consequence:
- Written notice of violation
- 30-60 day corrective action period
- Follow-up documentation submission (no re-inspection)
- Typically no fine for first occurrence
Your action plan:
- Acknowledge violation in writing within 10 days
- Submit corrective action plan
- Implement fixes
- Document completion with photos/evidence
- Submit proof of correction before deadline
Major Violations (Critical)
Examples: Inventory discrepancies >10%, failed product sold, unlicensed employees, surveillance failures
Consequence:
- Formal violation notice
- $5,000-$52,500 penalty (varies by state)
- 15-30 day corrective action period
- Follow-up inspection required
- License probation possible
Your action plan:
- Hire attorney/consultant immediately
- Submit detailed corrective action plan within 10 days
- Implement fixes with third-party verification
- Prepare for follow-up inspection
- Document EVERYTHING
License-Threatening Violations
Examples: Sale to minors, diversion (untracked sales), serious security breach, operating outside license scope
Consequence:
- Immediate license suspension possible
- $50,000+ penalties
- Criminal investigation possible
- Emergency hearing before state board
- License revocation risk
Your action plan:
- Hire attorney IMMEDIATELY (do not respond without counsel)
- Cease operations if ordered
- Cooperate fully with investigation
- Prepare for administrative hearing
- Consider settlement negotiations
The Post-Audit Checklist
Within 24 hours:
- Review auditor notes/report
- Document all findings
- Schedule team debrief meeting
- Identify immediate corrective actions needed
Within 7 days:
- Submit acknowledgment of findings (if required)
- Begin implementing corrective actions
- Update SOPs based on feedback
- Schedule employee training on findings
Within 30 days:
- Complete all corrective actions
- Submit proof of correction to state
- Update compliance documentation
- Schedule internal re-audit to verify fixes
Within 90 days:
- Conduct full internal compliance review
- Update audit preparation materials
- Schedule next mock audit
- Review and improve processes
Tools & Resources for Audit Preparation
Software We Recommend:
Inventory Management:
- Metrc API integration tools: Dutchie, Flowhub, Treez
- Alternative tracking: DistroSec, Canix, Confident Cannabis
Compliance Documentation:
- Document management: Google Drive (with proper access controls), Dropbox Business
- Training management: Ving, TrainingKeeper
- SOP software: Whale, Trainual
Surveillance:
- Enterprise systems: Genetec, Milestone XProtect
- Cannabis-specific: Safe and Sound Security, Cure8
Professional Services:
When to hire help:
- First-time annual license transition
- History of violations
- Complex multi-state operations
- Post-violation corrective action needed
What to expect:
- Pre-audit assessment: $2,500-$5,000
- Full audit prep: $5,000-$15,000
- Mock audit: $1,500-$3,000
- Post-violation remediation: $5,000-$25,000
Final Thoughts: Audit Mindset
The #1 mistake first-time operators make: Treating audits as a one-time event instead of ongoing compliance.
The truth: Cannabis compliance isn’t something you “prepare for” before an audit. It’s something you maintain continuously.
The operators who pass audits with zero findings:
- Conduct monthly internal audits
- Treat every day like audit day
- Document everything in real-time
- Train staff continuously
- Fix violations immediately (don’t let them accumulate)
Your audit isn’t a test you’re trying to pass. It’s a verification of your daily operating standards.
If you maintain those standards, audits become routine.
Need Help? We’ve Got You Covered.
CannaSecure Dispensary Members get:
✅ 50-state audit preparation checklists (state-specific requirements) ✅ Audit response templates (corrective action plans, violation responses) ✅ Monthly compliance updates (regulation changes, new requirements) ✅ Private Discord community (ask real-time questions, learn from others) ✅ Mock audit walkthroughs (video guides showing what auditors check) ✅ SOP templates (36 ready-to-customize procedures)
Upgrade to MSP/Enterprise for:
✅ White-label audit prep services (for your clients) ✅ Monthly strategy calls (discuss specific audit situations) ✅ Priority support (24-hour response time)
Not a member yet? Start your 7-day free trial.
Related Resources:
- Your Cannabis POS System is a Ticking Time Bomb
- Metrc Security Mistakes That Cost Dispensaries $50K+
- The Real Cost of a Cannabis Data Breach
- State-by-State Compliance Guide (Interactive Tool)
## Sign up for Canna Secure
Protecting Cannabis Businesses from Breaches & Audit Failures
Subscribe
.nc-loop-dots-4-24-icon-o{--animation-duration:0.8s}
.nc-loop-dots-4-24-icon-o *{opacity:.4;transform:scale(.75);animation:nc-loop-dots-4-anim var(--animation-duration) infinite}
.nc-loop-dots-4-24-icon-o :nth-child(1){transform-origin:4px 12px;animation-delay:-.3s;animation-delay:calc(var(--animation-duration)/-2.666)}
.nc-loop-dots-4-24-icon-o :nth-child(2){transform-origin:12px 12px;animation-delay:-.15s;animation-delay:calc(var(--animation-duration)/-5.333)}
.nc-loop-dots-4-24-icon-o :nth-child(3){transform-origin:20px 12px}
@keyframes nc-loop-dots-4-anim{0%,100%{opacity:.4;transform:scale(.75)}50%{opacity:1;transform:scale(1)}}
Email sent! Check your inbox to complete your signup.
No spam. Unsubscribe anytime.



