Cannabis Compliance Checklist

Scope. This is the 60-item quarterly compliance checklist we use internally for retained clients, adapted for self-audit. Run through it once per quarter. Every red or amber item gets a named owner and a fix-by date. Based on CCR Title 4, §§ 15000–17905 current as of January 1, 2026.

A quarterly run takes a compliance lead 4–6 hours. It is the single highest-leverage use of compliance time in the year.

Severity scoring — how to triage

Not every amber is equal. Use this severity matrix to prioritize remediation:

Quadrant 1: Licensing & disclosure

1. Current DCC license status verified in the public licensee database.
2. Every Owner under BPC § 26001(al) still accurately reflected on the licensee’s record; any post-issuance ownership change filed on Form DCC-LIC-027 within 14 calendar days under CCR § 15023.
3. Every Financial Interest Holder disclosed on Form DCC-LIC-021 under CCR § 15004 (new loans, new percentage-rent landlords, new profit-share investors).
4. Any material change in the last 14 calendar days filed under CCR § 15023.
5. Local authorization still current; any local renewal or modification filed.
6. Landowner’s written consent to commercial cannabis activity still current; lease in good standing.
7. $5,000 surety bond per premises (CCR § 15310) current and on file with DCC for every license type.
8. General liability and cannabis-specific insurance current under CCR § 15308.
9. Labor Peace Agreement (Form DCC-LIC-016) current if non-supervisory employee count is 10+ (threshold lowered from 20 to 10 effective July 1, 2024 under AB 2799).
10. Seller’s permit (CDTFA) and local cannabis business license current.

Quadrant 2: Records & METRC

11. METRC variance monitor run monthly; last cycle variance under 2%.
12. Inbound transfer manifests reconciled against physical receiving.
13. Outbound transfer manifests reconciled against retailer receipts.
14. Loss and destruction records (CCR 15048) reconciled to METRC destruction events.
15. All batch records retained under CCR 15037 (7 years).
16. CDTFA excise reconciled quarterly; remittance current.
17. Document control system in place; current SOP revision accessible.
18. Training records current for all staff on applicable SOPs.
19. COA archive organized; every potency claim traceable in ≤15 minutes.
20. Recall SOP documented; mock recall drill conducted in last 12 months.

Quadrant 3: Security & premises

21. Camera coverage verified against CCR 15044–15047 camera plan.
22. Video retention verified: 90+ days at 15+ FPS / 1280x720 minimum.
23. Alarm system tested in last 90 days.
24. Limited-access area controls tested; badge/key inventory audited.
25. Vault access logged and dual-control enforced.
26. Premises diagram (CCR 15006) matches physical layout; no undocumented modifications.
27. Perimeter secure: lights, locks, signage per CCR 15044.
28. Fire suppression current; fire marshal inspection log current (Type 7).
29. Air-quality permit current (Type 7).
30. CEQA determination current for annual licensees.

Quadrant 4: Operations & staff

31. Form DCC-LIC-019 SOPs current; revision log up to date.
32. Deviation log reviewed; any open deviations with named owner.
33. CAPA procedure documented; any open CAPAs tracked.
34. Staff ID-verification practices validated (retail).
35. Age-verification log current; CCR 15409 daily-limit tracking active (retail).
36. Delivery SOPs active: vehicle checklist, manifest, route logs (Type 10 NS, Type 13).
37. Manufacturing process validation (IQ/OQ/PQ) documented.
38. Supplier approval program active; incoming COA audit log current.
39. Cross-contact / allergen controls in place (shared-use kitchens).
40. Cannabis waste disposal protocol (CCR 15048 / BPC 26069) current; waste log audited.

How to use this checklist

Run through once per quarter with your compliance lead. Score each item green (in place), amber (partial or at-risk), or red (gap). Every amber or red gets a named owner and a fix-by date. Most operators find 10–15 amber items on the first pass. The goal is zero red, trending amber to green.

Worked example — a mid-size Type 10 retailer

A Sacramento Type 10 storefront with $6.2M in annual gross receipts, 14 FTEs, and a single premises runs the quarterly pass and surfaces the following findings:

• Red (2). Item 3: a new $400K working-capital loan funded last month was not disclosed under CCR § 15004 (48-hour fix-by — file disclosure and board minutes). Item 22: DVR retention dropped to 71 days after a storage-pool fault (48-hour fix-by — reconfigure pool and validate retention).
• Amber (11). Six SOP revisions stale beyond the annual review cycle; two training records overdue; one mock-recall drill not run in the last 12 months; three visitor-log format gaps.
• Green (27). Balance of items in place.

Outcome: both reds closed within 48 hours. Nine ambers closed inside 30 days; two rolled to the next quarter with a documented fix-by. Year-over-year, the same operator reduces first-pass ambers from 13 to 4 once the cadence takes hold.