METRC variance,
before it becomes a finding.

METRC reconciliation breaks cleanly into four operational areas. These are our named responsibilities — not a spreadsheet export, not a “quick check,” not a supervisor sign-off on someone else's count. Where we own, we walk, reconcile, trace, and remediate. Where you own, we coordinate but operational decisions stay with the business.

Escalation path

When reconciliation surfaces variance that may rise to a voluntary-disclosure decision, a possible diversion finding, a CDTFA excise-reconciliation exposure, or defense of an existing DCC accusation, we coordinate with your counsel or introduce one from our retained network. The engagement letter names this boundary. We do not practice law, and we do not drive disclosure decisions.

How we draw the boundary with you

You own: inventory management, sales cadence, POS and ERP selection, hiring and personnel action, and any business decisions about how to respond to a finding. We own: the four areas above. Where a finding is material and a decision is yours, we brief verbally before we document so you decide with full information — the disclosure path, the HR action, the CDTFA true-up — not after a written record has been committed.

What’s explicitly out of scope

Direct METRC data entry, POS or ERP integration implementation, CDTFA excise-tax dispute representation, Cal/OSHA work arising from warehouse findings, and any criminal or civil litigation from a diversion finding are not within the scope of this engagement. Those are specialist fields with their own practitioners. Where one is needed, we flag it and route to the right specialist from our network.

The engagement runs through five named milestones over seven business days. METRC reconciliation is forensic work — physical inventory walked, package records reconciled, manifests audited, destruction events verified, and every variance traced to a named root cause. DCC uses METRC as the system of record under CCR 15036; CDTFA uses the same data to reconcile excise tax. Getting it right keeps both agencies off your desk.

Milestones, in detail

• Day 1 — On-site physical walk. An analyst walks the site with a scanner and a printed package list. Every shelf, every safe, every transit cage, every vault location inventoried. Each physical item matched against a METRC tag. Untagged product, ghost tags (ledger entries with no physical counterpart), and tags with wrong location assignment each photographed and logged with a location note. No sampling — the walk is comprehensive for the license type and scope.
• Day 2–3 — Package reconciliation. Every open package in METRC reconciled against the physical walk from Day 1. Weight, form, strain, source harvest batch each verified. Variance flagged by magnitude (under 1%, 1–2%, over 2%) and categorized by root cause. Each package UID exported with tag status and variance column so findings are traceable tag by tag, not shelf by shelf.
• Day 4 — Manifest and loss audit. Every inbound and outbound transfer manifest within the reconciliation window audited against METRC records and CCR 15307 chain-of-custody requirements. Mis-keyed weights, late departures, missing driver sign-offs, unreversed rejected transfers each flagged with the specific manifest number. Concurrently, CCR 15048 waste and destruction records reconciled against METRC destruction events: timing, witness signatures, disposal method, 72-hour notice each verified.
• Day 5 — Root-cause analysis. Every flagged variance traced to one of four root causes: SOP drift (the procedure was followed but is wrong), training gap (the procedure is right but wasn’t followed), tooling failure (POS-to-METRC auto-deduct misfire, ERP integration timing, Franwell API batch failure on Flowhub / Dutchie / Distru / Treez), or intent (the residual category requiring its own investigation). Each cause carries a specific remediation path.
• Day 7 — Findings and remediation. Variance report finalized, Form DCC-LIC-019 SOP revisions drafted, retraining memo issued, tooling recommendations specified, and a formal CAPA drafted for any material variance. Where variance rises to a voluntary-disclosure decision, we brief you verbally first; the disclosure path is yours in coordination with counsel. We produce the underlying record.

Duration and rhythm

A standard single-site reconciliation runs five to seven business days from walk to findings. Multi-site operators (distribution + retail, cultivation + manufacturing) run 10–14 business days on a coordinated cadence. Quarterly cadence for most operators; monthly for high-volume distribution; on-demand for any triggering event (notice of inspection, observed discrepancy, pre-diligence).

Who you work with each phase

A named principal owns the engagement and signs the findings report. An on-site analyst walks physical inventory and drives package reconciliation. Your floor team (inventory manager, distribution lead, compliance coordinator) coordinates scanner access and SOP document production. Your IT or ERP contact coordinates on tooling variance where integration is the root cause. Retained counsel is looped in only if a variance rises to voluntary-disclosure territory.

When this reconciliation cycle closes, you’ll have a specific set of variance reports, manifest audits, destruction reconciliations, SOP revisions, and a forensic archive that answers any regulator, auditor, or diligence team cold. These are not summary spreadsheets. They are package-level reconciliations tied to physical count, manifest audits tied to driver sign-offs, waste reconciliations tied to timestamped destruction events, and a documented remediation log retained under CCR 15037.

The ten outputs, in detail

• Package-level variance report. Every open package in METRC reconciled against physical inventory — weight, form, strain, source harvest batch. Variance flagged by magnitude (under 1%, 1–2%, over 2%) and categorized by root cause. Report exported with each package UID, tag status, and variance column so findings are traceable tag by tag. Typical length: package count plus a two-page executive memo.
• Transfer manifest review. Every inbound and outbound transfer manifest within the reconciliation window audited against METRC records and CCR 15307 chain-of-custody requirements. Mis-keyed weights, late departures, missing driver sign-offs, and unreversed rejected transfers flagged with the specific manifest number. Retrospective scope extends back to METRC activation where the engagement is remediation-driven.
• Loss & destruction audit. CCR 15048 waste records reconciled against destruction events in METRC. Destruction timing (event-level vs. batched), witness signatures, disposal method, and 72-hour-notice compliance each verified. Untagged waste, late destructions, and missing witnesses flagged with the specific event date so the remediation is event-specific, not policy-level.
• Physical inventory walk. An on-site walk with a scanner and a printed package list. Every shelf, every safe, every transit cage, every vault location inventoried. Each physical item matched against a METRC tag. Untagged product, ghost tags (ledger entries with no physical counterpart), and tags with wrong location assignment identified with a photograph and a location note.
• SOP drift analysis. Where variance traces to SOP drift, the specific SOP step is called out — the re-weigh skip, the unit-of-measure swap, the post-sale package close. The Form DCC-LIC-019 SOP is revised, version-stamped, and posted to the vault with a retention date aligned to CCR 15037. The prior version is archived so the diff is documented.
• Team retraining. Floor team retraining on the specific procedures that caused the variance — not a generic “METRC training,” but a targeted session on the SOP steps that drifted. Attendance logged, retraining memo signed, re-competency verified on the next cycle so the retrain is measurable, not ceremonial.
• Tooling recommendations. Where variance is technical (POS-to-METRC auto-deduct misfires, ERP integration timing, Franwell API batch failures on Flowhub / Dutchie / Distru / Treez), the integration adjustment is specified with the exact field, endpoint, or sync cadence that needs to change. We don't write the integration; we specify what the integration team needs to do.
• Formal corrective action. Where variance is material, a formal CAPA is drafted: root-cause analysis, corrective action, preventive action, responsible party, and verification date. Filed internally, archived, and carried forward to the next cycle to verify the fix held. Where the variance rises to a voluntary-disclosure decision, you and counsel drive the disclosure; we produce the underlying record.
• Monthly variance monitor. A monthly check-in on variance trend between full reconciliations — package-count drift, manifest-error rate, waste-timing compliance — so the quarterly reconciliation isn't the first time a drift is seen. Delivered as a one-page dashboard against the prior quarter's baseline.
• Board-ready report. A one-page variance report sized for board or investor review: quarter's variance percentage, trend against trailing four quarters, top three root-cause categories, remediation status, and forward outlook. Signed, dated, and stored with the operator's other regulatory reporting.

Format and delivery

Every document is delivered as both an editable source (Word, Pages, or Excel) and a final PDF with your approvals. Raw reconciliation data is delivered as CSV for your own archive. File naming follows a consistent convention so the METRC archive stays auditable cycle over cycle. All reconciliation records retained for 7 years per CCR 15037 and for the life of the engagement under our retention policy.

Defensibility anchor

Every recommendation cites a specific regulation. If DCC field staff asks “why did you reclassify this variance?” or CDTFA asks “what supports this excise reconciliation?” the answer is in the document. CCR 15048 for waste and destruction. CCR 15307 for transfer-manifest chain of custody. CCR 15037 for records retention. The Franwell-operated METRC tag system as DCC's designated track-and-trace of record. CDTFA excise mechanics that use METRC as source of truth.

What’s not included

Direct METRC data entry, POS or ERP integration implementation, defense of an existing DCC accusation, CDTFA excise-tax dispute representation, and any criminal or civil litigation arising from a diversion finding are explicitly outside this scope. Where those are needed, we coordinate with your IT team, your retained counsel, or introduce a specialist from our network. The engagement letter names this boundary.

Deliverables are what we produce. Outcomes are what those deliverables enable — the specific operational benefits of METRC reconciliation done right. METRC is the system of record for California track-and-trace; variance is a signal, not a statistic, and operators who treat it that way stay out of enforcement.

The ten outcomes, in detail

• Inside the practical variance tolerance cycle after cycle. Well-run operations stay under 1% aggregate variance; above 2% triggers a DCC pull of the package ledger, manifests, and CCR 15048 destruction log for the year under CCR 15036 authority; above 3% is a finding. Our engagements typically close with post-remediation variance below 0.5%, with the trend documented quarterly so the next renewal review opens against a clean record. The number is the headline; the explainability behind it is what survives an inspection.
• Every variance traced to a named root cause. SOP drift, training gap, tooling failure, or intent — the four categories that exhaust the universe of explanations. No variance is left unexplained in the findings report, which means no variance is left unremediated cycle to cycle. The named cause carries a remediation owner and a verification date so the fix is audited the next pass, not filed and forgotten.
• Clean manifest record. Every CCR 15307 chain-of-custody manifest reconciled against the METRC GET /transfers/v2/incoming, /outgoing, and /rejected endpoints. Mis-keyed weights, late departures, missing driver sign-offs, and unreversed rejections each resolved with the specific manifest number on the record. For distributors operating the hub model under CCR 15311, the four-event sequence (arrive, check-in, check-out, depart) is reconstructed leg by leg so dwell times defend the QA narrative. Clean manifests keep CDTFA excise audits off the desk.
• CCR 15048 waste compliance. Every destruction event paired with the correct METRC adjustment (PUT /packages/v2/adjust with the Mandatory State Destruction reason code), the 72-hour-notice evidence, witness signatures, and disposal-method record. Waste is the single most common audit finding precisely because every element is documentation-heavy and operators treat it as a back-office task rather than a regulatory event. Where waste is commingled across categories or batched for operational convenience, the practice is documented against the regulation and the exposure is flagged before DCC sees it.
• CDTFA excise reconciled. METRC sales-receipt and transfer data aligned with the CDTFA excise filings under the 15% gross-receipts framework that AB 564 sets through June 30, 2028. Mismatches between track-and-trace and tax reporting are the fastest way to draw a CDTFA audit, because the agency uses METRC as its primary cross-check. Reconciliation closes the gap before filing season and gives the tax preparer or CFO a defensible reconciliation memo to attach to the return.
• POS-to-METRC integration stabilized. Where variance traces to the integration layer — Flowhub, Dutchie, Distru, Treez, or any other Franwell-connected platform — the specific adjustment is specified down to the field, the endpoint (POST /sales/v2/receipts, PUT /packages/v2/adjust, the webhook event subscription), and the sync window. Your IT team or ERP vendor makes the change; we hand over the written specification with the regulation citation. The variance stops recurring on the next cycle, which is what separates a one-time clean from a stable trendline.
• Floor team retrained on specifics. Not generic “METRC training,” but targeted retraining on the exact Form DCC-LIC-019 SOP steps that drifted — the re-weigh skip, the unit-of-measure swap, the post-sale package close. Attendance is logged, the retraining memo is signed, and re-competency is verified on the next cycle so the retrain is measurable rather than ceremonial. The retraining record sits in the vault under CCR 15037 with the SOP version it remediates.
• Formal CAPA on material variance. Where variance is material, a Form DCC-LIC-017 Corrective Action Plan is drafted: root-cause analysis, corrective action, preventive action, responsible party, and verification date. Carried forward to the next cycle to verify the fix held rather than filed and forgotten. Where the variance rises to a voluntary-disclosure decision under BPC 26031, you and counsel drive the disclosure path; we produce the underlying record.
• Diligence-ready archive. Quarterly variance history, remediation records, CAPA closures, retraining logs, and SOP version diffs — the forensic record an acquirer’s diligence team needs to clear track-and-trace risk. Acquirers price track-and-trace exposure into the deal; a documented reconciliation history strengthens the M&A position rather than discounting it. The same archive answers a CDTFA inquiry, a Form DCC-LIC-027 ownership-change review, and a renewal-window challenge.
• Inspection-ready on 24-hour notice. The reconciliation archive plus the current-cycle dashboard mean a DCC unannounced inspection lands on an operation that can produce a clean record in minutes rather than scrambling through emails. CCR 15048 destruction logs, CCR 15307 manifest reconciliations, and the package-level variance export are each retrievable from the vault by date and form number. Inspectors who get clean answers to their first three questions typically close the visit shorter than they planned.

How we measure

Three quantitative measures: (1) post-reconciliation variance percentage — target under 1%; (2) manifest error rate — target under 0.5% of transfers; (3) waste-timing compliance on 72-hour notice — target 100%. Reported in the findings memo and trended cycle over cycle.

Post-engagement review

Thirty days after findings delivery, a written verification memo: corrective actions audited, preventive actions observed, retraining attendance logged, tooling changes tested. The memo closes the CAPA loop and seeds the next reconciliation’s baseline. If you’re on retainer, the monthly variance monitor keeps the trend visible between full reconciliations.

When DCC asks “why did you reclassify this variance?” we cite the regulation. When CDTFA asks “what supports this excise reconciliation?” we cite the CCR section and the corresponding METRC v2 endpoint. When counsel asks whether a finding rises to a voluntary-disclosure event, the regulatory chain — tag → package → manifest → destruction → retention — is documented in full. METRC reconciliation rests on four overlapping authority layers: California statute (BPC Division 10), DCC operational regulation (CCR Title 4 Division 19), DCC forms, and the METRC v2 REST API itself.

BPC statutes

• BPC 26067 — Track-and-trace program. The MAUCRSA statute that establishes California’s mandatory track-and-trace system and authorizes DCC to designate the platform. Every variance ultimately resolves back to this section because it is what makes track-and-trace a non-discretionary obligation rather than a best practice.
• BPC 26031 — Disciplinary action and self-disclosure. Authorizes DCC to discipline licensees and frames self-reported, remediated violations as a mitigating factor under the September 2021 Disciplinary Guidelines. The reason a documented CAPA on a found variance is materially better than a discovered variance with no record.
• BPC 26069 — Cannabis waste. The statutory authority for the waste-and-destruction regime that CCR 15048 implements. Requires that cannabis waste be rendered unusable and unrecognizable before disposal — the legal floor under every destruction event.

CCR Title 4 Division 19 (DCC operational rules)

• CCR 15036 — Track-and-trace system of record. Designates METRC, operated by Franwell under contract to DCC, as the system of record for all commercial cannabis activity in California. Every movement, package, transfer, and destruction event must be reflected in METRC. This is the regulation that turns a spreadsheet variance into a compliance issue — because METRC is the record, not the inventory system or the POS.
• CCR 15046 — Track-and-trace user requirements. Specifies who must hold a METRC user account, what training is required before account activation, and the duty to record every reportable event. Drift patterns that individually read as noise compound into a CCR 15046 citation pattern at annual renewal audit.
• CCR 15048 — Waste and destruction. Requires 72-hour notice to DCC prior to destruction, witness signatures, documented disposal method, and specific waste-render methods (grinding with mineral oil, saturation with non-cannabis solid waste at a 50/50 ratio, or equivalent). Waste is the single most common audit finding precisely because every element is documentation-heavy.
• CCR 15307 — Transfer manifest chain of custody. Specifies the information required on every manifest: origin, destination, license numbers, driver identity, vehicle, route, planned departure and arrival times, and sign-offs at each leg. Mis-keyed weights and missing driver sign-offs are the two most common manifest defects and the two most common CDTFA excise-audit triggers.
• CCR 15311 — Distributor transportation. Governs the distributor hub model that California uses to gate wholesale cannabis through QA before retail handoff. Hub dwell-time anomalies, missing arrive/check-in/check-out/depart events, and sub-90-second hub passes each surface as variance under this section.
• CCR 15037 — Records retention. Requires seven-year retention of all records related to commercial cannabis activity. Governs how long reconciliation records, CAPAs, SOP versions, and the underlying METRC export must be held; our vault retention is set to indefinite rather than the seven-year minimum.

DCC forms

• Form DCC-LIC-019 — Consolidated Standard Operating Procedures. The SOP package that includes the inventory-reconciliation, METRC user, transportation, waste-destruction, and recordkeeping procedures. Where reconciliation surfaces SOP drift, this is the form we revise and version-stamp before the next cycle.
• Form DCC-LIC-017 — Corrective Action Plan. Required where a Notice to Comply or other DCC finding lands. Where a reconciliation finding rises to a CAPA-requiring event, this is the form that frames the corrective action, preventive action, responsible party, and verification date.
• Form DCC-LIC-027 — Notifications and Modifications. The post-issuance form for premises, ownership, DRP, and license-type changes. Reconciliation that surfaces a premises-diagram mismatch or an undisclosed sublocation routes through this form rather than the application portal.

METRC v2 API resources

• Packages — GET /packages/v2/active, /onhold, /inactive, /intransit; PUT /packages/v2/adjust. The endpoint family every reconciliation reads from and writes to. The /adjust call carries the AdjustmentReason enum (Moisture Loss, Theft, Mandatory State Destruction, Entered in Error, Scale Variance) that categorizes every variance event in the audit trail.
• Sales receipts — POST /sales/v2/receipts. The 24-hour reporting endpoint for retail transactions. Late receipts, duplicate ExternalNumber posts, and post-sale package-state mismatches are surfaced here. The single most time-sensitive METRC workflow under CCR 15036.
• Transfers — GET /transfers/v2/incoming, /outgoing, /rejected; GET /transfers/v2/manifest/{id}/pdf. The endpoint family that exposes the chain-of-custody record under CCR 15307. The /rejected endpoint is where transfer-bounce patterns — a possible diversion signal — first appear.
• Hub operations — POST /transfers/v2/hub/arrive, /checkin, /checkout, /depart. The four-event sequence that records each leg of the distributor hub model under CCR 15311. Sub-minute dwell times between arrive and checkout are reviewed for genuine QA performance.
• Webhooks — POST /webhooks/v2/. Push notifications for packages.adjusted, transfers.rejected, and labtests.results.failed. The infrastructure that lets a monthly variance monitor see drift in near real time rather than waiting on quarterly polls.

How the authorities interact

METRC reconciliation is a two-agency problem: DCC uses METRC as the system of record under CCR 15036, and CDTFA uses the same data to reconcile cannabis excise tax under AB 195 / AB 564 mechanics. Waste under CCR 15048, manifests under CCR 15307, distributor hubs under CCR 15311, and records retention under CCR 15037 are the four most-audited data categories — each resolves to specific METRC v2 endpoints (packages/v2/adjust for waste, transfers/v2/* for manifests, transfers/v2/hub/* for distribution, with the seven-year archive sitting outside the API in your vault). The DCC-LIC-019 SOP, DCC-LIC-017 CAPA, and DCC-LIC-027 modification forms are the documentation layer that closes the loop between a finding, a remediation, and a regulatory commitment. A variance in any one of the four authority layers propagates through to both agencies — which is why a single quarterly reconciliation serves two masters and why citation discipline at the document level pays dividends across the renewal cycle, the CDTFA filing, and any M&A diligence.

Scope, pricing, timelines, edge cases — the questions operators actually ask about METRC reconciliation, with specifics rather than deflections.

• What’s a typical variance percentage? Well-run operations stay under 1%. Variance in the 1–2% band is worth investigating but not a crisis. Over 2% is notable; over 3% is a finding that triggers formal investigation if DCC sees it first. Our post-remediation engagements typically close below 0.5%. The number alone doesn’t matter as much as the trend and the explainability.
• Do you integrate with Flowhub / Dutchie / Distru / Treez? We audit across all major cannabis ERPs and POS systems. Full integration work — writing API calls, changing ERP configuration, deploying new sync cadences — is handled by your IT team or the ERP vendor. We specify what needs to happen: which field, which endpoint, which sync window. Clear handoff, documented in the findings report.
• What if variance is large? We brief you verbally first, before the written report issues. Material variance can rise to voluntary-disclosure territory under DCC’s disciplinary guidelines; the disclosure decision is yours in coordination with retained counsel. We produce the underlying record — the package-level variance, the manifest defects, the destruction discrepancies — that supports whatever path you and counsel choose. CCR 15048 waste variance over 2% typically warrants immediate internal review.
• Can you audit manifests historically? Yes — retrospective manifest audit going back to your METRC activation date. Standard engagements cover the prior four quarters; remediation-driven engagements (post-inspection, pre-diligence, post-audit) cover whatever window the triggering event requires. CCR 15037 requires seven-year retention, so the data is available.
• How often should this run? Quarterly for most operators, monthly for high-volume distribution, on-demand for any triggering event (DCC notice, observed discrepancy, pre-diligence, post-inspection, excise audit). Retail-only operators can run semi-annually if variance is consistently under 0.5%; manufacturers with complex conversions (flower-to-extract, extract-to-product) typically run monthly.
• What’s the relationship between METRC and CDTFA? CDTFA uses METRC data to reconcile cannabis excise-tax filings. Mismatches between METRC transfers and excise returns are the fastest way to draw a CDTFA audit. Reconciliation closes the gap — and in practice we coordinate with your tax preparer or CFO to verify the alignment.
• What about CCR 15048 waste specifically? 72-hour notice to DCC before destruction; witness signatures; documented disposal method (grinding with mineral oil, fire-ash saturation, or equivalent); timestamped METRC action. Waste is the single most common audit finding precisely because every element is documentation-heavy. Our engagements typically surface 3–8 waste-record defects on a first-cycle retail operation.
• Can you do this remotely? Partially. The physical walk on Day 1 requires on-site presence — scanner in hand, package list in hand, shelves to walk. Package reconciliation, manifest audit, loss audit, and root-cause analysis all run remotely from our side once the walk is complete. For multi-site operators, we coordinate cadenced on-site walks with remote reconciliation.
• How much does this cost? $3,500–$12,000 per cycle depending on license type, site count, and scope. Single-site retail on a quarterly cadence lands near the bottom; multi-site distribution + manufacturing on monthly cadence lands near the top. Remediation-driven engagements (post-DCC notice) carry an urgency premium.
• What happens if DCC finds a variance first? The finding enters the formal disciplinary track under DCC’s guidelines. A proactive reconciliation with a CAPA already on file is materially better than a discovered variance with no record — which is why most operators run reconciliation on cadence rather than waiting for inspection.