What Cannabis Businesses Can Expect with Regulatory Audits | RizePoint

Using QMS Software to Prepare for and Comply with Cannabis Regulatory Audits

The cannabis industry can feel like the Wild West as more states legalize recreational and medicinal marijuana. But if entrepreneurs want to capitalize on this growing industry, they’ll need to comply with state and federal regulations in order to obtain and maintain their business license.

Every state has its own way of regulating the cannabis industry. Cannabis businesses will need to provide regulators with detailed records regarding all aspects of their operations before they’re allowed to sell marijuana-related products to the public. Once a license has been issued, the company will need to prepare for regulatory audits that ensure the company is complying with the law. If these businesses aren’t prepared to comply with state and federal regulations, they could face costly fines or see their licenses revoked, which involves a lengthy appeals process.

As exciting as this new industry can be, cannabis companies need to prepare for several different types of regulatory audits by keeping up-to-date records and ensuring supplier quality compliance.

Different Types of Regulatory Audits

Cannabis Audits

Cannabis businesses may be audited before, during, and after they’ve received their business license. These audits are designed to ensure the company is complying with state and federal tax regulations, consumer protection laws, and food and safety regulations. Here are some of the most common regulatory audits in the cannabis industry.

  • Pre-Licensing Audit

Cannabis companies may be audited before receiving their official business license. The company will need to demonstrate to auditors that they have complied with state and federal regulations, including verification of relevant forms and documentation, a thorough record-keeping system, and basic security measures.

    • Introductory Audit


Once a license has been issued, companies may be subject to an introductory audit, which takes place when the business is ready to begin cultivation. In addition to maintaining their business records, cannabis companies will also need to implement a robust quality management system to ensure fair, transparent production practices as well as secure transportation of its products.

  • Pre-Sales Audit

Before the company can open its doors and sell its products to the public, it may be subject to a pre-sales audit. This will include verification of the company’s compliance with federal and state laws regarding testing, product packaging, and labeling to ensure products are suited for consumption. It may also include auditing against government rules for point-of-sale procedures.

  • Federal Regulatory Audits

Companies may face additional audits from the Internal Revenue Service regarding the company’s finances. Cannabis businesses that sell edibles to the public will also be subject to regulations by the FDA, including those outlined in the Food Safety Modernization Act (FSMA).

What Regulatory Audits Typically Include

Cannabis Quality Management

Auditors will need access to the company’s businesses records, including sales, inventory management, purchases, taxes, employment records, supplier quality compliance, environmental compliance, and legal and transportation documentation. Regulators will notify a business by mail that it is under audit. The letter will include a list of all relevant information the business will need to provide regulators. Auditors may also need access to the physical location of the business to ensure proper product labeling, adequate security measures, and product quality compliance.

As soon as a company receives a letter notifying them of an audit, they should start organizing and retrieving a copy of all relevant records as soon as possible. If companies produce edibles, it’s also important to note that under the FSMA rule, they may have as little as 48 hours to return comprehensive information to the FDA.

How to Prepare for a Regulatory Audit

Cannabis Auditors

To ensure compliance with all state and federal regulations, business owners in the cannabis industry should err on the side of caution and get in the habit of keeping their records as detailed as possible. In addition to keeping a master log of all the company’s records, businesses will also need to keep all source documentation, including transaction-level receipts, invoices, and bank statements with individual check and deposit slip details. Any individual record verifying a purchase should be logged in a master records system. If these systems are missing any supplementary information, it could lead to a costly fine or a revoked business license.

Cannabis companies can prepare for regulatory audits by keeping a thorough digital records system that incorporates all relevant documentation. This makes it easier for these companies to manage and update their records. Creating a single source of truth for all compliance data will simplify the data collection process.

Business owners and their employees can use a quality management software solution with cloud storage to quickly upload compliance documents and data to the records system from any location, including product specifications, supplier audits and certifications, invoices, and other relevant information for regulators. Some digital quality management tools also help workers do self-assessments for on-the-job training. This way workers can quickly correct any inconsistencies on the spot in order to stop issues from becoming bigger problems, which ultimately saves money and reduces risk.

Companies may also want to invest in third-party audits, so they can spot any weaknesses in their records before the official audit begins. Using third party auditors can help provide guidance in a burgeoning market. This will ultimately help companies avoid fines or a revoked license by making sure all of their records comply with regulatory standards.

As the cannabis industry continues to grow and evolve, business owners will need to do everything they can to ensure regulatory compliance. Keeping a robust digital records system, using cloud storage for audit and document management, and conducting self assessments are just some of the ways businesses can prepare for regulatory audits.

To learn more about how cannabis companies can best prepare for regulatory audits, visit RizePoint for a free cannabis quality management demo.