Give dispatchers, drivers, and the person validating identity different jobs in the record. The observer reports conditions; the owner chooses the next action; the reviewer tests whether the evidence supports closure. Do not make one checkbox stand in for all three perspectives. A note that says “resolved” hides the useful questions: resolved how, by whom, against which source, and with what remaining uncertainty?
Evidence context for this decision
Delivery data needs a boundary The Virginia Cannabis Control Authority and Virginia Administrative Code define the local control environment. A route completion percentage cannot prove that each handoff, identity check, or custody record met the applicable rule. ## Delivery evidence table | Stage | Evidence | Exception | | --- | --- | --- | | Order | Order ID and eligibility | Duplicate or canceled order | | Handoff | Authorized recipient and time | Refused or failed handoff | | Custody | Seal, vehicle, or chain record | Break or unexplained gap | | Route | Approved area and stop | Boundary or delay | | Closeout | Returned inventory and reviewer | Quantity mismatch | Compare recall notification data and incident reporting data. Public context includes CCA reports, NHTSA, FMCSA, OSHA, CISA, NIST, FTC, USPS, Bureau of Transportation Statistics, and CDC. ## Method and limitations These sources cover regulator, transport, safety, security, and consumer contexts. They are not a pooled delivery benchmark. Preserve local source versions and do not publish a route success rate without a defined denominator. This is operational research, not legal or transportation advice. ## Frequently asked questions ### Is an on-time rate enough? No. Pair timing with authorization, custody, handoff, and exception completion. ### What should happen after a failed handoff? Follow the current approved procedure, preserve the record, reconcile inventory, and assign the exception owner. ### Can a national logistics study set a delivery SLA? No. It can inform questions; local evidence sets a defensible baseline. ## Sources 1. Virginia CCA 2. Virginia Administrative Code 3. CCA reports 4. NHTSA 5. FMCSA 6. OSHA 7. CISA 8. NIST 9. Bureau of Transportation Statistics 10. CDC ## Conclusion Delivery research is credible when the order, custody, handoff, and exception records close into one reproducible chain. A vendor score is only as reliable as its evidence. A simple red, amber, or green label hides whether the problem is an expired certificate, a missing continuity plan, weak access controls, or a state-license question. Keep those dimensions visible. ## Four dimensions to score Score each dimension with a stated rule: regulatory scope, operational continuity, information security, and evidence freshness. Use “unknown” when the packet is incomplete. Do not convert an unknown into zero risk. | Dimension | Evidence example | Result | | --- | --- | --- | | Regulatory scope | License and service boundary | Pass, review, or unknown | | Continuity | Recovery contact and tested plan | Dated status | | Security | Access and incident process | Control owner | | Evidence freshness | Review date and expiry | Current or stale | NIST CSF 2.0's six functions, including Govern, provide a useful map for technology suppliers [S1]. For financial providers, the FinCEN marijuana guidance is a source to review, not a vendor endorsement. Virginia operators should check CCA laws, processor rules, and CCA reports. NIST SP 800-53, the NIST Privacy Framework, and NIST supply-chain resources help structure questions. FDA supplier controls are a bounded regulated-industry analogy. NARA records management, IRS marijuana guidance, OSHA recordkeeping, and CISA small business guidance cover adjacent controls. ## A transparent calculation Assign one point for each of four required evidence fields. A packet with 3 of 4 receives 75% completeness, not a “green” label. A separate risk decision may still block approval if the missing field is a license or security control. Compare supplier evidence with the payment risk statistics and product recall data. Keep their source populations separate. ## Frequently asked questions ### Is a high score proof the vendor is compliant? No. It shows that the local packet met local criteria at a point in time. ### How often should vendors be reviewed? Set review intervals by risk and evidence expiry. The sources do not establish one cannabis-wide interval. ### Can a contract transfer regulatory responsibility? Do not assume that it can. Obtain qualified advice for the relevant license and contract. ### What happens when evidence is missing? Mark the field unknown, assign an owner, and restrict the affected workflow until resolved. ## Sources 1. [S1] NIST, CSF 2.0, 2024. 2. [S2] NIST, Supply chain guidance, accessed August 10, 2026. 3. [S3] NIST, SP 800-53, 2020. 4. [S4] NIST, Privacy Framework, 2020. 5. [S5] CISA, StopRansomware, accessed August 10, 2026. 6. [S6] Virginia CCA, Laws, accessed August 10, 2026. 7. [S7] Virginia Administrative Code, Processor rules, accessed August 10, 2026. 8. [S8] Virginia CCA, Reports, accessed August 10, 2026. 9. [S9] FinCEN, Marijuana businesses, 2014. 10. [S10] FDA, Food guidance, accessed August 10, 2026. 11. [S11] National Archives, Records management, accessed August 10, 2026. 12. [S12] IRS, Marijuana industry, accessed August 10, 2026. ## Conclusion Use vendor statistics to expose missing evidence and review work, not to manufacture certainty. Record the score rule and its date with the approval.
Applying the evidence to delivery address amendments
Review a small sample at a predictable time. Read one open case for ownership and one closed case for evidence. Look for repeated delays, copied explanations, missing witnesses, late timestamps, and actions that depend on memory. A trend is not proof of fault; it is a prompt to inspect the design. Ask whether delivery address amendments gives staff a clear stopping point and an easy way to surface an exception before it becomes a customer or compliance problem. Close with a legible status sentence: what happened, what is protected, what evidence is attached, what decision was made, and who owns the next review. That sentence is more durable than a long narrative that leaves the reader searching for the answer. Recheck the record after the next shift or operating cycle. Reliability comes from making the right small fact available at the right moment, not from making every record look identical.
