Security Administration
Reviewing a Cannabis Dispensary Key-Control Register
DispensaryVA Editorial Team
physical key-control register reviewdispensary operationsevidence workflow
Security Administration
Published September 10, 2026.
Reviewing a Cannabis Dispensary Key-Control Register gives DispensaryVA readers a bounded routine for physical key-control register review. It supports administrative consistency and evidence quality; it is not legal, medical, tax, safety, or compliance advice. Verify current Virginia requirements and the operator's approved procedures before acting.
Keep key identities and access details in restricted systems. A signed register supports traceability but does not prove exclusive possession or physical access; security response remains with designated personnel.
Treat one controlled key assignment or return event as the unit of work. The evidence packet should connect the key identifier, authorized custodian, issue and return times, approvals, exception, and verification. The example control marker DV-S10-B04-47 identifies this article's model only; it is not a required operator or regulatory identifier.
Write down what causes a record to enter the queue and what evidence permits it to leave. Received, assigned, awaiting evidence, under review, corrected, escalated, and verified closed are useful only when each status has a clear owner and transition rule. Do not use “done” when the record merely moved or a message was sent.
A later correction belongs in the history with its reason, timestamp, and author. Preserve the originally observed value. Silent replacement makes it impossible to distinguish a clean first observation from a repaired record.
| Field | Minimum value | Review question |
|---|---|---|
| Scope | one controlled key assignment or return event | Is the boundary unambiguous? |
| Source | System, document, version, and time | Can another reviewer find it? |
| Observation | Original expected and observed values | Are fact and interpretation separate? |
| Ownership | Current role and due time | Who has the next authorized action? |
| Disposition | Decision, evidence, and verification | What supports closure? |
Keep original and normalized values in different fields. Mark missing, unknown, not applicable, suppressed, and zero separately. Those states have different meanings and should not collapse into an empty cell.
The first pass checks identity, required fields, source access, and obvious conflicts. The second pass checks meaning: whether the source supports the displayed or recorded claim, whether the responsible role is authorized, and whether closure evidence answers the original question. A fast first pass prevents incomplete records from consuming deeper review time.
For recurring work, sample a bounded set for independent review. Give the second reviewer the sources and definitions, not the first reviewer's conclusion. Record disagreements and their resolution. Repeated disagreements usually point to an unclear definition, unreliable source, or missing workflow instruction.
Count eligible records received, reviewed, returned for evidence, escalated, corrected, and verified closed. Put the denominator and date range beside each rate. Note outages, staffing gaps, source changes, and revised inclusion rules. A falling exception count can mean improvement, narrower coverage, or missed intake; the count alone cannot choose among those explanations.
Time measures also need named endpoints. Receipt-to-assignment, assignment-to-first-review, and review-to-closure describe different parts of the workflow. Use local timezone and state how work received outside business hours is treated. Do not average incompatible intervals.
Administrative support can collect sources, compare fields, prepare a correction, and route an exception. Decisions reserved for licensed, onsite, financial, security, clinical, legal, or other authorized roles remain with those roles. The record should name the requested decision without pretending that preparation equals approval.
Store personal, financial, security, and commercially sensitive information only in approved systems with role-based access. Public reports should use the least detail needed to explain the method. An operational checklist never creates permission to collect more data.
Escalate conflicting authoritative sources, missing stable identifiers, suspected unauthorized changes, overdue decisions, repeated failed corrections, and privacy or security concerns. State the observed condition, sources checked, temporary containment, decision needed, deadline, and next owner. Avoid blame or causal claims that the record cannot support.
At shift or day end, order open items by required next action rather than arrival alone. Identify cases waiting on an external source separately from cases waiting on an internal decision. That distinction helps the next owner act without rereading every message.
A dependable physical key-control register review routine preserves scope, source, status, ownership, uncertainty, and verified disposition. Keep the unit narrow, make exceptions visible, and close only when the retained evidence supports the recorded outcome.
For related support, see workflow documentation and contact the DispensaryVA team.