Cannabis Operations
A Vendor Document Expiration Calendar That Gets Used
DispensaryVA Editorial TeamPublished
vendor expiryworkflow controldispensary operations
Powered by StealthAgents
Powered by StealthAgents
Cannabis Operations
Published August 14, 2026.
Close with a legible status sentence: what happened, what is protected, what evidence is attached, what decision was made, and who owns the next review. That sentence is more durable than a long narrative that leaves the reader searching for the answer. Recheck the record after the next shift or operating cycle. Reliability comes from making the right small fact available at the right moment, not from making every record look identical.
A vendor score is only as reliable as its evidence. A simple red, amber, or green label hides whether the problem is an expired certificate, a missing continuity plan, weak access controls, or a state-license question. Keep those dimensions visible. ## Four dimensions to score Score each dimension with a stated rule: regulatory scope, operational continuity, information security, and evidence freshness. Use “unknown” when the packet is incomplete. Do not convert an unknown into zero risk. | Dimension | Evidence example | Result | | --- | --- | --- | | Regulatory scope | License and service boundary | Pass, review, or unknown | | Continuity | Recovery contact and tested plan | Dated status | | Security | Access and incident process | Control owner | | Evidence freshness | Review date and expiry | Current or stale | NIST CSF 2.0's six functions, including Govern, provide a useful map for technology suppliers [S1]. For financial providers, the FinCEN marijuana guidance is a source to review, not a vendor endorsement. Virginia operators should check CCA laws, processor rules, and CCA reports. NIST SP 800-53, the NIST Privacy Framework, and NIST supply-chain resources help structure questions. FDA supplier controls are a bounded regulated-industry analogy. NARA records management, IRS marijuana guidance, OSHA recordkeeping, and CISA small business guidance cover adjacent controls. ## A transparent calculation Assign one point for each of four required evidence fields. A packet with 3 of 4 receives 75% completeness, not a “green” label. A separate risk decision may still block approval if the missing field is a license or security control. Compare supplier evidence with the payment risk statistics and product recall data. Keep their source populations separate. ## Frequently asked questions ### Is a high score proof the vendor is compliant? No. It shows that the local packet met local criteria at a point in time. ### How often should vendors be reviewed? Set review intervals by risk and evidence expiry. The sources do not establish one cannabis-wide interval. ### Can a contract transfer regulatory responsibility? Do not assume that it can. Obtain qualified advice for the relevant license and contract. ### What happens when evidence is missing? Mark the field unknown, assign an owner, and restrict the affected workflow until resolved. ## Sources 1. [S1] NIST, CSF 2.0, 2024. 2. [S2] NIST, Supply chain guidance, accessed August 10, 2026. 3. [S3] NIST, SP 800-53, 2020. 4. [S4] NIST, Privacy Framework, 2020. 5. [S5] CISA, StopRansomware, accessed August 10, 2026. 6. [S6] Virginia CCA, Laws, accessed August 10, 2026. 7. [S7] Virginia Administrative Code, Processor rules, accessed August 10, 2026. 8. [S8] Virginia CCA, Reports, accessed August 10, 2026. 9. [S9] FinCEN, Marijuana businesses, 2014. 10. [S10] FDA, Food guidance, accessed August 10, 2026. 11. [S11] National Archives, Records management, accessed August 10, 2026. 12. [S12] IRS, Marijuana industry, accessed August 10, 2026. ## Conclusion Use vendor statistics to expose missing evidence and review work, not to manufacture certainty. Record the score rule and its date with the approval. A cash reconciliation statistic is only useful when the operator defines the population. A count of deposits, a dollar variance, and the percentage of packets reviewed answer different questions. Federal overtime rules use 40 hours in a workweek for covered nonexempt employees, but that number does not establish a safe reconciliation workload [S1]. ## What to count Use one row per closed business day or approved shift. Record the register close, POS sales total, cash counted, deposit record, reviewer, and exception status. Keep a correction separate from the original count. That gives management an audit trail rather than a clean-looking replacement number. IRS guidance says section 280E does not prevent a marijuana business from reducing gross receipts by properly calculated cost of goods sold, while it limits deductions and credits within the statute's scope [S2]. A reconciliation file is not a tax position, so send classification questions to the tax professional. | Measure | Local definition | Why it matters | | --- | --- | --- | | Packets received | Closed shifts with required fields | Denominator | | First-pass match | Packets without an unresolved variance | Process quality | | Open exceptions | Variances awaiting documented action | Queue risk | | Review age | Time from close to approval | Timeliness | | Evidence completeness | Five required fields present | Record quality | For privacy and security, borrow the outcome-based approach in NIST CSF 2.0 and the least-privilege logic in NIST SP 800-53. Virginia operators should read the CCA laws and regulations and the Virginia pharmaceutical processor rules for their license scope. The IRS marijuana industry page and IRS section 280E guidance cover federal tax context. OSHA recordkeeping and OSHA overtime guidance are separate employment controls. The National Archives records-management guidance supports retention design, while the NIST Privacy Framework helps bound personal information. The FinCEN marijuana banking guidance is relevant to financial-institution due diligence. The Virginia CCA reports page provides current state publications. ## A small worked example Suppose a local register has 22 closed packets in a month. Twenty had all five evidence fields and matched on first review. The first-pass completeness rate is 20 / 22 = 90.9%. Do not call that an industry benchmark. It is a local operating measure with a stated denominator. Link the exception queue to the inventory accuracy benchmarks and retain the approved procedure with the record-retention benchmark. Neither article supplies a legal retention period for every jurisdiction. ## Frequently asked questions ### What is a good cash reconciliation rate? No cited national source supplies one. Report the local numerator, denominator, review window, and exception rule. ### Does reconciliation prove tax compliance? No. It documents one control. Tax treatment requires the applicable law, records, and qualified advice. ### Who should approve a variance? The licensee should assign that authority in a written procedure. A preparer should not silently approve their own correction. ### How often should management review the metric? Set the cadence in the procedure and shorten it when exceptions age or repeat. The cadence is a local control, not a published statistic. ## Sources 1. [S1] U.S. Department of Labor, Overtime, accessed August 10, 2026. 2. [S2] IRS, IRS announces marijuana-industry enforcement campaign, updated 2025. 3. [S3] IRS, Marijuana industry, accessed August 10, 2026. 4. [S4] FinCEN, BSA expectations regarding marijuana-related businesses, 2014. 5. [S5] NIST, CSF 2.0, 2024. 6. [S6] NIST, SP 800-53, 2020. 7. [S7] NIST, Privacy Framework, 2020. 8. [S8] Virginia CCA, Laws and regulations, accessed August 10, 2026. 9. [S9] Virginia Administrative Code, Pharmaceutical processors, accessed August 10, 2026. 10. [S10] OSHA, Recordkeeping, accessed August 10, 2026. 11. [S11] National Archives, Records management, accessed August 10, 2026. 12. [S12] Virginia CCA, Reports and studies, accessed August 10, 2026. ## Conclusion Measure cash controls with explicit populations and preserve the evidence behind each exception. That produces a useful local series without turning an employment or tax rule into a made-up dispensary benchmark.
Give purchasing staff, vendors, receivers, and finance reviewers different jobs in the record. The observer reports conditions; the owner chooses the next action; the reviewer tests whether the evidence supports closure. Do not make one checkbox stand in for all three perspectives. A note that says “resolved” hides the useful questions: resolved how, by whom, against which source, and with what remaining uncertainty? Separate containment from investigation. Containment protects people, product, privacy, money, or a promised service while facts are still being assembled. Investigation explains the cause and decides whether the routine needs changing. For this topic, the first response may be a hold, a callback, a second count, a corrected notice, a locked cabinet, or a facilities work order. Record that temporary measure separately from the final conclusion.
Use the current primary guidance for the jurisdiction and activity: SBA business compliance resources and Virginia Cannabis Control Authority. Check the source directly when a rule, safety decision, or customer communication depends on it.