Auditing delivery address change controls at a dispensary

Question and scope

This audit asks whether a cannabis dispensary can measure the controls it applies when a customer changes a delivery address. The unit is one address change request attached to one order. The review examines verification, zone check, hold status, approval, and release. It does not determine whether a specific delivery was legal or whether the customer was truthful. Set the scope to one store, one delivery queue. A fixed period

What the sources establish

The Virginia Cannabis Control Authority provides the state regulatory context for licensed delivery, and NIST privacy guidance is relevant to the customer information used in the change. The U.S. Postal Service address information resources illustrate why address verification is a separate step from accepting a customer's instruction. None of these sources measures a store's control. The store therefore needs local evidence for the operational claim. Public sources can explain why verification matters and where the privacy boundary sits. They cannot show whether a specific order was released before the change was approved.

Definitions and measures

Define an address change as a request to deliver an existing order to a different address than the one on the original record. Define verification as the documented check of the caller's identity and authority. Define approval as the authorized owner's decision that the new address is within the delivery zone and acceptable under store policy. Measure the number of change requests, the number with a documented verification, the number with a zone check, the number held during review, the number approved. The number released before approval

Evidence standard and data handling

Collect the original order, the change request, the verification note, the zone check, the manifest, and the release record. Mask customer identifiers in the analysis table. If the approval was given verbally, record who gave it and when. A manifest with the new address is not proof that the change was approved before the order left. Keep the original address and the proposed address in the record. A clean replacement field hides the fact that a change occurred and makes it harder to review the decision. The evidence standard should preserve the sequence.

Sampling and collection

Sample change requests rather than deliveries, then review every step attached to the selected request. Include requests that were denied and requests that were withdrawn. Stratify by delivery zone and by channel. Record the sampling rule and the observation window. Follow the order to the release event. An order that is still held at the end of the window is an open case. An order released after the window is a later event. Those distinctions keep the review from counting a future release as a completed control.

Analysis and reporting

Report the number of requests, the number verified, the number zone-checked, the number held, the number approved. The number released before approval Inspect the exceptions. Was the change approved by someone who was not authorized, or was the manifest updated without a hold? The pattern should lead to one process or system change. Avoid ranking dispatchers by the number of changes they handled.

Limits and sources of error

The delivery record may not show a verbal approval, and the driver may have received the change through a channel that is not logged. The customer may have changed the address again after the review. The audit cannot determine whether a delivery was appropriate in a specific case. Those limits belong beside the result. Public sources describe the regulated setting and privacy expectations, not the store's queue. The study should present its measures as a local control review, not a compliance certification.

Review and next action

Choose one change: a required verification field, a zone-check step, a hold status, or a release approval. Assign the owner and the next audit date. Repeat the review with the same definitions. The address change routine describes the front-desk steps that this audit reviews. Use the result to improve the control, not to claim that every delivery was correct.

Conclusion

Address change controls are measurable when the store separates verification, zone check, hold, approval, and release. A defensible audit preserves the original and proposed addresses and reports releases before approval as exceptions. The result is local evidence for one delivery queue during one period. It should guide a small control change and a review conversation, not a public claim about delivery safety.

Sources

The sources below support the regulatory, recordkeeping, and privacy context for this review. They do not measure this dispensary, and no source is presented as a local benchmark. The operational finding comes from the store records described in the method.

• Virginia Cannabis Control Authority
• U.S. Bureau of Labor Statistics, secretaries and administrative assistants
• NIST Privacy Framework
• FTC, Protecting Personal Information
• GAO, Assessing Data Reliability

This article describes a measurement method rather than legal, medical, or compliance advice. Confirm current requirements with the applicable authority and qualified advisers. Keep the local evidence separate from those requirements. Record the review date and the owner who accepted the interpretation. recheck the sources before reusing a number or a regulatory description.