Cannabis Dispensary Cycle Count Frequency Data 2026

There is no single national cannabis cycle-count frequency. The defensible answer is a local schedule tied to product risk, variance history, physical access, and the controlling state system. Virginia's rules and CCA publications must be read for the operator's license and date [S1][S2].

A four-ledger count

Reconcile the physical count to four separate records: the POS quantity, the state seed-to-sale quantity, the receiving record, and the adjustment log. The systems may be integrated, but the evidence should still show which record was checked and who approved a correction.

The 94.4% result is a synthetic example, not an industry benchmark. Change the denominator when the count design changes. NIST's CSF 2.0 is an outcome framework, not a cannabis inventory rule. NIST SP 800-53 gives security-control vocabulary for access and audit evidence. The CCA laws page, Virginia processor regulations, and CCA reports are the relevant Virginia starting points. METRC documents platform context, not every jurisdiction's legal requirement. FDA recall guidance illustrates traceability in another regulated setting. NARA records guidance supports retention design. NIST Privacy Framework helps limit personal data in count files. OSHA recordkeeping applies to workplace records, not inventory accuracy. IRS marijuana guidance covers tax records. FinCEN guidance covers financial controls.

Set the schedule from evidence

Count high-value, fast-moving, temperature-sensitive, or recently adjusted packages more often. Expand the schedule after a repeated variance, a system integration change, an unexplained adjustment, or a custody break. Reduce frequency only through a documented review; a quiet month alone does not prove lower risk.

Connect the exception procedure to METRC inventory control statistics and the product recall data review. Keep the article's examples separate from state-law advice.

Frequently asked questions

Should every package be counted daily?

The reviewed authorities do not support a universal answer. Use the license rule first, then document risk and capacity.

Does a POS match prove compliance?

No. A match is one control result. Retain the count method, package identity, source records, and approval.

Who can post an adjustment?

The written procedure should name the authorized role and required evidence. Do not infer authority from software access.

What is the best metric?

Report match rate, unresolved exceptions, age, and repeat variance count with their denominators.

Sources

1. [S1] Virginia CCA, Laws and regulations, accessed August 10, 2026.
2. [S2] Virginia CCA, Reports and studies, accessed August 10, 2026.
3. [S3] Virginia Administrative Code, Pharmaceutical processors, accessed August 10, 2026.
4. [S4] METRC, System overview, accessed August 10, 2026.
5. [S5] NIST, CSF 2.0, 2024.
6. [S6] NIST, SP 800-53, 2020.
7. [S7] NIST, Privacy Framework, 2020.
8. [S8] FDA, Recalls and market withdrawals, accessed August 10, 2026.
9. [S9] National Archives, Records management, accessed August 10, 2026.
10. [S10] OSHA, Recordkeeping, accessed August 10, 2026.
11. [S11] IRS, Marijuana industry, accessed August 10, 2026.
12. [S12] FinCEN, Marijuana-related businesses, 2014.

Conclusion

Cycle-count frequency should be a documented response to risk and variance evidence. Publish the rule, retain the count packet, and label local examples as local examples.