Administration and compliance
Cannabis Dispensary Document Control Data 2026
A measurement model for current versions, approvals, stale copies, and retrieval performance in regulated dispensary work.
Key takeaways
- Document availability, current-version use, approval, and retrieval are separate measures.
- NARA guidance supports lifecycle thinking but does not set a cannabis retention period [S1].
- A stale-copy rate needs a defined search population.
A folder full of documents is not a controlled document system. Measure whether the current approved version exists, whether staff can find it, and whether work used that version. Do not treat a download or acknowledgement as proof of use.
The document-control record
Record owner, version, effective date, approval, location, and superseded status. When reviewing a completed task, link the document version used. This makes a later correction traceable without rewriting history.
| Measure | Definition | Example |
|---|---|---|
| Current availability | Current approved documents / required set | 18 / 20 |
| Retrieval success | Successful finds / test requests | 9 / 10 |
| Stale-copy rate | Stale uses / reviewed uses | 1 / 25 |
| Approval coverage | Approved documents / active documents | 20 / 20 |
NARA's records management guidance supports lifecycle design. Use NIST CSF 2.0, NIST SP 800-53, and the NIST Privacy Framework for access and data minimization. Virginia scope comes from CCA laws, processor rules, and CCA reports. GAO data reliability, OSHA recordkeeping, USCIS I-9 Central, EEOC employers, IRS marijuana guidance, FDA quality resources, and FinCEN guidance have distinct scopes.
Use a stated review window
In a 90-day review, suppose staff used 25 controlled documents and one use referenced a superseded copy. The local stale-use rate is 1 / 25 = 4%. That does not estimate all work unless the sample design supports it. Keep the sample, version IDs, and reviewer notes.
Pair this control with record-retention benchmarks and the SOP adoption review. Document ownership remains separate from content publication.
Frequently asked questions
Does a signed acknowledgement prove use?
No. It proves an acknowledgement event under the local record design.
What is the right retention period?
The answer depends on jurisdiction, record type, and license. Ask qualified counsel when the rule is unclear.
Should superseded documents be deleted?
Do not delete records without the approved retention and disposition rule. Restrict use and preserve history.
Who owns the document register?
Name a role in the procedure and assign a backup. Software ownership alone is not accountability.
Sources
- [S1] National Archives, Records management, accessed August 10, 2026.
- [S2] NIST, CSF 2.0, 2024.
- [S3] NIST, SP 800-53, 2020.
- [S4] NIST, Privacy Framework, 2020.
- [S5] GAO, Data reliability, 2019.
- [S6] Virginia CCA, Laws, accessed August 10, 2026.
- [S7] Virginia Administrative Code, Processor rules, accessed August 10, 2026.
- [S8] OSHA, Recordkeeping, accessed August 10, 2026.
- [S9] USCIS, I-9 Central, accessed August 10, 2026.
- [S10] EEOC, Employers, accessed August 10, 2026.
- [S11] IRS, Marijuana industry, accessed August 10, 2026.
- [S12] FDA, Regulated products, accessed August 10, 2026.
Conclusion
Controlled-document statistics should expose stale use and missing approval. Publish the sample and version rule with the result.
Reviewed by the DispensaryVA editorial team on 2026-08-10.