Dispensary standard operating procedures are the written procedures your cannabis business submits to state regulators and follows on the floor every day. They turn the state cannabis act, the administrative code, your local ordinances, and your license conditions into step-by-step instructions that a new hire can execute and an inspector can audit. No regulated state will issue or renew a retail cannabis license without them, and the manual that gets you licensed is the same manual your staff has to actually work from once the doors open.
What follows is a working guide to what belongs in that manual, section by section, and how to write each part so it holds up under both a license review and a real inspection.
What to Gather Before You Start Writing
Drafting stalls fast if you haven’t pulled the source material first. Every state with a licensed cannabis program publishes its own cannabis act, administrative code, and licensing regulations, and your SOPs need to track the version currently in effect, not last year’s and not another state’s. Most state cannabis agencies also publish an application checklist that effectively doubles as a table of contents for the manual, telling you which topics the reviewer expects to see and in what order.
Beyond the state code, collect your local zoning ordinance (which may restrict hours, signage, or proximity to schools), municipal fire and building codes, and any conditions attached to your local business license. Sort all of it by operational area: inventory, security, sales, sanitation, waste, training, and emergency response.
Then lay your organizational chart over those areas. Every SOP should name the job title responsible for performing the task and the manager responsible for verifying it. That accountability structure is what regulators look for during an audit, and it is what protects the business when an individual employee goes off-script.
Inventory and Seed-to-Sale Tracking
Seed-to-sale tracking is the backbone of cannabis compliance. Every regulated jurisdiction requires dispensaries to log product in a state-approved electronic tracking system from the moment it arrives until it is sold or destroyed. METRC, which uses RFID tags, is the most widely deployed platform and is currently used across more than two dozen states and territories.
Your SOP has to spell out what happens when a shipment arrives: who inspects the delivery, how they verify package tags against the shipping manifest, how they weigh and count, and how they enter the data into the tracking system. Any discrepancy between the manifest and what actually arrived gets documented immediately and reported to both the distributor and the state agency. A small unreported weight variance can trigger an investigation that puts the license at risk.
Most states also require periodic physical reconciliation of on-hand inventory against the tracking system. Frequency varies. Some jurisdictions require daily counts for retail; others require a full reconciliation every 14 to 30 days. Write a schedule that meets or exceeds your state’s minimum, name the employee who performs the count, and describe how variances are investigated and documented.
Quarantine and Damaged Product
Set aside a clearly marked physical area, separate from sellable inventory, for product that is damaged, expired, recalled, or flagged during a count. The SOP should require a manager’s sign-off for anything entering or leaving quarantine, and every item logged with the date, reason, batch number, and the employee who flagged it. Nothing leaves quarantine except back to the sales floor after clearance or into the waste destruction process.
Delivery Operations
If your license permits delivery, the manual needs a separate section for it. States that allow delivery generally require that cannabis be locked in a container secured inside the vehicle, that it not be visible from outside, and that each trip carry a delivery manifest generated through the tracking system. The manifest cannot be altered after the driver leaves the premises. Cover vehicle identification records (make, model, plate, VIN, insurance), GPS tracking where required, and the rule in most jurisdictions that delivery vehicles cannot be left unattended or parked overnight at a driver’s home with product inside.
Security and Surveillance
Every cannabis state requires a detailed security plan as part of licensing, and your SOPs are where that plan becomes operational. Cameras must cover every entry and exit, the sales floor, all storage and vault areas, the waste destruction area, and any location where cash is handled or stored. Systems record continuously in high definition, twenty-four hours a day.
Minimum footage retention varies by jurisdiction, typically between 45 and 90 days. Write your state’s exact number into the SOP, specify where footage is stored (on-site server, cloud, or both), and name who can access or export it. Regulators and law enforcement can request footage at any time, so the procedure for responding to those requests matters as much as the recording itself.
Access control extends past the front door. Define restricted zones inside the facility. Limit vault access to named managers. Require visitor logs that capture identity, entry and exit times, and purpose of visit, with every non-employee wearing a visible badge and being escorted. Alarm codes go out on a strict need-to-know basis, and the procedure for changing codes whenever an authorized employee leaves the company should be written down. If your state requires panic or duress alarms, describe where they are installed and how staff activate them.
Customer Verification and Sales
No transaction begins without confirming the customer’s age and, for medical sales, the validity of their recommendation or patient card. Require staff to check a government-issued photo ID for every customer, every time. Many dispensaries use electronic ID scanners that read encoded license data and automatically flag expired documents or underage buyers. The SOP should also cover what happens when an ID is suspicious or unreadable: the sale does not proceed.
For medical operations, describe how staff verify a patient’s recommendation against the state registry, confirm it is current, and document the check. That step protects the business when a patient’s authorization has lapsed or been revoked.
Purchase Limits
Every state sets daily purchase limits, and exceeding them is one of the fastest ways to draw enforcement. Limits differ significantly. For flower, most states cap a single customer’s daily purchase at one to two and a half ounces. Concentrate limits run from roughly five grams up to sixteen grams depending on the state. Configure the point-of-sale system to flag transactions approaching or hitting those thresholds, and write instructions for how staff handle the alert. The goal is to prevent looping (a customer visiting multiple times in one day to get around the limit) and smurfing (someone sending several buyers to purchase on their behalf).
Cash Handling
Because most cannabis businesses still operate primarily in cash, cash procedures need to be airtight. Document the chain of custody from register drawer to safe: who counts the drawer at shift change, how discrepancies are investigated, when and how cash is moved to the safe or bank, and who holds safe access. Dual-control policies (two people present for any large cash movement) reduce both theft risk and accusations of skimming.
If you bank with a financial institution, be aware that federal anti-money-laundering rules apply. Under active FinCEN guidance, banks and credit unions serving marijuana-related businesses must file Suspicious Activity Reports on those accounts regardless of state legality, because cannabis distribution still violates federal law.1FinCEN. BSA Expectations Regarding Marijuana-Related Businesses The SOP should include procedures for maintaining the documentation your bank needs for those filings: proof of state licensure, transaction records, and evidence that you are not engaging in FinCEN’s enforcement-priority activities such as sales to minors or diversion out of state.
Employee Training
A binder of SOPs is worthless if the staff hasn’t been trained on it. Several states now require structured, state-certified training programs for dispensary employees, with responsible vendor courses typically running at least two hours and due within 90 days of hire. Some states require eight hours of annual training plus a passing score on a certification exam. Even where there is no formal state mandate, regulators expect employees to be trained on a written manual covering cannabis safety, age verification, and regulatory compliance.
Lay out the training timeline in the SOP: what a new hire learns on day one versus week one versus within 90 days, who delivers the training, how competency is tested, and how completion is recorded. Keep signed training acknowledgment forms in each employee’s file. Regulators check these during inspections, and they become critical evidence if you ever need to show that a compliance failure was an individual’s mistake rather than a systemic gap.
Workplace safety training runs alongside cannabis-specific education. Under federal OSHA rules, any employer with hazardous chemicals on-site (which includes cleaning solvents and even ground cannabis dust) must train employees on the Hazard Communication Standard and keep safety data sheets accessible during every shift.2eCFR. 29 CFR 1910.1200 – Hazard Communication Write down where SDSs are kept (physical binder, digital terminal, or both), who updates them when new products arrive, and how employees reach them in an emergency.
Sanitation, Environmental Controls, and Product Integrity
Cannabis products degrade when exposed to the wrong temperature, humidity, or light, and contaminated surfaces can introduce pathogens that testing may or may not catch before product reaches a customer. Set cleaning schedules for every surface that contacts cannabis, list approved cleaning agents, and require handwashing protocols modeled on food-service standards. Document frequency, method, and the employee responsible.
Environmental monitoring goes past cleanliness. Temperature and humidity logs for storage areas get recorded at consistent intervals, and the SOP should define acceptable ranges for different product types. When a reading falls outside range, the procedure describes who is notified, what corrective action is taken, and how affected product is evaluated before returning to the sales floor or moving to quarantine.
Odor Control
Neighbor odor complaints are one of the most common triggers for municipal enforcement against dispensaries. Many local ordinances require an odor mitigation plan, and failure to control odors can produce fines, nuisance lawsuits, or revocation of local permits. Standard HVAC does not capture the volatile organic compounds and terpenes responsible for cannabis smell. Effective mitigation typically requires activated carbon filtration, often combined with HEPA filters and proper airflow design to capture odors before they leave the building. Cover filter replacement schedules, maintenance logs, and how the business responds to odor complaints.
Certificates of Analysis
Every product on the shelf should be backed by a certificate of analysis from an accredited testing laboratory, confirming potency, terpene profile, and the absence of contaminants such as pesticides, heavy metals, and microbial pathogens. Describe how staff verify a valid COA exists for each batch before it goes on the sales floor, how COAs are stored and organized (typically by batch number), and how customers can access them. Most states require dispensaries to hand a COA to any customer who asks, so build that into the point-of-sale workflow.
Cannabis Waste Disposal
Unsold cannabis does not go in the dumpster. Virtually every state requires cannabis waste to be rendered “unusable and unrecognizable” before it leaves the premises. The standard method is to grind the material and mix it with non-cannabis waste (paper, cardboard, soil, food scraps, or similar) so the resulting mixture is at least 50 percent non-cannabis by volume. Some product types need special handling: gummies may need to be melted before mixing, and topical patches must be removed from backing and incorporated into the blend.
Write the destruction process step by step, including who performs it, which waste materials are used for mixing, and where it takes place (on camera). Every destruction event needs a log entry recording the date, time, batch numbers destroyed, mixing method, the employee who performed the destruction, and which cameras captured it. Once rendered unusable, the waste goes to a permitted facility such as a landfill, composting operation, or incinerator. Waste disposal records typically must be retained for three to five years depending on the state.
Emergency Response and Product Recalls
Include a written emergency response plan covering robberies, medical emergencies, fires, natural disasters, and system failures. For each scenario, describe the immediate steps employees take, who contacts emergency services, how the incident is documented afterward, and who at the company is notified. Robbery protocols matter especially given how much cash is on-site: employees should know not to resist, how to activate panic alarms if installed, and how to preserve the scene for law enforcement.
If an alarm or surveillance system goes down, the SOP should specify how long before management is notified and what interim security measures kick in. Many states require backup power capable of keeping alarms operational for at least eight hours during an outage.
Product Recalls
Recalls happen more often than new operators expect, and they move fast. Include a standalone recall plan covering how you identify affected batches through the seed-to-sale system, how you pull those batches from the sales floor, how you notify customers who bought the product, and how you communicate with the state agency. Most states require notification to the cannabis regulator within 24 hours of initiating a recall, with weekly status updates for the duration.3Office of Cannabis Management. Recalls Recalled product goes straight into quarantine and cannot be resold under any circumstances.
Customer Data and Record Retention
Dispensaries collect sensitive personal information at every transaction: license data, dates of birth, addresses, and in medical programs, patient card numbers and health information. The exposure risk is unusually high in this industry. Because cannabis remains a federal controlled substance for recreational purposes, breached customer data could affect someone’s employment, immigration status, lending eligibility, or a custody dispute. Medical cannabis data carries additional obligations under HIPAA and state health privacy laws.
The SOP should specify what customer data is collected, where it is stored, who can access it, how long it is retained, and how it is destroyed when no longer needed. Configure point-of-sale systems and ID scanners to collect only what is legally required and nothing more. If your state requires certain records be kept for a specific period (three to five years is common), build that retention schedule into the SOP alongside a procedure for secure deletion when the period expires.
Submitting, Approving, and Updating the Manual
The finished manual gets submitted to your state cannabis agency as part of the license application, typically through an online licensing portal. Some agencies accept digital uploads only; others want physical copies. After submission, expect a review period that can stretch for weeks or months. If the reviewer finds gaps, you will get a deficiency notice identifying what needs to be corrected, with a limited window (often 10 to 30 days) to submit revised language. Missing that deadline can produce an outright denial, so treat deficiency responses as urgent.
Approval does not mean the manual goes on a shelf. Schedule a full internal review at least once a year, and trigger an immediate update whenever the state changes its regulations, the business model shifts (adding delivery, for instance), or an incident or inspection reveals a procedure that is not working as written. Date every revision and archive the old version rather than delete it. Distribute updates to affected employees and document that they received the change and were trained on it. Regulators want to see not only that the manual was updated but that the staff actually knows about it.