Compliance Drift: How Good Minnesota Cannabis Stores Slowly Become Noncompliant
Drew Duffy, MHA, FACHE, Founder & Managing Director, CannaPath Regulatory Solutions
Last reviewed September 21, 2026
THE SHORT VERSION Compliance drift is the slow gap between what your policies say and what your people do. Over one weekend I walked into eight Minnesota dispensaries and saw it at nearly everyone, including one we work with. OCM has confirmed that enforcement checks of operating stores begin in the next few weeks. Here is what I saw, why it happens to good stores, and what to fix now. |
I am going to say something a little different from what we normally say at CannaPath.
I am a little worried.
Not because I think Minnesota cannabis retailers are ignoring the rules. What I saw this past weekend looks like something much more ordinary, and potentially much more dangerous. Compliance drift.
In all, I stopped at eight dispensaries, five in the metro and three in greater Minnesota. We had a trip that took us from the cities up to northern MN. Four of them I had never been inside. I wasn't looking for clients. I just wanted to see how everyone is holding up.
It was disturbing. I saw violations at nearly every store, including one we work with. And this wasn't a metro problem or a rural problem. Staffing was noticeably thinner at the greater Minnesota stores, while the metro stores were mostly well staffed, but the drift showed up in both.
Here is the part I want every owner to sit with. Everything I saw, I saw as a customer, standing on the sales floor. If I can see it, so can OCM. And an inspector doesn't stop at the counter.
Why this matters right now
OCM has confirmed to us that it is beginning enforcement checks of currently operating stores, and that those checks start in the next few weeks. We don't have a date, and nobody has a list of which stores will come first. That includes us.
None of this should come as a surprise. OCM has said all along that every licensed business is subject to routine compliance inspections, and its inspection lists were updated August 1. Those lists are written for pre-license inspections, but they are the clearest public picture of what inspectors look at, and OCM says plainly that they aren't exhaustive and that it can inspect every part of a cannabis business.
So, let's talk about what drift looks like. I watched a lot of it in thirty minutes.
Thirty minutes in one store
The first store we walked into had an ID check stand set up right inside the door. It's a good setup. You can't get to the sales floor without walking past it, and their own signage says IDs are checked at entry. But a station like that only works if someone is standing at it. Nobody was.
There were two employees in the whole store, and both were at the register with two customers who were checking out. Those customers decided at the last minute not to take one of their items. Not a problem. But when the transaction ended, the employee didn't take that product back to the inventory room. It stayed on the register, out in the open.
We were greeted right away, and as soon as the clerk finished with the first customer, he asked for our IDs. He looked at them, but he didn't run them through the store's ID checking software. While he was helping us, three more people came in. They walked right past the ID station, went off in different directions, and started looking at product and smelling samples.
As it turns out, one of them was 17. She had come in with her sister and didn't know she couldn't be in there. It was a mess.
The whole time we were there, for about thirty minutes, the vault room door was wide open. Not cracked open. Wide open. From the sales floor we could see exactly where they kept the flower, the gummies, the tinctures. Nobody attended it, because both employees were busy with customers. It was very clear that neither a manager nor the owner was on site.
Then we heard an employee tell a customer, “Oh, if you got swelling, you need this stuff. It gets rid of all of that.” That may even be true for some people. But that employee is not a medical professional, and in Minnesota an oral statement made to promote a sale counts as advertising. Cannabis advertising cannot make unverified health claims. That one was a real violation, said out loud on the sales floor.
This wasn't a bad store
I want to be clear about this. This store was not a bad actor. Someone put real thought into how it was set up. The ID stand was in the right place, and the vault had real hardware on it. They had good policies in place that no one was following. That is the problem, and that is compliance drift.
Minnesota's security rule doesn't just ask you to write your security measures down. It says a cannabis business must develop, document, implement, and maintain them. A policy that is documented but not followed doesn't meet that standard, however good it looks on paper.
One of the stores we visited was a CannaPath client, and they weren't perfect either. They had a couple of minor issues. The biggest was that their ID checker was having a hard time staying at his station, which their own SOP requires. On its own, that isn't a violation of a state rule. But it goes against their own written procedure, and when an inspector reads your SOP and then watches your floor, the two need to match.
The difference is that we were able to tell the owner right away. They heard about it from us, instead of from an inspector.
The store with one employee
At another store, there was one employee working. One. Someone had called in and they couldn't find a replacement. I understand how that happens. It doesn't matter.
Minnesota's rules don't put a number on minimum staffing, even though the statute names the number of employees working as something OCM's security requirements can cover. But think about what that one person must do at the same moment. Confirm that everyone who walks in is 21 or older. Run the register. Keep the vault closed and controlled. Log anyone who goes into the back. Keep product off the counter. One person cannot do all of that at once. I don't believe you can run a store with one employee and stay compliant, and that afternoon is exactly when OCM would walk in.
It's worth pulling out your security plan and your SOPs, too. If either one assumes more than one person on the floor, a one-person shift is drift from your own documents.
How good stores drift
Most compliance problems don't begin with someone saying, “Let's violate the rules.” They begin with something that feels reasonable. Nobody's back here. I'm only going in for a second. We're slow right now. I'll close it when I'm done. That customer already showed their ID.
Then the exception happens again. And again. Eventually the exception becomes the normal workflow. The store still has the lock and the policy, and maybe an SOP that says the door stays secured. But the actual operation has drifted away from the control.
It usually happens slowly. An employee finds a faster way. A supervisor stops correcting a small shortcut. A new hire learns the process from whoever is working that shift instead of from the written procedure. Someone calls in. It gets busy. And the workaround becomes routine. That's why drift is so hard to catch from a desk. Read your SOPs and everything may look perfect. Walk the floor and the story can be very different.
There's another uncomfortable part. Sometimes the person best able to spot drift isn't there every day anymore. An owner or experienced manager sets up good controls when the store opens. Everyone knows the expectations, and corrections happen on the spot. Then the business gets comfortable. The owner steps off the floor, managers take over, the store gets busier, and the small corrections stop. That doesn't mean anyone stopped caring. It means the system changed.
A compliance program that depends on one person noticing every exception is not really a compliance system. |
What to fix, starting this week
This is the part that matters most, and the good news is that almost none of what I saw takes a big investment to fix. It takes controls that keep working when nobody has a free hand, and some honesty about what your store does on a busy Saturday.
Start with the vault. A door closer shuts the door on its own, and most access-control systems can alert you when a door is held open. Make the normal state closed and locked instead of something someone has to remember and fill in the entry log when someone goes in, not at the end of the shift.
Then the front door. If your SOP says IDs are checked at entry, that station needs a person at it every minute you are open, or entry needs to stop there until someone can check. If you can't staff it, you have two honest options. Add the staff or change the process to one you can run and update the SOP to match. A written process nobody can follow is the worst of both.
If you have ID scanning software, scan every ID, including your regulars. Recognizing a face is exactly how drift starts. And anything that isn't sold or on display goes back to secure storage before the next customer is helped. Minnesota requires everything other than display samples to be kept in secure storage, and a returned item sitting on the register is neither.
Give your staff approved language for health questions, and practice it until it's automatic. Something as simple as “I can't give medical advice, but here's what's on the label, and your doctor or pharmacist is the right person to ask” keeps a helpful conversation from turning into a health claim.
Put your minimum staffing in writing, along with a call-out plan: who gets called, who covers, and what the store does if it still comes up short. Decide that ahead of time and check it against your security plan. That decision should never fall on the one person standing behind the counter. And name someone in charge of the floor for every shift, even when the owner and manager are off.
Last, when you find a step, your staff routinely skip, don't leave it sitting in the SOP. Either retrain it or revise it through your version control, the same week. An SOP that promises more than your floor delivers is a liability.
Walk your store this week
Don't start by reading your SOPs. Start at the front door. Pretend you have never seen your store before. Walk in as a customer, then walk through it again as an inspector, and look for the things you stop seeing because you see them every day. Do it during your busiest hour, because a quiet Tuesday morning will tell you very little.
Then ask the question that catches drift better than almost anything else.
What do we do when we are busy?
Because that is usually where the real process lives.
One warning. A store can clean itself up for an inspection. Close the vault door, remind everyone about IDs, straighten the counter, find the missing paperwork. That can feel like being ready. But if everything drifts back to the old workflow the day after, nothing was really fixed. What you are building is an operation that stays compliant when nobody is watching.
And if OCM finds it first
I want to be careful here, because fear is not how we operate at CannaPath, even after a weekend like this one. Not every mistake equals a shutdown. It doesn't. But the consequences are real. Minnesota law lets OCM issue an administrative order requiring a business to correct a violation, stop the conduct, or both, with the deadline set in the order itself. Penalties can reach $10,000 per violation. Suspension and revocation are a separate process with their own hearing.
A business should not discover its compliance drift because a regulator discovered it first.
The biggest compliance problem in your dispensary may not be a missing policy. It may not even be a bad policy. It may be the shortcut that became a habit six months ago, the door that stays open because “we're slow,” or the ID process that changes when the store gets busy. That's compliance drift. Once it starts, it rarely announces itself. It just becomes normal.
Need another set of eyes?
That is exactly why we built Scout, CannaPath's compliance gap-analysis tool. Scout is designed to help identify the gaps between what your operation is supposed to be doing and what your documentation and processes actually show. You can learn more and submit a review at cannapath.org/sentinel.
And if you get into something you would rather not sort out alone, we are here. Reach out.
We don't just explain the rules. We help you operate under them.
-Drew
SOURCES Minn. Stat. 342.01, subd. 5 (advertisement defined); 342.19 (orders and penalties); 342.21 (suspension and revocation); 342.27 (retail requirements); 342.64 (advertising limits). Minn. R. 9810.1500 (security) and 9810.2501 (adult-use retail). OCM, Preparing to Open, and its pre-license inspection lists, updated August 1, 2026. Rules change. Confirm anything you plan to rely on directly with OCM. This post is general information, not legal advice. |
