The Minnesota Cannabis Inspection Checklist
Updated: Aug 4
CANNAPATH
REGULATORY SOLUTIONS
The Ultimate Minnesota Cannabis Inspection Checklist
What OCM can actually do, what they’ll actually look at, and how to be ready before the door opens.
FIFTEEN SECTIONS · MINNESOTA RETAIL · JULY 2026
MINNESOTA CANNABIS RETAIL COMPLIANCE · cannapath.org
What OCM can actually do, what they'll actually look at, and how to be ready before the door opens.
Why This Guide Exists
Most Minnesota retail operators have never been through an OCM inspection. That's not a knock — the market is young, and a lot of you are still in your first eighteen months of operation. But "never been through one" and "not going to go through one" are very different things, and the gap between them tends to close without warning.
Here's the thing worth understanding up front: an inspection is not a test you pass by being clever on the day. It's an audit of decisions you made months ago. By the time an inspector is standing in your vestibule, the outcome is largely already determined by whether your logs are current, your SOPs match your actual practice, and your staff can describe what they do without guessing.
That's actually good news. It means readiness is a thing you build, not a thing you perform.
This guide walks the inspection in the order it tends to happen. Not because OCM publishes a script — they don't — but because inspections follow a natural logic: credentials, documents, systems, people, physical premises, records. We'll go through each one, tell you what's being evaluated, and tell you what "ready" looks like.
Clarity, not fear. Let's go.
Part One: Understanding OCM's Actual Authority
Before the checklist, understand the legal footing. This matters because operators who don't know the boundaries tend to do one of two things: panic and over-comply, or push back in ways that create a violation where none existed.
The governing section is Minn. Stat. § 342.19. It's short, and worth reading in full at revisor.mn.gov. Here's what it establishes:
OCM can inspect at any time. The office may conduct inspections of any licensed cannabis business at any time to ensure compliance with the ownership and operation requirements of the chapter. There is no notice requirement for a licensed business. "At any time" means at any time.
Entry cannot be delayed. Upon presenting appropriate credentials to the owner, operator, or agent in charge, the office is authorized to enter any cannabis business without delay and at reasonable times, and to inspect and investigate during regular working hours and at other reasonable times — within reasonable limits and in a reasonable manner — any cannabis business and all relevant conditions, equipment, records, and materials therein.
Employees can be questioned privately. The statute explicitly authorizes the office to question privately any employer, owner, operator, agent, or employee of a cannabis business. Privately means without you in the room. This is the single most under-prepared-for element of a Minnesota inspection, and we'll spend real time on it below.
Refusal is itself a violation. An employer, owner, operator, agent, or employee must not refuse the office entry or otherwise deter or prohibit the office from taking action. There's no soft version of this. Stalling at the door is a finding.
You have a right to accompany. Here's the one operators consistently don't know: subject to rules issued by the office, a representative of the business shall be given an opportunity to accompany the office during the physical inspection for the purpose of aiding such inspection. Use it. Always.
Complaints trigger special inspections. Any person may report a suspected violation. If the office determines there are reasonable grounds to believe a violation or danger exists, it shall make a special inspection as soon as practicable, and shall prioritize inspections where there are reasonable grounds to believe a violation poses imminent danger to the public or customers.
Subpoena power exists. In making inspections and investigations, the office has the power to administer oaths, take depositions, issue subpoenas, and compel the attendance of witnesses and the production of papers, books, documents, records, and testimony. If they can't get it in the walkthrough, they can get it later.
And separately — don't forget your local compliance checks. Under Minn. Stat. § 342.22, a local unit of government shall conduct compliance checks of every retail-registered business, assessing age verification, applicable operation requirements, and limits on product types being sold — and must conduct unannounced age verification compliance checks at least once each calendar year. That's a separate, guaranteed, annual, unannounced knock. Most operators forget it entirely.
Two regulators. Different scopes. Both real.
Part Two: The Arrival
What happens
Someone walks in during business hours. They present credentials. They state their purpose. That's the trigger point — from that moment, the clock is running and everything is observable.
What's being evaluated (whether or not you realize it)
The first ninety seconds tell an experienced inspector a great deal. Not because they're judging your vibe, but because arrival reveals whether you have a system or whether you have a scramble. Does the person at the front know what to do? Do they know who to call? Does anyone check the credentials? Does the store keep operating, or does it freeze?
An operation with a real SOP looks calm. An operation without one looks exactly like what it is.
Ready looks like
A written Inspector Arrival SOP that every single staff member has actually read. Not "is in the binder." Has read. It should be one page and fit these beats:
1. Greet, don't obstruct. Never delay entry. Never say "let me check if that's okay."
2. Verify and record credentials. Ask for the credential, photograph or copy it, write down the inspector's name, agency, badge/ID number, and the time of arrival. This is not an act of resistance; it's basic recordkeeping and any professional inspector expects it.
3. Notify the designated contact immediately. One named primary, two named backups, phone numbers posted at the point of contact — not saved in someone's personal phone.
4. Designate the accompanying representative. Someone walks with them. Always. This is your statutory right and it's also your best source of truth about what actually happened.
5. Continue normal operations. Don't close. Don't shoo out customers. Don't start shredding — which should go without saying, but the statute's subpoena power means anything that vanishes today can be compelled tomorrow, with a far worse story attached.
6. Start the contemporaneous log. A running timeline: arrival time, who's present, what areas were entered, what documents were requested, what was said. Written as it happens, not reconstructed that night.
That last one is the highest-value habit in this entire guide. Memory degrades. Your contemporaneous log is what protects you when a finding shows up sixty days later describing an event nobody remembers accurately.
The manager-is-off-site problem
Statistically, your inspection will not happen on a day your most competent person is working. Plan for the Tuesday afternoon when your newest budtender is alone on the floor. If your arrival SOP only works when the GM is present, you don't have an arrival SOP — you have a GM.
Part Three: Required Documents
What's being evaluated
Not just whether the documents exist. Whether they're current, whether they're findable, and whether they match what's actually happening in the building.
The third one is the killer. A beautiful SOP describing a process nobody follows is worse than no SOP at all, because it converts an ambiguous practice question into a documented deviation from your own written standard.
The document set
Pull these together now, before you need them:
Licensing and registration
• Current OCM license and any endorsements
• Local retail registration
• Certificate of occupancy
• Local zoning certification
• Department of Revenue cannabis tax registration
• Any local conditional use permit
Governance
• Ownership disclosure and true party of interest documentation
• Any changes filed with OCM since original licensure — and proof they were filed
Operations
• Complete written SOP set
• Version control record showing revision dates and approvals
• Evidence that staff were trained on the current version
Personnel
• Employee roster, current
• Criminal history check documentation
• Training records for every employee
• Signed acknowledgments
Security
• Security plan
• Surveillance system documentation
• Alarm system records
• 90-day security system testing records
Financial
• Cash handling procedures
• Daily reconciliation records
• Tax filings
Ready looks like
One binder — physical or digital — organized by category, with an index. When an inspector asks for something, the correct response time is measured in seconds, not "let me look for that."
The digital-versus-physical debate is a distraction. What matters is that the thing is indexed and current. A well-organized physical binder beats a chaotic shared drive. A well-organized shared drive beats a chaotic binder. Chaos loses either way.
A quarterly document review calendar. Every quarter, someone confirms each document is current, each license is unexpired, each SOP reflects actual practice. Twenty minutes, four times a year. This is the cheapest insurance in the industry.
Part Four: SOP Review
What's being evaluated
Whether your written procedures cover what they're required to cover, and whether reality matches the paper.
The gap that kills people
Here's the pattern we see constantly: an operator buys or copies an SOP template. It's fine. It's comprehensive. It describes a receiving process with three signature points and a two-person verification step.
Nobody does that. Nobody has ever done that. The actual receiving process is one person with a clipboard.
Now you've got a problem you created yourself. Without the SOP, an inspector evaluates your practice against the rule. With the SOP, they evaluate your practice against your own written standard, and you've documented your own non-compliance.
Your SOPs must describe what you actually do. If your written process is aspirational, either start doing it or rewrite it to reflect reality — and make sure reality clears the regulatory floor.
Ready looks like
Every SOP has a version number, an effective date, an approver, and a revision history.
Every SOP has been walked. Literally. Someone reads the SOP aloud while someone else performs the task. Every mismatch is either a training gap or a document gap. Fix one or the other on the spot.
Every SOP maps to a source. Not for the inspector's benefit — for yours. When the rule changes, you need to know which documents are affected. A simple compliance matrix — requirement, citation, SOP, owner, last verified — turns a rule change from a panic into a Tuesday task.
Staff can find them. If your SOPs live on a laptop only the GM can log into, they functionally don't exist during a Tuesday afternoon inspection.
Part Five: Employee Interviews
This is the section most operators skip. Don't.
What's being evaluated
The statute grants OCM authority to question privately any employee. Private means you're not there. You don't get to coach. You don't get to clarify. You will find out what was said afterward, from your employee, filtered through their memory and their anxiety.
What's being evaluated is whether your compliance culture is real or performed. An inspector talks to three budtenders. If all three describe roughly the same process — the one in your SOP — you have a system. If they describe three different processes, or if they say "I'd have to ask my manager," you have a binder.
The wrong preparation
Do not script your employees. Do not tell them what to say. Do not tell them to be evasive, to deflect to management, or to say "I don't know" defensively. All of this is transparent to anyone who's done this work, it reads as coaching, and it converts a routine conversation into a credibility problem.
It's also, frankly, the wrong instinct. Your employees aren't a liability to be managed. They're the evidence that your training worked.
The right preparation
Train them so well that honest answers are good answers. That's the entire strategy. There is no other one.
Every employee should be able to answer, in their own words, without notes:
• What do you do when someone can't produce valid ID?
• What do you do when someone appears already impaired?
• What's the possession limit for a single transaction?
• What do you do if you notice inventory that doesn't match the system?
• What do you do if you suspect a diversion or theft?
• Who do you report a compliance concern to?
• What do you do when a customer asks whether this product will help their anxiety?
• What's the procedure when the surveillance system goes down?
• What happens at close?
That last cluster matters more than people realize. Under Minn. Stat. § 342.24, subd. 2(d) governs employee quality-control sampling — a genuine operational area where staff understanding tends to be thin and improvisation is common.
Tell your staff the truth about interviews, in advance. Something like: An inspector may ask to speak with you privately. That's normal and it's their legal right. Answer honestly. If you don't know something, say you don't know — that's an honest answer and it's a fine one. You will never be in trouble here for telling an inspector the truth. If you're unsure whether something is a compliance issue, tell me afterward and we'll look at it together.
Say it out loud, at a staff meeting, more than once. An employee who has heard that sentence behaves completely differently under questioning than one who hasn't.
Run the drill. Quarterly, someone your staff doesn't work with daily asks those questions cold. You'll learn more in twenty minutes than in a year of training modules.
The retaliation trap
If an employee tells an inspector something unflattering and you discipline them for it, you have created a problem substantially larger than whatever they said. The statute contemplates any person reporting a suspected violation. Your response to an honest employee is itself a data point about your operation.
Part Six: Surveillance Review
What's being evaluated
Coverage, retention, functionality, and access.
The specifics that bite
Is it recording right now? A camera that's up but not recording is a camera-shaped decoration. Someone should verify recording status daily and log it.
Is retention actually meeting the requirement? Check the math, not the setting. A DVR configured for the required retention period but overwriting early because someone added cameras without adding storage is one of the most common real-world failures. Verify by pulling footage from the oldest date you're required to have and confirming it exists.
Are there gaps in coverage? Walk your floor plan against your camera views. Every required area, actually covered, actually in focus, actually not obstructed by the seasonal display someone put up in October.
Can you produce footage on request? Right now. Not "our vendor can pull it." Can the person standing here, today, export a specific date and time range to a file and hand it over? If the answer requires a phone call to an integrator, that's your finding.
Is the 90-day testing documented? Security systems require testing and inspection at least every 90 days. Testing you did but didn't document is testing that didn't happen, from an audit perspective. And note the operational consequence: a license holder may not sell cannabis if a required security or statewide monitoring system is not operational. That's not a paperwork issue — that's a stop-selling issue.
Ready looks like
• Daily recording verification, logged
• Monthly footage retrieval test, logged — pick a random date, pull it, confirm it exists and is legible
• Quarterly system test with written documentation and a named tester
• A camera map that matches your floor plan
• A named person who can operate the export function, plus a named backup
Part Seven: Metrc
What's being evaluated
Whether your Metrc data is accurate, timely, and reconciles to physical reality.
The core standard
Every individual inventory movement, wholesale transfer, and retail transaction gets logged in real time in the statewide monitoring system. And the accuracy requirement is end-of-business-day — meaning your system and your shelf agree before the lights go off. Not weekly. Not "when we catch up."
This is, straightforwardly, the most commonly cited area in unannounced inspections. Not because operators are cavalier — because the discipline is genuinely hard and small errors compound quietly.
Ready looks like
A daily close-out that actually closes. Someone confirms every transaction posted, every adjustment is documented with a reason, every transfer is received and reconciled. Signed. Dated. Every day.
Documented reasons for every adjustment. An adjustment without a reason code and a narrative is an unexplained discrepancy. Enough unexplained discrepancies and you're not having a paperwork conversation anymore.
Named users, individual logins. Shared credentials destroy your ability to attribute any action to any person. When something goes wrong — and something will — attribution is the difference between "a trained employee made a documented error" and "we have no idea who did this."
Someone who understands the system, plus a backup. The single-point-of-failure Metrc admin is a business risk, not just a compliance one.
A written variance procedure. What's the threshold that triggers escalation? Who investigates? What's documented? How fast? Decide this on a calm day.
Part Eight: Inventory Reconciliation
What's being evaluated
Whether the number in the system equals the number on the shelf. And when it doesn't, whether you knew, and what you did.
The uncomfortable truth
Variance is not automatically a violation. Undetected, unexplained, unaddressed variance is. Every operation has variance. Mature operations catch it same-day, document it, investigate it, and close it out. Immature ones discover it during an inspection.
Which category you're in is entirely determined by whether you count.
Ready looks like
A written cycle count schedule that you follow. High-value SKUs more frequently. Full counts on a defined cadence. Documented, signed, dated.
A variance threshold with teeth. At what point does a discrepancy stop being noise and start being an investigation? Write the number down. Follow it.
An investigation record for every threshold breach. What happened, what you found, what you changed, who signed off, when it closed.
The theft escalation path, memorized. Theft or diversion has an 8-hour reporting window to OCM. Eight hours. That is not a lot of time to figure out who decides, who calls, and what gets said. Every manager should know the number, the deadline, and the decision authority without looking anything up.
Print it. Post it. Drill it.
Part Nine: Security Logs
What's being evaluated
Whether restricted areas are actually restricted, whether visitors are actually controlled, and whether you can prove it.
The logs that matter
Restricted-access log. Who entered limited-access areas, when, why, and who authorized it.
Visitor log. Every non-employee: name, company, purpose, time in, time out, escort name. Vendors. Contractors. Delivery drivers. The owner's cousin who stopped by. All of them.
Key and credential log. Who has access, when it was issued, when it was revoked. The termination-day access revocation is a place operations routinely fail — someone leaves on bad terms and their badge works for another three weeks.
Alarm event log. Every activation, every false alarm, every response, every resolution.
The signage requirement
Restricted-area signage has required statutory language. Not "roughly this idea" — specific language. Check yours against the source, not against what the last store you visited had on their door.
Ready looks like
Logs that are complete, contemporaneous, and legible. A log with gaps is worse than useless — it affirmatively documents that your control was inconsistent. If the log shows entries on twelve days in a month with thirty operating days, you've written down that you weren't watching for eighteen of them.
Either log everything or fix the process that makes logging everything impossible.
Part Ten: Training Records
What's being evaluated
Whether every employee received required training, whether you can prove it, and whether the training was on the current version of your procedures.
The requirement
Employee training obligations run through Minn. R. 9810.1102. Beyond the mandate itself, understand what an inspector is really doing here: they're connecting your training records to the employee interviews from Part Five. If your records show comprehensive training and your employees can't answer basic questions, your records aren't evidence — they're a contradiction.
Ready looks like
A training file per employee containing what training, when, who delivered it, what version of the material, signed acknowledgment, and any assessment.
Onboarding training completed before independent floor work. Not "in the first month."
Documented refresher training on a defined cycle. Annual, at minimum.
Retraining triggered by procedure changes. When an SOP changes, everyone affected gets retrained on the new version, and the record shows it. This is the link most operations are missing entirely — the SOP gets updated, the training file still shows acknowledgment of version 1.2, and the mismatch is right there in writing.
Records that survive turnover. Including for departed employees, per the retention schedule.
On the retention schedule
Minnesota uses a three-tiered records retention structure — different record categories carry different retention periods. Know which of your records fall in which tier. "We keep everything for a while" is not a retention policy.
Part Eleven: Packaging
What's being evaluated
Whether product leaving your store meets packaging requirements, and whether your exit procedure is consistent.
The specifics
Child-resistant, opaque exit packaging — every final purchase goes into an opaque, child-resistant exit bag before the customer leaves the retail area. Before they leave the area, not before they leave the building.
Original packaging integrity. Product should be in compliant packaging when you receive it. But "the manufacturer sent it that way" is not a complete defense — you're the last checkpoint before a consumer.
The universal symbol. The OCM universal intoxicating cannabinoid symbol must appear on packaging. Verify at receiving, not at sale.
Ready looks like
A receiving inspection step that includes packaging compliance. Documented. If it fails, it doesn't go on the shelf — and there's a written procedure for what happens to it instead.
Exit bag procedure trained and consistent. Every transaction. Including the regular. Including the five-minute-to-close rush. Including when someone's just buying one pre-roll.
A quarantine location and procedure for non-compliant product, with a log.
Part Twelve: Labeling
What's being evaluated
Whether labels contain required elements and whether nothing on or around the product makes a prohibited claim.
The health claims line
This is where good-faith operators get into trouble, and it usually isn't the label — it's the shelf talker, the menu description, the chalkboard, or the budtender's mouth.
Making health claims not substantiated by credible scientific evidence is prohibited across all channels. Your labels are probably fine, because your suppliers handle them. Your in-store merchandising and your staff's language are where the exposure lives.
"This one's great for anxiety" is a health claim. It's a health claim when a budtender says it conversationally to a customer they like. Your staff needs a trained, comfortable way to talk about product that stays on the right side of that line — not a rule that makes them afraid to talk at all, which just produces worse selling and worse customer experience.
Ready looks like
A label verification step at receiving, documented.
A merchandising review covering every piece of in-store copy: shelf talkers, menus, signage, printed materials.
Digital menu review on the same cadence — your website, your third-party menu integrations, your social. All of it is subject to the same rule.
Staff trained on the claims line with actual language they can use. This is a training problem, not a signage problem.
Part Thirteen: Incident Reports
What's being evaluated
Whether you document things going wrong, and whether documentation leads anywhere.
What counts as an incident
Broader than most operators assume:
• Theft or diversion, actual or suspected
• Inventory variance beyond threshold
• Security system failure
• Metrc outage or data error
• Denied sale escalation
• Customer medical event
• Product complaint or adverse event
• Employee compliance violation
• Law enforcement contact
• Anything involving a minor attempting purchase
The counterintuitive part
An empty incident log is a red flag, not a gold star.
Nobody with an operating retail business has zero incidents. An operation reporting none is telling an experienced reader one of two things: they don't recognize incidents, or they don't record them. Neither is the impression you want.
A log showing incidents identified, documented, investigated, and closed is evidence of a functioning system. That's what you want on the table.
Ready looks like
A standard incident form. What, when, where, who, what was done, what was reported, to whom, by when.
A clear reporting-trigger matrix. Which incidents require OCM notification, and on what timeline. The 8-hour theft window lives here. So does everything else with a clock on it.
Contemporaneous documentation. Written same day. Not reconstructed.
Closure documentation. An open incident from fourteen months ago is worse than the incident.
Part Fourteen: Corrective Actions
What's being evaluated
The thing that actually determines your trajectory as a licensee.
Findings happen. Every mature regulated business has a history of findings. What separates operations that stay licensed from operations that don't is not the absence of problems — it's the response to them.
After the walkthrough
Debrief immediately, while it's fresh. Your accompanying representative and everyone who interacted with the inspector. Write down what was asked, what was observed, what was said. Same day.
Don't argue in the moment about things you can verify later. If you disagree with an observation, note it in your log and address it through the formal process. Live debate creates a tone problem and rarely changes an outcome.
Fix what you can fix today, today. And document the fix with a timestamp.
When findings arrive
Meet every deadline. Whatever response window you're given, calendar it backwards from the due date with internal checkpoints. A missed corrective action deadline is a categorically different problem than the original finding.
Address root cause, not symptom. "We retrained the employee" is a symptom fix. "We identified that our receiving SOP had no verification step, added one, retrained all staff on version 2.1, and implemented a weekly audit" is a root cause fix. Inspectors read the difference instantly, and so does the next inspector, two years from now, looking at your history.
Document the whole arc. Finding, root cause analysis, corrective action, implementation date, verification, sign-off.
Follow up on your own follow-up. Thirty days later, is the fix still in place? Ninety? A corrective action that decayed is worse than none, because now you've documented that your fixes don't stick.
The escalation reality
Understand where this leads if it goes badly. Minn. Stat. § 342.21 governs license suspension and revocation. § 342.19 connects inspection findings to penalties under § 342.09, subd. 6. And locally, a local unit of government may suspend your retail registration if it determines you're not operating in compliance or that your operation poses an immediate threat — with the office reviewing and either ordering reinstatement or taking action under 342.19 or 342.21. That local suspension runs up to 30 days unless the office suspends or revokes for longer.
That's the ladder. Corrective action is how you get off it.
Part Fifteen: The Honest Summary
If you take nothing else from four thousand words:
Inspection readiness is a daily practice, not a project. The operators who do well are not the ones who prepared hard for two weeks. They're the ones who reconcile Metrc every night, log every visitor, verify recording every morning, and count on schedule. The inspection just observes what was already true.
Your written procedures must match your actual practice. Aspirational SOPs are self-inflicted findings.
Your employees are your best evidence or your biggest exposure, and the variable is training, not coaching.
Contemporaneous documentation is worth more than accurate memory, because in twelve months you will not have accurate memory.
Findings are survivable. Patterns are not. A finding, corrected at root cause and documented, is a business operating normally. The same finding three times is a story about your operation.
None of this requires you to be afraid. It requires you to be systematic. Those are different things, and the second one is achievable on a Tuesday.
Where To Go From Here
Every citation in this guide comes from primary sources at revisor.mn.gov. We'd encourage you to read § 342.19, § 342.22, § 342.24, and Minn. R. 9810 yourself. OCM summary pages are useful orientation; the statute is what governs.
The rest is just doing it. Reconcile every night. Log every visitor. Verify recording every morning. Count on schedule. Write things down while they're happening. None of it is complicated, and all of it is easier to start on an ordinary Tuesday than on the day someone presents credentials at your counter.
If you'd rather not build the logs and forms from scratch while you're also running a store, that's what our document library is for. And if you want a second set of eyes on where your operation actually stands, that's what we do.
If you've made it this far, you're already doing something many operators never do—you've invested time in understanding your responsibilities before someone asks to see them.
That's what good compliance looks like.
It isn't perfection.
It's preparation.
It's consistency.
It's creating systems that let you spend less time worrying about inspections and more time serving your customers.
That's the business CannaPath hopes to help build across Minnesota.
-Drew
