The 2027 Compliance Trap: Your Business Can Grow Faster Than Your SOPs
Drew Duffy, MHA, FACHE, Founder & Managing Director, CannaPath Regulatory Solutions
The most common compliance problem we see is not a business breaking a rule on purpose. It is a business that changed while its written procedures stayed exactly where they were. |
The biggest compliance problem Minnesota cannabis businesses are going to run into in 2027 will not come from anyone deliberately ignoring a rule. It will come from something a lot more ordinary than that. The business changes, sometimes very quickly, and the compliance system sitting behind the business does not change with it.
That happens constantly in a growing company. A retailer gets busier and hires. A manufacturer adds a product line. The POS gets replaced because the old one was not working. Somebody finally upgrades the security system, a room gets put into service or repurposed, an endorsement gets added that lets the business do something it could not do before. Businesses adapt because they have to adapt.
The SOPs do not always adapt with them.
We can finally put a number on this
For most of the time I have worked in compliance, this was something you asserted. You knew it was true because you had seen it, but you could not size it.
We can size it now. As of this writing, Sentinel Scout has taken in 102 submissions. In 67% of them, something about the way the business actually operates had changed and the SOP had not been brought along with it.
Sixty-seven percent. Two out of three. And I want to be clear about what that number is not. It is not two out of three businesses missing a required document. Missing documents are easy to find and easy to fix. This is two out of three businesses holding a complete, properly formatted, fully submitted procedure that no longer describes what happens in the building.
That is a harder problem, because nothing about it looks wrong until somebody asks a question.
Sentinel Scout findings across 102 SOP submissions.
What it looks like in practice
Here is one, with the identifying details stripped out.
An operator opened the way a lot of small shops open. Everything went into Metrc by hand. Sales ran through a separate system that did not talk to Metrc at all, so somebody reconciled the two. It worked. It was slow and it was tedious, but it worked, and the SOP described it accurately because somebody had sat down and written out what they were actually doing.
Then they upgraded to a POS that integrates directly with Metrc.
That was a good business decision. It cut the double entry, it sped up the close, and it removed the chance of somebody fat-fingering a number into the state's system at the end of a fourteen-hour day. I would have told them to do it.
But look at everything that moved. Inventory stopped being entered by a person and started being pushed by software, which means the control is now a configuration rather than a human step. The sales workflow changed. Reconciliation changed, because what you are reconciling against is a different thing than it was. Who can adjust inventory changed, because permissions in a POS are not the same as who happens to have the Metrc login. Where an error can hide changed completely.
Not just product. Sales too. The whole shape of the thing.
The SOP still described the manual process.
Nobody did anything wrong here. There was no moment that felt like a compliance event. That is precisely why it goes unnoticed, and it is why OCM lists implementing a new point-of-sale system, or replacing an existing one, as a material change for adult-use and medical cannabis retail. The state understands what a POS change actually touches. The question is whether the business does.
The part that worries me more than the SOP
In about 35% of all 102 submissions, something at the store had been upgraded and the policies and procedures never followed. That is more than half of everything we flagged. The single most common way a Minnesota cannabis business ends up out of step with its own documentation is by improving something.
One of those businesses had just trained five new employees.
Sit with that for a second, because there are two problems in it and most people only see the first one.
The first problem is obvious enough. Five people were trained to the current process. The current process is not the documented process. So five employees are now doing the job a way the company cannot demonstrate to an inspector, and they are doing it correctly by the only standard anyone gave them.
The second problem is the one that concerns me the most. Those five employees learned something else in their first week that nobody intended to teach them. They learned that the SOP does not describe how the job is done here. Nobody said it out loud. They worked it out, the way anybody would, by noticing the gap between the binder and the floor.
So when they have a question six months from now, they are not going to open the SOP. They are going to ask the person next to them.
That is how a company ends up running on word of mouth. And it is a very hard thing to undo, because you are no longer fixing a document. You are fixing what people believe the document is for.
Growth changes the control even when the name of the process does not
One of the easiest mistakes with SOPs is assuming the process is still fundamentally the same because it still has the same name.
Inventory reconciliation is called inventory reconciliation whether you are reconciling twenty-five products or four hundred. The words did not change. The control environment absolutely did.
When four people work in a building, everybody knows who has access to what, and the informal control is real even if it is not written down. Once you are at twelve, responsibilities get divided, shifts rotate, managers take over different functions, and access gets complicated fast. A procedure that gave you genuine control when two people handled a task may give you almost nothing when ten people do.
Manufacturing works the same way. A small manufacturer may start with one product category and a simple process, then add equipment, add products, add methods, and add people who need access to all of it. OCM treats new processing equipment and new product categories as material changes for exactly this reason. They change the approved operational structure of the business.
So opening the SOP and asking whether it still sounds right is not enough. The question is whether the control still works for the business you have now.
Sometimes the employees know before the compliance department does
There is a test I like because it costs nothing.
Take somebody who actually performs the job and ask them to walk you through it without letting them look at the SOP first. Let them explain what they do, in the order they really do it, with the systems they really use.
Then compare that to the written procedure.
You will learn one of three things. The employee is following the SOP, which is great. The SOP is technically correct but missing practical steps that grew in around it. Or the employee is doing something materially different because the written process stopped making sense a while ago.
That third one is more common than most businesses expect, and it is not a personnel problem. Employees are trying to get the job done. When a procedure becomes impractical they find a better way, they teach the next person the better way, and the manager accepts it because it works.
A number of Scout submissions have turned into engagements, which means we went out and walked the building. We find more on the walkthrough than the document review found. Every time.
The one I keep running into, and I am going to say it plainly because I am seeing it everywhere: the door to the vault room standing open. Not unlocked. Open.
Nobody is being reckless. The room is busy, people are in and out all day, the door is heavy, and propping it saves twenty seconds a trip. Then it stays propped. Then it is just how the room works. And it appears in no SOP anywhere, because obviously no SOP says to leave the vault open.
That is a limited-access area. Treat an open vault door as a serious finding, because an inspector will.
2027 gives everyone more reasons to change
The reason this deserves attention right now is that Minnesota's framework is still moving, and a lot of what lands on January 1 gives businesses new ways to expand what they do.
Qualifying cannabis businesses will be able to pursue medical cannabis endorsements for cultivation, manufacturing and retail. The medical cannabis combination business license goes away and becomes the macrobusiness license, with OCM converting existing licenses over. There is new room for microbusinesses and mezzobusinesses to expand through medical endorsements.
All of that is opportunity. It is also a lot of operational change arriving at once.
Two pieces of it are going to create more SOP drift than anything else in the law.
The first is the supply chain merger. Right now a business cultivating both medical and adult-use has to keep them separated physically, tracked separately, stored separately, never run on the same equipment at the same time, with a log for every shared piece of equipment. That bifurcation ends. For most of the supply chain the line between medical and adult-use moves down to the point of retail sale. If your inventory control procedures were built around segregation, they were built around a structure that is changing underneath them.
One honest caveat on that. The statute changes January 1. As of this writing, the rules in Chapter 9810 still read the way they have read all along. Watch for OCM guidance and do not assume the rule text has caught up just because the law has.
The second is quieter and easier to miss. A retail location holding a medical cannabis endorsement has to employ or contract a pharmacist or a certified medical cannabis consultant. Adding that person is itself on OCM's material change list for medical cannabis retail. So the endorsement triggers a staffing requirement, and the staffing requirement triggers its own separate filing. One decision, two obligations, and they do not arrive in the same envelope.
The mistake is thinking the compliance work finished when the endorsement got approved. That is the moment to ask the only question that matters here.
What else changed because of this?
What takes effect January 1, 2027, and where documentation is exposed.
Change is not the problem. Unevaluated change is.
I do not want anyone reading this and becoming afraid to change anything.
Change is normal. Growth is normal. Technology gets replaced, employees leave, vendors fall through, equipment breaks, and businesses find better ways to work. A compliance program that cannot survive ordinary operational change is not a good compliance program.
OCM already draws the line for you, and the line is reasonable. Material changes get submitted and reviewed. Non-material changes do not require notifying OCM, but you still have to maintain internal documentation and have it available during an onsite inspection.
That second half is where people get hurt. "We did not have to tell OCM" is not the same sentence as "we did not have to write it down."
Two details are worth knowing because they bite.
If the change affects cultivation or manufacturing, OCM needs it at least ten business days before you implement it. Business days, not calendar days. Count them on a calendar and give yourself room.
And material changes have to be submitted and reviewed before you apply for renewal. Drift does not just sit there quietly forever. It has a due date, and the due date is your renewal.
So the answer is not to treat every change like a rewrite of your whole compliance system. The answer is that change has to be evaluated by somebody. Sometimes that produces an updated SOP. Sometimes it is a training change, sometimes an FPOR submission, sometimes documentation with no filing at all. Sometimes the honest answer is that nothing needs to change.
The point is that a person made that determination instead of everyone assuming it was fine.
OCM's line between material and non-material changes.
Common operational changes and what each one obligates you to revisit.
This is where the annual review falls short
I believe in reviewing compliance documentation on a schedule. I just do not believe the annual review can be the primary mechanism for keeping SOPs current.
A business can change twelve times between annual reviews. By the time somebody sits down in December with a stack of documents, the important operational changes happened in March, and in June, and in September, and nobody has looked at the control implications of any of them.
Review has to be connected to the business, not to the calendar. When something meaningful changes, that change itself should prompt somebody to stop and ask what it means. You do not have to halt operations every time someone buys a piece of equipment. You do need a way to recognize when a normal business decision has crossed into a controlled process.
That produces a much more realistic program, because the documentation is being maintained as the business evolves instead of being rewritten once a year to catch up with everything that already happened.
The real 2027 trap
When people hear "2027 compliance," they think about new rules. Fair enough. Businesses do need to understand what is changing, what applies to them, and what they have to do differently.
The trap comes after that.
The rule changes. Management decides how to respond. The process changes, employees get trained, the software gets configured, the work starts happening differently. And then everyone moves on to the next problem, because there is always a next problem.
That is how a gap opens up without anybody making a reckless decision. The business is operating under the new requirements while part of the compliance system is still describing the old operation.
Which brings me back to the thing I keep saying. Your SOPs should describe the business you actually operate. Not the business you had when you opened. Not the business you hope to become. Not the business that existed before the last three major changes.
The one you are running right now.
Your business is allowed to outgrow its SOPs
There is nothing shameful about discovering your business has changed faster than your documentation. In a growing company I would expect it to happen.
The problem is letting the gap sit.
A good compliance system is not a binder that announces how you operate. It is a living reflection of how the business actually functions, with enough structure behind it to keep people doing the right thing as the organization gets more complicated.
So the best time to look at your SOPs is not when an inspection is coming and it is not only when the annual review comes due. It is when you realize the business has changed in some meaningful way and you want to know whether the compliance system changed with it.
Going into 2027, that may be the single most useful compliance exercise a Minnesota cannabis business can do. Take the business that exists today and compare it honestly to the business your documentation describes. Then look hard at the places where those two have started to separate, because that is usually where your next finding is hiding.
Your business can grow faster than your SOPs.
That is not a failure.
Not noticing is.
Questions people actually ask about this:
Does replacing a point-of-sale system require notifying OCM?
Yes. OCM lists implementing a new point-of-sale system, or replacing an existing one used for sales transactions, as a material change for adult-use and medical cannabis retail. It is recorded in your Site, Security and Operations Final Plans of Record, and the updated FPOR goes to OCM for review.
What counts as a material change to a Final Plan of Record?
OCM publishes the list, and it is longer than most operators expect. Adding or reducing square footage, adding or repurposing rooms, structural modifications, replacing major building systems, changes to cultivation methods or drying and curing practices, new crop inputs, new processing equipment, new product categories, new extraction methods, installing a new alarm or camera system, changing security providers, changes to point-of-sale systems, adding or removing a pharmacist or certified medical cannabis consultant, and new testing methods or instruments all appear on it. If you changed something that sounds like any of those, assume it needs a look.
What happens if my SOP does not match how we actually operate?
The documentation and the operation are supposed to describe the same business. When they do not, the gap is the problem, not the document. How serious it is depends on what drifted: a procedure that is missing a few practical steps is a different situation from a procedure describing a control that no longer exists.
The useful first move is not to rewrite anything. It is to find out how far apart the two actually are. Walk the process with the person who performs it, compare that to what is written, and write down what you find. If the change behind the gap was a material one, that also tells you whether something is owed to OCM.
How much advance notice does OCM need before a change?
If the change affects cannabis cultivation or manufacturing, OCM requires notice at least ten business days before you implement it. Business days, not calendar days. Other material changes do not carry that advance window, but they still have to be submitted and reviewed.
Do non-material changes have to be documented?
Yes, and this is the part most operators miss. Non-material changes do not require notifying OCM, but you must maintain internal documentation and have it available during an onsite inspection. Not having to tell the state is not the same as not having to write it down.
Do SOPs have to be current before license renewal?
Material changes must be submitted and reviewed by OCM before you apply to renew. So an unresolved gap does not sit quietly forever. Renewal is the deadline whether you treated it as one or not.
What changes for medical cannabis endorsements on January 1, 2027?
Qualifying cannabis businesses can pursue medical cannabis endorsements for cultivation, manufacturing and retail. The medical cannabis combination business license converts to a macrobusiness license. For most of the supply chain, the separation between medical and adult-use moves down to the point of retail sale, which affects inventory procedures written around keeping the two apart. A retail location holding a medical cannabis endorsement also has to employ or contract a pharmacist or certified medical cannabis consultant, and that staffing change is its own material change filing.
One Last Thing, and It Has Nothing to Do With the Rules
There is one thing we hear almost every day. Some version of "I wish we had hired a consultant earlier."
The reasons people wait are completely understandable. A lot of you were operating for months without revenue. When money is that tight, paying for help is the easiest thing to push to next quarter.
It did not help that when Minnesota first legalized, we got a wave of out-of-state companies selling complete SOP template packages. You already know how that went. Those templates were not written for Minnesota, and Minnesota is not a state where that gets you through an inspection.
We also had out-of-state law firms moving into this market telling operators that getting them licensed and compliant would run $80,000 to $100,000 in fees. That is not what that work costs, and I would hate to think somebody walked away from this business because they believed it.
I want to be clear that this is not a shot at attorneys. I know the cannabis firms here in Minnesota, and they are genuinely good. I would trust any of them with a client. We refer work to a couple of them when something needs legal advice our in-house counsel cannot give. Of course I want your business. But the firms based here are good, and you should hear that from someone who competes with them.
So here is the part I actually want you to take away, and it applies whether you call us or call one of them.
Find your compliance partner before you need one.
I will tell you exactly how the economics work, because it is not complicated and nobody in this industry says it out loud.
The most expensive engagement we ever take is the one that starts with a call from someone we have never met, holding a deficiency, with ten days to respond.
Look at what that actually requires. We reorder the week for clients who have been with us for a year. Then we learn your entire operation from nothing, against a deadline somebody else set. Your site, your procedures, your systems, your history, fast enough to write something that will hold up. Every one of those hours is a discovery hour, and discovery hours do not fix anything. They only get us to the point where the real work can start.
The operators who pay the least are the ones who brought us in early. Some of that is rate, because emergency work costs more per hour here and everywhere else, and that is not punitive. It is what it costs to drop everything. But most of it is hours. When we already know your building and helped write your procedures, we are responding in the first hour instead of spending three days learning who you are.
Same deficiency. Completely different bill. The only variable is whether the relationship existed before the deadline did.
I am not telling you this to scare you into calling today. Most of you are not in trouble, and the entire point of what we write is to help you stay that way.
I am telling you because we watch the other version happen, and it is avoidable almost every time. Good people running real businesses who did everything right except make the call before the clock started.
I cant speak for everyone, but I can for us. if we have done anything with you, you are not an unknown. We have people email us all the time with just a question. That doesn't require a contract, and usually does not involve any cost, but for CannaPath that is the start of a relationship. For those of you who have submitted something through Scout, that certainly counts as a relationship. The point being , it does not have to be some large engagement, rather just so wee get an idea of who you are and how you run your business. we are confident that when Sentinel drops in March, some of this will no longer be an issue, as that is part of what this software is designed to catch.
Sentinel is the compliance platform we are building to keep the documentation and the operation in the same place, so drift gets caught when it happens instead of at renewal. Scout is available now, and is already showing people what they need if anything. To be clear not every one of those 102 submissions we received had issues, in fact some of you did incredible. This article is not meant to scare you, it just shows how quickly things change in this world and how easy it can be to have compliance drift. As always if you get into something where a second set of eyes would help, reach out, hello@cannapath.org. And if you would rather not speak with someone try Sentinel scout, its live right now on our website. If you would like to be notified when the launch date is, or any updates to this system, email: thewatch@cannapath.org , and we will get you on that list. And no we do not sell any info, nor will market to you, we don't have time for that and neither do you.
-Drew
Last reviewed: October 1, 2026
Regulatory sources: Minnesota Office of Cannabis Management guidance on material changes to Final Plans of Record; Minnesota Rules, chapter 9810; Minnesota Laws 2026, chapter 123. Rules change and figures should be verified with OCM. This article is educational information and is not legal advice.
