You Received a Minnesota Cannabis Compliance Deficiency Notice. Now What?

By Drew Duffy, MHA, FACHE, Founder & Managing Director of CannaPath Regulatory Solutions

Last reviewed August 31, 2026   ·  

THE SHORT VERSION

An OCM administrative order has to tell you two things: the deficiencies that make up the violation, and the time by which it must be corrected. Read both before you fix anything.

If you believe the order is wrong, you have seven days from receipt to ask for reconsideration. In writing, by certified mail, with documentation. OCM has 15 days to answer, and asking does not pause your correction deadline unless OCM issues a supplemental order granting more time.

Separately, Chapter 9810 carries its own repair deadlines that run without any order from OCM at all, including a 72-hour alarm rule that can require you to stop operating until the repair is done.

Fix the cause, not just the symptom. Document all of it. And find your compliance help before any of this happens, not after.

Nobody wants that email

You have been running your Minnesota cannabis business. Managing employees, serving customers, tracking inventory, dealing with vendors, and handling about a thousand other things that were not on the schedule this morning.

Then OCM identifies a deficiency.

Your first instinct may be to panic. Your second may be to start fixing everything you can think of at once.

Slow down. Not for long. But slow down.

A deficiency is serious, and the worst thing you can do is react before you understand three things: what you have actually been cited for, what OCM is requiring you to do about it, and how much time you actually have. That last one matters more than most operators realize, and it is the one people get wrong.

What a deficiency actually is

When OCM determines that a licensed cannabis or hemp business has violated Chapter 342 or the rules adopted under it, the office can issue an administrative order. That order may require you to correct the violation, to cease and desist from it, or both.

Two things the statute requires the order to contain: the deficiencies that constitute the violation, and the time by which the violation must be corrected. That is Minn. Stat. 342.19, subd. 5, and it is worth knowing by name because almost everything else in this article hangs off it.

Which means there is no universal thirty-day rule. There is no standard correction window that applies to everything. There is whatever your particular order says, about your particular deficiency.

Your deadline is a fact you read off the page. It is not a thing you assume, and it is not a thing anyone can tell you over the phone without seeing the order.

The clock. And the second clock.

This is the single most important thing I can tell an operator holding one of these notices.

Do not assume you have time. Find out exactly how much time you have. And understand that there can be more than one clock running at once.

If you believe something in the order is wrong, you can ask OCM to reconsider the parts you think are in error. That request carries three requirements, and the middle one is where I see people slip. It has to be in writing. It has to be delivered to the office by certified mail. And it has to be there within seven days after you received the order, with documentation supporting the claim of error. OCM then has 15 days to respond.

An email does not satisfy that. Certified mail is in the statute.

Now the part that operators consistently get backwards. Asking for reconsideration does not stay your correction order. The correction clock keeps running while you wait. It pauses only if OCM issues a supplemental order granting additional time. And OCM's disposition of a reconsideration request is final.

So filing for reconsideration does not buy you time. It buys you an answer. You keep working the correction while you wait for it, and you plan on the assumption that your original deadline stands, because unless OCM says otherwise, it does.

One more trap. Minnesota has more than one reconsideration process in the cannabis rules, and they do not run on the same rules. Mixing them up costs you the deadline.

Note the difference between days and business days across those rows. That is not a typo in the table. It is a real distinction in the source material, and it changes your actual calendar date.

Some clocks do not wait for OCM

Everything above assumes a clock that starts when an order lands in your inbox. Several of Minnesota's clocks are already running before OCM sends you anything at all.

These live in the rules themselves, mostly in the security chapter, and they are self-executing. Nobody issues an order to start them. There is no notice, no correction window, and no reconsideration process. You are simply out of compliance the moment one of them lapses, and you may not find out until an inspector asks when the light burned out.

The 72-hour row is the one I would put on the wall. If your alarm system fails and you cannot finish repairs inside 72 hours, and the system cannot operate the way the rules require, the rule says you stop operating until it is fixed. You can contact OCM to ask for an extension, and you absolutely should. But absent that extension, the obligation is to cease operations. There is no order, no hearing, and no negotiation written into that sentence.

The eight-hour trigger sits alongside it. If an alarm failure is expected to run longer than eight hours, you notify local law enforcement and OCM promptly and put your alternative security measures in place. If you have no alternative measure, or the alternative also fails, operations stop there too.

This is the whole argument for knowing which deadlines live inside your own rules instead of waiting to be told. A deficiency order tells you what OCM found. These tell you what was already true before anyone walked in the door.

Read everything before you fix anything

Do not skim the notice and jump straight into repairs. Sit down with it and pull it apart until you can answer every question below without guessing.

You have to separate the actual deficiency from everything else you suddenly became worried about at 9pm. This is where operators get themselves into trouble. They receive a citation for one problem and immediately decide they need to rewrite every SOP in the building, retrain every employee, replace every form, and rebuild the whole compliance program.

Maybe they do. Maybe they do not. You cannot know until you have read the thing carefully enough to say what the regulator is actually asking you to correct.

Then ask whether it is isolated or systemic

This is where a real compliance review earns its money.

Say OCM identifies that employees were not properly documenting something. The obvious response is to fix the form. The better question is why they were not documenting it.

Only one of those paths is a genuinely isolated problem. The other four mean the form was never the issue, and replacing it leaves the actual failure sitting exactly where it was. If the deficiency is evidence of a broader breakdown, fixing the symptom just means you will see the same citation again with a different date on it.

“We fixed it” is not a response

Another mistake is thinking the work ends when the problem stops. It does not. You need to be able to demonstrate what you did, and demonstrate it later, to someone who was not there.

If an SOP changed, preserve the revised version and the old one. If employees were retrained, document the training, who attended, and when. If a process was corrected, record when and who was responsible. If a form or log was created or modified, keep the records that show it.

The second column stops the bleeding. The third column is a compliance position. They are not the same document and they will not read the same way to a regulator.

There is money attached to this

Here is a part of the statute that rarely makes it into the conversation, and it belongs in front of you. The same subdivision that authorizes the correction order also authorizes penalties. For each violation of the chapter or its rules, OCM may issue a monetary penalty of up to $10,000, an amount that strips the business of any economic advantage gained by the violation, or both. Administrative penalties can be recovered in a civil action. And any applicable criminal penalty sits on top of all of that, not instead of it.

License suspension and revocation run on a separate track under a different section of the chapter, with their own hearing process.

I am not raising this to frighten anybody. I am raising it because the size of the downside is part of how you decide what the correction is worth, and how quickly you move.

Where I stop and your attorney starts

I am a compliance consultant, not an attorney, and this is education rather than legal advice. If you are looking at a penalty, a cease-and-desist, or anything touching suspension or revocation, that is a conversation to have with counsel. Bring your compliance people in alongside them, not instead of them.

Why the relationship has to exist before you need it

I talk constantly about building a compliance program before you need one. The same logic applies to the person you call.

When a deficiency lands, you are not calling a consultant to ask whether they might be able to help with compliance sometime. You are calling to say we have a problem and we need you now. Those are completely different conversations, and they cost completely different amounts.

Someone who already knows your operation, your SOPs, your systems, your staff, and your history can start on the actual problem. Someone who has never seen your business has to learn all of it first, on your clock, at your expense.

Everything in that upper track is work you are paying for before anyone touches the deficiency. It is also time coming out of a window that is already running. And there is a scheduling reality on top of it: a reputable firm has other clients, inspections, SOP builds, training projects, and deadlines already on the calendar. Dropping all of that to take an emergency is possible. It is neither easy nor cheap, and rush work is priced like rush work anywhere else.

Even a good program will eventually get one

I do not want to lose this point in everything above. Having a compliance professional does not mean you will never receive a deficiency. It would be irresponsible for anyone to promise that, and you should be suspicious of anyone who does.

You can have excellent SOPs. You can train every employee. You can run internal audits on a schedule. You can have a consultant reviewing your operation. And you can still get cited.

Because your business is operated by people. Employees have bad days. Someone gets distracted. Someone misunderstands a procedure. Someone skips a step because they are in a hurry and nothing bad has ever happened before. A vendor walks in for what is supposed to be a five-minute delivery and forgets a required part of the process. A new hire does something differently than they were trained. A manager makes a judgment call that turns out to be wrong.

And Murphy's Law appears to have a standing arrangement with regulatory inspections. The one afternoon when someone is having a terrible day, the new person is covering the counter, your manager is juggling three problems, and a vendor showed up unannounced? That is the afternoon the inspector walks through the door.

That is not necessarily a failure of your compliance program. That is a business being operated by human beings.

Good compliance is resilience, not perfection

The purpose of compliance is not to build a business where nothing ever goes wrong. That business does not exist. The purpose is to build one where, when something does go wrong, you recognize it, correct it, document the correction, and stop it from becoming something larger.

The strongest programs I see are not the ones where everyone pretends mistakes never happen. They are the ones that assume mistakes will happen and build the systems to catch them. Employees know what to do. Managers know what to look for. Documentation is maintained rather than reconstructed. The SOPs describe what the business actually does, not what somebody wished it did. Internal reviews happen on a schedule instead of when someone remembers. And there is a person who understands the operation well enough to step in fast when something goes sideways.

You are not paying a compliance professional to guarantee you never have a problem. You are paying them to help you identify risk, reduce the risk that is unnecessary, stay prepared, and respond well when something slips through anyway. That is a real difference.

Prevention is still the whole strategy

None of this makes deficiencies inevitable. The goal is to find your problems internally before OCM finds them for you.

Routine compliance reviews, employee training, SOP reviews against actual practice, documentation audits, inventory checks, and regular operational walkthroughs all surface weaknesses while they are still cheap to fix. OCM publishes inspection materials that show what the office looks for, which makes preparing considerably easier than guessing.

Which means compliance is not something you think about when you hear an inspection is coming. It is how the business runs on an ordinary Tuesday.

Do not put it in the “when we have time” folder

This should go without saying. It does not, because it happens.

An operator reads the notice, feels the weight of it, and thinks, we will get to it. A deficiency does not go in that folder. It goes to the top of the list, the day it arrives, before the clock has taken anything away from you.

The goal is not to be afraid of OCM

Compliance built on fear is exhausting and it does not work. You should not be standing in your store every morning wondering whether today is the day someone walks in with credentials.

You should be able to look at your operation and say: we know what our requirements are, we know how we actually operate, our people are trained, our documentation is current, we audit ourselves, and if something goes wrong we know exactly who we are calling.

That is a much better place to run a business from.

The best time to make that call is before there is anything to report

Find the compliance professional or firm that understands your business and understands Minnesota's regulatory environment. Have them review your operation while nothing is wrong. Learn how they work and what their response process looks like. Make sure they know your business well enough that when you call and say I just received a deficiency, the answer is send it over, let's look at it.

Not, okay, tell me who you are and what you do.

That difference is worth a great deal when there is a date on a piece of paper staring back at you.

You should absolutely do everything you can to prevent deficiencies. But good compliance planning also accepts something simple: sometimes things go wrong anyway. When they do, you want to spend your time fixing the problem, not searching for somebody who can help you fix it.

Before you go

If there is one thing I hope you take away from this, it is this:

Do not wait for a deficiency to start taking compliance seriously.

If you do find yourself staring at an OCM notice someday, you do not have to figure out the compliance side of it alone. Reach out to us at hello@cannapath.org. We can help you understand what you are looking at, what needs to be addressed, and what the next steps should be.

Hopefully, you never need that call.

But if you do, it is a lot better to already know who is on the other end of the phone.

-Drew

A note from CannaPath

This article is intended for general educational purposes and is not legal advice. Review the specific notice or order you received, because deadlines and requirements depend on what your order says. Deadlines described here reflect Minn. Stat. 342.19, subd. 5 and Minn. R. 9810.1500 as published by the Minnesota Revisor of Statutes at the time of writing; rules and guidance change, so verify against current sources and consult appropriate legal and compliance professionals about your own circumstances.