Cannabis Compliance & Metrc Operations

Scope: This file covers three operational domains that the inventory-side compliance KPI in inventory-kpis.md depends on: (1) Metrc audit cadence (monthly / quarterly / annual reconciliation rhythms), (2) the 4 manifest types operators handle daily (incoming, outgoing, transfer, adjustment), and (3) state-specific cannabis expiration rules across the 6 largest licensed markets (CA, CO, MI, IL, FL, NY). These rules are the regulatory ceiling that sits above the practitioner 90/120/180-day flower aging thresholds cited in inventory-kpis.md's dead-stock callout.

Source: practitioner operations playbook from Treez operator network (~300 orgs across 24 legal states), as of 2025-2026. This is operational guidance, not legal advice — state regulators publish authoritative rules; verify with your state regulator and seek counsel before changing compliance posture.

For state-by-state cannabis legal status see legality.md. For compliance-tech tooling (Metrc API integrations, BioTrack bridges, audit-prep software) see tech-compliance.md. For the inventory KPI that consumes this file's audit cadence and expiration rules see inventory-kpis.md — specifically the Compliance Adherence Rate KPI and the Dead Stock Aging Thresholds callout.

Audit Cadence

Compliance audit work in a licensed dispensary runs on three nested rhythms: a monthly Metrc reconciliation (the operational core), a quarterly internal audit (the integrity check), and an annual external audit prep + state filing (the regulatory capstone). Each cadence catches a different class of error. Operators who run only the monthly rhythm tend to catch weight variance but miss cumulative process drift; operators who run only the quarterly tend to catch process drift but carry 60+ days of silent weight variance into each cycle.

Monthly

End-of-month Metrc reconciliation: package-level on-hand snapshot reconciled against Metrc API state.

Cadence: last business day of each month.
Owner: inventory manager (single-store) or compliance lead (multi-store / MSO).
What it catches: weight variance (package-level on-hand vs Metrc), lost packages (tagged in Metrc but not physically located), manifest misclosures from the prior 30 days, expired Metrc tags that weren't caught at receiving.
Typical variance threshold before escalation: ±2% by category by store. Beyond that, the compliance lead opens a variance log entry and may trigger a partial physical count.
Treez operator network practice: if monthly variance exceeds 3% for two consecutive months, trigger a full physical count. Cumulative drift >5% signals a systemic process issue (typical root causes: weigh-tare protocol at receiving, deli-prep weight accuracy, or POS-vs-Metrc sync lag).
Typical duration: 4–8 hours for a single store; 2–3 full days for an MSO with 5+ stores running serially.

Quarterly

Internal compliance audit: random-sample 10% of received manifests and transaction records against Metrc transfer logs.

Cadence: end of Q1, Q2, Q3, Q4 (aligned to the company's fiscal calendar, not the calendar year, if they differ).
Owner: compliance lead or general manager.
What it catches: receiving-process drift (bud-tender misweighing during deli prep), missing manifest acknowledgments (incoming manifests accepted but never closed in Metrc), expired Metrc tags on shelf product, age-verification log gaps, sales-side compliance flags (a sale recorded but no valid ID scan on file).
Typical artifacts: a quarterly audit report naming the sample size, the anomalies found, remediation steps, and an "audit opinion" paragraph (clean / findings / material concerns).
Treez operator network practice: compliance lead owns the audit plan; a rotation of bud-tenders and inventory staff help execute so operational staff see the audit discipline firsthand.

Annual

External audit prep + state-mandated annual filings.

Cadence: 60 days before state license renewal date (varies by state and by license type).
Owner: general manager and compliance lead jointly; an external auditor or CPA firm typically reviews the artifacts.
What it catches: cumulative documentation gaps that would surface in a state inspection; tax-return vs Metrc-data reconciliation issues; license-condition drift (security-plan, diversity-plan, employee-training documentation that has fallen out of date).
Typical artifact: an annual compliance binder per store containing 12 months of monthly reconciliation reports, the 4 quarterly audit findings + remediation logs, the state-mandated filings (varies by state), and any incident reports (theft, diversion, product recall, destruction events).
Treez operator network practice: organize the binder by state-inspection checklist rather than chronologically — state inspectors scan for specific artifact types, not date ranges.

Manifest Management

Every regulated cannabis movement — inbound from a cultivator/distributor, outbound to another licensee, store-to-store transfer inside an MSO, or an on-hand adjustment to reconcile to physical count — generates a manifest that must be opened and closed in Metrc (or the state's equivalent system). Four manifest types cover the operational surface; each has a distinct trigger, closure protocol, and typical failure mode.

Incoming Manifests

Trigger: a licensed cultivator, manufacturer, or distributor ships product to the dispensary. A transporter arrives at the receiving door with a Metrc transport manifest number printed on the bill of lading.

Closure: dispensary acknowledges receipt in Metrc and reconciles received weights against manifest weights. Variance is logged in the receiving variance report.

Common variance source: bulk flower weight differences — manifest declares 453.6g, actual scale reads 451.2g. This sub-1% variance is within typical Metrc tolerance but must be logged at receiving, not smoothed at month-end. Common pitfall: accepting the manifest at the door without a weigh-tare check, then discovering variance three weeks later during monthly reconciliation.

Operator best practice: codify a weigh-tare protocol at the receiving dock — scale calibrated daily, tare weights recorded for every packaging type, a second-person sign-off on any variance >1%. Per the Treez operator network this is the single largest source of cumulative variance in the monthly reconciliation.

Outgoing Manifests

Trigger: any product LEAVING the dispensary that is NOT a retail sale. Practical examples: B2B transfers back to a distributor for a quality issue, return-to-vendor of defective product, destruction transports for expired inventory, samples shipped to a testing lab for retest.

Closure: the receiving licensee (distributor, testing lab, disposal vendor) acknowledges in Metrc.

Common pitfall: dispensaries treat B2B transfers as "occasional" and never assign a standing operator. A bud-tender executes the first one and improvises the paperwork; the second one six months later is handled by a different bud-tender who improvises differently; by the third transfer the compliance trail is fragmented.

Operator best practice: name a compliance lead (or co-owner) as the single workflow owner for all outgoing manifests. Every outgoing event — even a "small" return to vendor — follows the same documented procedure, with a printed Metrc manifest, a witness signature at the loading dock, and a 48-hour follow-up to confirm acknowledgment.

Transfer Manifests

Trigger: inter-store transfer within a multi-store operator (MSO) — moving product from one licensed location to another to rebalance inventory, fulfill a promotion at a sister store, or shift slow-moving product to a store with better category velocity.

Closure: the receiving store reconciles and acknowledges within the state-mandated window (24–72 hours depending on state).

Common pitfall: in-transit shrinkage — a driver mishandles a package (drops it, leaves it in a hot vehicle, makes an unauthorized stop) and the receiving store documents variance against the sending store, triggering an inter-company dispute. Without a documented transfer SOP, the dispute carries into cost accounting and creates recurring friction.

Operator best practice: require a transfer-acknowledgment within 24 hours of receipt; transfers initiated on Friday get acknowledged by Monday morning. Any variance >2% by weight triggers a joint sending-store + receiving-store review before the variance is finalized.

Adjustment Manifests

Trigger: on-hand inventory must be reconciled against Metrc state without a sale, transfer, or destruction event. Practical examples: a found-package discovered behind a shelf during physical count, a weight-correction after a scale recalibration, a theft write-off after a suspected diversion event, a damaged-package write-off after a spill or contamination.

Closure: compliance lead closes the adjustment in Metrc with a documented rationale. State inspectors scrutinize adjustment manifests more closely than any other type — they're the natural hiding place for diversion.

Common pitfall: treating adjustments as a silent error-correction mechanism rather than a compliance event. Any adjustment that reduces on-hand by more than a trivial amount should trigger a root-cause investigation, not just a checkbox in Metrc.

Operator best practice: any adjustment >$500 in cost basis requires GM sign-off and a remediation note explaining the root cause and the process change that will prevent recurrence. Adjustments without remediation notes should be treated as an audit finding.

State-Specific Expiration Rules

The 6 states below collectively represent the largest cannabis markets by revenue and license count as of 2025-2026. For each state, the paragraph below names the regulator, summarizes whether the state mandates hard expiration dates (on flower, pre-rolls, vapes, edibles, or some combination), describes the retest cadence, and documents the destruction protocol. These rules are the regulatory CEILING — the practitioner 90/120/180-day flower aging thresholds in inventory-kpis.md are the operational FLOOR. Where the two conflict, the state rule wins.

California

Regulator: Department of Cannabis Control (DCC).

Flower carries no state-mandated hard expiration date but the Certificate of Analysis (COA) expires 12 months from test date. Practical operator effect: flower has a 12-month shelf life from test date, not from packaging date — a package tested in January and packaged in March has only 10 months of salable life remaining. Retest cadence: required if COA expires before the product is sold. Destruction: requires a Metrc adjustment manifest + witnessed disposal logged in the state track-and-trace; common Treez operator network practice is bulk flower destruction at quarter-end batched into a single disposal event to minimize witness-scheduling overhead. Edibles and vapes must carry the shorter of the manufacturer-printed expiration date or 12 months from test date.

Colorado

Regulator: Marijuana Enforcement Division (MED).

Flower has no state-mandated expiration but must carry lot identification at retail, and testing is valid for 9 months from test date (shorter than CA). Practical effect: operators must plan flower procurement on a 9-month rolling horizon, not 12. Retest cadence: 9 months. Destruction: MED requires video documentation for any destruction event exceeding 1 lb of flower equivalent, which meaningfully changes the operational cost of destroying aged flower — operators batch destruction to amortize the video-documentation overhead. Edibles and concentrates must carry a printed expiration date per MED labeling rule.

Michigan

Regulator: Cannabis Regulatory Agency (CRA).

Flower carries a 1-year shelf-life expectation from packaging date — widely observed in practice though not strictly mandated as a hard expiration. Vapes and edibles must show a printed expiration date on the label per CRA labeling rule; the label date governs at retail. Retest cadence: not required if the product was originally compliant at test. Destruction: CRA requires a Metrc destruction manifest plus a 72-hour advance notice before the destruction event, giving the agency an option to witness in person. Treez operator network practice: schedule destruction events for the middle of the week to maximize the chance of agency availability and minimize rescheduling.

Illinois

Regulator: Illinois Cannabis Regulation Oversight Office (CROO), with BioTrack as the seed-to-sale system (Illinois is a BioTrack state, not a Metrc state — IL operators who use Metrc-native tooling bridge via compliance software).

Edibles must carry an expiration date on the label. Flower has no state expiration rule, but operators routinely apply 12-month internal limits to align with COA best-practice. Retest cadence: required if product is held more than 12 months. Destruction: must be witnessed and logged in BioTrack with a disposal rationale. Operator note: because Illinois uses BioTrack, the manifest-management workflows above map onto BioTrack transport tickets rather than Metrc manifests — the operational concepts are identical, the system-of-record differs. See tech-compliance.md for the BioTrack-vs-Metrc platform comparison.

Florida

Regulator: Office of Medical Marijuana Use (OMMU). Florida is a medical-only market as of 2025-2026, which means tighter testing requirements and shorter shelf-life rules than adult-use states.

Edibles and concentrates must show a 6-month expiration from manufacture date. Flower products must be sold within 9 months of cultivation harvest date, which is a harder rule than either CA (12-month COA) or CO (9-month test). Retest cadence: required at the 9-month mark for unsold flower, after which the product typically must be destroyed rather than retested. Destruction: OMMU notification required before the destruction event; the event is logged in the state's medical-marijuana track-and-trace system (Florida uses BioTrack). Because Florida is vertically integrated (cultivators own their dispensaries), destruction events tend to be handled at the cultivation facility, not the dispensary.

New York

Regulator: Office of Cannabis Management (OCM). New York is a young adult-use market (launched late 2022) and the rulebook is still evolving through 2025-2026.

Adult-use flower expiration is not yet hard-coded in rule, though OCM has signaled intent to require shelf-life labels in a forthcoming bulletin. Retest cadence: emerging — operators should assume a 12-month default until the rule lands. Destruction: Metrc-based; NY adopted Metrc as the official seed-to-sale system from launch. Treez operator network practice in NY: run a shadow 12-month shelf-life discipline internally even though the rule is not yet codified — the shift from "advisory" to "mandatory" typically carries a short (30-60 day) implementation window, and operators who haven't already built the discipline scramble. Edibles and vapes must carry printed expiration dates per OCM labeling rule.

State rules update frequently — verify the regulator's current bulletin before applying these to operations. The 2025-2026 landscape above reflects practitioner understanding from the Treez operator network, not a current legal review.

Cross-References

legality.md — state-by-state cannabis legal status (consume this first to determine which of the 24 legal states the operator is in, and which tracking system — Metrc / BioTrack / Leaf Data / state-built — the state uses).
tech-compliance.md — compliance-tech tooling (Metrc API integrations, BioTrack bridges, audit-prep software, COA-management vendors).
inventory-kpis.md — Compliance Adherence Rate KPI + Dead Stock Aging Thresholds callout consume this file's audit cadence and state-specific expiration rules. This file is the regulatory ceiling; inventory-kpis.md supplies the operational floor (90/120/180-day flower aging thresholds).
sops.md — operational SOPs that wrap these compliance workflows (receiving protocol, physical-count procedure, destruction-event SOP).
labeling.md — state-specific labeling requirements; overlaps with the expiration-date display rules above.

How This File Is Used

Three typical consulting conversations pull from this file:

"What's my monthly compliance workload?" — point the operator to the Audit Cadence section. Establish the monthly Metrc reconciliation as non-negotiable; scale the quarterly audit to 10% sample size as the minimum viable internal-integrity check; treat the annual as the artifact-building rhythm for state inspections.
"We had a variance at receiving — what's the right response?" — route to Incoming Manifests first (codify weigh-tare protocol), then to Adjustment Manifests if the variance must be formally reconciled. Coach against silent adjustments without remediation notes.
"We're expanding to [state] — what's the compliance surface?" — route to the state paragraph in State-Specific Expiration Rules for the retest / destruction / labeling rules; cross-link to legality.md for the tracking-system designation and legal-status baseline; cross-link to tech-compliance.md for platform-specific tooling choices.

The common thread: this file is used operationally (what do I do today?), not academically (what do the rules say?). Keep the framing practitioner-first in every conversation that pulls from it.