Checklist · Cannabis · Inspection Readiness

Cannabis Inspection Readiness: Illinois and Missouri Mock-Audit Checklist

Use a mock audit to test the records, inventory, physical controls, employee practices, and approval conditions that an Illinois or Missouri regulator can examine. The checklist is license-specific and evidence-driven.

By Lincoln Square Law · 8-minute read

🖨 Print this checklist

A mock audit should test the facility the way a regulator can experience it: as a combination of license records, physical conditions, system data, product records, employee practices, and evidence. Illinois law subjects specified cannabis facilities to random inspection and gives regulators document-production and investigative authority. Missouri DCR requires commencement inspections for specified new or changed operations and maintains ongoing compliance and enforcement functions under Article XIV and 19 CSR 100-1. The goal is not to stage a clean room for inspection day. It is to operate so an ordinary day produces records and conditions that can withstand inspection.

Use the checklist as a test, not a certification

This checklist is an operational recommendation, not a substitute for the license-specific statute, rule, condition, or regulator checklist. Assign an auditor who is not solely responsible for the area being tested when practical. Select real records and real inventory at random. Do not give teams advance notice to repair the exact samples you intend to inspect. Record the evidence you reviewed, not only a pass/fail conclusion.

License, governance, records, inventory, and facility controls

• Confirm the current license, approved premises, ownership, and principal-person records match actual operations.
• Keep the governing statute, current rules, license conditions, local approvals, and regulator correspondence in one inspection binder or indexed repository.
• Verify every required SOP reflects current operations and that employees can locate the version that governs their work.
• Reconcile physical inventory to the state track-and-trace system and investigate unexplained variances before they age.
• Trace a random package from source or harvest through testing, transfers, packaging, sale, waste, or other final disposition.
• Confirm surveillance, alarms, access controls, visitor logs, badges, and restricted-area controls work in practice, not only on paper.
• Pull sample surveillance footage and verify required cameras, timestamps, image quality, and retention are functioning.
• Test loss, theft, diversion, and inventory-discrepancy escalation so employees know whom to notify and what to preserve.
• Match current employee and agent credentials to the roster, job duties, facility access, and training records.
• Confirm product lots have the required test results and that product on hold, failed, quarantined, or awaiting disposition cannot be sold or transferred.
• Review packaging, labels, warnings, item approvals, and product records against the actual units on the shelf or in finished inventory.
• Test point-of-sale controls for age or patient verification, purchase limits, discounts, returns, and transaction recording as applicable.
• Verify manifests and transfer records match product actually moved, including dates, quantities, origin, destination, and transporter information.
• Review waste records from generation through rendering unusable and final disposal. Confirm physical practice matches the written procedure.
• Confirm sanitation, pest-control, chemical, pesticide, food-safety, and facility-maintenance records required for the license type are current.
• Walk local conditions of approval: zoning, occupancy, fire, signage, odor, hours, parking, loading, and any site-specific restrictions.
• Compare blueprints and approved room uses with the facility as built. Flag expansions, shared space, or changed uses requiring regulator approval.
• Sample required records and time how long it takes staff to retrieve them. Fix records that exist but cannot be produced promptly.
• Document every mock-audit finding with owner, due date, corrective action, evidence of completion, and verification that the fix held.
• Escalate any issue that may require regulator notice or approval before “correcting” the record, inventory, premises, or ownership informally.

Illinois: connect the mock audit to the license type

Illinois requirements differ by license. Under 410 ILCS 705/20-30, cultivation-center operating documents include oversight procedures, a plant-monitoring system with weekly physical inventory, accurate recordkeeping, and staffing, while the statute also requires security measures and permits random inspections by identified agencies. Section 30-30 imposes parallel concepts on craft growers, including weekly physical inventory, security, restricted premises, and random inspection.

Dispensing organizations operate under a different article. The CRTA authorizes the Department to investigate applicants, licensees, principal officers, agents, vendors, and other associated parties for alleged violations or qualification issues and to require production of pertinent records. A dispensary mock audit should therefore emphasize POS, inventory verification, acquisition and sale records, employee credentials, consumer controls, product status, and rapid document retrieval.

Build the Illinois audit sheet around the specific license. A cultivation checklist copied onto an infuser or dispensary can create false confidence because the statutory duties and supervising agencies differ. Keep a master control library, but generate a facility-specific audit from the license and current rules.

Missouri: test commencement conditions and continuing operations

Missouri DCR’s current commencement-inspection guidance states that licensees need a commencement inspection before beginning operations under a new license or location and before using specified new or changed space. The request process includes documentation, blueprints where applicable, self-inspection checklists, and written approval to operate. During a mock audit, compare the facility to the approved blueprint and the use of each space. A room quietly repurposed months later can become a regulatory issue even if the original inspection passed.

DCR’s compliance structure also reviews facility operations, statewide track-and-trace, testing, packaging and labeling, and other regulated functions. A Missouri mock audit should therefore include both physical inspection and data inspection. Pick actual packages in the facility and trace them in the statewide system. Pick system records and locate the physical product. Investigate discrepancies rather than forcing the records to match without an audit trail.

Test records under realistic retrieval pressure

Many inspection failures are not caused by a complete absence of documentation. The record exists, but no one can find the current version, the responsible employee is off-site, filenames are inconsistent, or the evidence sits in a personal inbox. During the mock audit, ask staff to produce sample records within a reasonable period without help from the person who created them.

Create a controlled index showing where each record class lives, who owns it, how long it is retained, and who can access it during an inspection. For electronic repositories, test permissions and backup access. For records maintained off-site where allowed, make sure the facility can still produce them when the regulator requires them.

Audit the gap between SOP and practice

Inspectors can compare written procedures to observed operations. That gap is often more significant than a drafting defect. If an SOP requires two-person waste verification but the facility routinely uses one person, either the practice is noncompliant or the SOP no longer describes the approved process. Do not solve the discrepancy by editing the SOP during the mock audit without first determining what the law and license require.

Interview employees who perform the work. Ask them to show how they receive product, make an inventory adjustment, respond to a failed test, admit a visitor, export surveillance, create waste, or escalate a theft. The answer should match the written control and system permissions.

Close findings with evidence, not promises

Every finding should have a risk statement, legal or policy source, owner, corrective action, due date, and closure evidence. Separate immediate containment from root-cause correction. For example, fixing one inaccurate inventory package contains the immediate discrepancy. Retraining users and changing the reconciliation process may correct the systemic cause.

After closure, retest. If the same variance appears in the next cycle, the earlier corrective action was not effective.

Maintain the history so management can see recurring issues and allocate resources before the regulator identifies the pattern.

Escalate before changing regulated facts

A mock audit may uncover an ownership issue, unapproved premises change, missing product, testing problem, security failure, or other matter that could require regulator notice, approval, or a controlled system correction. Do not “clean up” the record by backdating, deleting, moving inventory without documentation, or editing regulated data outside the authorized process. Preserve the facts, involve compliance and counsel, determine the required reporting or correction route, and document the response.

The objective of readiness is not a perfect-looking file. It is a reliable operation that can explain its records, identify exceptions, and show how exceptions were addressed. That is the evidence a regulator, buyer, lender, or board should expect from a controlled cannabis business.