Checklist · Cannabis · Inspection Readiness

Cannabis Inspection Readiness: An Illinois and Missouri Mock-Audit Checklist for 2026

A mock audit tests the facility the way a regulator can: license records, physical conditions, tracking data, product status, waste, credentials, and how quickly staff can produce records. This checklist reflects the Illinois rules effective May 1, 2026 and Missouri’s current inspection and reporting rules.

By Lincoln Square Law · 8-minute read

🖨 Print this checklist

What an inspector can test

Both states inspect licensed cannabis facilities without needing a complaint first. Illinois craft growers are subject to random inspections by the Department of Agriculture, local safety or health inspectors, and the Illinois State Police (410 ILCS 705/30-30(h)), and cultivation centers have parallel provisions in Article 20 of the Act. IDFPR regulates and inspects dispensaries. Missouri’s Division of Cannabis Regulation inspects new and changed space before operations begin and may require product samples at any time without notice (19 CSR 100-1.110(12)).

The aim of a mock audit is not a staged inspection day. It is to confirm that an ordinary day produces records and conditions that hold up. Assign an auditor who does not run the area being tested where practical, choose real records and real inventory at random, and do not tell teams in advance which samples will be pulled. Record the evidence reviewed, not only a pass or fail.

License, premises, and people

• Confirm the license, licensed address, approved floor plan, ownership, and principal officers on file match current operations.
• Compare each room’s actual use with the approved plan and flag any change that may need an Illinois alteration or modification application or a Missouri commencement inspection.
• Match every person working in a regulated role to a current agent badge or agent identification card, the roster, assigned access, and training records.
• Keep the governing statute, current rules, license conditions, local approvals, and regulator correspondence in one indexed repository that staff can reach during an inspection.

Tracking, inventory, and product status

• Reconcile physical inventory to the state tracking system and to internal records, and investigate unexplained variances before they age.
• Trace a random package from source or harvest through testing, transfers, packaging, sale, or destruction, then trace a system record back to the physical product.
• Confirm each activity was recorded when it was completed, as the Illinois supply-side rule requires, and that Missouri dispensary sales were recorded immediately.
• Check that Illinois plant and package tags were recorded in the system within three calendar days of receipt and that unused tags were not transferred to anyone else.
• Confirm held, failed, quarantined, and recalled product cannot be sold or transferred in either the tracking system or the point-of-sale system.
• Review discrepancy, theft, and system-outage reports against the deadlines that apply to the facility, and confirm each was filed on time.

Security, waste, and facility records

• Pull surveillance footage for sample dates and confirm coverage, timestamps, image quality, and retrieval, including the 90-day minimum retention described in the Illinois Spring 2026 bulletin.
• Test alarms, access control, visitor logs, escorts, and restricted-area signage in practice.
• Trace sampled waste events from creation through weighing, system entry, notice, rendering unusable, and final disposal.
• Confirm sanitation, pest-control, pesticide, chemical, and equipment-maintenance records required for the license type are current.
• Walk local conditions of approval, including zoning, occupancy, fire, signage, odor, hours, parking, and loading.

Records retrieval and findings

• Time how long staff take to produce sample records without help from the person who created them, and fix records that exist but cannot be found.
• Document each finding with an owner, due date, corrective action, completion evidence, and a later check that the fix held.
• Escalate any finding that may require regulator notice or approval before anyone corrects the record, the inventory, the premises, or the ownership.

Illinois rules to test against in 2026

The Department of Agriculture’s Part 1300 rules were amended effective May 1, 2026. Under the tracking subpart, the state monitoring system is the official record for every item in the locked facility, requires that the data entered be accurate and complete, and prohibits anyone affiliated with a licensee from intentionally falsifying data in the system or directing others to do so (8 Ill. Adm. Code 1300.1000). Activities must be recorded upon completion (8 Ill. Adm. Code 1300.1030), and a loss of system access must be reported by the end of the business day, with the backlog entered within three business days of restoration (8 Ill. Adm. Code 1300.1050). The Department’s bulletin describes other changes that an auditor should check, including camera retention of at least 90 days, plant tags required at 16 inches in height, and new label fields due November 1, 2026.

Craft growers must keep operating documents that include a plant monitoring system with a weekly physical inventory, follow a security plan with 24-hour interior and exterior surveillance, cultivate only in an enclosed, locked facility, and report any loss or theft to local police, the Illinois State Police, and the Department within 24 hours after discovery (410 ILCS 705/30-30(i)). Dispensaries reconcile daily, need IDFPR approval before any inventory adjustment, and keep records for five years (410 ILCS 705/15-75, 68 Ill. Adm. Code 1291.310). Build the audit sheet for the specific license. A cultivation checklist used at a dispensary creates false confidence because the duties and regulators differ.

Missouri rules to test against

Missouri’s inspection exposure starts before opening and continues through every change of space. A licensee must pass a commencement inspection and receive written approval to operate before beginning operations at a new license or location, occupying new space, sharing space, or changing how a space is used. During a mock audit, compare each room with the approved blueprint. A room repurposed months after the original inspection can be a violation even though that inspection passed.

Missouri’s tracking deadlines are short and should be tested directly. Discrepancies are reported within 24 hours of discovery, purchase-allotment errors are reported and corrected within 24 hours, suspected criminal activity by an agent is reported within 24 hours, and a system failure is reported within three hours, during which tracked activity must stop (19 CSR 100-1.130(1)). Licensees file a monthly physical inventory report, and tracking violations can bring fines of up to $50,000 (19 CSR 100-1.130). Our seed-to-sale guide explains the Illinois and Missouri rules side by side.

Test the gap between procedure and practice

Inspectors compare written procedures with what employees do. That gap usually matters more than a drafting defect. If a procedure requires supervisor verification of waste and the floor routinely skips it, either the practice is noncompliant or the procedure no longer describes the approved process. Do not resolve the difference by editing the procedure during the audit without first checking what the rule and the license require.

Ask the people who do the work to demonstrate it: receiving product, making an adjustment, responding to a failed test, admitting a visitor, exporting surveillance, creating waste, and escalating a theft. Their answers should match the written control and their system permissions.

Respond to a real inspection the way you rehearsed

A mock audit is also a rehearsal for the real visit. Decide in advance who greets inspectors, who accompanies them, who pulls records, and who may answer questions about ownership, security, and inventory. Keep a log of what was requested, what was provided, and when, and make copies of every document handed over. Staff should answer factual questions accurately and should not guess. If an inspector asks for something that cannot be produced immediately, record the request and the promised delivery time. Missouri licensees must respond to the Division’s document requests within the period its rules set, and its checklists warn that late responses can draw daily fines. After the visit, review any written findings with counsel before responding, and treat each finding as a corrective-action item with an owner and a deadline.

Close findings with evidence

Each finding should carry a risk statement, the rule or procedure it tests, an owner, a corrective action, a due date, and closure evidence. Separate containment from root cause. Fixing one wrong package contains the problem. Retraining and changing the reconciliation step may correct its cause. Retest after closure, and keep the history so management sees recurring issues before a regulator does. Where a finding involves ownership, premises, missing product, testing, or security, involve compliance and counsel before changing any regulated record. Do not backdate, delete, or move inventory outside the authorized process. Our briefing on change control covers the approvals that facility changes can require.