Checklist · Cannabis · Recall Response

Cannabis Recall Response Playbook: A Working Checklist for Holds, Scope, Notices, Returns, and Closeout in Illinois and Missouri

The checklist companion to our recall guide. Use it to run a recall or a mock recall: preserve the trigger, place the hold, define the affected universe, send the required notices, reconcile returns and disposition, and close with corrective action that is tested.

By Lincoln Square Law · 8-minute read

🖨 Print this checklist

How to use this playbook

A recall tests traceability, records, communication, and judgment at the same time. Operators who handle recalls well prepared the playbook before they needed it. This checklist is the working tool. Our recall guide explains the rules behind each step, including IDFPR’s recall and quarantine orders and Missouri’s public recall notices. Run the checklist in order during an event, and run it in full at least periodically as a mock recall on a live but unaffected batch.

Trigger and hold

• Preserve the triggering evidence in its original form with the date, source, product identifier, and recipient.
• Record when defective or potentially defective product was first discovered and by whom, because Illinois dispensary notices run from discovery.
• Issue a written hold that identifies the affected product and stops further manufacture, transfer, delivery, and sale while scope is assessed.
• Name the recall coordinator, regulatory lead, operations lead, communications lead, and the person who keeps the record.

Scope from traceability data

• Map every affected batch, lot, package, SKU, production date, test sample, and ingredient identifier.
• Use tracking data to identify current on-hand inventory, transfers, receiving facilities, and disposition status.
• Use point-of-sale or distribution records to determine whether affected product reached consumers and in what quantities.
• Record why the initial scope is sufficient, and record each later expansion or narrowing with its basis.

Quarantine

• Physically segregate all affected product on site and mark it against release.
• Set tracking and internal system status so the product cannot be sold or transferred by accident.
• Do not destroy, remediate, repackage, or relabel product until the rule or regulator allows it, and hold product under any quarantine order for the period the order sets.

Notices

• At an Illinois dispensary, send the required notice to IDFPR, the Department of Agriculture, and the Department of Public Health within 24 hours of the discovery time recorded above.
• Find the producing licensee from the package and tracking records and reach its recall contact.
• Send downstream licensees a product-specific hold or recall notice with identifiers and handling instructions.
• Review consumer communications for accuracy, clarity, and consistency with the regulator’s instructions, and keep every version.

Returns, disposition, and closeout

• Reconcile distributed, on-hand, returned, destroyed or released, and unresolved quantities, and escalate nonresponsive recipients.
• Enter recalled product in the State verification system before destruction in Illinois, and follow the destruction rule for the license.
• Complete root cause and corrective action with an owner, deadline, and verification method, then repeat the trace exercise on an unrelated batch to prove the fix.
• Give notice to insurers and contract counterparties as their terms require, and keep cost records from the first day.

Map the playbook to the Illinois dispensary rule

IDFPR’s recall section lists six elements that a dispensary’s written procedures must contain (68 Ill. Adm. Code 1291.330). The playbook covers each one: the purchaser-contact and return steps sit under Notices and Returns, producer contact is its own item, the three-agency notice has a 24-hour clock running from discovery, collection and destruction follow the dispensary destruction rule (68 Ill. Adm. Code 1291.325), and the State verification system entry comes before destruction. If an IDFPR order imposes a quarantine, the disposition step changes from destruction to a hold for the period the order sets. Our recall guide explains the order and hearing process.

When a failed test starts the recall on the supply side

Many recalls begin with a laboratory result. In Illinois, a batch that fails the pesticide residue test must be recalled and disposed of in its entirety, while a batch that fails another required test may be used only to make a CO2 or solvent-based extract that must itself pass. Laboratories file microbiological, mycotoxin, heavy metal, and pesticide failures with the Department of Agriculture at the same time they send results to the producer (8 Ill. Adm. Code 1300.700). The producer’s playbook should therefore assume the Department already knows about the failure when the hold is placed, and should move quickly to identify every package and transfer tied to the failed batch. In Missouri, a failed result produces an administrative hold in the tracking system, and the licensee must notify the Department within 15 days which path it will take, reanalysis, remediation, or destruction, and complete it within three months (19 CSR 100-1.110(10)). Heavy-metal failures may not be remediated.

Missouri notices and holds

In Missouri, the Division can publish its own recall notice when it judges a product a possible health and safety threat, citing 19 CSR 100-1.100(4)(P). Its notices identify the licensee, the product’s tag, the basis for the recall, and return instructions for consumers. Failed test results also produce an administrative hold in the tracking system, and the licensee must choose reanalysis, remediation, or destruction (19 CSR 100-1.110(10)). The Division’s bulk-sampling guidance notes that recalls run by test tag number, so a single test result shared across several products can widen a recall (DCR guidance, June 12, 2026).

Classify the hazard before choosing the message

Not every trigger presents the same risk. A pesticide failure, microbial contamination, undeclared allergen, potency error, package defect, foreign material, label error, or traceability failure may need different containment and communication. Write a short risk assessment that separates confirmed facts from hypotheses, identifies the affected population and severity, and states whether product remains in commerce. Let it drive the urgency and breadth of the response without overstating facts still under investigation. When a product may present a health risk, act on the available evidence and document the uncertainty.

Keep one record of the facts

A fast recall generates inconsistent emails, draft theories, and duplicate spreadsheets. Keep one chronology and one controlled repository, with the source for each material fact. Preserve original records, messages, certificates, system history, and photographs without overwriting them. Interviews should separate what a witness saw from what the witness concluded later. When counsel is directing legal analysis, set that up deliberately and keep it distinct from ordinary business records.

Prepare the counter for returns

At a dispensary, a recall reaches customers at the counter and by phone. Give staff a short script, approved by the recall lead, that identifies the affected product by name and identifier, tells the customer how to return it, and says what the dispensary can and cannot say about the risk. Log each return against the scope table with the package identifier, quantity, date, and the employee who received it, and move returned units straight into quarantine. Do not resell, exchange, or dispose of returned product outside the disposition the rule or the regulator allows. Missouri’s recall notices have told patients that returned product does not count against their purchase limit, so check that the point-of-sale system records the return correctly. Report adverse reactions customers describe through the channel the regulator specifies.

Run the mock recall

Give the team a live product identifier and ask it to find source inputs, the testing record, quantities produced, current inventory, transfers, receiving facilities, and sales data. Time the exercise and record missing records, duplicate identifiers, stale contacts, and unclear decision authority. Test the contact lists for regulators, receiving facilities, the laboratory, the insurer, and leadership. Each gap becomes a corrective action with an owner and a deadline.

Test whether the fix held

Thirty to sixty days after closeout, sample the revised procedure, the training records, new production or receiving records, and a new batch trace. Confirm that employees use the new control and that it would have caught the original problem earlier. If the fix exists only in a revised document, the recall has not produced a working preventive control. Changes to equipment, rooms, or procedures that come out of the investigation may need Department review first. Our briefing on change control explains when.