Guide · Cannabis · Recall Response

Cannabis Recalls and Investigations: The First 24 Hours

The first day of a cannabis recall is an evidence-control exercise. The operator must protect consumers, stop affected product from moving, preserve the state-system record, and build a defensible factual scope before public communications outrun the investigation.

By Lincoln Square Law · 8-minute read

Hour zero: establish command and stop movement

The first decision is who has authority to act. Name one incident lead, one regulatory lead, one operations lead, one communications lead, and one person responsible for the evidentiary record. Create a timestamped incident log immediately. Then stop shipment, sale, transfer, destruction, relabeling, rework, or other movement of potentially affected product until the scope is understood. The goal is not to freeze the entire business reflexively. It is to prevent the evidence and product population from changing while the team determines what belongs inside the hold.

Illinois dispensary law requires written policies and procedures that address mandatory and voluntary recalls, as well as inventory controls and records. Missouri DCR likewise has authority under its current rules to issue recall notices where product presents a potential health or safety threat. Those authorities make a prewritten recall plan operationally important: the first hours should execute an existing command structure rather than invent one.

Preserve the source record before correcting anything

Export or otherwise preserve the relevant seed-to-sale data, manifests, package histories, lab results, COAs, production records, batch records, sanitation logs, environmental records, employee access logs, surveillance references, customer-return information, complaints, vendor communications, and prior corrective actions. Preserve the versions that existed when the incident was discovered. If the business later corrects an inventory entry or label, keep the before-and-after record and the reason for the change.

This matters because recalls often become investigations. A regulator may ask not only which units were affected but when management learned of the issue, what the system showed at that time, who changed records, and why. An operator that cleans up its data before preserving the original state can create avoidable credibility problems even when the underlying issue was remediable.

Define scope with identifiers, not adjectives

A recall description such as “some gummies from last week” is not an investigation scope. Build a table using license number, facility, product name, batch or lot, package tag, production date, test sample, test result, transfer destinations, quantities produced, quantities transferred, quantities sold, quantities returned, and quantities still controlled. If the suspected cause is a failed test, manufacturing deviation, ingredient issue, labeling problem, contamination risk, or chain-of-custody break, identify every product population that could share that cause.

Use the state tracking system as a starting point, then reconcile it against physical inventory, manifests, sales records, and production records. Differences become investigation issues, not assumptions. When the factual boundary changes, record why. Scope expansion and contraction should be traceable decisions.

Separate consumer protection from root-cause analysis

The team does not need a final root cause before taking protective action. If product may present a health or safety risk, quarantine and notification decisions should be made from the evidence available, with uncertainty documented. At the same time, do not make public statements that convert a working hypothesis into a fact. Communications should identify the affected product precisely, explain what consumers should do, and use language consistent with the regulator’s direction.

Root-cause work can proceed in parallel: test retained samples where appropriate, review production and sanitation records, interview personnel, examine equipment and environmental conditions, assess supplier inputs, and compare affected and unaffected lots. Keep interview notes and testing decisions within the investigation file. If counsel is directing the investigation for legal advice, establish that structure deliberately rather than assuming every internal email is privileged.

Notify regulators through the correct channel

Determine which agency, license type, jurisdiction, and reporting rule apply before sending an informal email. Prepare a concise initial package: what happened, when discovered, product identifiers, current hold status, known distribution, consumer risk information, immediate controls, and the next investigation steps. If facts are incomplete, say so and provide a schedule for updates. Consistency matters across state regulators, local authorities, laboratories, distributors, retailers, insurers, and public statements.

Missouri’s recent DCR recall notices illustrate the regulator’s focus on the responsible licensee, product identity, testing or compliance basis, and instructions to consumers and licensees. Illinois operators should similarly expect the regulator to connect the recall to the company’s required written policies, inventory records, and recordkeeping obligations.

Close the first 24 hours with a written status record

By the end of the first day, the operator should have a documented incident owner, product hold, preserved evidence set, current scope table, regulatory-contact log, consumer-protection decision, preliminary root-cause plan, and schedule for the next update. Record open questions and who owns each one. If the event will continue, establish daily reconciliation of recalled, returned, destroyed, and outstanding product.

The first 24 hours do not need to solve the recall. They need to prevent the problem from becoming harder to solve. A disciplined record lets management make decisions from a stable factual base and gives regulators a coherent explanation of what the operator knew, what it did, and what it is doing next.

Control internal communications from the first alert

Recall investigations generate fast, speculative communication. Employees may guess at causes, blame vendors, discuss possible consumer harm, or propose record corrections before facts are established. Direct the team to use a designated incident channel and factual language. Preserve messages that are part of the investigation. Separate operational coordination from public-facing statements, and route external communications through the designated regulatory and communications leads. This is not about hiding information. It is about preventing inconsistent statements from becoming part of the record.

If counsel is directing work for the purpose of legal advice, identify that role clearly and keep the investigation disciplined. Privilege is not created by copying a lawyer on every operational email. The stronger approach is to define which legal questions counsel is investigating and which business records must remain ordinary operational records.

Reconcile every unit through disposition

Once the recall population is defined, create a quantitative roll-forward. Start with total units or weight produced, then identify quantities still at the originating facility, transferred to other licensees, sold to consumers, returned, quarantined, destroyed, or otherwise unresolved. Each movement should tie to package identifiers, manifests, sales or transfer records, and state-system entries. The unresolved balance should be visible every day until it reaches an acceptable final state.

This reconciliation protects against two common failures: believing a notice reached every affected downstream party, and assuming all recalled product was actually removed from commerce. A communication log proves notice. An inventory reconciliation proves disposition. The recall file needs both.

Convert the investigation into corrective and preventive action

After containment and root-cause work, define corrective action for the specific failure and preventive action for the system that allowed it. Examples can include supplier qualification, sampling changes, equipment maintenance, sanitation controls, label approval, state-system permissions, training, second-person verification, or escalation thresholds. Assign owners and due dates and test whether the control works after implementation.

Close the recall only when the company can explain what happened, which product was affected, what happened to that product, what changed, and how effectiveness was verified. Preserve the final report with supporting evidence. A regulator evaluating a future event will care about whether the company learned from the prior one.

Plan the second day before the first day ends

Before the first incident period closes, schedule the next regulatory update, inventory reconciliation, testing decision, management briefing, and public-communication review. Identify evidence that still needs to be collected and preserve responsibility for each task. If outside laboratories, insurers, vendors, or downstream licensees must act, record the request and expected response time. This forward plan prevents the investigation from losing discipline after the initial urgency passes. It also gives management a basis for allocating staff and deciding whether production, distribution, or sales can resume in unaffected areas while the recalled population remains controlled.