Compliance audit before a sale

Why audit before you sell?

Because two outside parties are about to examine the business, and both can stop the deal.

The buyer. Compliance is a standard diligence workstream; see the cannabis due diligence checklist. Problems the buyer finds become price reductions, escrows, or special indemnities. Problems found late can end the deal.

The regulator. A sale requires approval of the new owners, and the application puts the licence file in front of agency staff. Open investigations, unpaid fees, and undisclosed owners tend to surface at that point. The approval process is described in change of ownership approval explained.

Regulatory history is also increasingly public. California’s Department of Cannabis Control posts citations, fines, suspensions, and revocations by business name, with the rule sections violated. Track-and-trace and video surveillance violations feature heavily in those records. A buyer can read the file before the first conversation.

An audit lets the seller find issues while there is time to fix them, and decide how to present what cannot be fixed. The effect on price is covered in how compliance history affects value.

What regulators can do with a violation

Penalty frameworks show what is at stake. Two examples:

• Colorado. The Marijuana Enforcement Division’s penalty rule has a most-serious category (sales to minors, diversion, falsified records, and similar) with suspension, revocation, or a fine in lieu of suspension of up to $100,000, and a second category with fines of up to $25,000 per violation. Listed mitigating factors include no discipline in the previous 24 months, corrective measures, staff training, and self-reporting. Aggravating factors include owner or manager involvement and repeat conduct. From January 2026, failure to pay required licence fees sits in the most serious category.
• California. The Department’s disciplinary guidelines sort violations into tiers, with minimum penalties for the lowest tier starting at a stayed revocation with a short suspension or fine, and revocation as the maximum.

The lesson for a seller is that mitigation is earned before the regulator arrives. A documented internal audit, a correction log, and training records are the evidence.

Audit scope: the eight workstreams

Workstream	What is tested	Typical findings
1. Licence standing	Every state and local licence: status, expiry, conditions, fees paid, renewals filed on time, premises diagram matches the actual layout	Unapproved premises changes; lapsed local permit; late renewal fees
2. Ownership and financial interests	Cap table, loans, profit-share and management agreements against what the regulator has on file	Undisclosed investor, lender with profit participation, or departed owner never removed
3. Track-and-trace	Physical count against system; adjustment, waste, and transfer logs; timeliness of entries	Unexplained adjustments; late entries; untagged product
4. Security and surveillance	Camera coverage, resolution, retention, alarm, access control, visitor logs	Blind spots; retention shorter than required; failed recorder unnoticed
5. Product compliance	Testing certificates for every batch on hand, packaging and labelling, advertising	Expired or missing certificates; non-compliant labels
6. People	Agent badges or worker permits current for all staff, required training, payroll compliance	Expired badges; staff working before approval
7. Tax and financial	Sales, excise, local cannabis tax, payroll, and income tax filings and balances; cash controls	Unfiled returns; payment plans in default; weak cash logs
8. Facility and local	Zoning and use permit conditions, fire and building sign-offs, waste handling, pesticide and environmental records for cultivation	Unpermitted construction; conditions of approval not met

Ownership disclosures deserve first priority

This is the finding most likely to kill a deal. Regulators decide who may profit from a licence, and an undisclosed party of interest is a continuing violation. In California, for example, owner changes must be reported within 14 calendar days. Compare every agreement that gives anyone a share of revenue, profit, or control with the regulator’s records. The standards are in true party of interest and financial interest rules.

Track-and-trace: test to the state’s own thresholds

Use the rules the inspector uses. In California that means events recorded within 24 hours, reconciliation at least every 30 calendar days, and any difference of 5% or more treated as a significant discrepancy. Do a full physical count, not a sample, at least once before going to market. A buyer will rerun the same tests when verifying revenue with track-and-trace data, and system mechanics at closing are in track-and-trace systems and transactions.

Surveillance: a cheap fix that is often missed

Requirements are specific and easy to test. California requires cameras of at least 1280 by 720 pixels recording at 15 frames per second, coverage of entries, exits, cannabis handling areas, and points of sale, and retention of at least 90 calendar days. Pull footage from the oldest required date for each camera. If it is not there, fix the storage now. Other states’ rules are summarised in retail build-out and security requirements.

Timeline

When	Action
9 to 12 months before market	Engage counsel and auditor; agree scope; run fieldwork
6 to 9 months	Correct findings; file overdue disclosures and amendments; decide on any self-reports with counsel
3 to 6 months	Re-test corrected items; build the compliance section of the data room
At launch	Prepare a short factual summary of compliance history for the offering materials
Signing to closing	Keep monthly reconciliations and logs current; the buyer will bring the review down to the closing date

A seller with less time should run workstreams 1 to 3 and 7 first. Those are the ones that block approval or create liabilities that follow the business.

What to do with the findings

1. Fix what can be fixed, and keep evidence: dated photos, amended filings, training sign-in sheets, payment receipts.
2. Bring ownership records into line by filing the required disclosures or unwinding the arrangement.
3. Resolve open regulator matters where possible. A signed settlement with a paid fine is a known quantity. An open investigation is not.
4. Quantify what remains. Unpaid taxes and penalties can be estimated and handled through price or escrow; see tax liabilities and holdbacks in a sale.
5. Disclose accurately. The purchase agreement will ask the seller to represent compliance and list exceptions. The audit gives the seller the facts for that schedule; see reps, warranties, and compliance indemnities.
6. Reconsider timing if needed. A serious open matter may mean a different route, covered in selling with compliance violations.

What a clean audit is worth

It will not raise a multiple by a fixed amount, and nobody can promise that it shortens approval. What it does is remove reasons for a buyer to discount or walk away, support narrower indemnities and smaller escrows, and let the seller run a process with fewer surprises. It belongs alongside the financial clean-up described in preparing a cannabis business for sale. A seller who wants to talk through sequencing can book an intro call.

This page is educational and not legal advice. Each state’s rules differ, and the audit scope should be built from the current regulations for each licence held.