Compliance, licensing and track-and-traceCompliance, licensing and track-and-trace

Purpose and scope

Growing the plant is half the job. The other half is being able to prove, to a stranger, on paper, at any moment, where every gram came from, where it went, and that you did what your own rules say you do. That proof system is what this paper is about.

It is written for the person who just got handed ‘compliance’ along with the watering: the first-licence operator, the small team where the head grower is also the quality manager, the technician who has never met an auditor. No prior knowledge is assumed. Every term is defined before it is used.

The route: what a licence actually is and how it lives; how to deal with the regulator; batch and lot thinking (the genealogy that connects everything); seed-to-sale tracking and the reconciliation habit; records that survive an audit; deviations without the bureaucracy; the GACP/GMP boundary and quality agreements; security and destruction; recall readiness; a walkthrough of audit day; and two real regimes, New Zealand and Australia, described from altitude as worked examples.

Definitions

Compliance conversations fail when two people use the same word for different things. These definitions are generic; your regime's legal definitions override them, and part of setting up a facility is writing down which definitions you use.

Evidence and limitations

Compliance objective: documented control

Every rule in every cannabis regime compresses to one demand: demonstrate control. Control of the material, nothing enters, moves, or leaves except as recorded. Control of the process. What happens to the plant follows written rules. And the demonstration must work for someone who was not there and trusts nothing but the record.

Most new operators obsess over layer one, getting the licence, and starve layer three. That is backwards. Licences are rarely lost on the day they are granted; they are lost years later, at the records layer, when an auditor asks a simple question the paperwork cannot answer. In pharmaceutical GMP, documentation is not admin support for the real work; it is defined as part of the quality system itself^[1], and cannabis regimes borrow that DNA directly.

Licence activities, conditions and renewals

A cannabis licence is not one permission; it is a bundle of named activities with strings attached. New Zealand's scheme, for example, builds each licence from activities such as cultivation, nursery (supplying seeds and propagation material), research, possession for manufacture, and supply^[2]. Australia consolidated its federal structure in December 2021 into a single medicinal cannabis licence that can cover cultivation, production, manufacture and research, with permits underneath it^[3]. The naming differs; the pattern, activities plus conditions plus quantities, repeats almost everywhere.

Read your licence as a machine with parts:

Two habits prevent most licence trouble. First, a compliance calendar: every expiry, renewal window, report deadline and fee, with alerts at 90, 60 and 30 days. Renewals are administratively boring and operationally fatal to miss. Second, treat variations as prerequisites, not paperwork catch-up: if you want to add a room, an activity, or a key person, the general rule across regimes is ask first, act after, and the operators who get this wrong usually knew the rule and gambled on nobody looking.

Regulatory inspections, notifications and variations

The regulator is not a customer, not a mate, and not an enemy. The productive mental model is external quality assurance with statutory power: they exist to verify control, and everything they ask maps back to that. In New Zealand that function sits with a dedicated agency inside the Ministry of Health that administers the scheme and its licensing^[5]; in Australia, with the Office of Drug Control at the federal layer^[4]. Whoever it is, the relationship runs on three channels:

Inspection posture matters more than most operators think. Findings are contested in writing, with evidence, after the visit, not argued in the corridor. Take your own notes of everything said, ask clarifying questions until each finding is specific enough to act on, and respond by the deadline with dated commitments. Then actually do them: a repeat finding at the next inspection is graded harder than the original, because it demonstrates the thing regulators care most about, whether your system self-corrects.

Batch and lot traceability

A batch is a promise of uniformity: a defined quantity of material that went through the same process at the same time, so one test result, one record, one decision can honestly speak for all of it. Everything in traceability hangs off that promise.

In a grow room the practical translation is: plants started together and treated the same are a batch; the moment treatment diverges, different room, different feed, a spray applied to some and not others. You have two batches, whether or not you wrote it down. The paperwork should follow the biology, not the other way round. Formal quality systems define batch and lot carefully and expect full traceability of what went into each one^[6]; small operators mostly get in trouble not by defining batches badly but by merging and splitting them silently.

This is why one plant's records matter. Genealogy means records inherit downward: the spray on the mother is part of the pesticide history of the packaged lot four generations later; the CoA on the packaged lot is only meaningful because the chain above it is unbroken. It cuts the other way too, a missing record poisons everything downstream, because you can no longer prove the negative. ‘We never sprayed that crop’ is unprovable if the spray log has a three-week hole in it.

• Make IDs human-readable and unique. A scheme like CL-2603 (clones, week 26, 2003rd batch. Whatever your convention is) beats both ‘the back table’ and a bare UUID. Write the convention down.
• Splits and merges are events. Two harvest lots combined into one dry lot is a recorded transformation with weights on both sides, not a quiet tidy-up.
• Never let a physical thing exist without an ID, even for an afternoon. Unlabelled totes of wet trim are where traceability actually dies.

Seed-to-sale tracking and reconciliation

Track-and-trace is perpetual inventory for a controlled substance. Three ingredients: identity (every plant and package carries a tag or UID), events (every movement, transformation, sample and destruction is recorded when it happens), and a ledger that holds it all. The ledger can be a government-mandated platform, commercial software, or a paper book. The logic is identical.

The most instructive worked example is the US state model. Systems like METRC issue physical plant tags and package tags, and licensees report growth stages, harvests, conversions, transfers and disposals against those IDs within set windows^[7]. California requires every commercial licensee to record all cannabis activity, cultivation through sale, in its state track-and-trace system, CCTT-Metrc, built on unique identifiers assigned to each plant and package^[8]. New Zealand and Australia (as at 2026) run no such state-operated ledger; the same functions live in your own records plus regulator reporting. The software is jurisdictional; the concepts transfer completely.

Principles that survive any software choice:

• Physical equals digital. The room and the ledger must say the same thing at all times. Any gap between them, in either direction, is a finding.
• Record at the moment of the event, at the place of the event. Batch-entering the day's movements from memory at 5 pm is how drift is manufactured.
• Weigh at every transformation. Wet weight at harvest, dry weight after drying, waste weight at trim, net weight at packaging. The differences are your moisture and waste story, and auditors read that story closely.
• Nothing leaves except as a recorded transfer, sample, or destruction. There is no fourth category. ‘Gave some to the lab guy’ is a sample with a log entry, or it is diversion.
• Movements get paper before wheels roll. The manifest (what, how much, from, to, carrier) exists before the material moves, and both ends reconcile against it on arrival.

Inventory reconciliation and drift

Inventory reconciliation is the audit test that needs no skill to run and no judgement to interpret: the book says X, the scales say Y, explain the difference. That is exactly why unexplained variance is the most reliable way for a small operator to fail. It is the easiest thing to check and the hardest to fake after the fact.

Drift has boring causes: moisture loss nobody logged as the flower cured; trim swept up and binned without a weight; QC pinches and lab samples that never hit the ledger; wet weight recorded in one unit and dry in another; harvest-day chaos where material moved rooms faster than anyone wrote it down. None of these are diversion. All of them look like diversion on paper, and controlled-substance regimes are built to treat unexplained loss as possible diversion until you demonstrate otherwise. When Oregon's state auditors reviewed their recreational system, they flagged reliance on self-reported data and poor data quality in the tracking system as core weaknesses in detecting exactly that^[9].

The fix is cadence plus honesty. Small operations do well with a weekly cycle count of one area and a monthly full count; every variance gets a written investigation the day it is found, even when the conclusion is ‘moisture loss, within expected range, convention updated’. Give the ledger one owner. And log your moisture-loss convention explicitly (e.g. wet-to-dry expected 75–80% loss) so the biggest legitimate shrink in the building stops looking like a hole.

Audit-ready records and ALCOA+

Regulators worldwide converge on the same definition of a trustworthy record, usually abbreviated ALCOA: Attributable, Legible, Contemporaneous, Original, Accurate, extended in practice with Complete, Consistent, Enduring and Available (ALCOA+). The US FDA's data-integrity guidance for drug manufacturing is built explicitly on these attributes^[10], and cannabis auditors inherit the framework wholesale.

The mechanics for a small operation:

• Bound books with numbered pages, or a digital system with locked history. Loose leaf paper and editable spreadsheets invite exactly the suspicion you are trying to kill.
• Write at the bench, not the office. The clipboard hanging at the point of work beats better software in the wrong room, because it makes the compliant path the lazy path.
• Corrections: single line through, initial, date, reason. The wrong value stays readable underneath. No pencil, no correction fluid, no torn-out pages, no recopying messy originals into a ‘neat’ book. The messy original is the record.
• No blank fields. Strike through what does not apply. A blank is a question mark an auditor fills with their imagination.
• Retention: keep records for years, not seasons. Exact minimums are regime-specific and usually written into your licence conditions. Storage that survives staff turnover and a dead laptop is part of the requirement.

Contemporaneous is the attribute that kills, because backfilling has a signature: a week of entries in one pen, one handwriting, one sitting, with no coffee rings, no wear, and suspiciously round timestamps, or a digital log where twenty entries share one burst of system time the night before the inspection. Auditors read logbooks the way forensic examiners read documents, because that is literally the discipline they are borrowing from. A backfilled record discovered is worse than a gap admitted: the gap costs you a finding; the fake costs you your credibility on every other page.

Deviation management and corrective actions

A deviation is any departure from your written process: the dehumidifier died overnight, the feed was mixed at the wrong EC, the wrong room got sprayed, a delivery arrived with no paperwork. The deviation is not the failure. The unrecorded deviation is the failure, because it means your system does not notice its own departures, and noticing is the entire point of a quality system^[6].

Calibrate the depth. A missed daily check gets three lines and a same-day close. A wrong-tank feed that touched two flowering batches gets impact assessment and a root cause. Classify minor / major / critical in your own procedure so the depth decision is rule-based, not mood-based. What an auditor wants to see is not perfection; it is evidence that you notice, assess product impact, and close loops.

GACP, GMP and quality agreements

Two rule-sets govern the journey from seed to medicine. GACP, Good Agricultural and Collection Practice, covers growing, harvesting and primary processing of medicinal plants: identity, hygiene, inputs, documentation, traceability at the farm layer. The foundational text is the WHO's 2003 guideline^[11], and the European medicines regulator maintains a GACP guideline for herbal starting materials whose 2025 revision explicitly accounts for indoor, controlled-environment growing^[12]. GMP, Good Manufacturing Practice, covers turning that material into a medicine: validated processes, batch manufacturing records, QC release, an independent quality unit^[1]. The PIC/S GMP guide harmonises these expectations across dozens of national inspectorates, including New Zealand's and Australia's^[6].

Where exactly the line sits is regime-specific, and it matters commercially. Cultivation through drying and trimming commonly sits under GACP; extraction, formulation and packaging of the medicine sit under GMP. Australia's TGA, for instance, applies GMP to manufacture while cannabis cultivation feeds it as GACP-governed starting material, with product quality pinned by a statutory standard (TGO 93)^[13]. As at 2026, check where your regulator draws it, the answer decides which rule-set your dry room lives under, and getting it wrong in either direction is expensive.

For a grower the boundary has a practical meaning: you are a starting-material supplier to a GMP site, and GMP obliges that site to qualify its suppliers. Expect the processor's auditors as well as the regulator's. Your GACP documentation (genealogy, input records, drying logs, CoAs) is their evidence that their starting material is controlled. This is where the quality agreement comes in: a signed split of responsibilities so nothing falls between two companies each assuming the other had it.

Security, access and destruction records

Every regime writes its own security prescriptions (safes, alarm standards, camera retention days) into licence conditions, so this section stays deliberately generic. The underlying logic is constant: controlled material demands controlled custody, and custody is proven the same way as everything else, with records.

• Layers, not one big lock. Site, building, room, container: each layer slows an intruder and narrows who can be inside it legitimately.
• Access is two lists. Who may enter (an authorisation list, maintained, signed) and who did (entry logs, key/code registers, visitor book with escort). Auditors cross-check the two.
• Joiners and leavers. The classic finding is an ex-staffer's code still live months after they left. Offboarding (codes killed, keys returned, lists updated) is a same-day task with a record.
• Visitors are escorted and logged, contractors included. The electrician in the flower room is inside your custody chain while the door is open.

Waste is still controlled material. Trim, fan leaves from flowering plants, failed lots, dead plants, in most regimes cannabis waste remains within the licence's custody obligations until it is rendered unusable and its destruction is recorded. The bin is not an exit from track-and-trace; destruction is an event, with the same dignity as a transfer.

Recall readiness and mock recalls

A recall is traceability run under stress: something already released turns out to be suspect, and you must find all of it, fast, and prove you found all of it. Formal GMP systems require a recall procedure and expect it to be tested^[6]; the concept scales down to the smallest licensed grower, because the question, where did every gram of that lot go?, is the same at every scale.

Readiness is the ability to run the genealogy in both directions. Trace back: from a product in the market to every input, room, person and process that touched it. Trace forward: from a suspect input, one mother, one nutrient delivery, one dry room, to every lot and customer it reached. Both directions should run from records alone, in hours.

The mock recall is the drill version: pick a lot at random, pretend its test result just failed, and run the whole exercise on paper against the clock. No material moves; the output is a timed report. A common expectation across supply-chain quality schemes is same-day reconciliation of essentially all of the affected quantity, hours, not weeks. Whatever target you adopt, write it down and measure against it.

What breaks in most first attempts: transfers recorded without lot IDs (so the manifest cannot say which lot the processor got); retained samples that exist in the SOP but not on the shelf; and waste weights too vague to close the mass balance. Every one of those is cheap to fix on a Tuesday afternoon and ruinous to discover during a real event.

Audit-day walkthrough

Inspections vary (announced or not, desk or on-site, routine or triggered) but the shape of a survivable audit day is consistent. The work is 90% done before the knock on the door; the day itself is choreography.

1. 1
   Notification received

   Confirm scope, date, duration and who is attending, in writing. Book your own key people. If a named responsible person is legally required to be present, make sure they are.
2. 2
   Pre-audit sweep

   Self-inspect against your own SOP index and licence conditions. Close what you can close honestly. Do not backfill records. A gap found is a finding; a fake found is a crisis.
3. 3
   Stage the front room

   Licence and conditions, org chart, SOP index, training records, current logs, last inspection's findings and their closure evidence, findable in minutes, not archaeology.
4. 4
   Opening meeting

   Agree scope and logistics. Appoint one person to route all requests and log every document handed over. Everyone else answers what is asked, nothing more, nothing invented.
5. 5
   The walk

   Inspectors watch practice against procedure: gowning, logs at the bench, labels on totes, locks locking. Answer truthfully; where unsure, say ‘I will check and confirm’ and write it down. Never guess, never bluff, never argue.
6. 6
   The document room

   Requests get logged, copies get marked as copies, originals stay yours. If a record does not exist, say so, the recovery plan you offer matters more than the gap.
7. 7
   Closing meeting

   Capture every finding verbatim and ask questions until each is specific enough to act on. Clarify; do not contest. The place to contest is your written response, with evidence.
8. 8
   The response

   Written, by the deadline: for each finding, the correction, the preventive change, the date, the owner. Then do them and keep the evidence, the next audit opens exactly here.

How small operators actually fail

Almost never through malice, and rarely through ignorance of growing. The recurring failure modes are structural. And every one is visible in advance:

Worked examples: NZ and Australia

New Zealand, the Medicinal Cannabis Scheme

New Zealand's scheme is administered by the Medicinal Cannabis Agency within the Ministry of Health, under the Misuse of Drugs (Medicinal Cannabis) Regulations 2019, in force since 1 April 2020^[14]. The licence is built from named activities (cultivation, nursery, research, possession for manufacture, supply) and an operator applies for the combination their operation needs^[2]. Products must meet a minimum quality standard before they can be supplied, which is what pulls GACP-grade cultivation records and GMP manufacture into the picture for anyone aiming at the medicinal market^[5]. Licences carry conditions (security, record-keeping, reporting) and renewal cycles; the Agency publishes application guidance and holds the inspection relationship.

Australia, ODC licensing, TGA quality

Australia splits the job at the federal layer: the Office of Drug Control licenses cultivation, production, manufacture and research under the Narcotic Drugs Act 1967^[4], and since 24 December 2021 a single medicinal cannabis licence can cover those activities together, with permits authorising quantities beneath it^[3]. Product quality is the Therapeutic Goods Administration's territory: manufacture happens under GMP, cultivation feeds it as GACP-governed starting material, and medicinal cannabis products supplied in Australia must comply with a statutory quality standard, TGO 93^[13]. State and territory law adds further layers on top of the Commonwealth ones.

Look at the two side by side and the generic pattern of this whole paper reappears: an activity-based licence with conditions; permits or quantity controls underneath; a quality standard that drags GACP and GMP into cultivation decisions; and security, record and reporting obligations carried as licence conditions. Learn the pattern once, then read your own regime's current documents with it.

• NZ Medicinal Cannabis Agency, about the scheme
• NZ, licence activities
• NZ, Misuse of Drugs (Medicinal Cannabis) Regulations 2019
• AU Office of Drug Control, medicinal cannabis
• AU TGA, quality requirements for medicinal cannabis

Troubleshooting and control principles

Where to next: Daily checks is the operational twin of this paper. It builds the daily record set that makes everything here cheap. GMP hash manufacturing describes life on the far side of the GACP/GMP boundary, where your lots become someone else's starting material. And the IPM papers show why the spray log you keep for compliance is the same one that saves your crop.