Module 1: Record Keeping Fundamentals

Understand the critical importance of proper documentation and Ohio's comprehensive record keeping requirements.

Why Record Keeping Matters

  • Legal Requirement: Ohio law mandates specific records be maintained
  • License Protection: Poor records can lead to suspension or revocation
  • Audit Defense: Documentation proves compliance during inspections
  • Business Intelligence: Records provide insights for operations
  • Legal Protection: Proper documentation in disputes or investigations

⚠️ The 3-Year Rule

Unless otherwise specified, ALL cannabis business records must be retained for a minimum of 3 years. This is not negotiable and applies to both physical and electronic records.

Core Record Keeping Principles

📏 Accuracy

  • Records must be true and correct
  • No alterations without documentation
  • Corrections clearly marked
  • Original data preserved

⏰ Timeliness

  • Enter data when events occur
  • Daily reports filed on time
  • No backdating allowed
  • Real-time documentation

🔍 Accessibility

  • Records available on demand
  • Organized filing system
  • 3-day reconstruction rule
  • Remote access capability

Legal Framework

Regulation Record Keeping Requirement Key Points
OAC 3796:6-3-17 General record keeping 3-year minimum, all transactions
OAC 3796:6-3-20 Security footage 45-day retention minimum
OAC 3796:2-2-08 Cultivation records Plant tracking, pesticide use
OAC 3796:3-2-08 Processing records Batch records, formulations

Consequences of Poor Record Keeping

🚨 Potential Penalties:

  • Warning Letters: First offense documentation issues
  • Fines: $5,000-$50,000 for serious violations
  • License Suspension: Repeated failures to maintain records
  • License Revocation: Falsified or destroyed records
  • Criminal Charges: Intentional record falsification

💡 Best Practice Foundation

Establish these fundamentals from day one:

  • Assign a records compliance officer
  • Create standardized forms and templates
  • Implement daily record review procedures
  • Train all staff on documentation importance
  • Conduct monthly record keeping audits

Module 2: Categories of Required Records

Learn exactly which records Ohio requires cannabis businesses to maintain and how to organize them effectively.

Business & Licensing Records

🏢 Corporate Documents:

  • Articles of incorporation/organization
  • Operating agreements
  • Ownership structure and changes
  • Board meeting minutes
  • Financial interest disclosures

📜 License Documents:

  • Initial license application
  • License certificates (current and previous)
  • Renewal applications
  • Correspondence with regulators
  • Inspection reports

Financial Records

Record Type Specific Requirements Retention Period
Bank Statements All accounts used for business 3 years
Tax Returns Federal, state, local filings 7 years
Sales Records Daily reports, receipts, voids 3 years
Purchase Orders All cannabis product purchases 3 years
Invoices Issued and received 3 years

Employee Records

👥 Personnel Files Must Include:

  • Application materials: Resume, application, references
  • Background checks: FBI and BCI results
  • License documentation: Employee registry cards
  • Training records: Initial and ongoing compliance training
  • Performance documentation: Reviews, disciplinary actions
  • Time records: Schedules, timecards, PTO

Inventory & Product Records

📦 Track and Maintain:

Acquisition Records
  • Manifests (incoming)
  • Lab test results
  • Vendor information
  • Product specifications
Processing Records
  • Batch production logs
  • Formulation records
  • Quality control tests
  • Packaging dates
Distribution Records
  • Manifests (outgoing)
  • Transfer receipts
  • Customer information
  • Delivery confirmations
Disposal Records
  • Waste manifests
  • Witness signatures
  • Disposal method
  • Video evidence

Security Records

  • Visitor logs: All non-employee access
  • Alarm records: Activations, tests, false alarms
  • Key/access card logs: Distribution and return
  • Incident reports: Security breaches, theft attempts
  • Equipment maintenance: Camera, alarm service records

Compliance Records

📋 Regulatory Documentation:

  • Standard Operating Procedures (current and previous versions)
  • Compliance audit reports (internal and external)
  • Corrective action plans and implementation
  • Regulatory correspondence and bulletins
  • Training materials and attendance records
  • Mock recall exercises and results

✅ Organization Best Practice

Create a master filing system:

  1. Use consistent naming conventions
  2. Separate by year and category
  3. Maintain both physical and digital copies
  4. Create an index or database
  5. Assign access permissions appropriately

Module 3: Retention Requirements & Schedules

Master Ohio's specific retention periods for different record types and create an effective retention schedule.

Retention Period Overview

📅 Key Retention Periods:

Record Category Retention Period Start Date
General business records 3 years minimum Date of creation
Security camera footage 45 days minimum Date of recording
Tax records 7 years Filing date
Employee records 3 years after termination Separation date
Disposal/waste records 3 years Disposal date
Lab test results 3 years Test date

Special Retention Considerations

🔍 Extended Retention Triggers:

  • Active Investigation: Keep all related records until case closed + 3 years
  • Litigation Hold: Preserve all documents until legal matter resolved
  • Audit in Progress: No destruction during active audit
  • Product Recall: Keep all batch records indefinitely
  • License Violations: Related records kept 5 years minimum

Creating a Retention Schedule

🗟️ Implementation Steps:

  1. Inventory all record types
    • List every document your business creates
    • Categorize by department/function
    • Note format (paper/electronic)
  2. Assign retention periods
    • Apply regulatory minimums
    • Consider business needs
    • Add buffer for safety
  3. Create destruction schedule
    • Monthly review of eligible records
    • Quarterly destruction events
    • Annual policy review

Record Destruction Procedures

🗑️ Proper Destruction Methods:

Paper Records
  • Cross-cut shredding
  • Professional destruction service
  • Certificate of destruction
  • Witness verification
Electronic Records
  • Secure data wiping
  • Multiple overwrite passes
  • Hard drive destruction
  • Cloud data removal

⚠️ Never Destroy These Records

  • Records under litigation hold
  • Documents requested by regulators
  • Evidence of regulatory violations
  • Records related to ongoing investigations
  • Original licenses and permits

Retention Schedule Template

Record Type Location Retention Review Date Destroy Date
2022 Sales Receipts Archive Box 22-15 3 years 12/31/2025 01/15/2026
Security Footage Jan 2025 Server Drive C 45 days 02/14/2025 02/15/2025
Employee File - Smith HR Cabinet 3 yr post-term 06/01/2028 06/15/2028

💡 Digital Advantage

Benefits of electronic record keeping:

  • Automated retention scheduling
  • Search capabilities for quick retrieval
  • Reduced storage space needs
  • Easier backup and disaster recovery
  • Access controls and audit trails

Module 4: Daily Reporting Requirements

Understand Ohio's daily reporting obligations and learn efficient systems for timely compliance.

Daily Reporting Overview

📆 What Must Be Reported Daily:

  • Beginning inventory: Count at start of business day
  • All acquisitions: Products received from vendors
  • All sales: Every transaction to patients/customers
  • All disposals: Waste, damage, theft, or loss
  • Ending inventory: Count at close of business
  • Employee hours: Who worked and when

METRC Daily Requirements

Activity METRC Entry Deadline Consequences of Delay
Package creation Same business day Inventory discrepancy
Sales recording By end of business day Compliance violation
Transfer acceptance Within 24 hours Chain of custody break
Waste logging Day of disposal Inventory variance

Zero Activity Reporting

⚠️ Critical Requirement

If NO activity occurs during a business day, you must still submit a "zero report" confirming:

  • Business was operational
  • No sales or transfers occurred
  • No inventory changes
  • System was functioning properly

Failure to submit zero reports is a violation!

Daily Closing Procedures

🌆 End-of-Day Checklist:

  1. Complete all METRC entries for the day
  2. Reconcile POS sales with METRC
  3. Balance cash drawers
  4. Review and approve inventory adjustments
  5. Generate daily sales report
  6. Back up all electronic records
  7. Secure all paper documents
  8. Set security system
  9. Complete manager's daily log

Common Daily Reporting Errors

🚫 Avoid These Mistakes:

  • Batch entry: Waiting to enter multiple days at once
  • Estimation: Guessing instead of actual counts
  • Incomplete data: Missing transaction details
  • Time zone errors: Using wrong cutoff times
  • Delegation without verification: Not checking staff entries

Daily Reports to Generate

📊 Sales Summary
  • Total transactions
  • Revenue by category
  • Payment methods
  • Discounts applied
📦 Inventory Movement
  • Products received
  • Products sold
  • Adjustments made
  • Current levels
👥 Staff Activity
  • Clock in/out times
  • User transactions
  • Override usage
  • Training completed

Monthly Compilation

📅 Monthly Reporting Tasks:

  • Compile all daily reports into monthly summary
  • Verify sequential dates (no gaps)
  • Cross-reference with bank deposits
  • Reconcile with state tax filings
  • Archive according to retention schedule
  • Distribute to required parties

✅ Efficiency Best Practice

Automate daily reporting where possible:

  • POS integration with METRC
  • Scheduled report generation
  • Automated email distribution
  • Dashboard for real-time monitoring
  • Exception alerts for anomalies

Module 5: Electronic Record Systems

Learn requirements for electronic record keeping systems and best practices for digital compliance.

Electronic System Requirements

💻 Ohio's Electronic Record Standards:

  • Real-time capability: Must update as transactions occur
  • Web-based access: Available from any authorized location
  • Data integrity: Prevent unauthorized alterations
  • Audit trails: Track all changes with user/time stamps
  • Backup systems: Daily automated backups required
  • 3-day reconstruction: Ability to recreate records within 72 hours

System Features Checklist

Feature Required/Optional Compliance Benefit
User access controls Required Prevents unauthorized access
Automatic timestamps Required Proves when entries made
Data encryption Required Protects sensitive information
Report generation Required Quick inspection response
Integration APIs Optional Reduces manual entry errors
Mobile access Optional Enables real-time updates

Data Security Requirements

🔒 Protecting Electronic Records:

Access Controls
  • Unique user accounts
  • Strong password policies
  • Role-based permissions
  • Two-factor authentication
Data Protection
  • Encryption at rest
  • Encryption in transit
  • Secure servers
  • Firewall protection
Backup Procedures
  • Daily automated backups
  • Off-site storage
  • Regular restore tests
  • Version control

Integration Best Practices

🔗 System Integration Strategy:

  • POS ↔ METRC: Automatic sales reporting
  • Security ↔ Access: Door logs to timecards
  • Inventory ↔ Accounting: Real-time financial updates
  • HR ↔ Compliance: License expiration tracking

Audit Trail Requirements

🔍 Every Electronic Entry Must Show:

  • Original entry data and time
  • User who made the entry
  • Any modifications (with original preserved)
  • User who made changes
  • Reason for changes (if applicable)
  • Approval chain for significant changes

⚠️ Electronic System Violations

  • Systems that allow record deletion
  • Shared user accounts
  • No backup procedures
  • Inability to export/print records
  • Systems that can backdate entries

Disaster Recovery Planning

🌊 Business Continuity Essentials:

  1. Risk Assessment: Identify potential system failures
  2. Backup Strategy: Multiple locations, regular testing
  3. Recovery Procedures: Step-by-step restoration plan
  4. Alternative Systems: Manual procedures if needed
  5. Communication Plan: Notify regulators of issues
  6. Regular Drills: Practice recovery procedures

💡 Vendor Selection Tips

When choosing electronic systems:

  • Verify cannabis industry experience
  • Check Ohio compliance specifically
  • Request security audit results
  • Ensure data portability
  • Review service level agreements
  • Test customer support response

Module 6: Record Keeping Audit Preparation

Prepare your record keeping systems for regulatory inspections and ensure quick access to required documentation.

What Inspectors Review

🔍 Primary Documentation Reviews:

  • Random sampling: Inspectors select random dates/transactions
  • Complete chains: From acquisition to sale/disposal
  • Consistency checks: METRC vs. physical records
  • Compliance history: Previous violations and corrections
  • Employee records: Current licenses and training
  • Financial accuracy: Sales records vs. bank deposits

Quick Access System

📁 Organize for 5-Minute Retrieval:

Physical Filing
  • Color-coded folders
  • Labeled file cabinets
  • Master index posted
  • Current year accessible
Digital Organization
  • Logical folder structure
  • Consistent naming
  • Search capabilities
  • Quick filters/views
Hybrid System
  • Digital index of physical files
  • Scanned key documents
  • Cross-reference system
  • Backup locations noted

Pre-Inspection Checklist

📋 48 Hours Before Inspection:

  • Print current employee license list
  • Organize recent inspection reports
  • Prepare METRC access credentials
  • Review last 30 days of records
  • Check all retention deadlines
  • Ensure backup access works
  • Brief staff on record locations
  • Clear workspace for inspector

Common Record Keeping Violations

Violation Type How to Prevent
Missing records Daily filing routine, regular audits
Illegible documents Scanning old papers, digital preference
Incomplete information Standardized forms, required fields
Premature destruction Clear retention schedule, approval process
Inaccessible records Multiple access methods, clear organization

Mock Audit Exercise

🎯 Monthly Self-Audit Process:

  1. Select random date: Pick any business day from last month
  2. Request documentation:
    • All sales from that date
    • Opening/closing inventory
    • Employee records for staff working
    • Any waste disposal
    • Security footage (spot check)
  3. Time the retrieval: Should take under 15 minutes
  4. Verify completeness: All required elements present
  5. Check accuracy: Math adds up, signatures present
  6. Document findings: Create improvement plan

Building a Compliance Culture

🌱 Record Keeping Excellence:

  • Daily habits: "Document as you go" mentality
  • Team accountability: Everyone responsible for their records
  • Regular training: Monthly record keeping refreshers
  • Recognition: Reward documentation excellence
  • Continuous improvement: Learn from every inspection

🎓 Course Complete!

You've mastered Ohio's record keeping and reporting requirements! Key takeaways:

  • Documentation is your compliance foundation
  • The 3-year rule is non-negotiable
  • Daily diligence prevents major problems
  • Organization enables quick inspection response
  • Electronic systems offer efficiency and security

Remember: Good records protect your license and your business!