Common Compliance Mistakes After Receiving a Cannabis Licence

Almost nobody loses a cannabis licence because of a dramatic failure. They lose ground slowly, through a set of ordinary mistakes that look harmless for months and then surface all at once when an inspector opens a batch record or a renewal application lands on a reviewer's desk.

The pattern is remarkably consistent. A company builds a compliance system to win a licence, then treats that system as finished. Staff turn over. The site changes. Procedures written for a facility that no longer exists stay in the binder. Nothing appears wrong until Health Canada compares what the paperwork says with what the site actually does, and finds a gap. This article sets out the ten mistakes that produce most of those gaps, with the provision behind each one and the corrective and preventive action that closes it.

Executive Summary

Post-licence compliance failures cluster in ten places: a compliance system left to decay after licensing, standard operating procedures that no longer describe the site, records that cannot survive retention scrutiny, a quality assurance person who exists only on paper, site or activity changes made before the amendment is filed, security clearances allowed to lapse, monthly reports that do not reconcile to inventory, pest control products used outside their authorization, a recall system that has never been tested, and marketing that crosses into prohibited promotion. Each has a specific hook in the Cannabis Act, the Cannabis Regulations (SOR/2018-144) or the Cannabis Fees Order (SOR/2018-198), and each has a corrective action that is cheap now and expensive later. The sections below give the finding as an inspector would write it, the rule it breaches, and the fix that holds.

What Goes Wrong After Licensing, and Why

What it is: the drift between the compliance system described in your licence application and the way your site actually runs a year later. Why it matters: an inspection tests that gap, and the gap is what gets written up. What to do: assume drift is happening and audit for it on a schedule rather than waiting to be told.

Health Canada's compliance and enforcement report for 2024 to 2025 records 889 inspection activities under the Cannabis Act and its regulations, made up of 437 regular inspections, 101 targeted inspections, 128 compliance verifications, 197 inspections of registered personal and designated production, and 26 promotions inspections. From those activities it issued 37 non-compliant inspection reports to licence holders. It also stated that inspections follow a risk-based approach focused on the highest risk to public health and public safety, using onsite, offsite and hybrid methods.

The report named three example issue types: non-compliances related to good production practices, unsatisfactory retention of documents and information, and not conducting activities as per their responsibilities. Read those three together and a picture forms. They are not about contaminated product or diverted inventory. They are about a management system that has stopped keeping pace. That is good news, because management systems are fixable without capital expenditure. It is also bad news, because the drift is invisible from inside. For the frequency and targeting of these inspections, see our guide to how often cannabis companies get audited.

The table below maps the issue types Health Canada named to what they look like in practice and the provisions that govern them.

Issue type named by Health Canada	What it looks like on site	Where the rule sits
Good production practices	Sanitation program not followed, equipment that cannot be cleaned effectively, unapproved pest control products, storage that does not maintain quality	Cannabis Regulations Part 5, sections 79 to 88.94
Unsatisfactory retention of documents and information	Missing batch records, destruction records that do not reconcile, recall simulation never documented, key investor record incomplete	Cannabis Regulations Part 11, sections 221 to 241
Activities not conducted as per responsibilities	Lot release without QAP approval, responsible person not engaged, head of security role unfilled in practice	Sections 19, 37, 38 and 88
Promotion	Marketing assets published without review; 436 cases of potential non-compliance created and 130 actions taken in 2024 to 2025	Cannabis Act sections 17 to 24, and section 48 of the Regulations

The Ten Mistakes

1. Treating the licence as the finish line

The most expensive mistake is structural. The consultant leaves, the regulatory budget is reallocated to production, and the person who understood the file moves on. Six months later nobody owns the compliance calendar. This is not a breach of any single section; it is the condition that produces all the others. Section 79 of the Regulations is the gate that eventually catches it: a holder must not sell, distribute or export cannabis unless the applicable requirements in sections 80 to 88.94 have been met. If your system has decayed, you are technically failing that gate every time you release a batch. The fix is to name an owner for post-licence compliance on day one and to fund the role. Our companion guide to post-licensing support for Canadian cannabis licence holders sets out the full obligation calendar that person should be running.

2. SOPs that describe a facility you no longer run

Section 80 requires that cannabis and ingredients be produced, packaged, labelled, distributed, stored, sampled and tested in accordance with standard operating procedures designed to ensure compliance with Parts 5 and 6. Note the wording: in accordance with. It is not enough to have the SOP. Practice must match it. Yet SOPs are usually written during the application, by someone describing a facility that has not been built yet, and they are rarely revisited once the room is actually running. The inspector asks an operator to walk through a step, the operator describes what they really do, and the answer does not match the document. That is a finding, and it is one of the easiest to avoid. See our guide to good production practices for cannabis in Canada for the full Part 5 map.

The corrective action is a walkthrough review: take each SOP to the room it governs, have the person who does the job read it aloud, and revise wherever practice and paper diverge. Decide deliberately which one is wrong. If practice is better, change the SOP under document control. If the SOP is right, retrain. Do not leave the two disagreeing. Our article on internal audits for cannabis and GMP facilities explains how to schedule this properly.

3. Records that cannot survive retention scrutiny

Health Canada explicitly named unsatisfactory retention of documents and information as a recurring issue. Part 11 of the Regulations sets retention duties across inventory and distribution, destruction, security, production, packaging and labelling, cannabis accessories, the system of control for recalls, promotion, research and development, and key investors. Most are two years, but the periods vary. The retained portion of a tested sample under section 92(2) must be kept for at least one year after the last sale of any portion of the lot or batch. The revenue records behind the annual fee, under section 11 of the Cannabis Fees Order, must be kept for at least seven years in a form that permits a timely audit. Applying a single blanket retention period across the whole operation is how companies destroy something they were required to keep.

The other half of the problem is retrievability. A record you cannot produce during an inspection is functionally a record you do not have. Build a retention schedule that lists each record type, its provision, its period and its location, and test it by asking for three records at random and timing how long they take to appear.

4. A quality assurance person who is a name on a form

This is the sharp end of not conducting activities as per responsibilities. For processors, section 88(1) requires that investigations be conducted under the QAP's responsibility, that the QAP immediately cause measures to be taken to mitigate risk, that methods and procedures be approved by the QAP before implementation, that the preventive control plan for extracts and edibles be approved before implementation, and that every lot or batch be approved by the QAP before it is made available for sale. An amendment brought in by SOR/2025-43 added section 88(2), permitting the activities in paragraphs (1)(b) to (e) to be conducted under the QAP's responsibility rather than personally. That is real flexibility, but it is not a licence to disengage: the QAP still carries the accountability, and any delegation must be documented and controlled. See the risks of ignoring cannabis quality assurance for the wider consequences.

The warning signs are easy to spot from the inside if you look. Lot release signatures applied in batches, days after shipment. Deviations closed with no investigation record. A QAP who has never refused a release. If none of your lots has ever been held, that is not evidence of quality; it is evidence that nobody is looking.

5. Changing the site before filing the amendment

The Regulations divide change into three categories and the categories carry very different obligations. Section 32 requires an application for an amendment before a change to the name of the holder, the address of the site or building where the activity is authorized, or the authorized activity. Section 33 requires the Minister's approval before a site plan change that would require physical security measures under Part 4. Section 34 requires notification within five days after a change to contact details, other site plan changes, the replacement or addition of an individual who must hold a security clearance, or a change to the organizational security plan. Build first and file later, and the licence no longer describes your operation, which is precisely what an inspector checks. Our article on how regulatory consultants handle licence renewals and amendments works through the same split across the other Health Canada frameworks.

A related omission catches almost everyone at least once. Section 35 requires written notice to local government, police and fire authorities, with a copy to the Minister, within 30 days after the issuance, amendment, suspension, reinstatement or revocation of a licence. Companies remember it at initial licensing and forget it at every amendment and renewal afterwards.

6. Letting security clearances lapse

Section 50 sets out who must hold a clearance, and the list reaches further than most new licence holders expect: the holder, directors and officers, individuals in a position to exercise direct control, directors and officers of a controlling corporation or cooperative, partners, the responsible person, the head of security, the master grower, the quality assurance person, their designated alternates, and anyone the Minister specifies. A clearance is valid for a period set by the Minister up to a maximum of five years, and Health Canada opens the renewal option in the CTLS 180 days before expiry. Read its guidance on the cannabis security clearance process before any change in personnel or ownership.

The trap is corporate change. A financing round brings a new director. A parent company restructures. Each event can create a person who needs a clearance, clearances take months, and Health Canada states that a licence renewal may be affected if key personnel, partners, directors and officers of the holder and the parent company are missing clearances, and that clearances must be valid at the time of renewal, as set out in its guidance on renewing your cannabis licence. Keep a live roster with names, positions, expiry dates and alternates, and review it whenever the cap table or the org chart moves.

7. Monthly reports that do not reconcile to inventory

Holders of a licence for cultivation, processing or sale for medical purposes that authorizes possession must report to the Minister no later than the 15th day of each month under the Cannabis Tracking System Order (SOR/2019-202), and Health Canada's monthly reporting guide explains each field. Filing late is a straightforward non-compliance. Filing numbers that do not tie back to your batch, destruction and shipping records is worse, because unexplained variance in a controlled substance framework reads as a diversion risk rather than a clerical error.

Reconcile before you submit, not after somebody asks. Retain the working papers that show how you got from the physical count to the reported figure. When you find an error, correct it deliberately and record why. Health Canada also expects any non-compliance with reporting requirements, including monthly reporting and key investor reports, to be resolved before it will process a renewal.

8. Using a pest control product outside its authorization

Section 81 is unambiguous: cannabis must not be treated with a pest control product unless the product is registered for use on cannabis under the Pest Control Products Act or is otherwise authorized for use under that Act. The registered list is short, the pressure of a live infestation is real, and that combination is exactly how a grower reaches for something that works but is not authorized. Section 92(3)(a) then requires the retained portion of the tested sample to be sufficient to determine whether the lot meets section 81, so the evidence of what you used stays in the freezer. Our guide to integrated pest management for cannabis covers the preventive approach that keeps you out of that corner.

One point of accuracy that matters here. The Cannabis Regulations do not themselves require pesticide residue testing of every lot. Section 91 requires testing for microbial and chemical contaminants but expressly excludes residues of a pest control product or its components or derivatives. The residue limits sit in Part 6 by reference to maximum residue limits specified under the Pest Control Products Act, and Health Canada's mandatory testing expectations are set out in its own guidance rather than in a section of the Regulations. If someone tells you the Regulations mandate pesticide testing by section number, ask which section.

9. A recall system that has never been tested

Section 46 requires a system of control permitting the rapid and complete recall of every lot or batch sold or distributed, and it requires more than that: a recall simulation at least once every 12 months, a document setting out how it was conducted and the results, and retention of that document for at least two years. The simulation is skipped constantly, on the reasoning that nothing has ever been recalled. That reasoning is backwards. The simulation is the only cheap opportunity to discover that your traceability breaks somewhere between the grow room and the shipping manifest. Our article on avoiding cannabis product recalls sets out what good traceability looks like.

If a real recall arrives, section 247 requires a detailed document to the Minister before you commence, a risk evaluation within 72 hours of that document, and a report on the results and the measures taken to prevent recurrence within 30 days of completion, which the Minister may extend to a maximum of 90 days. Those clocks are unforgiving if you are inventing the process while running it.

10. Marketing that crosses into prohibited promotion

Promotion is the mistake most often made in good faith, because marketing usually sits outside the quality system and nobody thinks of a social post as a regulated act. Sections 17 to 24 of the Cannabis Act restrict promotion sharply, and section 48 of the Regulations requires you to include your name, as set out in the licence, in every means by which you identify yourself in relation to cannabis, including advertising, purchase orders, shipping documents and invoices. Health Canada created 436 cases of potential non-compliance related to promotions between April 1, 2024 and March 31, 2025 and took 130 actions, of which 68 were compliance emails or letters and 62 were compliance promotion emails or calls. It also ran 26 inspections targeting promotions at both licensed and unlicensed establishments.

The fix is procedural, not creative. Put every outbound asset through a documented compliance review before publication, keep the review record, and retain promotion records as Part 11 requires. Treat the marketing agency as a supplier operating inside your quality system, with a specification and an approval step.

What Health Canada Does When It Finds Something

What it is: the graduated enforcement response to a non-compliance. Why it matters: the cost is rarely the penalty; it is the stop sale and the renewal risk. What to do: close every observation with a documented CAPA and verify the fix held.

Health Canada states that it takes a graduated and proportional enforcement approach to address risks to public health and safety, and that its tools include, but are not limited to, warning letters, seizure and detention of products, and licence suspension or revocation. The actions it actually took against licence holders in 2024 to 2025 are set out below. Note how modest the headline numbers are and how disruptive the middle column would be to a small operation.

Action against licence holders, FY 2024 to 2025	Number	Practical effect
Non-compliant inspection reports issued	37	Findings on file; may affect renewal; CAPA and follow-up required
Stop sales initiated	10	Sales of the affected product halt immediately while you investigate and correct
Warning letters issued	2	Formal notice of non-compliance with a request for corrective measures
Seizure and detention of products	1	Product removed from your control pending resolution
Destruction	1	Affected product destroyed; total loss of that inventory
Promotions: cases of potential non-compliance created	436	Compliance correspondence, escalating where unresolved
Promotions: actions with regulated parties	130	68 compliance emails or letters and 62 compliance promotion emails or calls

The stop sale is the number to watch. Ten of them across the whole sector in a year sounds rare until you are one of them. It arrives without warning, it stops revenue on the affected product, and it ends only when the inspector is satisfied. The other lever is quieter: Health Canada states that a non-compliant inspection rating may affect the renewal of your licence. Findings you left open twelve months ago become a live problem exactly when you need a clean file. For the inspection process itself, see our steps for passing a Health Canada cannabis inspection and our guide to passing a cannabis regulatory audit.

Writing a CAPA That Actually Closes the Finding

Most corrective and preventive actions fail for the same reason: they correct the instance and leave the cause. An inspector finds one batch released without QAP approval, the company signs that batch off retrospectively and calls it closed. Six months later it happens again, and now there is a pattern and a credibility problem. A CAPA that closes a finding has five parts.

Correction: what you did immediately about the specific instance, including any product held, recalled or destroyed.
Extent of condition: how far the problem reaches. If one batch was released without approval, how many others? Answer this before the inspector asks.
Root cause: why the system permitted it. "Operator error" is almost never a root cause; it is the place you stopped asking why. Our list of root cause analysis mistakes covers the common traps.
Preventive action: the change to the system, whether that is a procedure, a control, a training requirement or a piece of software, that makes recurrence structurally harder.
Effectiveness check: a dated verification, months later, that the fix held. Without this, a CAPA is a promise rather than evidence.

Post-Licence Compliance Checklist

Work through this list to find the drift before an inspector does.

Name one person accountable for post-licence compliance, with a funded role and a documented calendar.
Walk every SOP through the room it governs with the person who does the job, and reconcile paper to practice under document control.
Build a retention schedule listing each record type, its provision, its period and its location, and test retrieval at random.
Confirm the QAP approves every lot or batch before it is made available for sale, and that any delegation under section 88(2) is documented.
Classify every planned change as an amendment, an approval or a notification before you act, and file section 34 notifications within five days.
Send section 35 notices to local authorities within 30 days of every issuance, amendment, suspension, reinstatement or revocation, not just the first one.
Maintain a live security clearance roster with positions, expiry dates and alternates, and review it whenever ownership or the org chart changes.
Reconcile the monthly report to physical inventory before submitting, and retain the working papers.
Verify every pest control product in the building is registered for use on cannabis or otherwise authorized under the Pest Control Products Act.
Run and document a recall simulation at least once every 12 months, and retain the record for two years.
Route every promotional asset through a documented compliance review before publication, and retain the review record.
Close every open observation with a full CAPA including extent of condition and a dated effectiveness check, well before your renewal window.

Frequently Asked Questions

What is the most common compliance mistake after getting a cannabis licence?

Letting the compliance system decay once the licence is issued. Health Canada's 2024 to 2025 report named good production practices, unsatisfactory retention of documents and information, and activities not being conducted in line with assigned responsibilities as the example issues it observed. All three are downstream of the same cause: a system built to pass an application and never maintained afterwards. In practice this shows up first as SOPs that no longer describe the site.

How is this different from mistakes made during the licence application?

Application mistakes cost you time and money before you are licensed: incomplete submissions, missing clearances, a site plan that does not meet Part 4. Post-licence mistakes cost you revenue and your authorization after you are operating: stop sales, seizures, and a renewal that stalls. The skills overlap but the stakes are different, because once licensed you have inventory, staff and customers depending on the licence staying valid. See our separate list of cannabis licence application mistakes for the pre-licensing stage.

Can Health Canada stop my sales without suspending my licence?

Yes. A stop sale halts sales of the affected product while the issue is investigated and corrected, without the licence being suspended or revoked. Health Canada initiated 10 stop sales against licence holders in fiscal year 2024 to 2025. For a small operation with concentrated inventory, a stop sale can be more immediately damaging than a warning letter, because it hits cash flow with no notice and lasts until the inspector is satisfied.

How long do I have to keep cannabis records?

It varies by record type, which is why a blanket policy is risky. Part 11 of the Cannabis Regulations sets the periods, and many are at least two years. The retained portion of a tested sample under section 92(2) must be kept for at least one year after the last sale of any portion of that lot or batch. The revenue records supporting your annual regulatory fee must be kept for at least seven years under section 11 of the Cannabis Fees Order, in a manner that enables a timely audit. Build a schedule by record type and confirm each period against the relevant provision.

Do the Cannabis Regulations require pesticide testing on every batch?

Not by that wording. Section 91 requires testing for microbial and chemical contaminants but expressly excludes residues of a pest control product or its components or derivatives. What the Regulations do is restrict which pest control products may be used at all under section 81, set residue limits in Part 6 by reference to maximum residue limits specified under the Pest Control Products Act, and require under section 92(3)(a) that the retained sample be sufficient to determine compliance with section 81. Health Canada's testing expectations are set out in its own guidance rather than in a numbered testing section, so confirm current requirements with Health Canada before relying on any summary.

What happens if I make a site change and file the amendment afterwards?

You have conducted an activity that the licence does not authorize in the way it is now being carried out, and your licence no longer describes your operation. Section 32 requires the amendment before a change to the holder's name, the site or building address, or the authorized activity. Section 33 requires the Minister's approval before a site plan change needing physical security measures under Part 4. Filing afterwards does not cure the gap in the interim, and it is precisely the mismatch an inspector looks for. Always confirm the category and the approval requirement before you act.

How do I fix a finding so it stays fixed?

Write a CAPA that has all five parts: the immediate correction, the extent of condition, a genuine root cause, a preventive action that changes the system rather than the person, and a dated effectiveness check months later. The most common failure is stopping at the correction. If you fix the batch but not the process that released it, the finding returns, and a repeat finding is far harder to explain than a first one.

How MFLRC Can Help

MF License and Regulatory Consultants (MFLRC) helps Canadian cannabis licence holders find and close compliance gaps before Health Canada does. With more than twenty years of quality assurance, quality control and regulatory affairs experience across cannabis, pharmaceuticals, natural health products, medical devices, food and cosmetics, our senior-led team turns findings into closed CAPAs and keeps authorizations defensible. We provide:

Gap assessments and mock inspections through our audit services, benchmarked against the findings Health Canada actually writes up.
SOP development and remediation, GPP systems, batch record design, CAPA authoring and QAP support through our quality assurance services.
Amendments, notifications, CTLS reporting and renewal management through our regulatory affairs, licensing and import and export services.
Process, equipment, cleaning and computerized system validation through our pharmaceutical validation services, for holders moving toward GMP or export markets.
Recall simulation design and execution, and support during a real recall including the section 247 submissions.
Inspection response support, including CAPA authoring, extent of condition analysis and effectiveness verification.

Carrying an open finding, or unsure whether your SOPs still match your site? Talk to MFLRC, or connect with our team, for a candid assessment of where your file stands.

Book a Consultation

Conclusion

None of these ten mistakes requires bad intent, and most are made by capable people running busy sites. That is exactly why they persist. The compliance system that won your licence was a snapshot of a facility on paper. The facility then started running, and the two have been diverging ever since. Health Canada's inspection findings are simply the measurement of that divergence. Close the gap deliberately, on a schedule, with someone accountable for it, and the whole framework becomes manageable. Leave it, and the first honest measurement of your compliance system will be taken by an inspector, on their timetable rather than yours.