When an Employee Breaks a Cannabis Compliance Rule: How to Investigate Without Putting Your License at Risk

Hypothetical, not a real case: it is 7:40 on a Tuesday morning at a dispensary. A budtender tells the shift lead that the camera over the back stockroom has been turned toward the wall since Sunday night. She adds that she saw a coworker go into that room twice after close. By lunch, the owner wants to know if this is a firing, a police matter, a regulator matter, or all three. A cannabis employee investigation often starts in exactly this kind of muddle, and the first few hours decide whether it ends cleanly.

Here is the part most HR guides skip. In an ordinary business, a rule violation is a personnel issue. In a licensed cannabis business, the same act can be a personnel issue and a regulatory issue at once. The regulator’s clock does not wait for your interview schedule. So this post walks through the order of operations: what to protect first, who decides about reporting, how to run the interviews, how to choose the outcome, and how to close the matter.

Why a Cannabis Employee Investigation Is Different

The license sits behind every decision

When an employee breaks a rule, that employee can lose a job. The company can lose far more: fines, conditions on the license, a suspension, or a harder renewal. Regulators generally hold the licensee responsible for what happens inside the building, no matter who did it. That is why a cannabis employee investigation has to protect the facts as carefully as it protects fairness. A fair process that lets the video overwrite itself is still a failure.

Massachusetts as a worked example

Massachusetts is a useful example because its security rule, 935 CMR 500.110, is specific. We read the text on the Cornell Law School Legal Information Institute site and on a second published copy. The Cannabis Control Commission amends its rules from time to time. So please confirm everything below on the current version at the Cannabis Control Commission regulations page before you rely on it.

Cameras must cover areas that may contain marijuana, vaults and safes, sales areas, every point of entry and exit, and any parking lot. They must be angled to identify people clearly and must record 24 hours a day. Recordings must be available to the Commission for at least the preceding 90 calendar days. Nobody may destroy or alter them. Retention runs longer if the licensee knows of a pending investigation or the Commission asks for preservation. Equipment needs inspection and testing at intervals of no more than 30 calendar days. An alarm failure must alert designated employees within five minutes.

The incident reporting clock

Incident reporting runs on a shorter fuse. The rule lists reportable events, including inventory discrepancies, diversion, theft or loss, criminal action on the premises, and “any other breach of security.” For those events, the licensee must notify law enforcement and the Commission immediately, and in no instance more than 24 hours after discovery. A written incident report goes to the Commission within ten calendar days. The licensee keeps incident records for at least one year, or for the length of an open investigation if that is longer.

We are not saying that a particular act, such as turning a camera or consuming in a back room, is reportable under that list. That depends on the facts and the rule’s definitions. Deciding whether something is reportable is a decision for the license holder and counsel. It has to happen within hours. HR’s job is to make sure someone is deciding.

Every state sets its own numbers

Do not carry Massachusetts numbers into another state. Public Michigan filings show how much the details vary. One formal complaint, as the agency describes it, cites a video rule calling for 30 calendar days of recordings. Another cites a rule that requires a licensee to notify the agency and local law enforcement within 24 hours of learning about theft, loss, or criminal activity. So look up your own regulator’s surveillance, retention, and incident rules. Find the time limits, and put them on a card in the compliance binder before you need them.

What regulators cite licensees for

We opened four public Michigan Cannabis Regulatory Agency documents from its 2025 and 2026 disciplinary files. The themes are ordinary and operational. They include inventory and chain-of-custody entries done wrong, too many employees in a vault during sampling, visitor logs left blank, and camera systems that lacked the required days of footage. In one final order, the agency fined a licensee $12,500 on two counts. One count involved surveillance recordings the licensee could not produce. The licensee said the footage was lost in an export glitch and overwritten.

Most of these documents are complaints, which are allegations and not findings, so we describe them only in general terms. The lesson for any cannabis employee investigation is still clear: regulators read video, tracking records, and logs, and they ask what the licensee did once it knew. Your file should answer that question on the day someone asks.

The First 24 Hours of a Cannabis Employee Investigation

Preserve the video and records

Before anyone interviews anyone, secure the evidence. Export and copy the relevant video. Then lock the originals so the system cannot record over them on its normal cycle, and note the date, the time, and the person who made each copy. In Massachusetts, the rule bars destroying or altering recordings. Apply the same instinct to seed-to-sale records, badge and door logs, alarm logs, schedules, and the camera system’s own maintenance log.

Then limit who can touch it. Name one person to hold the evidence, and keep a simple log of who viewed what and when. A manager who watches the footage alone and forwards a clip to a group chat has turned evidence into gossip. That manager may also have tainted a witness.

Make sure someone decides about reporting

This is the step generic HR guides miss. Within hours of discovery, the license holder should decide with counsel whether the facts must go to law enforcement and the regulator. A compliance lead can act for the owner. Write down the decision and the reasons. If the answer is yes, the clock in Massachusetts runs from discovery. If the answer is no, a dated note explaining why protects you later.

Watch the word discovery. Sitting on a coworker’s report for three days can look, afterward, like sitting on the discovery itself. So log the exact time the report arrived. Then get the decision-makers on a call the same day.

Protect the person who reported

The coworker who spoke up is the most fragile part of the process. Thank them, and say you will take the report seriously. Explain what happens next in general terms, and state plainly that retaliation will not be tolerated. Then ask a practical question: does the accused employee supervise them or control their schedule? If so, change who approves their shifts for now. Moving the reporter to a worse shift “for their protection” is a classic retaliation pattern.

Interim measures: paid leave or suspension

Sometimes the accused employee has to be out of the building while you gather facts. Paid administrative leave is usually the cleaner choice, because it signals that you have reached no conclusions. An unpaid suspension before the facts are in can look like punishment first and investigation second. For salaried exempt employees, it can also raise pay-rule problems, so ask counsel before you use it.

Short of leave, change access. Suspend seed-to-sale credentials, safe or vault access, alarm codes, and keys. Adjust the schedule so the employee is never alone with the evidence. Do this quietly, and write the reason in neutral words such as “pending review.” Never write “caught tampering” in a record before anyone has been heard.

Running the Cannabis Employee Investigation

Pick a neutral investigator

The investigator should have no stake in the outcome and no history with the people involved. The direct manager is almost never the right choice, because that manager may be a witness or may have missed the problem. In a small company, the investigator might be the owner, an outside HR consultant, or counsel. If the facts point toward a possible crime or a regulator filing, ask counsel whether the lawyer should direct the work so it stays as protected as possible. An investigator who is close friends with the accused should step aside.

Interview order and technique

Interview the reporter first to pin down what they saw, when they saw it, and who else knows. Next, speak with witnesses. Start with those who have the least stake and move toward the people closest to the events. Interview the accused last, once you hold the video and records. That lets you ask open questions first and then show specifics. Keep each interview separate and short, so witnesses cannot compare stories while the details are fresh.

Open each interview with the purpose: you are gathering facts, and you have decided nothing. Ask open questions such as “Walk me through Sunday night.” Avoid leading ones. Give the accused a full chance to answer every allegation and to name witnesses or documents. If your workforce is unionized, employees may have a right to a representative at an interview that could lead to discipline. Ask counsel before you schedule anything.

Notes and documentation

A cannabis employee investigation lives or dies on its paper trail. Take notes during every interview, with a second person in the room when you can, and type them up the same day. Record who attended, the date and time, what you asked, and what the employee said, using the employee’s own words where they matter. Separate facts from impressions. “She looked nervous” is an impression, while “she said she did not remember the date” is a fact.

Keep a running timeline and a file index. The index should list the original report, the video clips with the copy log, the records you pulled, the interview notes, the interim-measures decision, and the reporting decision. Finish with a short written summary of the allegations, the evidence, your findings of fact, and the policy each finding was measured against.

Confidentiality has limits

You can ask people to keep the matter confidential while interviews are underway, because that protects the facts. Do not promise absolute secrecy, though. You may need to share information with the regulator, with law enforcement, with counsel, or with the accused so they can respond. Blanket rules that bar non-supervisory employees from discussing workplace issues can also collide with the National Labor Relations Act. It protects employees acting together for mutual aid or protection, with or without a union. Agency positions on investigation confidentiality have shifted over time. A case-by-case request with a stated reason, ending when the investigation ends, is safer. Ask counsel to review the wording.

What retaliation looks like in practice

Retaliation is rarely a dramatic firing. More often it is a schedule that quietly gets worse. It is a reporter who stops getting the good shifts, a manager who goes cold, or a group chat that freezes someone out. It can be a write-up for something nobody cared about last month. Watch for all of it. Watch especially for managers who were not part of the process but heard the rumor.

Federal law adds layers. The NLRA protects non-supervisory employees from discipline for protected concerted activity. Section 11(c) of the OSH Act bars retaliation for raising safety and health concerns, and an OSHA fact sheet says the complaint is due within 30 days after the employee learns of the adverse action. State whistleblower and anti-retaliation laws vary. So treat protection as broad, and call counsel before you take any adverse step against a reporter or a witness.

Deciding the Outcome: Termination, Final Warning, or Something Else

Consistency and proportion

Before choosing a penalty, pull the file on past cases of similar conduct and see what you did. Suppose the last person who propped open a back door got a written warning. If this person is fired, you need a reason you can state: intent, concealment, the level of risk, or a prior warning. Differences are fine when they are real and written down. Differences that track age, sex, race, medical status, or complaint history are what plaintiffs’ lawyers look for.

Think in a ladder: coaching, written warning, final warning, termination. Many violations belong on the lower rungs, such as a missed log entry or a late inventory count. Resist treating every violation as a firing offense just because the setting is regulated. Over-severity breaks consistency and invites claims.

Zero-tolerance categories

Some conduct threatens the license so directly that most operators treat it as grounds for termination on a first proven offense. Typical examples include diversion of product, falsifying inventory or tracking records, and deliberately tampering with cameras or alarms. Selling to a minor, skipping the ID check, and consuming on site belong on the list too. Write these categories into the handbook in plain words, and have employees sign that they read them. Zero tolerance still requires a cannabis employee investigation, though. The phrase describes the consequence of proven conduct, and it does not excuse you from finding the facts.

Impairment and off-duty rules

Off-duty and impairment rules differ sharply by state. New York’s Labor Law 201-d protects legal cannabis use outside work hours, off the premises, and without the employer’s equipment. It still lets an employer act when an employee is impaired, meaning the employee manifests specific articulable symptoms while working that reduce job performance or interfere with the employer’s duty to provide a safe workplace.

New Jersey’s Cannabis Regulatory Commission issued interim workplace impairment guidance in September 2022. As we read it, an employer cannot act based solely on a metabolite test from lawful off-duty use. Documented signs of impairment at work can support action. The guidance also describes a Workplace Impairment Recognition Expert certification, while saying it is not required for reasonable-suspicion determinations. We have not checked for later updates, so confirm before you rely on it.

Whatever your state, document observable signs rather than conclusions, use a second observer, and apply one process to every employee. On-site consumption is a different question from off-duty use, and many states treat it very differently.

Medical patients and accommodation

In Massachusetts, the Supreme Judicial Court held in Barbuto v. Advantage Sales and Marketing (2017) that a medical marijuana patient fired after a positive test could pursue a handicap discrimination claim under G.L. c. 151B, section 4(16). Employers may need to explore reasonable accommodation. The court also held that the medical marijuana law does not require an employer to accommodate on-site use. That is a short summary of a longer decision, so have counsel review it.

In practice, pause if the employee says they are a registered patient. Ask counsel before you decide. An accommodation conversation concerns off-site use and impairment-free work. It does not excuse diversion, tampering with cameras, or consuming in the back room. Other states handle medical patients differently.

After the Decision: Meetings, Access, and the Regulator

The termination meeting

Keep it short, private, and calm. Two people from your side attend. State the decision in the first minute, give the reason plainly, and do not debate or introduce new evidence. Have final pay, benefits information, and return-of-property items ready. Follow your state’s final pay timing, which in Massachusetts is the day of discharge. Our termination playbook covers the meeting script and the paperwork in more detail.

Remove access the same hour

Disable seed-to-sale credentials, POS and timeclock logins, key and badge access, safe and alarm codes, email, and scheduling access. Collect keys, badges, and any company phone, and change every shared code the person knew. Keep the audit trail on each account rather than deleting it, because that activity log may become evidence. Then have someone walk the employee out, calmly, since the building holds product and cash.

Regulator follow-up

Many regulators expect updates when a licensed agent leaves or an incident changes shape, and some send follow-up requests for records. The details are state-specific and we have not verified any other state’s deadlines, so look up yours. In Massachusetts, a reportable incident needs the written report within ten calendar days. The incident records stay on file for a year or longer if an investigation is open. Keep the investigation file, the video copies, and the reporting decision in one place so you can answer a regulator’s request in an afternoon.

Telling the team without gossip

Say little. Tell the team that the person no longer works there, that you will not discuss why, and that shift coverage is set. Remind everyone that the rules on cameras, product, and reporting still apply. Add that anyone who raises a concern in good faith is protected. Do not name the reporter, do not hint, and do not let managers share details at the counter. People will talk anyway. What you control is whether the official version is short and respectful.

Close the loop with the reporter

Go back to the person who reported. You may not be able to share what happened to the other employee. You can say that you reviewed the concern, acted on it, and appreciate the courage it took. Check in again at 30 and 90 days to ask whether anyone has treated them differently. That small habit tells the team that reporting works, and it catches retaliation early.

Preventing the Next Cannabis Employee Investigation

Policy language, camera audits, and training

Start with the handbook. Your policies should define on-site consumption, tampering with security equipment, diversion, record falsification, sales to minors, and the duty to report concerns. They should say the company may preserve and review video and records. They should also require employees to cooperate with investigations. Our cannabis employee handbook guide shows how to build those sections.

Next, audit your own cameras. Massachusetts requires equipment checks at intervals of no more than 30 calendar days. Use that rhythm to confirm every camera still points where it should, and keep the log. A camera that sat turned toward a wall for two weeks without anyone noticing is a finding in its own right, so treat it that way.

Finally, train at hire and every year. Cover the zero-tolerance list, how to report, and what retaliation is. Teach managers what to do when someone reports: thank them, do not investigate alone, and call HR the same day. Our budtender onboarding checklist shows where compliance training fits in the first 90 days.

A reporting channel outside the manager chain

Many problems surface late because the person who saw something would have to tell the very manager involved. Offer at least two routes: a direct line to HR or the owner, and a third-party hotline or form that goes to someone other than the store manager. Explain both at hire, and post them in the break room. Decide in advance who reads each report and how fast it gets triaged. Also plan how you will ask follow-up questions of someone who stays anonymous.

A one-page checklist

Here is the whole sequence on one page, so you can print it and keep it in the compliance binder.

• Log the exact time the report arrived, and name one person to hold the evidence.
• Export and lock the video and records before anything else.
• Within hours, have the license holder and counsel decide on reporting, and write down the decision.
• Protect the reporter, and set interim measures: paid leave or an access change.
• Appoint a neutral investigator who is not the direct manager.
• Interview the reporter first, witnesses next, and the accused last, with notes.
• Compare the outcome with past cases, and document the reasons.
• Remove access within the hour, then handle regulator follow-up.
• Send a short team message, close the loop with the reporter, and check in at 30 and 90 days.

When to Call Counsel

Call an employment lawyer, ideally before you interview anyone, if the facts could be reportable to the regulator or to law enforcement, or if the reporter raised a safety, wage, or discrimination concern. Call as well if the accused is a medical patient or on protected leave, if the workforce is unionized, or if you plan to terminate. A cannabis regulatory lawyer should review any filing to the regulator.

If you have no HR team to run a cannabis employee investigation, employee relations support for licensed operators can supply a neutral process, interview notes, and documentation. Your lawyer handles the legal calls. Either way, decide who you will call before the first report arrives.

Frequently Asked Questions

Do we have to report every employee policy violation to the regulator?

No. Reporting depends on the facts and on your state’s definition of a reportable incident. Many violations are purely personnel matters. The question is who decides. Make sure the license holder and counsel review each case quickly and write down the answer.

Can we fire the employee right away?

Sometimes, but investigate first. Terminating before the facts are in is how wrongful-termination and retaliation claims begin. Use paid leave or an access change while you gather evidence. Then decide based on what you find.

What if the employee refuses to be interviewed?

Document the refusal, and explain that you will decide on the evidence you have. Offer the employee a chance to submit a written response. Ask counsel how your policy and any union agreement treat refusals before you attach consequences.

How long should we keep the investigation file and the video?

Follow your regulator’s rule first. In Massachusetts, recordings must stay available for at least 90 calendar days, longer when you know of a pending investigation. Incident records stay for at least one year, or for an open investigation. Ask counsel how long to keep employment records beyond that.

Can we promise the reporter anonymity?

You can protect their identity as far as you reasonably can. Do not promise secrecy, because the facts may point straight to them. Promise instead that retaliation will not be tolerated, and keep your word.

This article is general HR information and is not legal advice. Laws and regulations vary by state and change often, including Massachusetts 935 CMR 500.110. Confirm the current rules with your regulator, and consult qualified employment and cannabis regulatory counsel before you act on a specific situation.