Managing Risk Across the Cannabis Supply Chain
Cannabis operators spend enormous amounts of time thinking about compliance inside their own four walls. They train employees, reconcile inventory, maintain cameras, test products, update SOPs, retain records and prepare for inspections.
But some of the most consequential risks to a licensed cannabis business can originate somewhere else entirely.
Colorado received another reminder of that reality on September 25, 2026 when the Colorado Department of Revenue and Colorado Department of Public Health and Environment issued a Health and Safety Advisory involving vaporizer products manufactured by Staycon LLC, doing business as Craft. According to the advisory, affected production batches had been manufactured using an ingredient found to contain methylene chloride (a prohibited cancer causing ingredient), which the agencies deemed a threat to public health and safety.
The scale of the advisory is what should get the attention of the broader industry. The affected products had been sold at 405 Colorado stores between March 27 and September 25, 2026.
Those hundreds of retailers did not manufacture the product or use the ingredient. They did not formulate the vaporizer product or convert the Hemp into THC. Most had no direct ability to know what occurred upstream in the vape’s production lifecycle until it was too late.
Because once affected products entered their inventory, the problem became theirs too.
That is the larger compliance lesson.
Compliance Risk Travels Through the Supply Chain
The cannabis industry is no longer a collection of isolated businesses. It is an interconnected supply chain.
Cultivators provide material to manufacturers. Manufacturers purchase ingredients, hardware and other inputs from vendors. Products move between licensees. Testing laboratories provide information relied upon by businesses further down the chain. Retailers ultimately place finished products in consumers’ hands.
Each transaction creates dependency and liability.
A retailer may operate an excellent compliance program and still receive a product that later becomes subject to a Health and Safety Advisory. A manufacturer may maintain strong internal production controls but introduce risk through an inadequately qualified supplier. A cultivation problem can follow plant material into manufacturing but not ultimately into finished products.
That does not mean every business is responsible for controlling every other participant in the supply chain. It does mean operators should understand where they are dependent upon other parties and build reasonable controls around those relationships.
The September advisory illustrates just how far an upstream problem can travel.
For the retailers involved, the immediate issue becomes identifying affected inventory and responding appropriately. The advisory instructs consumers possessing affected marijuana to destroy it or return it to the regulated marijuana store from which it was purchased for proper disposal. It also identifies affected products using the manufacturer license and specific production batch identifiers, reinforcing the importance of traceability throughout the regulated supply chain.
The rules require CAPA plans and recall SOPs for these instances. For operators, however, the more important question comes afterward:
If this happened to one of our products or suppliers tomorrow, how quickly could we respond?
Supplier Approval Should Be More Than a Purchase Order
Cannabis businesses naturally evaluate suppliers based on price, availability, quality and reliability. Compliance and quality risk should be part of that equation as well.
That does not require every dispensary to conduct pharmaceutical-style audits of every brand on its shelves. Controls should be proportional to the business, product and risk involved.
A manufacturer purchasing ingredients for use in inhalable products, for example, faces a different level of supplier risk than a retailer purchasing packaged merchandise. The appropriate controls should reflect that difference.
Manufacturers should know what specifications apply to critical ingredients and inputs, what documentation accompanies them, how suppliers are qualified, how changes are communicated and what happens when an input does not meet expectations. Receiving procedures should establish what employees actually verify before materials enter production rather than assuming that because something arrived from an approved vendor, it is automatically acceptable.
Retailers have different opportunities for control. Purchasing policies, vendor records, product documentation, receiving procedures, batch traceability and clear HSA response protocols can substantially improve the speed with which a store identifies and responds to affected inventory.
The objective is not to eliminate supply-chain risk. That isn’t realistic.
The objective is to know where the risk exists and be prepared to manage it. Especially among new vendors, product types, and historic performance.
Traceability Matters Most When Something Goes Wrong
Track-and-trace systems are frequently viewed as regulatory obligations. Their value becomes much clearer during a product incident.
When a specific production batch is implicated, a business should be able to determine what it received, where it went, whether any remains in inventory and what records support those conclusions.
Good documentation turns a potentially chaotic response into a controlled process.
This is also why traceability should extend beyond simply entering transactions into METRC. Purchase records, receiving documentation, certificates and supporting records, internal inventory information, vendor contacts, batch information and disposition records should collectively allow the business to reconstruct what happened.
The same principle applies to manufacturers working backward through their supply chains.
If a finished product presents a problem, can the manufacturer identify the ingredients and inputs associated with that batch? Can it determine which supplier provided them? Can it identify other production batches in which those materials were used? Can it determine whether the problem is isolated or potentially broader?
Those questions are difficult to answer for the first time during an emergency.
CAPA Begins Where the Immediate Response Ends
Removing affected inventory addresses the immediate problem. It does not necessarily prevent another one.
This is where Corrective and Preventive Action becomes important.
A meaningful CAPA process asks what happened, why it happened, whether the problem could exist elsewhere, what corrective action is necessary, and what should change to reduce the likelihood of recurrence.
For a retailer affected by an HSA, that might include reviewing how quickly the store identified affected products, whether responsible employees knew what to do, whether vendor contact information was readily available and whether inventory records allowed affected batches to be located efficiently.
For a manufacturer, the questions may go considerably deeper into supplier qualification, ingredient specifications, purchasing controls, receiving, production procedures, quality review and change management.
The point is not to assign blame after every incident. It is to learn from the incident.
A mature compliance system should become stronger every time something goes wrong.
HACCP Can Help Operators Think Beyond the Rulebook
Hazard Analysis and Critical Control Points, or HACCP, provides another useful way of looking at supply-chain risk.
Rather than beginning with the question, “What does the rule require?” HACCP begins by asking what could reasonably go wrong, where the hazard could enter the process, how significant that hazard would be, and where controls can prevent or detect it.
That mindset applies across cannabis operations.
Cultivators can evaluate biological, chemical and physical hazards throughout cultivation and post-harvest handling. Manufacturers can examine ingredients, equipment, processing steps and packaging. Retailers can consider receiving, storage, product handling and recall or advisory response.
Compliance tells an operator what it is required to do.
Risk management asks whether those requirements alone are enough to protect the operation.
The strongest businesses learn to do both.
The Cost of an HSA Doesn’t Stop With the Manufacturer
Health and Safety Advisories also demonstrate something that is easy to overlook when calculating the cost of compliance: failures create costs throughout the supply chain.
Affected retailers spend employee time locating inventory, reconciling records, responding to customers and managing product disposition. Manufacturers and suppliers may need to investigate production and sourcing. Management attention moves away from ordinary operations. Consumers may lose confidence in products or brands.
None of those consequences necessarily means another business in the chain did anything wrong.
They demonstrate that in an interconnected regulated marketplace, another company’s quality problem can quickly become your operational problem.
That is why supply-chain compliance should not be viewed merely as vendor paperwork.
It is business continuity.
Operators Should Be Asking a Different Question
For years, much of cannabis compliance has focused on a relatively straightforward question:
Are we following the rules?
That question still matters, but mature operators should add another:
Where can something outside our immediate control create risk inside our business?
The answer might be a supplier, ingredient, testing laboratory, cultivation source, manufacturer, technology provider, transportation process or simply another licensee upon whose information the business relies.
Once those dependencies are identified, operators can decide what level of verification and control is reasonable.
That is the difference between reacting to risk and managing it.
The September Craft advisory should not cause Colorado businesses to distrust every supplier or product they work with. It should encourage them to examine whether their systems are capable of responding when something in that supply chain goes wrong.
Because eventually, something will.
The businesses best positioned to weather those events will not necessarily be those that predicted them.
They will be the ones that prepared for them.
How iComply Can Help
For more than 15 years, iComply has helped cannabis businesses translate regulatory requirements into operational systems that work in the real world.
Our Supply Chain & Quality Risk Assessments can examine vendor and supplier qualification, purchasing and receiving controls, ingredient and product documentation, traceability, recall and HSA preparedness, SOPs, CAPA, HACCP, inventory controls and broader quality-management practices.
For businesses with a specific concern, we offer affordable consultation to examine an issue, identify priorities and determine an appropriate path forward.
Not sure what you need? Start with a complimentary 30-minute conversation and we’ll help determine whether there is a problem worth solving.
[Schedule a Complimentary 30-Minute Call]
[Inquire and we’ll get back to you – LINK]
Manage your compliance before it manages you.