Required Cannabis SOPs: The Mandatory SOP Library Every Licensed Producer Needs

Every licensed producer needs the same core set of written procedures, and an inspector who finds a required SOP missing, expired, or uncontrolled will write the finding even if your daily practice is flawless.

There is no single appendix in the Cannabis Regulations that lists “your SOPs” by name. Instead, the obligation to have a written, documented, controlled procedure is woven through the regulatory text: security, sanitation, record keeping, and quality each carry requirements that can only be met with a procedure behind them. The result is a predictable library of required cannabis SOPs that every Health Canada licence holder ends up building, organised into six functional categories. This page is the working reference: a table mapping each SOP to what it governs, whether it is legally required or best practice, who owns it, and how often it must be reviewed, plus what makes a procedure legally mandatory and why a master SOP register holds the whole thing together.

This page is one spoke of our wider cannabis SOP guide, which covers how to write, control, train on, and audit the procedures described below.

What Makes a Cannabis SOP Legally “Required” Rather Than Best Practice?

The distinction matters because the consequences differ. A required SOP is one without which you cannot demonstrate compliance with a specific obligation in the Cannabis Regulations (SOR/2018-144) or the Cannabis Act (S.C. 2018, c. 16). The regulator does not need to find that a batch was harmed. The absence of the controlled document is itself the deficiency, because the regulation expects the activity to be performed to a documented, repeatable standard and verifiable after the fact.

Three regulatory mechanisms turn an activity into a required cannabis SOP. First, an explicit obligation: the regulations require physical security, sanitation programmes, and good production practices, each only auditable through a written procedure. Second, the record-keeping duty: licence holders must keep records that demonstrate compliance, and a record is only defensible if a controlled procedure produced it rather than improvisation. Third, the quality assurance person (QAP) function: the QAP is accountable for investigating complaints, approving product release, and ensuring product meets specification, none of which survives an inspection without the SOPs that define how those decisions are made.

Best practice SOPs are different. They are procedures a well-run operation maintains because they protect the batch and prevent the failures that do become findings, but the regulation does not name the procedure itself as mandatory. Integrated pest management is the clearest example: there is no rule that says “you must have an IPM SOP,” but an unmanaged pesticide programme produces residue failures that are very much a regulatory problem. In practice, best practice SOPs are how you avoid the events that trigger required-SOP scrutiny.

The Required Cannabis SOPs Library, Organised Into Six Categories

Organising the required cannabis SOPs by function gives you a register that maps cleanly to how a facility actually runs and to how an inspector tends to work through a site. The six categories below cover security, cultivation, quality assurance and testing, sanitation, inventory, and personnel. Each row carries a stable SOP code, what the procedure governs, whether it is required or best practice, the typical owner, and the review frequency. Codes such as SOP-SEC-001 are a naming convention, not a regulatory citation, but adopting a consistent code scheme is itself part of good document control.

Read down the Status column and the pattern is clear: of the thirteen SOPs in this library, eleven are required and two are best practice. Both best-practice procedures sit in cultivation, consistent with the regulatory weighting toward security, quality, sanitation, and record keeping rather than horticultural method. Note also how often the QAP appears in the Owner column. The QAP is accountable across quality, sampling, recall, sanitation, inventory, and training, which is why the QAP function is the spine of a defensible SOP library.

How Should You Read the Six SOP Categories?

Each of the six categories of required cannabis SOPs exists because a distinct cluster of regulatory obligations lands there. Understanding why each group is grouped together helps you spot the SOP you are missing rather than the one you happen to have written.

Security and access control

The physical security obligations in the Cannabis Regulations are among the most prescriptive in the entire framework, covering perimeter detection, intrusion monitoring, visual recording, and restricted-access control over operations areas. SOP-SEC-001 and SOP-SEC-002 translate those obligations into repeatable practice. The access SOP is also the one most likely to be reviewed off-cycle, because any security incident triggers a review regardless of where you sit in the annual calendar.

Cultivation and plant management

SOP-CUL-001, seed-to-sale plant tracking, is the required anchor here because the regulations require licence holders to track and reconcile cannabis through every stage. Tagging, stage transitions, destruction recording, and reconciliation of discrepancies are the procedural backbone of that obligation. The IPM and harvest SOPs are best practice: they protect the batch from the contamination and residue failures that would otherwise surface as quality findings, but they are not themselves named obligations.

Quality assurance and testing

This is the densest required category, with four SOPs (SOP-QA-001 through SOP-QA-004) all owned by the QAP. Lot sampling, COA review and batch release, deviation reporting, and recall together define how product moves from “produced” to “released” and how a problem is escalated when something goes wrong. The recall SOP in particular benefits from an annual mock drill, because a recall procedure that has never been rehearsed is the one most likely to fail under real pressure.

Sanitation and hygiene

Good production practices in the regulations require a sanitation programme and personnel hygiene controls. SOP-SAN-001 covers the cleaning schedule, approved products, dilution rates, and contact times. SOP-SAN-002 covers gowning, PPE, hand washing, and illness reporting by zone. Both are required, and both are reviewed when you change cleaning products or reconfigure your zoning.

Inventory, storage, and distribution

SOP-INV-001 reconciles physical counts against the seed-to-sale system, satisfying the inventory accuracy and record-keeping duty. SOP-INV-002 governs cannabis waste destruction, including approved methods, witness requirements, and the recording and reporting that make a destruction defensible. Waste destruction without a witnessed, recorded procedure is a recurring source of findings.

Personnel and training

SOP-HR-001 ties the whole library together by ensuring staff are trained on the SOPs relevant to their role and that competency is verified and recorded. A required SOP that nobody has been trained on is functionally the same as not having it. For the full treatment of how training records link to specific SOP versions, see cannabis SOP training.

Why Is a Master SOP Register the Document That Holds the Library Together?

A master SOP register, sometimes called an SOP index, is the single controlled document that lists every SOP in force at your facility along with its current version number, approval date, next review date, owner, and status. It is the document an inspector will ask for first, because it is the fastest way to answer the question that drives the whole audit: do you know what procedures govern your operation, and are they all current?

The register is more than a table of contents. It is the control that prevents the three most common failures across your required cannabis SOPs. The first is the missing SOP: a regulatory obligation with no procedure behind it, which the register exposes the moment you map obligations to entries. The second is the expired SOP: a procedure past its review date, which is a finding even when the practice is sound, and which the next-review-date column surfaces. The third is the orphaned version: a superseded SOP still circulating on the floor while the controlled copy has moved on, which the register catches by being the one authoritative statement of which version is current.

The register and the document control discipline behind it are inseparable. Version numbers, archived superseded copies, QAP approval signatures, and controlled distribution are what make a register trustworthy rather than decorative. Our cannabis SOP document control spoke covers that machinery in detail, and the cannabis SOP template spoke covers the eight elements every individual SOP must contain so that each register entry points to a procedure that actually holds up.

The strongest version of this control links each SOP version directly to the batch records produced while it was in force. When a procedure and the batch it governed are connected in your operations platform, an inspector can see exactly which version of an SOP was live when a specific batch was produced, which turns the register from a list into an audit trail. GrowerIQ is cannabis seed-to-sale and operations software used by more than 200 licensed facilities across nine countries, and that batch-to-procedure linkage is one of the reasons the master register stops being a document you maintain by hand. For the inspection-day view, our cannabis audit readiness checklist walks through how the register is used during a Health Canada inspection.

Frequently Asked Questions

How many SOPs are required for a cannabis licence in Canada?

There is no official count, because the Cannabis Regulations do not list SOPs by name. In practice, a Health Canada licensed producer ends up maintaining a library of roughly eleven required procedures across six categories: security, cultivation, quality assurance and testing, sanitation, inventory, and personnel, plus a handful of best-practice SOPs such as integrated pest management and harvest handling. The exact number depends on the scope of your licence and the activities you perform, but the six functional categories are consistent across operations of every size.

What is the difference between a required cannabis SOP and a best-practice one?

A required cannabis SOP is one without which you cannot demonstrate compliance with a specific obligation in the Cannabis Act or Cannabis Regulations, such as physical security, sanitation, seed-to-sale tracking, batch release, or record keeping. The absence of the document is itself a finding. A best-practice SOP, such as integrated pest management or curing, is a procedure that protects the batch and prevents quality failures but is not named as a mandatory obligation. The practical rule is that best-practice SOPs exist to keep you out of the situations that trigger required-SOP scrutiny.

Is integrated pest management a required SOP?

No. An IPM SOP (coded SOP-CUL-002 in the standard library) is best practice rather than a named regulatory requirement. There is no rule that says you must have an IPM procedure. The reason almost every serious operation maintains one is that an unmanaged pesticide programme produces residue failures, and a residue failure is very much a regulatory problem. So while the SOP itself is best practice, the outcomes it prevents are squarely in required-compliance territory.

What is a master SOP register and do I need one?

A master SOP register, or SOP index, is the single controlled document that lists every SOP in force at your facility with its version number, approval date, next review date, owner, and status. It is the document an inspector asks for first. While the regulations do not name “the register” as a mandatory document, it is treated as required in practice because it is the only way to demonstrate that every procedure governing your operation is identified, current, and controlled. A document-control SOP that governs the register itself, an SOP for SOPs, is also expected.

Can I be cited for an SOP that is out of date even if my practice is correct?

Yes. Under the Cannabis Regulations, an out-of-date, missing, or uncontrolled SOP is a compliance finding in its own right, even when your actual day-to-day practice is sound. The regulator expects the activity to be performed to a documented, repeatable standard and to be verifiable after the fact. An overdue review date, an unsigned current version, or a superseded copy still circulating on the floor can each generate a finding regardless of how well the work is actually being done.

Get the Full Cannabis SOP Guide

The free guide collects the complete required-SOP library, the eight elements of a compliant procedure, the document control rules, a master register template, and an audit readiness checklist into one field reference a new QAP can put to work on day one.

Download Free Guide