Key Takeaways
- The Pennsylvania medical marijuana audit revealed inadequate controls in inspections and enforcement, leading to missing checklists and unissued deficiency notices.
- Auditors found that 35 out of 103 inspection checklists were unretained, raising questions about compliance and safety standards.
- The Department of Health agreed to all nine recommendations from the audit and is implementing corrective actions, including updated procedures and training.
- Pennsylvania’s medical marijuana program relies on patient trust, which suffers when regulatory oversight fails, affecting both patients and compliant operators.
- Political debates are ongoing about whether to shift oversight from the Department of Health to a Cannabis Control Board, amid differing opinions on regulatory effectiveness.
Pennsylvania’s medical cannabis program collects tens of millions of dollars in tax revenue every year. Grower/processors alone generated about $34.3 million in the 2024 fiscal year, according to the Department of Revenue. That money funds patient assistance, research, and drug prevention programs across the state. It’s a system built on the assumption that regulators are actually watching the shop floor.
A new report from Auditor General Timothy DeFoor suggests that assumption doesn’t hold up well.
Released September 9th, the audit examined how the Department of Health’s Bureau of Medical Marijuana handled inspections, complaints, and enforcement throughout 2024, with follow-up work stretching into August 2026. It marks the first time anyone has reviewed the bureau’s inspection and enforcement practices since the program launched under Act 16 in 2016. What auditors found paints a picture of a regulator that built the right paperwork process on paper but failed to follow it in practice.
What Did Pennsylvania’s Auditor General Actually Find?
The audit produced two formal findings. The first: DOH lacked adequate controls to ensure inspections, enforcement actions, and related procedures were performed consistently. The second: inadequate approval processes for complaint conclusions and plans of correction reduced the effectiveness of DOH’s oversight.
Auditors reviewed inspection records for 9 of the state’s 34 grower/processors and 30 of 182 operating dispensaries active during 2024. That sample covered 103 separate inspection checklists, the core documents inspectors use to confirm a facility meets state regulations.
“Inconsistent procedures may allow issues to go uncorrected and lead to unsafe conditions within facilities or products,” Auditor General Timothy DeFoor said in the audit release. “Hundreds of thousands of Pennsylvanians rely on the program to be safe, secure and trustworthy, so it’s up to these regulators to ensure proper procedures are in place.” That’s a fair point. Patients don’t get to inspect the grow room themselves. They rely entirely on the state doing that job for them.
To DOH’s credit, the department agreed with every one of the nine recommendations and says corrective steps are already underway.
How Bad Was the Paperwork Breakdown?
Of the 103 inspection checklists auditors requested, 35 were never retained at all and two more were only partially retained. That means for roughly a third of the sample, nobody could confirm whether an inspection had actually been completed properly or whether flagged problems got fixed.
Auditors also found zero documented evidence of supervisory review on the checklists that did exist. No sign-off, no second set of eyes confirming inspectors did their jobs correctly.
The notice process fared worse. Among 26 checklists that contained deficiencies serious enough to require a formal Notice of Deficiency, 15 of those notices were simply never issued. Of the ten that were sent, nine arrived late. In one case, a dispensary had 14 documented deficiencies on its checklist, and no notice ever went out.
Then there’s the correction side. Facilities are supposed to submit a Plan of Correction, which BMM then reviews and approves. Only one of ten submitted plans was approved within 30 days. Five took longer, and four remained unapproved as of March 6, 2026, one lingering for 378 days and counting at the time auditors checked.
Why Does This Matter for Pennsylvania Medical Marijuana Patients and Operators?
Medical cannabis works because patients trust the system enough to use it instead of the illicit market. That trust depends on someone actually checking that dispensaries and grow operations follow the rules. When 35 checklists go missing and 15 required notices never get sent, that oversight function isn’t functioning.
Operators have a stake here too. Businesses that clear inspections and follow the rules deserve a regulator that applies its enforcement consistently across every facility, not sporadically depending on staffing that week. The audit noted BMM cited a hiring freeze, staff turnover, and medical leave as contributing factors to the delays, along with the absence of any automated tracking system.
None of that excuses missing paperwork on 34% of inspections reviewed, but it does explain how a bureau of roughly 50 employees can fall behind when the volume of dispensaries keeps growing. Pennsylvania now has 195 active dispensary locations, up from the original 50 permits issued in 2017 and 2018.
Does This Change the Case for a Cannabis Control Board?
This audit lands in the middle of an active political fight over who should regulate cannabis in Pennsylvania at all. Senate Bill 49, sponsored by Sen. Dan Laughlin, would have moved oversight of the medical marijuana program from DOH to a newly created Cannabis Control Board.
The bill had real momentum, with nine Democratic co-sponsors and Republican leadership support. It still failed in a 27-23 Senate vote on June 10th, after seven of those nine Democrats reversed course. Laughlin placed blame on Gov. Josh Shapiro, saying the governor pushed Democrats to vote no. Shapiro’s office denied applying pressure but said the administration wants more comprehensive adult-use regulations than SB 49 offered. The bill also included language banning intoxicating hemp products, which drew opposition from hemp business owners who said it would shut them down entirely.
Whatever side of that debate someone lands on, this audit gives both camps ammunition. Supporters of a dedicated Cannabis Control Board can point to missing checklists and unsent notices as evidence that managing cannabis alongside its broader public health mandate has stretched DOH too thin. Defenders of the current structure can note that DOH agreed with every recommendation and is already correcting course, without needing a new agency built from scratch.
What Happens Next After DOH Agreed to All Nine Recommendations?
DOH’s official response, included in the audit report, outlines several fixes already in motion. In February, the bureau updated its inspection checklists to require supervisors to sign off both when reviewing a checklist and when uploading it. Staff completed training on that update in March.
The department is also finalizing standard operating procedures that were still in draft form during the audit period, covering grower/processor inspections, dispensary inspections, and plan of correction reviews. The board formally approved only the Notice of Deficiency procedure, back in August 2024.
The bigger fix is technological. DOH is counting on the Enterprise Licensing System, a multi-agency platform meant to automate inspection tracking and document storage. It was originally supposed to launch in August 2024. It’s now delayed until March 2027. Until then, BMM is relying on interim manual tracking to catch what the old process missed.
The Auditor General’s office says it reserves the right to follow up and check whether these fixes actually took hold. Given the timeline problems documented in this report, that follow-up seems worth watching.
Frequently Asked Questions
The audit found the Department of Health’s Bureau of Medical Marijuana lacked consistent controls over inspections and enforcement in 2024, including missing inspection checklists, unissued deficiency notices, and delayed approval of correction plans.
Auditors requested 103 inspection checklists covering 9 grower/processors and 30 dispensaries. Thirty-five were never retained and two were only partially retained.
Yes. DOH agreed with all nine recommendations and stated that several corrective actions, including updated checklists and supervisory sign-off requirements, are already underway.
Not currently. Senate Bill 49, which would have created a Cannabis Control Board to take over medical marijuana oversight from DOH, failed in the state Senate on June 10, 2026.
Inspectors document deficiencies on a checklist.If the facility fails to resolve the issues within 24 to 48 hours, the bureau may issue a Notice of Deficiency. The facility then has 30 days to submit a Plan of Correction and 90 days to address the underlying problems.
