Dispensary Management Software: Staff Offboarding Checklist

Employee offboarding is a security, inventory, and compliance process—not just an HR task. A departing budtender, manager, inventory specialist, or administrator may retain access to sales records, package data, cameras, cash controls, online menus, and restricted areas.

Well-configured dispensary management software should let authorized managers disable accounts quickly while preserving the employee’s historical actions. The goal is to remove every current access path without deleting evidence needed for audits or reconciliation.

Whether an employee resigns, changes roles, or is terminated, the store should know who starts offboarding, which systems are affected, and how completion is verified.

Why Cannabis Retail Offboarding Needs Extra Control

Cannabis stores combine regulated inventory, payments, customer verification, and seed-to-sale reporting. One employee may hold credentials for the cannabis POS platform, Metrc, e-commerce, payments, surveillance, alarms, and vendor accounts.

NIST guidance recommends disabling system access, revoking credentials and authenticators, and retrieving security-related property when employment ends. It also recommends reviewing access when a person transfers to another role.

Disabling only the register login is not complete offboarding. Every digital, physical, and third-party access path must be addressed.

Prepare Before the Final Shift

Assign an Offboarding Owner

One manager should coordinate HR, IT, compliance, inventory, and physical security. For a high-risk termination, access may need to be disabled before the meeting begins.

Assign responsibility for:

• Confirming the effective separation time;
• Disabling system and facility access;
• Collecting company property;
• Reviewing recent high-risk activity;
• Transferring unfinished work;
• Approving final completion.

Maintain an access register by role and location instead of relying on memory.

Classify the Risk

A cashier with basic sales access presents a different risk from an administrator who can adjust packages, export data, edit taxes, or manage API credentials.

A higher-risk departure may require immediate session termination, password rotation, log review, and inventory reconciliation. The response should reflect access and risk, not title alone.

Disable Digital Access in the Right Order

Start With Central and Remote Access

Disable company email, single sign-on, VPN, remote desktop, device management, and password-manager access first. This can block several connected applications at once.

NIST describes centralized identity workflows that remove resource access and invalidate credentials across systems when employment ends.

Then revoke active sessions, API tokens, passkeys, recovery codes, and registered authentication devices. Reset shared credentials the employee knew, even after the individual account is disabled.

Remove Cannabis Retail Access

Disable access to:

• The dispensary POS system;
• Metrc or another tracking portal;
• Inventory and receiving tools;
• Online ordering and menu platforms;
• Payment and refund portals;
• Accounting and scheduling systems;
• Camera, alarm, and access-control dashboards;
• Vendor support portals.

A Metrc-integrated dispensary POS should preserve the former employee’s user ID in historical transactions after login access is removed. Never delete an account merely to clean up the active-user list.

Revoke Authenticators

Access may survive through a remembered device, browser session, hardware token, authenticator app, or recovery method. NIST recommends promptly invalidating authenticators when an account ends or a user is no longer eligible.

Check tablets, security keys, saved passwords, backup codes, and recovery contacts.

Recover Physical Property and Access

Collect keys, badges, door codes, tablets, scanners, laptops, payment devices, documents, and storage media. Remove the employee from facility-access lists and change shared alarm or safe codes when appropriate.

The NIST personnel termination guidance includes retrieving security-related property and removing physical access that is no longer required.

Record each returned item, its condition, the time received, and the manager who verified it. Missing property should remain an open exception.

Preserve Records and Transfer Work

Keep the Audit Trail Intact

A retail platform for licensed dispensaries should retain receipts, approvals, discounts, refunds, package adjustments, login events, and permission changes connected to the former employee.

Do not rename the user as “deleted employee” or reassign transactions to a manager. Historical attribution must remain stable after access is disabled.

Archive business files according to company policy. Transfer reports, recurring tasks, vendor tickets, and shared documents to an active employee.

Review Open Operational Items

Identify unfinished work such as:

• Pending Metrc submissions;
• Unresolved inventory variances;
• Returns awaiting disposition;
• Transfers or deliveries in progress;
• Cash or payment discrepancies;
• Customer complaints and support tickets.

Assign a new owner and deadline to every item. Offboarding should not make operational exceptions disappear.

Review Recent High-Risk Activity

For employees with elevated permissions, review recent activity in the dispensary inventory and POS system.

Look for:

• Unusual discounts, refunds, or voids;
• Inventory adjustments and package changes;
• Customer or report exports;
• Role and permission changes;
• Activity outside scheduled hours;
• Repeated failed logins.

This review helps the store find unresolved errors, preserve evidence, and confirm that privileged access was used appropriately.

Handle Transfers and Role Changes Separately

An employee moving to another store or position should not keep old permissions “just in case.” Remove access tied to the former role, then grant only what the new job requires.

NIST account-management guidance calls for changing access when duties or need-to-know changes and disabling accounts no longer associated with a user.

A promotion should trigger an access review, not an accumulation of privileges.

Verify Completion With a Second Person

A manager, compliance lead, or IT administrator should independently confirm that the former employee cannot sign in, enter restricted areas, recover an account, or use an active session.

The final record should include:

• Employee, role, and location;
• Effective separation time;
• Systems and property reviewed;
• Completed actions and open exceptions;
• Names of the preparer and verifier;
• Date and time of approval.

Store the checklist with access-management and personnel records.

Test the Process Regularly

Compare active accounts with current staffing records on a regular schedule. Test a sample of disabled users across the all-in-one dispensary platform and connected services.

Update the checklist after migrations, new integrations, management changes, or security incidents. An offboarding process fails when the technology stack changes but the checklist does not.

Final Takeaway

Effective offboarding removes digital and physical access, invalidates authenticators, retrieves property, preserves historical activity, transfers unfinished work, and verifies completion independently.

POS software for dispensaries can automate part of the process, but management must maintain an accurate system inventory and act at the correct time. The strongest checklist closes every access path while keeping every past action traceable.