What a compliance audit checks in a Thai cannabis business

A Thai cannabis licence used to be something you got once. Since 2025 it is something you keep earning: every sale needs a prescription, every gram needs a certified source, every month needs a report, and every renewal now passes a test. A compliance audit checks a business against all of it before an inspector does.

This article describes what an audit looks at. It does not describe what audits find; that stays between us and the client.

Who it is for

• Licence holders facing renewal. Licences issued in 2024 expire on 31 December 2026, and renewals now follow an inspection.
• Operators with more than one shop, where records drift apart from site to site.
• Investors and partners about to put money into a licensed business, who need to know whether the licence will survive. See questions to ask before buying a dispensary.

What gets checked

The licence itself

The licence type, issue year and expiry date, whether it is displayed, and whether the business meets the eligibility list of Ministerial Regulation No. 2 B.E. 2569 (2026): a qualifying underlying licence or certificate, or a supplying cultivation site.

Monthly reports

Whether PT.27 and PT.28 are prepared, complete, filed on time and kept at the premises, and whether they reconcile with stock. A missing report is a 30-day suspension under the guideline announced on 22 June 2026, and a false one is revocation. See PT.27 and PT.28 explained.

Prescriptions

Whether every flower sale ties to a valid PT.33 from one of the seven prescribing groups, and whether the evidence is kept at the shop. The Ministry ordered enforcement against forged and traded PT.33 forms on 27 June 2026, so the source of the prescriptions matters as much as their existence.

Flower sourcing

Whether every batch comes from a certified source, a GACP-certified farm or a harvest with its own laboratory certificate of analysis, and whether the paperwork proves it.

Licence conditions on the premises

Premises held by ownership or possessory right, flower stored separately and off the floor, a DTAM-trained worker on duty in every opening hour, and an effective odour and smoke removal system. Plus the bans: no smoking on site, no online or vending machine sales, no advertising, no sales to barred buyers.

Accounting and company records

Whether the company's registration, shareholding, directors and filings are in order, whether the books match the controlled-herb records, and whether the ownership structure raises a Foreign Business Act question. Using a Thai nominee is a criminal offence for both people involved. See the nominee trap.

Readiness for change

How exposed the business is to the inspection-before-renewal direction of 22 October 2026 and to the draft Cannabis Control Act, which as reported would require shops to become medical facilities to renew. Estimated

What you get back

• A list of gaps against the rules in force, each tied to the rule it breaches.
• A fix for each gap, in the order to do them.
• A view on the licence's renewal readiness.
• Questions that need a lawyer, flagged as such.

The scope depends on the number of shops or sites and the size of the business. Every audit starts with a call, where we agree what to check and what you need it for.

How an audit runs

1. Scoping call. We agree what the audit is for, renewal, a purchase or a partnership, and how many sites and licences it covers.
2. Document request. You receive a list of what to send: licences, company records, leases, training certificates, monthly reports, prescription evidence and supplier certificates.
3. Desk review. We check the documents against the rules in force and against each other.
4. Site visit or video walk-through. We look at the premises as an inspector would: the licence on display, storage, the odour system, the counter and the records kept on site.
5. Record sampling. We trace a sample of sales back to prescriptions and a sample of stock back to its source.
6. Report and debrief. You receive the gaps, the fixes and the priorities, and we walk through them with you.

How findings are prioritised

• Revocation risks first: smoking on site, online sales, sales to barred buyers, sales in prohibited places, false reports.
• Suspension risks next: missing or incomplete reports, uncertified stock, sales without a prescription, an undisplayed licence, advertising.
• Renewal readiness: the eligibility list, the licence conditions and the suspension record.
• Housekeeping: record formats, filing routines and staff training.

The order follows the penalty guideline announced on 22 June 2026: the breaches that end a licence come before the ones that pause it. Estimated

When to audit

• Before filing a renewal, so gaps can be fixed while the licence is still valid.
• Before buying or investing, as part of due diligence on a target or partner.
• After a change, such as a new manager, a new site or a new supplier.
• After an inspection or an order, to make sure the same issue does not recur.

What an audit is not

An audit is a check against the published rules and good practice. It is not legal advice, it does not guarantee that a renewal will be granted, and it does not replace the licensing authority's own decision. Where a question needs a legal opinion, such as an ownership structure under the Foreign Business Act, the audit flags it for a Thai lawyer.

Who should take part

An audit goes faster and finds more when the right people are available. That usually means the licensee or a director, the shop manager, the DTAM-trained worker who covers the counter, and whoever prepares the monthly reports and the accounts. If a prescriber works with the shop, a short conversation with them helps confirm how prescriptions are issued and recorded.

What you receive at the end

• A gap list, with each finding tied to the rule it falls short of.
• A risk rating for each gap, from revocation risk down to housekeeping.
• A fix plan, with what to change, who should do it and what evidence to keep once it is done.
• A renewal readiness view, setting out which credential the renewal can rely on and what is still missing.

The report is written for the owner, not for the regulator. It is yours to act on and to share with a lawyer, an accountant or a buyer if you choose.

Questions owners ask before an audit

Will the audit be reported to the authorities?

No. An audit is a private review for the business. What you do with the findings is your decision.

Can an audit fix a past breach?

It cannot undo a breach, but it can show what changed afterwards. A documented fix is far stronger at renewal than a promise that the problem has gone away.

Does a multi-site operator need one audit or several?

Each licensed shop is checked on its own records and premises, because each licence is judged on its own. Company-level items, such as shareholding and accounts, are reviewed once for the group.

Sources

• Section 3 of the 2026 report, The rules in force (free to read)
• Thairath, DTAM guideline on administrative orders for cannabis shops, 22 June 2026
• The Star (Bernama), Thailand to tighten cannabis controls and propose tougher penalties, 22 October 2026
• Nation Thailand, Thai cabinet endorses draft cannabis control bill for medical use, 22 September 2026

This article is market intelligence, not legal advice. Rules change by notification; check the current text with the licensing authority or Thai counsel before you act.