Visitor Log & Facility Access SOP

Document No.: [SOP-SEC-002] | Effective Date: [DATE] | Version: [1.0] | Approved By: [NAME, TITLE]

1. Purpose
This SOP controls and documents access to the licensed premises of [COMPANY NAME] at [FACILITY ADDRESS] by anyone who is not a badged employee. Its purpose is to prevent unauthorized access to cannabis and limited-access areas, create a complete and auditable visitor record, and comply with the security and access requirements of [STATE REGULATORY AGENCY].

2. Scope
This SOP applies to all non-employee visitors, including vendors, contractors, maintenance and delivery personnel, investors, job candidates, tour guests, and government officials. It covers all limited-access areas of the facility, including cultivation rooms, processing areas, the vault, and inventory storage. Public lobby or retail sales-floor access by customers is governed by [SEPARATE SOP NUMBER].

3. Responsibilities
• Front Desk / Security Lead ([NAME/TITLE]): Performs check-in, ID verification, badge issuance, and check-out; maintains the visitor log.
• Escorting Employee: Remains with the visitor at all times in limited-access areas and enforces facility rules.
• Compliance Officer ([NAME/TITLE]): Approves standing vendor lists, reviews logs [WEEKLY/MONTHLY], and handles regulator visits.
• General Manager ([NAME/TITLE]): Approves non-routine visits (tours, media, investors) at least [X] hours in advance.

4. Procedure
• 4.1 Pre-approval. Routine vendor and contractor visits are scheduled and approved by [TITLE] at least [X] hours in advance. Unscheduled visitors are admitted only with real-time approval from [TITLE].
• 4.2 Check-in and ID verification. Every visitor presents a valid, unexpired government-issued photo ID. The Security Lead confirms the photo matches the visitor and that the visitor meets the state minimum age of [21/OTHER] for limited-access areas. The log entry records: full name, company, purpose of visit, areas to be accessed, time in, escort name, and badge number.
• 4.3 Badges. Each visitor receives a numbered visitor badge, visually distinct from employee badges, worn visibly above the waist for the entire visit. Badge inventory is reconciled at close of business daily; a lost badge triggers an incident report and, where applicable, notification under [STATE] rules.
• 4.4 Escort rules. Visitors are escorted 100% of the time inside limited-access areas, with no more than [X] visitors per escort. Visitors are never left alone with cannabis product, never handle product unless their role legitimately requires it (e.g., licensed transporter or state inspector), and may not photograph or record without written approval from [TITLE]. Access to the vault and [OTHER RESTRICTED ZONES] is limited to the pre-approved purpose only.
• 4.5 Government officials and law enforcement. Inspectors from [STATE REGULATORY AGENCY] and law enforcement acting in an official capacity are admitted promptly after identity verification. They are logged like all visitors, and the Compliance Officer is notified immediately. Staff must never obstruct or delay a lawful inspection.
• 4.6 Check-out. At departure, the Security Lead records time out, collects the badge, and confirms the log entry is complete and legible.
• 4.7 Violations. Any visitor who refuses ID verification, evades an escort, or violates facility rules is escorted out immediately. The escort files an incident report [FORM NO.] with the Compliance Officer the same day.

5. Records
Visitor logs, badge reconciliation sheets, pre-approval records, and incident reports are retained for [RETENTION PERIOD, e.g., minimum X years per state rule] in [LOCATION/SYSTEM] and produced to [STATE REGULATORY AGENCY] on request. Logs are never altered after the fact except by dated, initialed correction.

6. Review Cadence
The Compliance Officer reviews this SOP annually, after any access-related incident, and within [X] days of changes to [STATE] security regulations. The visitor log format is audited [QUARTERLY] for completeness, and findings are documented.

This template is a starting point for your own compliance program. Adapt it to your state’s regulations and have it reviewed by your compliance officer or counsel before adoption.