Objective: Assess the company’s compliance with the Age Verification requirements. 

1. Verify that the commercial cannabis business has a written age verification procedure appropriate for its size and type of business. The written procedures must be approved by the company and contain procedures that address:
   • Requesting an appropriate identification that can be authenticated
   • Authenticating the identification to the extent reasonable and practicable through risk-based procedures
   • Matching the customer to the identification
   • Responding to circumstances in which the commercial cannabis business cannot form a reasonable belief that it knows the true age of a customer, including determining when a customer should be rejected.
   • Complying with recordkeeping requirements.
2. Determine whether the commercial cannabis business’s age verification risk assessment appropriately considers the sales channels; the types of identification that can be accepted; and the commercial cannabis business’s size, location, and customer base.
3. Review the internal controls in place for age verification. Determine whether the commercial cannabis business’s internal controls are designed to assure ongoing compliance with age verification requirements and are commensurate with the commercial cannabis business’s size or complexity and organizational structure.
4. Review any identified instances of noncompliance with the age verification and any deviations from the commercial cannabis business’s age verification policies, procedures, and processes to determine whether the commercial cannabis business is effectively implementing age verification.
5. On the basis of examination and testing procedures completed, form a conclusion about the adequacy of age verification policies, procedures, and processes the commercial cannabis business has developed to meet regulatory requirements.