An announced inspection gives a business time to prepare. A surprise inspection shows the regulator what a normal day looks like, which is the point. Being ready for one is not about a last-minute scramble. It is about whether the conditions that should be true on site are true on ordinary days, not only on the days someone expects a visit.
It also helps to be clear about which kind of surprise visit you are preparing for. Some inspectors arrive, identify themselves, and ask to see the premises and records. Others never identify themselves at all. This post covers both, and separates the targets a business sets for itself from the obligations the rules impose. It reflects the sources listed at the end as of September 26, 2026, and is general information rather than legal advice.
Two kinds of unannounced visit
Identified inspections. An inspector arrives, identifies themselves, and asks for access to the premises and records. This is the visit most readiness plans are built around, and the sequence later in this post applies to it.
Undercover purchase checks. In tobacco retail, the FDA conducts undercover buy inspections in which, in the FDA’s words, “the retailer is unaware an inspection is taking place,” and the minor and the inspector do not identify themselves. The FDA says it sends a warning letter the first time a compliance check finds a violation, and that failing to correct violations may lead to civil money penalties or no-tobacco-sale orders. States and local agencies may run their own checks too. The Oregon Health Authority, for example, has said it and local public health authorities will conduct undercover compliance checks under Oregon’s updated tobacco law.
No greeting script or document folder helps with an undercover check. The only preparation is what the cashier does at every sale, which is why age verification at the register belongs in any inspection readiness plan. Our article on point-of-sale age verification and transaction records covers that side.
What should hold every day
Start by listing the conditions your rules require at all times. Common examples are licenses posted where required, required signage in place, product stored and labeled correctly, and staff training or certifications current where the rules call for them. These are not the interesting parts of compliance, which is exactly why they slip when attention goes elsewhere.
A useful test is whether the list holds on the busiest day of the month, not on a quiet morning when a manager had time to walk the floor first. The Inspection Readiness Checklist and the Monthly Site Walk-Through are built for that kind of routine check.
Internal retrieval targets and legal obligations
Set an internal retrieval target and separately record any legally required response period. The two are different things. An internal target, for example that a named person on shift can produce the licensing folder, the training log, and recent internal review records within a few minutes, is your own policy. It is a sensible goal, but it is not a legal deadline.
The legal obligations come from the rules for your license type and jurisdiction. California’s cannabis law is one example: it requires licensees to keep records identified by the Department of Cannabis Control on the licensed premises, allows the department to examine records and inspect premises during standard business hours or at other reasonable times, and treats refusing, impeding, or obstructing an inspection as a violation. Other programs set different terms. Record the requirement for each license alongside your internal target, and confirm it with the regulator or your counsel.
To test the internal target, pick a document category without warning and time how long it takes a staff member on shift, not the owner, to produce it. If the answer depends on who is working that day, the records are only retrievable when the right person is present. Our article on recordkeeping rules that come up during an audit goes further into retention and access.
Inspection readiness is not a folder you can assemble in an afternoon. It is a set of conditions that have to hold on ordinary days, whether or not anyone is watching.
Train staff for the moment, not just the manual
Most staff know a policy exists somewhere. Fewer know what to do the moment an inspector walks in and identifies themselves, and that gap is where visits go badly even at businesses with good written policies. Front-line staff should know who to notify, what they are and are not authorized to say, and where the standard document folder is kept, without needing to find a manager first.
A short walkthrough of the sequence during onboarding, repeated at an interval you set, keeps it familiar. The goal is not to make every employee an expert on regulatory procedure. It is to make sure nobody freezes, guesses, or improvises in the first few minutes of a visit. The Training Matrix and Sign-Off Log can record who has completed it.
- A named contact for every shift who knows what to do first
- A standard folder or file that authorized staff can retrieve without help
- A short, plain-language script, reviewed by counsel, for how staff greet an inspector, confirm identification, notify the on-duty contact, and provide the access and records the inspector is authorized to request
- A same-day habit of logging what happened, regardless of the outcome
After the inspection, the record still matters
A same-day internal note of what occurred, what was requested, what was provided, and any findings is worth more than memory months later, when a follow-up arrives or the same question comes up again. Any finding should go straight onto a Corrective Action Log with an owner, a due date, and a separate check that the fix worked.
The record also matters internally. A pattern across several visits, at one site or across several, can be a clear signal that a procedure needs to change, and it only shows up if every visit is written down the same way. For multi-site operators, a note from one location about how an inspector approached a question is useful only if it reaches the other sites. Our article on setting an internal review schedule covers how to build those checks into a routine.
Sources
- Retail Sales of Tobacco Products, U.S. Food and Drug Administration (accessed September 26, 2026)
- Oregon law expands “tobacco products” definition to prevent underage sales, youth nicotine addiction (June 3, 2026), Oregon Health Authority (accessed September 26, 2026)
- California Business and Professions Code section 26160, California Legislative Information (accessed September 26, 2026)
Review your inspection procedures
SPL Management helps licensed operators organize inspection preparation, records, and corrective-action tracking as part of Compliance Management. SPL does not represent clients before regulators. A consultation is a discussion of your current inspection procedures and whether a scoped review is needed.
General information only, current as of the last review on September 26, 2026. Rules vary by jurisdiction and change often. This is not legal, tax, or real estate advice; confirm current requirements with the regulator or a qualified professional before acting. How we write and review articles.
Keep reading
Compliance
Regulated Retail Recordkeeping: Retention, Access, and Audit Evidence
· 6 min read
Compliance
California vs. Oregon Tobacco and Nicotine Retail Rules
· 7 min read
Compliance
Multi-State Cannabis Compliance: What Changes Between Jurisdictions
· 6 min read
