A security event does not become useful simply because cameras recorded it or someone completed a report. Cannabis leaders need a reliable account of what happened, what people knew at the time, which decisions followed, and what the operation will change.
Incident replay provides that structure. It connects evidence, staff observations, required notifications, decisions, and follow-up work without turning the review into a search for someone to blame. The result should be a stronger procedure and a verified correction.
Portland's 2025 Annual Cannabis Policy Report described public safety as a persistent issue for the regulated market. It also reported that retail locations continued to experience a disproportionate share of reported crime, particularly during evening operating hours. A disciplined reconstruction process helps operators learn from those events without relying on memory or assumptions.
An internal replay should begin after immediate life-safety, emergency, and reporting duties are handled. Oregon requires a cannabis licensee or laboratory licensee to notify OLCC as soon as reasonably practical, and no later than 24 hours, after theft of marijuana items or money from the licensed premises. OLCC also advises immediate local law-enforcement reporting for theft. An attempted intrusion with no theft does not automatically trigger that same OLCC rule, though other duties may apply.
Preserve the record
Identify the original sources before building a narrative. Relevant material may include alarm history, video, access events, staff notes, and other records. Preserve originals, control access, and work from documented copies where appropriate. Record who collected each item, when it was collected, and whether a system clock or export process could affect the timestamp.
Oregon's surveillance rules require timestamps, retention, accessible reproduction, and a format that supports authentication of recordings. Those controls help, but a reviewer should still confirm that sources are complete and that gaps are visible rather than filled with assumptions.
Build a verified timeline
Arrange the evidence by time, then label each entry as confirmed fact, supported inference, reported observation, or unresolved question. Two systems can show different times. A staff recollection may be honest but imprecise. A camera may show movement without showing intent. The replay should preserve those distinctions.
Review each decision against the information available at the time. This also shows whether notification paths, authority, staffing, or system design made a timely decision harder.
Turn findings into assigned work
A finding needs an owner, due date, expected result, and verification step. "Retrain staff" is too broad. The action should state which role needs practice, which procedure or decision needs work, and how leadership will confirm that the change is understood. The same applies to maintenance, contact lists, documentation, vendor issues, and system changes. Before changing cameras, alarms, access control, or the licensed premises, determine whether the approved security plan or premises record must be amended and whether OLCC approval is required.
FEMA's continuous-improvement guidance treats corrective actions as a living plan that is monitored through completion. An open item should remain visible until someone verifies the result. A later exercise or event should test whether the correction worked.
Protect the review itself
The full replay may contain facility layouts, camera limitations, staff information, response timing, system identifiers, or investigative material. Limit the full record to people who need it. Public education can discuss the review method without publishing details that would help someone study a facility or its response.
A security event does not become useful simply because cameras recorded it or someone completed a report.
Operational standard
An incident-review process should require teams to:
Protect people, stabilize the event, make required notifications, and preserve evidence.
List sources, originals, copies, custodians, and known time differences.
Build a timeline that separates facts, observations, inferences, and open questions.
Review decisions against the information available at that moment.
Assign each corrective action an owner, due date, expected result, and verification method.
Test the changed process through role-based training or exercises.
Restrict the replay record under defined access, retention, and approval rules.
Nexus insight
As a design standard, Nexus could organize a secure, time-ordered incident record across approved data sources. A reviewer could move from an alarm or access event to related evidence, staff notes, decisions, and corrective actions without losing the source trail. This is not a claim that every depicted integration is currently live.
Original evidence should remain preserved. People should validate the timeline, control access, resolve uncertainty, and approve conclusions. Investigators, managers, regulators, and emergency responders retain decision authority.
Work with VSG
Talk with VSG about building a documented incident-review process that protects evidence, assigns corrective work, and gives leadership a clear record of what changed.