Incident replay turns security events into better decisions

A security event does not become useful simply because cameras recorded it or someone completed a report. Cannabis leaders need a reliable account of what happened, what people knew at the time, which decisions followed, and what the operation will change.

Incident replay provides that structure. It connects evidence, staff observations, required notifications, decisions, and follow-up work without turning the review into a search for someone to blame. The result should be a stronger procedure and a verified correction.

Portland's 2025 Annual Cannabis Policy Report described public safety as a persistent issue for the regulated market. It also reported that retail locations continued to experience a disproportionate share of reported crime, particularly during evening operating hours. A disciplined reconstruction process helps operators learn from those events without relying on memory or assumptions.

An internal replay should begin after immediate life-safety, emergency, and reporting duties are handled. Oregon requires a cannabis licensee or laboratory licensee to notify OLCC as soon as reasonably practical, and no later than 24 hours, after theft of marijuana items or money from the licensed premises. OLCC also advises immediate local law-enforcement reporting for theft. An attempted intrusion with no theft does not automatically trigger that same OLCC rule, though other duties may apply.

Preserve the record

Identify the original sources before building a narrative. Relevant material may include alarm history, video, access events, staff notes, and other records. Preserve originals, control access, and work from documented copies where appropriate. Record who collected each item, when it was collected, and whether a system clock or export process could affect the timestamp.

Oregon's surveillance rules require timestamps, retention, accessible reproduction, and a format that supports authentication of recordings. Those controls help, but a reviewer should still confirm that sources are complete and that gaps are visible rather than filled with assumptions.

Build a verified timeline

Arrange the evidence by time, then label each entry as confirmed fact, supported inference, reported observation, or unresolved question. Two systems can show different times. A staff recollection may be honest but imprecise. A camera may show movement without showing intent. The replay should preserve those distinctions.

Review each decision against the information available at the time. This also shows whether notification paths, authority, staffing, or system design made a timely decision harder.

Turn findings into assigned work

A finding needs an owner, due date, expected result, and verification step. "Retrain staff" is too broad. The action should state which role needs practice, which procedure or decision needs work, and how leadership will confirm that the change is understood. The same applies to maintenance, contact lists, documentation, vendor issues, and system changes. Before changing cameras, alarms, access control, or the licensed premises, determine whether the approved security plan or premises record must be amended and whether OLCC approval is required.

FEMA's continuous-improvement guidance treats corrective actions as a living plan that is monitored through completion. An open item should remain visible until someone verifies the result. A later exercise or event should test whether the correction worked.

Protect the review itself

The full replay may contain facility layouts, camera limitations, staff information, response timing, system identifiers, or investigative material. Limit the full record to people who need it. Public education can discuss the review method without publishing details that would help someone study a facility or its response.