Operating a highly regulated business is no easy feat, but it’s especially difficult in the commercial cannabis industry because of jurisdictional differences and rapidly changing regulations. Risk and compliance officers at commercial cannabis businesses, however, aren’t strangers to this complexity and know the balance needed between profitability and risk. It can be frustrating for commercial cannabis businesses to keep up with the complexities of compliance risks, so follow these three steps to ease the process.
Step One – Design a Framework
The first step when designing a risk assessment is to create a framework for assessing your business’s specific compliance risks; otherwise known as your business’s risk landscape. Your risk landscape is dependent on the products and services you offer, the business processes you have, and the jurisdictions in which you operate. This means that you will be exposed to environmental, health, and safety risks, cross-jurisdictional transportation risks, and other industry-specific compliance risks. Your business will also be exposed to certain compliance risks that are specific to your own business model, depending upon the products and services you offer, the business processes you have, and the jurisdictions in which you operate. These are the most common risk drivers within the compliance risk area for each commercial cannabis business, but your assessment and management of them will look different than those of other commercial cannabis businesses because your risk profile is different. Evaluating your business’s risk landscape against your specific business model is key to creating the framework for your risk assessment.
Step Two – Create a Methodology
The second step in the risk assessment process is to create a methodology explaining how you evaluated your business’s compliance risk landscape. The goal for this methodology is to bring you through the process of assessing the likelihood and potential impact of each risk so you can identify the inherent risk exposure to your business. Inherent risk is risk that is present without taking into consideration your policies and procedures, training programs, dual control, and segregation of duties, collectively known as your business’s control environment. Risk exposure can be documented on a rating scale of low to high, with low reflecting minimal impact and high reflecting significant impact, giving you a comprehensive visual representation of what you’re working with. While it may seem daunting, this methodology doesn’t have to be overly complex. You can document both the qualitative and quantitative ways you assessed your risk landscape to make your methodology easy to understand and follow. To learn more about creating a risk assessment methodology, check out this webinar.
Step Three – Determine Residual Risk
The third step in the risk assessment process is to determine your business’s residual risks and any elements where your control environment needs to be reworked. Residual risk is the risk that remains at the end of the risk assessment process. To determine your business’s residual risks, evaluate your control environment against the inherent risks you’ve identified. If in this process you find a weak control, or absence of a control within your control environment, this means that your control environment will fall short of managing the risks within your business’s risk appetite and will need to be fixed as soon as possible. Prioritize your highest residual risks and determine the best way to manage those risks.
By following these three steps, you gain insight into the most critical risks facing your business objectives and determine the best mitigation strategies to implement. With this knowledge, you can now communicate risk management options through your risk profile to senior management and the board so they can make enhancements to controls and decide whether the risk is worth the reward.
The Association of Certified Commercial Cannabis Experts (ACCCE) is dedicated to advancing the professional knowledge and skills of those committed to commercial cannabis risk management.
Click here for more information on how ACCCE can help our members at commercial cannabis businesses.
