Hey ACCCE,        

How would you describe to a CEO why the business should implement a risk-based approach to compliance?

Sincerely,

A Cannabis Compliance Manager

Describe Why Risk-Based Approaches are Implemented

In highly regulated industries, most companies reduce the risk of civil and criminal exposure by taking a risk-based approach that shows the company’s intent to comply. A company’s intent to comply is not judged by whether the compliance personnel worked 100 hours a week. Conversely, it would indicate that you are likely understaffed if your compliance staff consistently works those types of hours. Companies are formally judged by their well-designed risk program that effectively enables their risk-based approach, which demonstrates their intent to comply.

Describe the First Step

Everyone has their day 1, which is demonstrated when the board/members/owners approve a policy to manage risk through an effective well-designed risk program. In particular, ACCCE suggests that companies manage their money laundering, illicit cannabis market, supply chain, compliance, and operational risk this way. However, you may want to start implementation with compliance only. Consider starting by providing the policy statement for approval.

Don’t have a policy statement? We have you covered with the ACCCE Risk Program Template, Risk Program Package – ACCCE.

Describe the Milestones and What They Mean to the Business

After you have the policy statement approved, start implementing at a pace commensurate with the business’s size and complexity. Perfection is not the goal; demonstrating that the business is reasonably better at managing risk every year is. Over the next year, you should be able to appropriately size these activities to the size and complexity of the business:

• Align compliance, risk management, and business objectives by establishing the Tone at the Top, which will limit the risks the business and its stakeholders are exposed to.
• Enhance employees’ ability to make informed risk-based decisions by identifying likely risks the business faces through a risk assessment. Risk-based decision making allows the business to be more efficient by letting the right person make an informed risk-based decision. An informed risk-based decision is accomplished when the decision maker knows the business objective and the guidelines imposed by the business to balance the cost of compliance/risk management with the reward of attaining the business objective.
• Reduce risk in current activities by establishing a strong issue management system. Strong issue management reduces cost and increases the likelihood that your revenue stream and profit margin remain consistent.
• Document these efforts so that they can be evaluated for business valuation, investment, or M&A.
• Document these efforts to demonstrably prove its intent to comply if noncompliance is found in the future. This should put the business in the best position to mitigate civil and criminal penalties.

Here is a different way to describe this by Terradigm (The Ebbs & Flows of Change in the Cannabis Industry (terradigmconsulting.com)

Risk Management Benefits the Business

The compliance and risk professionals’ jobs are to enable the business to meet its objective while managing its exposure to reputational, administrative, civil, and criminal risk stemming from money laundering, illicit cannabis market, compliance, supply chain, and operations. This a science, not an art or a guess. Compliance and risk professionals do this through deliberate steps that demonstrate the business’s intent to comply. Implementing a risk-based approach is how the business formally gets credit for telling you to do your job.

Join ACCCE to access tools and resources that will save you time and money when implementing a risk-based approach, Commercial Cannabis Businesses – ACCCE.