In January 2019, investigators from the Massachusetts Cannabis Control Commission conducted an unannounced inspection of MCR Labs, a licensed independent testing laboratory for medical and adult-use cannabis in Framingham, MA. The inspection was initiated due to a complaint that vials containing marijuana and marijuana product waste had been disposed of in an unsecured dumpster at the facility (Bartlett 2019).
As a result of the investigation, the MA Cannabis Control Commission determined the lab’s conduct constituted grounds for an enforcement action. Ultimately, MCR Labs entered into a dispute resolution with the MA Cannabis Control Commission in July 2019 and agreed to pay a fine of $225,000 for improper disposal of cannabis products. The lab was also required to hire a facility and security manager and a compliance manager, and conduct a compliance audit six months after the positions were hired (Bartlett 2019).
Each commercial cannabis sector produces various categories of waste which require proper handling. Illicit cannabis market operators are incentivized to gain access to licensed cannabis product. As a result, wasting cannabis product is a business process that exposes the commercial cannabis business to diversion risk at the hands of illicit cannabis market operators. Commercial cannabis businesses need to assure that they have proper controls in place to manage diversion risk (part of the Illicit Cannabis Market risk area), including effective inventory management and proper training that will allow employees and stakeholders to report any potential suspicious activity associated with wasting cannabis product.
Risk Area Identification: The Illicit Cannabis Market
According to the Letter of Enforcement Intent from the MA Cannabis Control Commission, there were several violations pertaining to improper waste disposal identified during the investigation. Primarily, waste containing marijuana and marijuana products were not properly stored, secured, and managed in accordance with state and local laws and MA Cannabis Control Commission regulations. The Commission specifically detailed that failure to securely store marijuana and marijuana products exposed the general public to health and safety risks posed by the possibility of diversion. This is ultimately what resulted in the $225,000 fine.
Commercial cannabis businesses are exposed to numerous risks, including compliance risks. Compliance risk is an organization’s potential exposure to legal penalties, financial forfeiture and material loss, resulting from its failure to act in accordance with industry laws and regulations, internal policies or prescribed best practices (Sales, 2021). By not properly wasting cannabis product as prescribed by the Cannabis Control Commission, MCR Labs was in violation of its obligations associated with compliance management; however, the non-compliance exposed MCR Labs to additional illicit cannabis market risk because of the high potential for diversion as noted by the Commission. Although both risk areas exist in this case, ACCCE is categorizing this violation under illicit cannabis market risk specifically because the fine was handed down for potential diversion risk.
Background of the Case
On several days in January 2019, in multiple instances, MCR Labs employees deposited marijuana waste in an unlocked dumpster located on the lab’s exterior premises, and employees did not attempt to secure the dumpster before or after use. Additionally, MCR Labs disposed of marijuana mixed with liquid methanol in a solid waste container on the premises and the solid waste containers also included both usable and unusable marijuana that were not secured prior to disposal.
Further to the marijuana waste being disposed of improperly, the Commission identified that MCR Labs did not have effective inventory management controls in place. The lab provided the Commission with exported data from its Laboratory Inventory Management System (LIMS) that contained entries for approximately 7,520 samples received between the dates of November 1st, 2018, and January 23rd, 2019. The Commission identified that waste documentation lacked both the manner of disposal of all marijuana sample entries and the location of disposal. Additionally, the waste documentation lacked the signature of at least two lab employees witnessing the disposal of all marijuana sample entries recorded in the lab’s LIMS. On January 11th and 12th 2019, lab employees disposed of marijuana waste in an unlocked dumpster in at least seven instances without the accompaniment of a second lab agent to witness and document disposal of waste. It was noted that the non-compliance persisted for a time period of at least 83 days.
MCR Labs implemented a corrective action plan in February 2019 to address the deficiencies. These included storing marijuana and marijuana product in a secure location within the lab and removal by a licensed waste disposal company with records kept as applicable. All Standard Operating Procedures (SOPs) were updated and pertinent staff trained on the SOPs. An industrial grinder was purchased to render solid waste unusable.
The lab instituted training on waste disposal at both onboarding and on an ongoing basis. If policies, procedures, and processes change, the lab indicated they would retrain staff as applicable. The compliance officer was named as the responsible person to train all employees and keep pertinent records. The compliance officer is also responsible for periodic auditing of the waste disposal process to assure no deviations.
MCR Labs was subject of a re-inspection in April 2019 and while they had implemented effective controls to remediate their deficiencies and effectively manage inventory and waste processes on an ongoing basis, the Commission ultimately decided that the allegations were serious enough to suspend the license. In July 2019, MCR Labs entered into dispute resolution and agreed to pay the $225,000 fine for compliance failures.
Where is the Risk?
Certain business processes in commercial cannabis businesses are more vulnerable to illicit cannabis market risks. Wasting cannabis product is one such business process and in this case the root cause appears to be realized through weak inventory controls. Value and volume of cannabis product involved should also be considered when assessing business process risk.
Disposing of cannabis waste is complex because there are strict rules in place to track cannabis throughout its life, including as it heads to the landfill, recycling facility, or composting plant.
The following should be considered red flags in regards to wasting cannabis product:
- The risk assessment for wasting cannabis product does not include an analysis of
- Unusual value or volume of cannabis waste
- Reported product destruction lacking a convincing paper trail
- An employee that regularly disregards policies and procedures related to segregation of duties, inventory tracking, accounting, etc. processes
- Cannabis waste management is not overseen by a qualified employee such as a compliance or risk officer
- Training for cannabis waste management has not been provided to appropriate employees
- The business does not have a means to appropriately render cannabis product unusable
- Waste management is not periodically reviewed to assure the procedures and training are working as intended
- Procedures for wasting cannabis product do not include segregation of duties and dual control
How is the Risk Managed?
Commercial cannabis businesses are faced with changing rules and regulations on a constant basis, and maintaining compliance can be overwhelming. As a result, focus is typically centered on preserving compliance with these regulations in order to satisfy licensing requirements; however, managing risk holistically involves more than looking at the regulations. If compliance controls do not prevent non-compliance and the business doesn’t have any other internal control activities in place, there may be a greater chance of receiving civil and/or criminal penalties because of the non-compliance.
Implementing a formal risk-based approach is the best way to demonstrate that the business has considered all risks affecting it, and provides demonstrable proof that the business is appropriately allocating resources to its highest risks, even if a non-compliant event occurs. As evidenced in the MCR Labs case, ineffective controls and lack of assurance for inventory management resulted in non-compliance that lasted for almost three months before it was identified by their regulator. Once effective controls were implemented as part of their corrective action plan, oversight of the process identified waste disposal records that lacked quantities for 60 samples, resulting in the lab self-reporting the non-compliance. If these controls were in place from the beginning, the lab would most likely have detected the non-compliance earlier and helped protect the business from a penalty.
To further manage the risks associated with wasting cannabis product, the commercial cannabis business should consider all components of the Cannabis Risk Management Framework, which include, but are not limited to:
- Draft a formalized risk program that includes a statement that the business has a commitment to apply a risk-based approach to the destruction of cannabis product in order to reduce the risk of diversion
ACCCE’s customizable risk program template is a great starting place for commercial cannabis businesses with no risk program in place, or for commercial cannabis businesses looking to enhance their current risk program. Download it here: Risk Program Package – ACCCE
- Assign a qualified individual for managing wasted cannabis product
- Enhance the risk assessment to identify the commercial cannabis business’s illicit cannabis market risk for cannabis wasting
- Implement risk-based enhanced procedures and processes for managing wasted cannabis product that include segregation of duties and dual control
- Assign risk-based training to employees with cannabis wasting responsibilities that cover the company’s policies and procedures
- Implement risk-based enhanced self-reviews for unusually large cannabis wasting events
To see the entire risk issue, members should log in to their ACCCE account and go to Wasting Cannabis Product | Commercial Cannabis Handbook (accce.org)
Evaluate Risks Holistically for Effective Compliance Management
In a statement, lab owner Michael Kahn acknowledged that the lab has significantly improved its practices, beyond what is just required under state law. “Through full cooperation with the commission and a comprehensive audit of our procedures, we have implemented improved protocols for waste disposal that not only ensure full regulatory compliance, but represent the best practices in the cannabis testing industry,” Kahn said. “We will continue to advance public health and safety through our analysis of cannabis products” (Bartlett 2019).
Compliance and risk professionals use case examples like this to identify industry best practices that are likely to reduce noncompliance efficiently. Utilizing the red flag indicators for waste management, risk professionals can implement known mitigation strategies. In this case, we learned that assigning a qualified individual is important to this specific set of controls, as is having up to date training and procedures that have been communicated to all appropriate stakeholders and proper assurance activities.
Citations
Bartlett, Jessica. 2019. “Cannabis testing lab fined $225k for leaving weed waste in dumpster.” Last modified September 12, 2019. https://www.bizjournals.com/boston/news/2019/09/12/cannabis-testing-lab-fined-225-for-leaving-weed.html
Sales, Francesca. 2021. “Compliance Risk.” Last modified April 2021. https://searchcompliance.techtarget.com/definition/compliance-risk
