In June 2020, the Criminal Division of the US Department of Justice released a document to help prosecutors evaluate the effectiveness of the compliance program of a corporation being charged with a criminal offense. The report calls for the prosecutor to determine plan effectiveness at the time of the offense as well as when the prosecutor is determining which type of penalty, if any, is appropriate. What’s this got to do with cannabis? As it turns out, quite a lot.
Violations can be Mitigated
With waning COVID-19 levels, state regulatory agencies are getting back at it, hiring staff, and stepping up enforcement actions. Recently, Nevada regulators suspended a company’s adult and medical cannabis cultivation and production licenses for improperly tracking its cannabis.
When an inspector finds a deficiency or violation, how does s/he decide the appropriate level of punishment? While there is no standard across all states, many agencies take intent into account. Regulators evaluate the company’s compliance program—if there is one—and determine if it’s an active program or merely a paper program designed to assuage external stakeholders. While each company’s risk profile and solutions to reduce its risks are specific, and there is no such thing as a one-size-fits-all program, the Justice Department and some state cannabis regulatory agencies ask three fundamental questions:
- Is the corporation’s compliance program well-designed?
- Is the program being applied earnestly and in good faith, which means is it adequately resourced and empowered to function effectively?
- Does the corporation’s compliance program work in practice?
For those of you who would like to read the Justice report, you’ll find it here.
In this article, we will show you how the ACCCE Cannabis Risk Management Framework (CRMF) guides the process of implementing and maintaining an effective risk management system and how a compliance software system like ProCanna helps cannabis operators put that compliance program into action.
But first, why create a workable compliance system? It’s simple. Following ACCCE guidance and using a tool like ProCanna will put you in good stead when regulators – or bankers, insurers, investors, and potential supply chain partners – come knocking. If your company operations are compliant, you can prove it. If/when your operations are found to be deficient, showing external stakeholders that you have a compliance and remediation system in place is often enough to lighten or even dismiss a negative outcome.
Case in point: One ProCanna client had audited a dispensary and found an issue with the visitor log. The next week a regulator showed up for a surprise audit and found the same issue. When the facility manager showed the regulator that his team had already identified the issue and was working to remediate it, the regulator commended him on the effort to maintain compliance and chose not to write up a deficiency notice or violation.
See what else technology enabled audits can do for you.
Keep reading to learn three of the key tenets of an effective compliance program.
Is Your Corporation’s Compliance Program Well-Designed?
According to ACCCE’s CRMF model, a well-designed risk management and compliance program is comprised of six components:
- Internal Control Environment
- Risk Assessment
- Control Activities
- Information and Communication
- Training
- Assurance
The CRMF guides the cannabis operator through the process of identifying risks and opportunities and developing a compliance program that operates within the company’s risk appetite.
The risk assessment prioritizes and tailors the risk-based control activities. To establish the optimal risk-based decisions, management uses the risk profile to inform its analysis of business opportunities. Effective monitoring of known risks helps identify changes to the risk profile over time.
Training informs all individuals of their job responsibilities in compliance with company policies.
Assurance activities, also known as audits or self-reviews, assess the efficiency and effectiveness of controls and provide relevant feedback to stakeholders. ACCCE recommends conducting self-reviews on lower risk concerns or where timeliness is important. Independent audits cover the highest risk areas or where validation of industry best practices is needed. The risk officer oversees management’s response to mitigate gaps as they are identified.
Using a software tool like ProCanna provides cannabis establishments with four primary assets:
- State cannabis laws, rules, regulations, and guidance documents
- Information foundational policies, SOPs, and audits
- Tools for developing, sharing, and maintaining internal policies, SOPs, checklists, audits, videos, and quizzes; assigning and tracking activities, training, and auditing
- Date and time-stamped reporting on all documents and activities
Once the cannabis operator has established policies, SOPs, and audits that comply with external regulatory standards as well as internal brand standards, the organization must communicate those policies and SOPs to its employees. It’s important to have one central location for employees to access the policies and procedures that apply to their position. Training should occur during initial onboarding as well as at regularly identified intervals, such as whenever regulations are revised, when new ones are introduced, or whenever a policy or procedure is revised.
Assigning regularly scheduled or on-the-fly audits documents activities and identifies issues so they can be remediated.
For more information on Compliance & Risk Management: Two Functions, One Strategy – ACCCE.
Control Activities
Two key control activities, both identified in the Justice report, are important to all cannabis businesses—issue management and an ethics and whistleblower policy.
ACCCE advises that a commercial cannabis business develop a sound issue management process to increase the likelihood that issues are resolved according to the risk strategy and within the risk tolerance of the specific issue. Issue management control activities reduce overall risk by creating a central point of oversight through the risk officer to assure proper risk mitigation. The risk officer formalizes control activities that establish a risk-based control activity standard, oversees the risk issue until it is mitigated, and periodically reports to the board risk committee.
Given the number and complexity of laws that apply to any commercial cannabis business, noncompliance may occur. As a result, the cannabis company’s board should consider implementing ethics and whistleblowing policies and procedures to promote reports of noncompliance. These policies and procedures help to improve the cannabis business’s compliance and minimize the risk of penalties, fines, and damages.
The board has ultimate responsibility for establishing clear ethical standards with which all stakeholders and relevant vendors must comply. The board should review and approve the ethics and whistleblower policy, which describes the ethical standard all stakeholders are held to, the intent to comply with applicable whistleblower laws, the appointment of a designated stakeholder to manage the day-to-day activities of ethics and whistleblowing, and the requirement to investigate and report to the board verified complaints regardless of the outcome.
More information on how Risk Officers Support the Board – ACCCE.
Misconduct Is Not Necessarily a Fatal Blow
It’s important to note that most misconduct within a cannabis business is not fatal. The DOJ report states:
…it is important to note that the existence of misconduct does not, by itself, mean that a compliance program did not work or was ineffective at the time of the offense….Indeed, [t]he Department recognizes that no compliance program can ever prevent all criminal activity by a corporation’s employees. Of course, if a compliance program did effectively identify misconduct, including allowing for timely remediation and self-reporting, a prosecutor should view the occurrence as a strong indicator that the compliance program was working effectively.
In Summary
Following ACCCE’s guidelines and using compliance and operational software tools like ProCanna helps a cannabis operator establish, implement, and maintain efficient and effective compliance and operational program that will stand up to a regulator’s scrutiny if/when noncompliance is identified. An added benefit—when a cannabis business executive team sets the tone of compliance and empowers managers and staff with clear expectations and open communication, company culture, and often, the bottom line is strengthened.
See how ACCCE can help you establish an efficient and effective risk management system.
To learn more about ProCanna and/or sign up to demo the company’s compliance and operational system, click here. Complete the demo in 2022, and ProCanna will purchase your ACCCE membership and Certification, up to a $1,600 value.
