A Problem Worth Solving: Effective Tools for the Challenges of Inversion and Diversion
The transfer of cannabis products into and out of the licensed sector creates great risk for the cannabis business by jeopardizing their active license and risking substantial fines or license revocation by the regulatory authorities.
Building a risk management program utilizing the ACCCE Cannabis Risk Management Framework is critical to achieving an effective risk program and dealing with the longstanding issues of inversion and diversion.
A Problem Worth Solving
Regulators, risk officers, and compliance personnel continue to be challenged by cannabis moving in and out of the supply chain through the illicit market. Understanding the inherent risks associated with inversion and diversion allows a risk officer to develop and implement control activities that help maintain the legitimacy of the licensed cannabis market and ensure the consumer’s safety. The pharmaceutical industry has identified a similar problem. The American Society of Health-System Pharmacists (ASHP) guidelines state, “controlled substances diversion in the health systems can lead to serious patient safety issues, harm to the diverter, and significant liability risk to the organization.”[i] The cannabis industry benefits from taking a similar stance.
Various countries worldwide are creating laws that allow the commercialization of cannabis. Still, the illicit market’s well-established pathways have created challenges from day one for the risk management and compliance professions. Inversion and diversion can be substantiated by looking at regulatory fines, suspensions, license revocations, public news stories regarding facility shutdowns, and eyewitness accounts. Inversion and diversion are documented in the pharmaceutical industry as well. An ASHP guidelines article states, “diversion of controlled substances is common, but it is rarely discussed openly.”[ii] Having been in the cannabis sector since 2009, I can certainly attest to the reality of these kinds of activities in the cannabis industry as well.
People have trafficked in cannabis over the years to make a living or participate in an illicit market or culture. The illicit market and organized crime overlap in their desire to continue their participation in the cannabis marketplace. For licensed commercial cannabis to succeed more broadly in the marketplace, the licensed commercial cannabis businesses need to help differentiate themselves from bad actors.
For licensed commercial cannabis to succeed more broadly in the marketplace, the licensed commercial cannabis businesses need to help differentiate themselves from bad actors.
The Challenges
Perhaps the most significant challenges for licensed commercial cannabis business diversion and inversion lie in the supply chain, operational, and organized crime risk areas. Although seed to sale tracking has been enacted worldwide, this self-reporting model must be augmented with effective control activities. Without effective controls, it is difficult for licensed cannabis businesses to prove they did not invert by self-reporting additional products into the supply chain, or divert by under-reporting. Weak operational controls allow individual actors within the licensed business to attempt inversion and diversion for their benefit. Last, organized crime is incentivized to infiltrate the licensed business to divert and invert cannabis products. Without effective controls to reduce this organized crime coercion, some licensed businesses will be targeted. From my dealings and discussions with the cannabis industry, the regulatory sector, and ancillary providers, I believe there is a particular over-reliance on seed to sale tracking as a comprehensive compliance solution that is unwarranted and is hindering regulatory compliance by way of overdependence.
The Inversion and Diversion Example
Let me give you a familiar scenario. Grower A is an illicit business, and grower A produces a common Cannabis strain (strainX) that happens to be grown by grower B, a licensed business. Grower B usually produces about 1000 pounds per harvest and harvests five times per year. Grower B may have a crop deficiency that affects the number of pounds produced in any given harvest.
It is not realistic to assume that grower B’s plants will always produce the same quantity of flower products harvest after harvest. In one crop, in particular, grower B harvests 800 pounds of strainx and then purchases 250 pounds of the same strainx from grower A. Grower B inputs 1050 pounds of product into the self-reporting seed to sale tracking system. Most likely, no one will question the 1050-pound harvest, so a substantial amount of illicit product enters the licensed market. To ensure there are no problems, grower B places the 250 pounds off to the side, so there is no mix-up with product sampling that must pass testing for potency, heavy metals, and toxins. Once the licensed product passes testing, the illicit 250 pounds is co-mingled with the 800 pounds to align with the seed to sale data input by grower B. Two hundred and fifty pounds may represent $500,000 at the wholesale level and $1,750,000 at the retail level.
Diversion occurs in much the same manner. Grower B has a bumper crop and produces 1000 pounds of strainx at harvest #2 for the calendar year 2020. Grower B reports 800 pounds into the seed to sale tracking program (under-reporting) and sells the 200 pounds out into the illicit market. If questioned on the harvest total, grower B simply tells you that none of his harvests have been exactly the same. This time in particular, some of the plants performed poorly. Grower B tells you that the nutrient uptake was slightly off; some days were a little hot, which stressed the plants, and a few plants had root gnats (all common problems, by the way) but grower B says he did the best he could. Selling 200 pounds to the illicit market at wholesale can represent anywhere from $300,000 to $800,000 tax-free. Given that cannabis is predominantly a cash business, these monies could be folded into the company’s funds via obfuscation.
Red Flag Indicators
Below are twenty red flag indicators to consider when identifying inversion, diversion, or both:
General
1. Invoices to previously unknown vendors
2. Vendor business names that are not a match for licensed entities (names and addresses)
3. Incomplete, inaccurate, or partial records regarding the flower growing process and issues encountered
4. Declared harvest amounts that differ by more than 5% on average, and particularly, from the last harvest
5. Product quantity understated to the testing lab for test sampling purposes compared to declared harvest amounts
6. Harvested product that appears noticeably different in terms of aging
7. On-premise activities at unusual times for management or beneficial owners
8. Employees who exhibit a lavish lifestyle that cannot be supported by their salaries
9. An employee who is reluctant to take a vacation
10. An employee that regularly disregards policies and procedures related to segregation of duties, dual controls, or overrides
11. An employee takes a significant interest in business processes that they are not responsible for performing or have any need to understand
12. An employee who stocks unusual volumes of commercial cannabis inventory
13. Employees accessing cannabis stockrooms outside of regular hours
Inversion
14. Future testing records indicating test failure where none was present before for that crop
15. Test failure for heavy metals or toxins when no substantial production variations had occurred between harvests
16. Bills of sale that are out of numerical sequence considering sales dates
17. Bills of sale are not entered into the seed to sale system promptly comparing the entry date, harvest date, and numerical sequence
18. Different types of bulk packaging material are present
General
19. Trimming records via payments per pound do not match the declared harvest amounts
20. Lapses in records regarding persons on-premise at any given time and missing video
Implementing Control Activities
Risk management professionals must effectively address the operational and financial records of the commercial cannabis business to detect inversion or diversion. Skillful implementation of the ACCCE Cannabis Risk Management Framework is critical to identifying and addressing these risks through effective controls and measuring for assurance purposes.
The first step is to complete a risk assessment in order to determine what control activities should be implemented to manage the risks identified. Consider your business’s unique inherent risks for diversion and inversion to determine how you might develop tools for these red flags. Consider diversion and inversion risks in your analysis of organized crime, supply chain, and operational risk areas.
Let us consider some practical control activities based on the information mentioned above.
Vendor Management
Maintain a list of all vendors for your licensed business and require the list to be updated. Reconcile vendor activity to the report that includes the vendor name, license #, type, and date of the activity; the quantity obtained, transferred, or sold; and the dollar amount involved. This information should be reviewed monthly. This information can be used for many purposes in both financial and operational risk management and can expose record manipulation over time.
Harvest Records
Maintain a record over time regarding the number of pounds at the end of each harvest and after the product is cured. This will allow you to compare periodic submissions with year-end records and seed to sale information. A comparative analysis can be conducted across myriad data sets for congruency purposes.
Employee Abnormality
Maintain an ethics and whistleblowing process as part of your business’s risk program. In many cases of inversion and diversion, other employees will witness or suspect wrongdoing. Providing a method to report the activity anonymously and with clear standards on investigating the claim allows employees to help safeguard the company from occasional bad actors.
Operational Records
Maintain records regarding product testing that include not only the THC percentages, but information regarding heavy metals, toxins, and contaminants. Records should be sent to a centrally controlled function for monitoring, directly from the lab that produced them. Enhanced controls should be implemented to manage the proper destruction of cannabis product that fails testing because of the significant financial impact.
Trimming Records
Flower products are trimmed prior to packaging. Some cannabis businesses use commercial trimmers (motor powered devices that remove stems and leaves by blades) and then perform a final pass using hand trimming. Some cannabis businesses prefer that their entire crop is hand trimmed, as it purportedly enhances value beyond the extra labor expense. If hand trimming is preferred, cannabis businesses will likely hire independent contractors for the task and pay an agreed upon rate by the pound trimmed. Product must remain on-site during the trimming process. For harvests that are hand trimmed, reconcile payment records to independent contractors regarding the number of pounds trimmed at each harvest and the declared harvest amounts in the business’s seed to sale system.
Conclusion
As a risk management professional, consider the specific risks of inversion and diversion so you are prepared to manage the risk. Identify which of your current control activities will manage and expose these known risks. Do not rely too heavily on any one mitigation activity, but understand that a strong ethics and whistleblower program, recordkeeping, reconciliation, and risk assessment are critical for the risk officer to identify the tell-tale signs of inversion and diversion readily. Formally implementing control activities through your risk program will ensure that you couple them with the components of the ACCCE Cannabis Risk Management Framework.
Develop and maintain a wide range of control activities that you determine will be effective. Watch for the posting of reliable information that points to inversion or diversion and then, reflecting on your risk program, ascertain if you would have identified that activity. Seek a balance across all six components of the ACCCE Cannabis Risk Management Framework in your risk program to maintain your effectiveness and align with your organization’s risk appetite. Recognize that modification of your control activities should be an ongoing exercise as the cannabis industry evolves and your business grows, and you should anticipate that illicit actors will adjust to obfuscate their conduct.
The Association of Certified Commercial Cannabis Experts (ACCCE) is dedicated to advancing the professional knowledge and skills of those committed to commercial cannabis risk management.
The views and opinions expressed in this article are those of the author and do not reflect the official policy or position of the author’s affiliated institutions.
Citations
[i] Philip W. Brummond, David F. Chen, William W. Churchill, et al. American Society of Health-System Pharmacists. 2017. “ASHP Guidelines on Preventing Diversion of Controlled Substances.” Am J Health-Syst Pharm, Volume 74: 325-48. https://doi.org/10.2146/ajhp160919
[ii] Philip W. Brummond, David F. Chen, William W. Churchill, et al. American Society of Health-System Pharmacists. 2017. “ASHP Guidelines on Preventing Diversion of Controlled Substances.” Am J Health-Syst Pharm, Volume 74: 325-48. https://doi.org/10.2146/ajhp160919