It’s a common complaint among businesses: “I’m spending all my time putting out fires, I don’t have time to do my job.” Yet when I ask my clients, “how much is it worth to have fewer fires?” there is an awkward moment of silence. Is it worth having a qualified person on staff so that the CEO, COO, CFO, and every other person fighting fires can focus on their jobs instead of fires? Some want to believe that there is a magical day in maturity that risk stops affecting their company, and there will be fewer fires. As a risk professional, I find that it is the product of a qualified professional actively reducing the number of lit fires. I also find that the less your company is on fire, the more likely it will succeed.
The interesting part is that this is something that investors, regulators, and suppliers look for as well.
A risk officer understands that reducing risk allows everyone in the business to spend more time focused on their jobs. By identifying the obstacles to the company’s goals and implementing cost-effective ways to reduce their harm, compliance and risk professionals increase the likelihood that the business will achieve its goals. Further, communicating risks to all stakeholders in the company empowers all employees to make informed risk-based decisions, reducing the chances of noncompliance.
Most companies reward reactivity and discourage proactiveness for the simple fact that when a risk isn’t get big enough for everyone to notice, no one gets credit for solving it. Yet, most managers agree that someone should be mitigating risks to the business as early as possible. This juxtaposition is hard to overcome. In my experience, the misunderstood issue is that employees aren’t actually tasked or trained to identify, size, and mitigate risks across the business; this is the domain of compliance and risk professionals.
Here are three practical ways I’ve helped companies shift their thinking to assume the appropriate risk-based structure in their business.
Implement a Risk Assessment
One operations director I worked with had recently been tasked with the expressed purpose of integrating two licensed supply chains. She spent most of her time responding to operational missteps that caused noncompliance. Her authority to focus managers on new tasks and ability to buy the required tools trained employees to bring problems to her to authorize the solution. When we both looked at where she spent her time, it wasn’t on the most important business objective her business wanted her to accomplish in this role. When I asked her what her most important business objective was, she had a succinct and clear answer. She said, “take out duplicate costs from redundant work and get the organization vertically integrated while remaining compliant in multiple jurisdictions.” Based on that objective, we were able to focus our actions on identifying the compliance risks by products, business processes, and jurisdiction. This risk assessment allowed her to communicate the compliance risks specific to functional areas, the way the business intended to reduce the risk, and how important the risk was to each employee. This information empowered managers at the right level to make an informed business decision to keep the organization moving forward without causing as many issues.
By identifying the inherent compliance risks, we were able to identify the handful of local, state, and federal regulations that put this business objective most at risk. As with all cannabis operators, she had SOPs for each license, and we were able to map the controls to the risks they were mitigating. This left us with a handful of items to focus on, which reduced the frequency of fires because we resolved the root cause, not the symptoms of the problem. The risk assessment also allowed her to focus her efforts on the most material risks while integrating two licensed supply chains, putting her valuable expertise to work for the company on the most critical items.
Watch ACCCE’s complimentary webinar to put your risk assessment to work for you.
Appoint a Qualified Person with Appropriate Resources and Authority
A risk assessment is a useful tool, but it has its limitations. In the previous case, the operations director had the appropriate resources and authority to make the changes that were needed. The compliance issues in the supply chain also corresponded to what she was trying to accomplish, so she rose to the challenge. For the everyday situation, you need a person who will champion fixing whatever the most likely risk is that will keeps you from achieving your goals. This is the risk officer’s role. Absent this role, your CEO, CFO, COO, or other leaders will have to rally to the crisis leaving their function absent a leader.
Implement a Risk Program
Effective risk management is as much a mission of the company as a function overseen by a risk officer. No business can eliminate risk completely. Successful, highly regulated companies need a structure to translate business objectives into clear risk-based decisions that are made at the appropriate levels throughout the company. For people to commit to carrying out a company’s vision, they must both understand it and know what is expected of them.
This is more difficult than it may first seem. Commercial cannabis businesses face money laundering, illicit cannabis market, compliance, supply chain, and operational risks. Every business decision can have unintended consequences if there is not a unified view on how to manage these risks. The risk program is a foundational step in empowering your stakeholders to manage these risks in their daily decision making.
Try ACCCE’s Risk Management Program template to implement proven risk management solutions that you can easily customize to meet your business’s needs.
Risk-Based thinking is not new or abstract. Despite the common complaint that there is too much firefighting, there is a known and well-regarded discipline of risk management to reduce this problem. For commercial cannabis businesses to succeed, risk management should empower every employee to do their job compliantly. This helps every cannabis operator reduce public harm, increase public safety, and maintain a sound licensed cannabis market that is profitable to operate in. Risk management isn’t built in a day, but the sooner you start, the sooner everyone gets to do their job. Taking any of these three steps will create a strong foundation for your risk culture and company ethos to thrive.
The Association of Certified Commercial Cannabis Experts (ACCCE) is dedicated to advancing the professional knowledge and skills of those committed to commercial cannabis risk management.
Click here for more information on how ACCCE can help our members in the commercial cannabis industry.
