Executive and director roles for compliance and risk management are consistently found in highly regulated industries such as pharmaceutical, financial services, alcohol, tobacco, and publicly traded companies. As the commercial cannabis industry matures, similar roles are forming, but the roles are at different levels of maturity between commercial cannabis businesses and other highly regulated industries, and that is OK. Understanding why varying degrees of maturity in risk management are acceptable between industries is helpful.
Time Matters
Peers in other highly regulated industries are likely in their 10th plus iteration of risk assessments, have routine risk committees and have a budget for continuing education for their entire department. They have also seen fines in the billions of dollars and had decades to mature their compliance and risk programs.
With independent auditors, consultants with decades of experience, and assurance work programs, the risk environment has matured significantly in most industries over the last two decades. It can be hard to remember that the commercial cannabis industry has not had the time or been subject to the types of enforcement actions that other high-risk industries have. Risk and compliance programs never seem to be built fast enough, particularly from the eyes of ancillary cannabis businesses that may be used to a more mature environment. The risk-based approach is meant to consider the complexity, size, and time the industry has operated. Currently, one of the highest priorities in the commercial cannabis industry is to prioritize the foundational controls that allow compliance and risk management programs to manage change and escalate issues.
Make Risk-Based Decisions Part of Your Culture and Stop Firefighting – ACCCE
Compliance and Risk Management May Seem the Same Across Industries but also Aren’t
Each industry has risks specific to them and industry vernacular to describe them. Commercial cannabis industry participants must learn the risks specific to the industry, or it is difficult to have an in-depth conversation with cross-industry risk professionals. The five high-risk areas in commercial cannabis are money laundering, illicit cannabis market, supply chain, compliance, and operational risk.
For example, financial industry peers will understand the money laundering risks, which are like the illicit cannabis market risks. Illicit cannabis market risk focuses on the diversion or inversion of cannabis products in the licensed cannabis market. Like money laundering, the illicit cannabis market risks are managed through recordkeeping and unusual activity detection. The main difference is that money laundering is about the funds, and the illicit cannabis market is about the cannabis product.
New risks tend to make cross-industry peers concerned about the effect on their business or marketplace. However, the interaction between highly regulated companies should be managed through reliance on each business’s well-designed risk-based program. For example, professional service providers like banks or accountants aren’t expected to trace diamonds or arms through the supply chain to prove they are legitimate; they usually rely on evaluating those industries and specific customer risk programs.
In some cases, a professional service provider will point to the reputational risk of the commercial cannabis industry as a reason that cannabis compliance and risk professionals are expected to mature their programs faster. However, there is not a clear case where the reputational damage of a commercial cannabis business has increased risk in another industry. Risk management is hard enough when living up to management’s expectations, but it’s materially damaging the industry’s ability to manage risk based on impact and severity. The cannabis and ancillary risk and compliance professionals must consider the commercial cannabis industry’s risk management maturity when evaluating risk management practices.
Don’t have a risk program? ACCCE offers a customizable risk program template to help you get started.
Risk-Based Realism
The commercial cannabis industry is emerging for risk management, which means it is in a rapid phase of maturation. Through cross-industry communication, the industry will hopefully avoid some of the problems other high-risk industries addressed decades ago.
If you work in the industry, realize that other professionals will likely judge your risk management based on their expectations. Be ready to explain how you will enhance your risk program over time based on risk prioritization.
If you work with the industry, realize that many industries have a decade or more head start on risk management. Using the risk-based approach, consider that your potential customers will enhance their risk management over years, not months or weeks. If there are specific concerns, identify the inherent risk you are concerned with. This will be passed on through this relationship to see if the risk is worth prioritizing over other risks the customer has already identified.
Compliance and risk management as a profession are similar across industries but not the same. The commercial cannabis industry needs a similar amount of time to mature, an expectation afforded to all other industries.
The Association of Certified Commercial Cannabis Experts (ACCCE) is dedicated to advancing the professional knowledge and skills of those committed to commercial cannabis risk management.
Click here for more information on how ACCCE can help our members.
