The second component of the CRMF is to establish the risk assessment to evaluate the threats that could affect the achievement of business objectives with a focus on the likelihood and magnitude of impact.
The risk assessment includes all products, services, customers, entities, transactions, geographic locations, and other relevant factors, unique to the commercial cannabis business. The risk officer oversees the analysis of inherent risk and quality of controls to determine the residual risk. The risk profile is determined by the aggregate residual risks combined with the direction of risk. As the risk assessment and profile are updated, results are shared with the board for approval. Once approved, the risk assessment and profile are shared with senior management and all relevant stakeholders to create the risk mitigation plan.
Implementing the Risk Program
The risk assessment allows management to uniformly understand the risks faced by the commercial cannabis business. By understanding the factors presented in the risk assessment, the risk officer creates a prioritized risk plan and updates the risk program.
The risk program describes how the risk assessment will be updated, approved, and executed upon. The risk assessment is an ongoing exercise that is updated and approved at least every eighteen months and when a material change may alter the outcome. Periodically reviewing the risk assessment in these ways helps stakeholders maintain a current understanding of risks. The board approves the risk assessment and risk profile, the risk officer updates the risk assessment and risk profile, and management is responsible for remediating and reducing residual risks within the risk appetite.
Maturing the Risk Program
Risk assessment documentation and the risk program are updated and enhanced as management develops a deeper understanding of risks. The risk assessment’s formal methodology should be updated to include detailed standards of risk level, quality of control, and calculation of the residual risk. The risk strategy is routinely updated to further reduce risk and seize opportunities based on the current risk profile.
The risk assessment identifies the highest risks of a commercial cannabis business and informs management which risk-based control activities should be put in place to respond effectively to those risks. An effective control activity will specifically mitigate inherent risks identified in the risk assessment, which enables the commercial cannabis business to meet its business objectives while balancing its risk profile within the risk appetite. By enhancing the risk program control activities in conjunction with the risk assessment, management is better equipped to reduce the frequency or impact of a potential risk event by implementing a proactive approach to risk management. Ultimately, control activities are necessary for a commercial cannabis business to achieve its business objectives. A risk-based approach therefore considers the cost and benefit from these mitigation activities and assures a balance between risk mitigation and opportunity cost.
The risk program control activities are enhanced in conjunction with the risk assessment to determine if optimal strategies can be implemented, including reducing redundancies, implementing automation, or using other risk management techniques.
Risk management techniques include insuring, transferring, accepting, and avoiding.