The sixth component of the CRMF is to provide relevant stakeholders assurance that risk management is functioning as intended through continued monitoring and testing of the risk program.

It is important to verify that the risk program is implemented as designed to operate within the risk appetite while pursuing business objectives.

Implementing the Risk Program

Assurance activities assess the efficiency and effectiveness of controls and provide relevant feedback to stakeholders to assure they are aware of risk management’s quality expectations while executing their responsibilities. The risk program describes the independent and non-independent audit schedules and issue management expectations. Non-independent audit is conducted on lower risk concerns or where timeliness is important. Independent audit covers the highest risk areas or where validation of industry best practices is needed. The risk officer oversees management’s response for mitigating gaps as they are identified.

Audits require scheduling, reporting, issue management, and oversight reporting to the board. Scheduling is based on the risk assessment to ensure audits are risk prioritized. At the conclusion of an audit, the results are reported to the risk owners. In accordance with the risk tolerance, risk owners mitigate gaps identified in the audit. The risk officer oversees management responses, execution, and documents the progress according to issue management processes. On a periodic basis, the risk officer reports to the board the oversight of assurance activities and adherence to the audit schedule.

Audit frequency should be commensurate with the risk level identified in the risk assessment. The goal is to assure stakeholders that risks are appropriately mitigated across the commercial cannabis business.

The risk officer is responsible for implementing the assurance activities. This requires having a direct line of communication to the board and the authority to direct assurance activities across the commercial cannabis business.

Each manager is responsible for the timely mitigation of his or her risks. This requires the board to establish consequences for managers who do not meet this responsibility. Consequences include a negative impact on the manager’s performance review or lead to termination of employment.

Maturing the Risk Program

Audit procedures are updated as management develops a deeper understanding of risks and history of control failure. The scope, objective, and frequency of assurance activities are based on the results of the risk assessment, applicable findings from audits, and changes in the business environment. Audit scope varies based on the audit subject’s inherent risks and quality of controls, history of audit findings, and changes in the business environment since the last audit. The audit objective is formed based on the audit subject’s residual risk, history of audit findings, and changes in the business environment since the last audit. Audit frequency is based on the residual risk and expected changes in the business environment.