The fourth component of the CRMF is to implement information and communication that ensures stakeholders are aware of risks and responsibilities to make appropriate decisions.

The risk officer’s focus should be on the quality of information and effectiveness of communication to relevant stakeholders. Management is responsible for identifying key risk indicators and creating reports to provide timely and needed information to the appropriate stakeholders.

Implementing the Risk Program

Quality information and effective communication allow management to make decisions that reduce the risks faced by the commercial cannabis business. Quality information is tailored to the intended stakeholder, so the stakeholder’s risks are clearly reported. Effective communication is timely and enables management to make informed risk-based decisions that accomplish business objectives.

The risk officer is responsible for managing information and communication, which requires that role to have a direct line of communication to the board, authority to direct management reporting, and responsibility to disseminate tailored information. The risk officer has the responsibility to inform the board of material risks, actions management is taking to mitigate those risks, and how those actions are ensuring effective risk management to the risk appetite.

Maturing the Risk Program

The risk steering committee and risk officer update and enhance information and communication when risk owners make decisions that do not adequately balance the risks and business opportunities. Creating management structures increases the likelihood of risk owners making decisions within the risk tolerance that contribute to the success of business objectives. When the risk includes multiple risk owners, the risk steering committee creates a management structure to formalize how risk owners work together to make decisions. Formalizing the description of responsibilities of each risk owner and the frequency at which they should convene, allows for efficient and effective decision making. The risk steering committee sets expectations of documentation and reporting to assure quality of information and effective communication.