The first component of the CRMF is to establish the internal control environment in which the commercial cannabis business operates.
The board sets the tone of risk management by assigning responsibility and authority, which is implemented by senior management, resulting in standards that become ingrained in the company culture. The board or equivalent committee determines the level of risk the commercial cannabis business is willing to accept in the pursuit of its business objectives; this is known as the risk appetite. The risk strategy integrates business objectives with risk management techniques and is typically formed by management and approved by the board. Management should integrate risk management into all aspects of the commercial cannabis business.
To formalize the internal control environment, a formal risk policy should be approved, which would include a description of tone, risk appetite, and risk strategy. This risk policy assists management in integrating the risk culture throughout the business processes. Risk management is critical for the successful execution of a commercial cannabis business’s strategy. Failure to identify, assess, manage, and monitor critical risks can have devastating effects on the long-term performance of the commercial cannabis business.
Implementing the Risk Program
Through the CRMF, the board sets the tone that addresses risk and it flows down to all levels of the commercial cannabis business. By assigning authority and responsibility, an efficient and effective internal control environment is established that engages all employees in the management of risk.
The risk appetite and risk strategy enables management to make appropriate decisions to achieve business objectives. These policies and associated procedures are referred to as the risk program.
It is important that the board appoint a qualified person with the appropriate responsibility and authority to oversee the implementation of the risk program. While the title of the individual responsible for the cannabis risk-management program is not an essential factor, ACCCE refers to this position as the risk officer. The level of authority and responsibility is critical to the success of the individual in this role.
Maturing the Risk Program
The risk program should evolve with the complexity of the commercial cannabis business, changes in the market environment, and the knowledge and experience of the risk staff. The ultimate benefit of the risk program is to provide stakeholders with relevant and timely information needed to make educated decisions that either reduce the maximum impact of a risk event or increase the reward for taking on a reasonable risk.
Initially, the risk officer may be responsible for managing all risks through one or more risk programs. As the breadth and complexity of risk management increases, it is necessary for the risk officer to delegate the management of certain control activities to others while retaining oversight and ownership of the outcomes. Delegation allows employees with specialized knowledge to focus on these complex risks. Key control activities that may become separate risk management programs include but are not limited to inventory control, vendor management, and compliance. Each risk program should follow the six components described in the CRMF.
A sound CRMF offers many benefits including more efficient operations, a strong bottom line, and increased brand reputation. Developing a strong foundation for the risk programs requires acknowledgment that risk management should be embedded in day-to-day activities with a top-down commitment. This commitment is demonstrated by the approval of the risk program, appointment of a risk officer to manage the program, and allocation of appropriate resources. The risk program should be updated and approved on a periodic basis.