Commercial cannabis businesses using the CRMF to manage risks must formalize these concepts into policies and procedures, referred to as the risk program.

The risk program is designed to identify potential risks across business units that may affect the commercial cannabis business and implement risk mitigation strategies to minimize risks to property, services, and stakeholders, increase public safety, and reduce public harm. The risk program helps the risk officer communicate risk management expectations with stakeholders.

Purpose of Risk Policy

A risk policy is board approved and prescribes a set of principles that guide the commercial cannabis business risk decisions in order to achieve business objectives. The risk policy includes the establishment of the risk management function, description of risk management expectations, and appointment of the risk officer.