Key Control Activities

Download Transcript

The risk program is made up of many control activities. These key control activities are in every commercial cannabis risk program because these control activities are best practices that efficiently mitigate inherent risk associated with the common high-risk areas.

Change Management

Commercial cannabis businesses operate in an environment that is continually evolving and changing due to internal and external risks. Changes include, but are not limited to, laws and regulations, industry practices, technology, business strategy, and public perception. To maintain public safety and reduce public harm, it is incumbent on the commercial cannabis business to regularly monitor their environment for changes and communicate those changes to management for mitigation prior to the change impacting operations.

Change management is an integral component of cannabis risk management and allows the commercial cannabis business to remain nimble and agile. The risk officer formalizes control activities for identification of changes, communication to stakeholders, and issue management.

The risk officer is responsible for change management because they are the point of centralized knowledge about the commercial cannabis business and risks. Notwithstanding, change management requires the proactive participation and collaboration of all risk owners to reduce the risk of the identified change. Material changes should be brought to the risk steering committee for detailed oversight.

Vendor Management

Not all vendors present the same level of risk to a commercial cannabis business. Therefore, a risk-based approach is applied to vendor risk management. The risk officer formalizes the control activities to include vendor risk assessment, initial due diligence, contract negotiation, ongoing monitoring, evaluation and selection, risk-based training, and contract termination.

The board or a senior-level committee should identify approval expectations for management and identify when their involvement is required. The risk officer should provide periodic reporting to the risk steering committee and board for vendors considered higher risk. Periodic reporting includes evaluation of vendor performance to risk contract terms and changes to the risk environment.

It is incumbent on the commercial cannabis business to maintain adequate oversight of vendor activities and perform quality control to minimize risk exposure. The risk officer identifies risk-based terms and conditions to include in the contract that define performance standards by which the vendor must comply. Based on the vendor risks, the contract should specify the type and frequency of management information reports it receives. Management should also consider mandating exception-based reports that would serve as notification of any changes or problems that could affect the nature of the relationship or pose a risk to the commercial cannabis business.

It is important to understand that there are normally critical vendors. A critical vendor is a supplier or service provider that is considered essential or indispensable to an organization’s operations. A critical vendor is a vendor whose failure or disruption of service would have a significant impact on the commercial cannabis business’s operations, financial performance, or risk profile. An employee should be assigned the responsibility to identify and document a list of critical vendors so that is communicated to management. This critical vendor document should enable management to better understand their supply chain risk.

Examples of critical vendors could include suppliers of essential raw materials, vendors providing critical components, service providers responsible for key processes or functions, vendors providing essential technology or systems, or vendors that expose the buyer to higher reputational, administrative, civil, or criminal risk.

Information reports may include regulatory exam results, audits, financial reports, and security reports.

Exception based reports may include changes to beneficial ownership, control, licensing, or negative audit findings

Compliance Management

Commercial cannabis businesses should establish a formal, written set of compliance policies and procedures administered and managed by a designated employee, typically referred to as a compliance officer. This set of policies and procedures are essential source documents that serve as a training and reference tool for employees as well as an organized effort to guide compliance activities. Well-planned, implemented, and maintained compliance prevents or reduces regulatory violations and public harm. The designated employee formalizes control activities to perform a compliance risk assessment, provides assurance of compliance control activities, and reports noncompliance to the board risk committee.

The compliance officer must develop and maintain sound compliance management and integrate it into product and service design, delivery, and administration. Compliance should be integrated into a stakeholder’s day to day responsibilities. Internally, the commercial cannabis business should self-identify issues and initiate corrective actions. The compliance officer also manages relationships with vendors to ensure effective compliance with applicable regulations throughout the supply chain. Integrating compliance in this way provides a greater level of redundancy to identify and mitigate noncompliance as early as possible.

Effective compliance management is commonly enforced by an independent management structure that requires board oversight and the compliance officer’s daily management.

The board is ultimately responsible for developing and administering the compliance internal control environment and assurance to adhere with laws, minimize associated risks to public safety, and reduce public harm.

Key risk management responsibilities for the board include:

Establishing compliance policies that describes the intent to comply with all applicable laws
Appointing of a designated employee to manage the day to day activities of compliance
Periodic review of compliance reports

The compliance officer is responsible for implementing and managing the day to day risk assessment, control activities, training, information and communication, and assurance to adhere with laws, minimize associated risks with public safety, and reduce public harm. Key risk management responsibilities for the compliance officer include:

Identifying how a commercial cannabis business implements its compliance responsibilities through a risk assessment
Ensuring that responsibilities for legal requirements and internal policies are incorporated into business procedures
Training stakeholders on their responsibilities
Monitoring and testing operations to ensure responsibilities are carried out and legal requirements are met
Communicating the results of the risk assessment, monitoring and testing, and changes in compliance risk to the risk owners for corrective action
Communicating the results of the risk assessment, monitoring and testing, and changes in compliance risk to the board for oversight

Inventory Management

To reduce the risk of diversion and inversion, a commercial cannabis business must develop and maintain sound inventory management. Inventory management must be integrated into the overall framework for product and service design, delivery, and administration. The commercial cannabis business should self-identify issues and initiate corrective actions. The risk officer formalizes the control activities that establishes how a commercial cannabis business assigns its inventory responsibilities, communicates those responsibilities to stakeholders, assures the control activities are performing as intended, monitors for unusual activity, and implements corrective action.

Issue Management

A commercial cannabis business must develop a sound issue management process to increase the likelihood that issues are resolved according to the risk strategy and within the risk tolerance. The risk officer formalizes control activities that establish a risk-based control activity standard, oversees the risk issue until it is mitigated, and periodically reports to the board risk committee. Issue management control activities reduce overall risk by creating a central point of oversight through the risk officer to assure proper risk mitigation.

Ethics and Whistleblower

Given the number and complexity of laws that apply to any commercial cannabis business, noncompliance may occur. As a result, the board should consider implementing ethics and whistleblowing policies and procedures to promote reports of noncompliance. These policies and procedures help to improve the commercial cannabis business’s compliance and minimize the risk of penalties, fines, and damages.

The board has ultimate responsibility for establishing clear ethical standards with which all stakeholders and relevant vendors must comply. The board should review and approve the ethics and whistleblower policy. The policy describes the ethical standard all stakeholders are held to, intent to comply with applicable whistleblower laws, appointment of a designated stakeholder to manage the day to day activities of ethics and whistleblowing, and requirement to investigate and report to the board verified complaints regardless of outcome.

The risk officer formalizes control activities that require training for all stakeholders, allows stakeholder access to the complaint process, triggers an investigation, provides reporting to the board, and implements corrective action. The complaint process should allow a stakeholder to anonymously report concerns of potential misconduct or violations of the commercial cannabis business’s policies, laws, and regulations without fear of retaliation or retribution. The process ensures that all verified complaints are thoroughly addressed in a timely manner with the highest standards of confidentiality, objectivity, and fairness. The commercial cannabis business should appoint a designated individual(s) or an independent vendor to manage the process and provide adjudication and reporting.

Crisis Management

There may be an occasion when a commercial cannabis business faces a crisis, whether internal or external, and the business should be prepared to respond with a crisis management program to ensure public safety and business continuity. A crisis is an emergency or adverse act that poses a threat to a commercial cannabis business’s facility, employees, customers, stakeholders, or the industry as a whole. For example, natural crises such as tornadoes, floods, or wildfires; financial crises such as embezzlement or a significant fraud loss; and reputational crises such as lawsuits, criminal charges, or regulatory enforcements all have the potential to impact a commercial cannabis business.

Crisis management is the process taken by the business to prevent and respond to the threats that may harm public safety, disrupt business operations, damage the business’s reputation, or cause a financial loss. Crisis Management should include effective policies and procedures that detail who the crisis management team is and what everyone’s role is within the business to address applicable crises and ensure longevity of the business.

The Risk Officer is normally responsible for the day to day management of the crisis management program because they are the point of centralized knowledge about the commercial cannabis business and risks. Notwithstanding, crisis management requires the proactive participation and collaboration of all risk owners to prepare for potential events. The Risk Officer include: