The purpose of a risk assessment is to identify and analyze risks specific to the commercial cannabis business. The entity should take a risk-based approach to issue management of its outstanding risks, with a specific focus on risks that fall outside of the risk appetite.

The risk assessment is a formally written document that assists the risk officer in determining whether the risk program provides the necessary controls to mitigate risk within the risk appetite. In evaluating its risk assessment, a commercial cannabis business should not necessarily take any single indicator as determinative of the existence of an overall risk level. All risks unique to the commercial cannabis business are considered in order to identify gaps management should address.

An effective risk assessment is an ongoing process rather than a one-time exercise. The risk officer should update the risk assessment when any material change may alter the outcome of the risk assessment. These updates include the addition of a new product or service, entry into a new market, changes in laws or regulations, changes within the entity’s specific processes, or in the case of a merger or acquisition. Even in the absence of such changes, it is sound practice to periodically reassess risks at least every twelve to eighteen months.

The results of the risk assessment are shared with the board to keep their risk knowledge current. The board approves the risk assessment results at least every eighteen months or when a material change is made. Once approved, the risk assessment is shared with all appropriate stakeholders to guide their risk-based decisions.