The fifth component of the CRMF is to implement training that ensures stakeholders are aware of their risks and responsibilities.

The board should promote a culture supporting ongoing training and development for all stakeholders. The risk officer assures training content is accurate, training is tailored to the job function, trainee proficiency is evaluated, and records are maintained.

Implementing the Risk Program

Formalized risk-based training reduces the risks of stakeholder noncompliance. The risk program integrates risk-based training across the commercial cannabis business by requiring managers to provide training prior to a stakeholder performing a function. The risk officer should establish the frequency, timing, standard of content, and record-keeping expectations. The frequency of training is proportionate to the residual risk level identified in the risk assessment. The timing of training should consider both initial and ongoing needs of the stakeholder to perform his or her function. At a minimum, the training content identifies the internal policies and procedures, underlying requirements for compliance, penalties for noncompliance, and a responsible employee to contact for questions. Training is tailored to the intended stakeholder, so the stakeholder’s authority and responsibilities are clearly identified. Training records are maintained to provide evidence of stakeholder participation and assessment of knowledge. Effective training is essential as it provides a robust structure to prepare stakeholders to perform their functions.

The risk officer is responsible for the outcome of training, but in many cases delegates the implementation and oversight to another employee (referred to as the training officer). The risk officer should regularly apprise the board of the efficacy of training, and reporting should include the status of any incomplete or overdue training.

Maturing the Risk Program

Training is modified as the risk officer and risk steering committee gain a deeper understanding of the significant risks and outcomes of the assurance reports. Referred to as risk based training, the risk officer and risk steering committee create a needs analysis to prioritize training. A needs analysis uses the risk assessments and assurance reports to determine the most material risks and root causes of failures by stakeholder role. By using a needs analysis to modify training, stakeholders are more likely to be informed of the material risks and responsibilities that allow them to accomplish their job function within the risk tolerance.