Compliance risk is “exposure to legal penalties, financial forfeiture and material loss an organization faces when it fails to act in accordance with industry laws and regulations, internal policies or prescribed best practices.” (Rouse, 2014)

Certain products and services, business processes, or jurisdictions trigger the application of regulations that may drive compliance risk. The application of regulations can increase the complexity of the internal control environment for products and services and business processes. Commercial cannabis businesses may deal with cross-jurisdictional transportation, multiple regulatory agencies, and contradicting regulations.

In the commercial cannabis industry, compliance policies and procedures are required in the licensing process but only provide a liability framework. A risk-based compliance program is necessary to maintain compliance effectively as the business grows. The program is managed by a compliance officer responsible for managing non-compliant events, identifying compliance risks, training stakeholders, monitoring operations, and reporting to the board. Risk management integration provides a balanced approach to managing all business risks, and compliance management is an efficient way to maintain compliance.

Products and Services

The application of regulations can make products or services more complex to offer. Such products and services may be more susceptible to changing regulations, additional requirements, or complex implementations.

Business Processes

The application of regulations can make a business process more complex to implement. Regulatory impact on a business process can increase the degree of complexity throughout the lifecycle of the business process and present additional negative outcomes for non-compliance.

Jurisdiction

Jurisdiction refers to the geographic area in which a political authority is recognized. Identifying jurisdictions that may impact compliance risk is essential. Commercial cannabis businesses should evaluate the specific compliance risks associated with doing business in or facilitating transactions through jurisdictions because this can increase the number of regulations and the frequency of regulatory changes that apply to products and services and business processes. 

USEFUL RESOURCES