In summary, completing a risk assessment with respect to each applicable risk area will provide a consistent analysis of a company’s risk profile.
In order for a risk assessment to be effective, it must be thorough and performed using a consistent and standard process. For commercial cannabis businesses, this process includes:
- Identifying inherent risks
- Developing controls
- Determining residual risks
- Developing a risk program
Adhering to this risk assessment process is important, not only because it provides the basis to implement an informed and effective risk program, but also because it allows a commercial cannabis business to communicate risk mitigation solutions in a way that can be understood across the company and, when implemented consistently, throughout the industry. Moreover, the application of a standardized risk assessment process provides ancillary services valuable insight to understand and evaluate their commercial cannabis business customers’ risk.
The risk assessment process should be treated as an ongoing and critical part of the overall risk program, with updates performed regularly to ensure business continuity. Updates should be performed in anticipation of any major changes or in response to any unanticipated major changes. In the absence of major changes, a review of the risk assessment should be performed at least every eighteen months to account for changes in the environment. While implementing and maintaining a risk program based on a current risk assessment will not completely eliminate risk, it will ensure that a commercial cannabis business is able to operate within an acceptable level of risk appetite.