Commercial cannabis businesses interact with third parties, customers, and employees. The risk of each commercial cannabis business to this illicit cannabis market risk driver is unique.
Risks within this driver are primarily attributed to the nature of relationships the commercial cannabis business may have with third parties or customers whose activity is disguised to hide an illicit scheme, and employees who are complicit, forced, or coerced to confuse the inventory management audit trail or provide access to the cannabis product.
When applying a risk-based control environment, it is essential that the control activities reduce the identified inherent risk.
Inherent risk
In general, illicit cannabis market risks related to the third parties, customers, and employees risk driver are realized through illicit suppliers and customers and complicit, forced, or coerced employees.
Control activity
These inherent risks are best controlled through establishing effective vendor management, inventory management, and ethics and whistleblowing control activities.
The following sections examine the risk factors, red flags, and risk mitigation for these issues.