A risk assessment is the foundation of a well-designed risk program. The risk assessment process enables management to better identify and mitigate gaps in a commercial cannabis business’s control activities. It is sound practice that the risk assessment is formally written and in accordance with a methodology that is easily understood by all relevant parties.

The risk assessment is a three-step process that measures three indicators, enabling management to analyze risk that may affect business objectives. Each commercial cannabis business will have its own specific methodologies for conducting a risk assessment; all methodologies should measure the following indicators:

1. Inherent risk: The risks specific to a commercial cannabis business before controls are implemented
2. Quality of controls: The effectiveness of controls to mitigate risk
3. Residual risk: The risk remaining after the control activities have been applied to an inherent risk

Process Description

This section explores each of the steps in the risk assessment process in more detail.

Step 1: Measure Inherent Risk

The first step of the risk assessment process is to measure risks specific to a commercial cannabis business. While risk may emanate from many different areas, certain areas may be more vulnerable or have been historically more susceptible to these risks. Risks vary by specific characteristics such as the number and volume of transactions, geographic locations, and nature of the relationship between parties. Risks also vary from one commercial cannabis business to another due to the variance in these and other characteristics.

  Management’s role: In reviewing a commercial cannabis business’s risk assessment, the risk steering committee assists the risk officer in adequately identifying the material risks to a commercial cannabis business, absent controls.

Step 2: Measure Quality of Controls

The second step of the risk assessment process requires a detailed analysis of the control activities, as applied to the inherent risks identified in Step 1. Measuring the quality of controls requires evaluating the effectiveness and continuity of control activities in relation to the risk area over time.

  Management’s role: This step in the risk assessment process gives the risk officer a better understanding of a commercial cannabis business’s control profile in order to identify gaps in policies and procedures that mitigate the inherent risk. The analysis of the data pertaining to control activities should consider, as appropriate, the risk tolerance or risk appetite.

Step 3: Measure Residual Risk

The third step of the risk assessment process is to measure the residual risk. The measurement of residual risk involves evaluating the impact and likelihood that risks still occur. The level and sophistication of analysis may vary by commercial cannabis business based on risk. The detailed analysis is required to determine the risk to which a commercial cannabis business remains exposed and whether further mitigation is necessary to bring the risk in line with the risk tolerance or risk appetite.

  Management’s role: This step in the risk assessment process gives management a better understanding of a residual risk by risk area as it currently exists. This understanding helps prioritize management of the remaining risk.

Risk Profile

At the end of the risk assessment process, the risk profile is set forth based on the aggregate residual risks combined with the direction of risk. The risk profile is the summary document of the conclusions from the risk assessment, including the analysis of the inherent, quality of controls, and the residual risk of each risk area. In addition, key elements of a risk profile will include the identification and description of key risk areas and the impact and likelihood of occurrence of risks. Management’s understanding of risk exposures informs their decisions within the risk strategy and risk tolerance. The risk profile is updated in conjunction with the risk assessment. The risk profile is also a useful tool for standardizing the communication of risk internally and externally. 

A commercial cannabis business should have a common approach to developing a risk profile throughout the business. For example, different business units may have their own unique risk profiles, but these should be assembled across business units to create one overall company risk profile that can be addressed as a whole. 

Risk Direction

The direction of risk refers to whether a particular risk, risk area, or aggregate inherent risk will be increasing, stable, or decreasing over the next 12-24 months. The direction of risk should take into account several factors, including the likelihood and potential impact of the internal or external environment that could affect the risk, the current state of controls in place to manage the risk, and the organization’s risk appetite and tolerance levels.

Summary of Risk Assessment Process and Risk Profile

A risk assessment process must be thorough and performed using a consistent and standard process. The risk assessment process measures:

1. Inherent risks
2. Quality of controls
3. Residual risk

Adhering to the risk assessment process is important because it provides the basis to implement an informed and effective risk program. Implementing and maintaining a risk program based on a risk assessment does not eliminate risk; it ensures a commercial cannabis business is able to operate within the risk appetite.

A risk profile allows you to communicate risks in a way that is understood across the commercial cannabis business and by other stakeholders.

The risk assessment analyzes data and information, in contrast, the risk profile summarizes the conclusions from the risk assessment.