As most of us know, regulations differ between states and municipalities.  However, licensed cannabis businesses are also required to meet various federal regulations. This includes, but is not limited to HIPAA, FCC, and OSHA requirements. Most cannabis businesses have been focusing on state and local regulations because we’ve seen the most attention from those regulatory agencies up until this point.  However, as the industry grows and is further legitimized, other regulatory agencies are starting to pay more attention, making it important for business owners to begin minding various other layers of compliance.

Because of the sheer number of regulations we’re required to follow and the fact that they are constantly changing, it can be extremely difficult for businesses to manage compliance whilst maintaining resilience in the face of various challenges. Some of the hurdles we commonly face in the cannabis industry include, but are not limited to:

• High Employee Turnover

• Accessing Capital

• Constantly Changing Regulations

Putting the right operational or workflow systems in place to develop effective Compliance Programs will help your business stay strong in the face of these challenges and others while helping you meet or exceed compliance requirements.

When designing and implementing your Compliance Program, there are several best practices you can follow in any state or municipality, regardless of the specific requirements that are in place, that will help you build resilience and run your business with adherence to compliance at the forefront.

|

Understand the Spirit of the Law

At the end of the day, most regulatory agencies have the same main priority; which is public safety. If you think about the types of requirements we are required to meet through this lens, this starts to become clear. For example, most of our facility security requirements are in place to prevent the diversion of product. This includes outside theft as well as diversion by employees and consumers. Preventing or mitigating the risk of theft helps reduce crime locally and also helps keep consumers and industry workers safe. Likewise, state mandated seed-to-sale tracking systems and inventory management requirements are also in place to detect and prevent the diversion of product from both employees and non-employees. In addition, our advertising and many of our labeling and packaging requirements are meant to prevent children from accessing or being exposed to cannabis. Again, each of the aforementioned regulatory areas are meant to directly address and protect public safety.

Now let’s pick one of these examples apart a bit more to further understand what we mean about ‘Understanding the Spirit of the Law:’

• Colorado licensees are prohibited from using any advertising, packaging, or labels that may appeal to minors.

• In addition, we’re not allowed to use the word “candy” on any of our packaging, labeling, or on the product itself, as the state believes children have a strong attraction to and interest in candy.

• Businesses are also prohibited from selling edibles that are in the shape of humans, animals, or fruit because such products may be appealing to children.

The Marijuana Enforcement Division has made it abundantly clear that the safety of children is a top priority for their agency by requiring not just one, but a number of different regulations that meet the same end, including specifics about prohibiting particular words and shapes, and have indicated that a failure to meet any of the aforementioned regulations will constitute a Violation of Public Safety, which is the most serious type and will result in the most severe penalties.

As you can see, Understanding the Spirit of the Law and the reasons behind specific regulations helps us understand that this is an area that deserves extra attention. Once you understand that, the boundaries of what you can and cannot do in your facility become clear, which will help you meet or exceed various compliance requirements and avoid costly penalties.

Create Redundancy

Most of us are aware that when it comes to finances, it’s never a good idea to give any one person too much control, as that opens up the door to fraud and potentially very expensive mistakes. The same concept applies to our Compliance Programs.

First, allowing one single individual to manage your inventory without oversight is extremely risky. Many would-be thieves haven’t spent time figuring out a way to steal, but may take advantage of an opportunity they are presented with. In addition, most theft in the cannabis industry is perpetrated internally. Businesses should never rely on a single employee to manage inventory, no matter how trusted they are. Doing so not only increases the chances that you will lose valuable inventory to theft, mismanagement of your inventory could result in serious repercussions from state or local authorities. If regulatory agencies can demonstrate that your business is not responsibly managing its inventory by building checks and balances into your procedures, you could face penalties or potentially be denied future licenses. 

Similar to having a store manager verify cash drawer counts from each budtender at the end of their shift, it is recommended that you rotate between staff members so that multiple individuals are counting and managing inventory. If that is not possible, at the very least, a manager should perform random inventory spot-checks to ensure that the numbers being reported are correct. Doing so not only mitigates the risk of product diversion, you can also uncover mistakes that could be exacerbated and made even more costly over time.

In addition, compliance itself can be tricky and sometimes the regulations aren’t crystal clear. Instead of attempting to read the regulations and implement procedures based on your sole understanding of them, it is recommended that you have more than one person review the requirements so they can be discussed between team members to ensure full comprehension. If the regulations still aren’t clear, you’ll want to pull in a compliance expert to help you understand what is required and how to effectively meet those requirements.

Perform Regular Audits

It is not advisable to wait for a regulatory agency to perform an inspection to tell you what you’re doing wrong, as by then it might be too late and you may be facing steep penalties. Businesses should perform regularly scheduled audits to ensure all issues are fixed before an infraction or violation occurs. This includes facility audits and in some states, documentation audits as well. Colorado regulations in particular are heavy on documentation requirements so businesses in that state should treat that process separately. For example, the Trax Team Solutions Compliance Documents Audit Checklists for Colorado range from 60 to over 80 items, depending on the license type. Without performing a systematic check of each required item, it’s extremely easy to overlook specific requirements.

Businesses should also build redundancy into their Compliance Audit Program. If you only have one person running through the same audit checklist over and over again, chances are that individual will miss important details because they’re too familiar with the process. In addition, if the employee performing the audit is not well-trained, they may misunderstand the requirement and how to meet it. Therefore, it is important to bring in a fresh set of eyes, preferably from a third party, periodically to double check the work that has been completed by employees. Third party audits are also a great way of ensuring that new and updated regulations are being met. We recommend that businesses self-audit approximately once per month and bring in a third party to complete the process quarterly to ensure nothing is missed.

Maintain Organized and Compliant Documentation

Every state and many local municipalities require licensed businesses to maintain specific types of documentation. Not doing so may result in costly penalties. However, it’s not enough to merely ensure that each item is present, you must make sure that each item contains the information required by the regulations, that each item is current, and that everything is well-organized.

Similar to inventory management and audits, you want to build redundancy into your Compliance Documentation Plan.  Not only do you want to ensure that documents are secure and backed up with duplicates, you must also ensure that more than one employee knows how and where to access each item if needed. It’s not uncommon to find situations where all business documents are managed by a Store or General Manager, but when that individual leaves the company, owners and remaining staff members are scrambling to figure out where everything is. At the very least, you want to ensure that at least two employees are trained on how everything is organized. We love digital document management for many reasons, but primarily, having everything organized in digital form makes documents easy to organize and manage, while ensuring that key individuals have access.

Having everything well-organized is also extremely important for several other reasons. First, when employees spend excess time looking for specific items, valuable time and money are wasted. Although it may be cumbersome to organize everything on the front end, it will save you loads of time when it counts. In addition, if a regulatory agency asks to see a specific item, you want to demonstrate to them that you are running your business in an organized fashion. Not only does it look bad when you’re unable to locate specific items, in some cases, it could result in costly penalties.

In addition, maintaining transparency with regard to your documentation is a key means of demonstrating a track record of compliant business operations. If you are seeking investment capital or attempting to sell the business, the valuation of your business will substantially increase when those with deep pockets are able to examine the inner workings of the company by reviewing well-managed documentation.

Educate Yourself and Stay Current

As wonderful as your compliance consultants and lawyers are, they are expensive. You don’t want to put your business in a position where it is completely dependent upon the assistance of third parties to manage compliance. Good consultants and lawyers have an interest in keeping your business out of trouble and will help you manage your compliance well so that your business will succeed and you can continue working together over time. The best consultants and lawyers will not only tell you where your business can improve on compliance, they will show you how to make those improvements and will also effectively train you on how to manage some aspects of compliance yourself. For example, with each of our services, Trax Team Solutions provides extensive training for businesses so they can perform various compliance tasks internally, reducing the need to bring us in more frequently. In addition, we offer live, On Demand, and customized webinars for businesses that want to ensure key employees are trained at an affordable rate. In all cases, we provide a suite of workflow tools that can be utilized to ensure that compliance is accounted for within each internal procedure. We’re passionate about empowering businesses when it comes to compliance. We believe that one of the best ways to promote industry growth is to help business run their operations responsibly and compliantly. If we do so together, other states and local governments will be more open to allowing licensed cannabis businesses to operate in their jurisdictions, thus moving the industry forward.

Of course, regulations change often and it’s difficult to keep up with everything. It is important that the management team stays current by signing up for regulatory email updates and regularly reviewing agency websites. Once again, redundancy is important in this area. All owners, compliance directors, managers, and key employees should keep up on the regulations for each layer of compliance to ensure nothing is forgotten.

Adequately Train Staff and Follow-up

It’s incredibly important that all employees are trained the exact same way and empowered with the same information to avoid diluting the message that is being communicated to them. The last thing you want is for employees to play the “telephone game” when it comes to compliance, as individuals tend to put their own spin on things, whether on purpose or not.

You also want to be sure to follow-up periodically to ensure standard procedures well-understood and are being followed. This can be accomplished by performing random audits in specific areas, bringing in secret shoppers, or employing pop quizzes. It might make sense to utilize more than one of these methods to ensure nothing is being missed.

Use Technology Wisely

Cannabis software has come a long way over the years. By all means, use it to your benefit, but never forget that technology can fail. You want to design back-up processes for internet and server outages, among other failures. In other words, you want to have a plan of action that can be implemented if you’re not able to effectively rely on your chosen software. That plan should be well-documented and all employees must be adequately trained on what to do should that occur. For example, if your point of sale goes down, you will likely want to stay open so the business doesn’t lose revenue. Employees who are required to work under such adverse conditions tend to be stressed and may get frustrated or make costly financial and compliance mistakes if they aren’t properly trained on how to deal with that situation ahead of time.

Most cannabis software is now able to communicate with other key pieces of software via an API. For example, all major point of sale software options utilize an API, or Application Programming Interface, to communicate daily sales to state seed-to-sale tracking systems such as Metrc. This saves businesses a significant amount of money since they no longer need to pay an employee to upload that information manually. However, at times, the API doesn’t work correctly and sales aren’t accurately reported. At least one individual should perform periodic audits to ensure that the system is working the way it should. At the end of the day, the state doesn’t care whether or not your software is working properly; their main concern is that information is reported as required.

As you can see, implementing the right procedures and systems by keeping these Best Practices in mind when developing your Compliance Program will not only help you excel when it comes to compliance, it will help your business achieve resiliency, which is of the utmost importance in our industry considering the many challenges we face.