How to Create a Cannabis Compliance Program

In the Introduction to Cannabis Compliance guidance document, we discussed the need to redefine “compliance” in the cannabis industry. The industry needs to consider law that may apply to businesses that is not discussed or is otherwise absent from state and local cannabis regulations. After establishing a baseline understanding of the “universe” of law the industry must comply with, the question often becomes:

Where should a cannabis start in building a compliance program?

Risk Assessments 

Cannabis companies should start with a risk assessment. Risk assessments are a compliance staple in many other industries and represent the first step towards creating a compliance program in the cannabis industry. A business must first establish the risk it faces to know what to address in its compliance program.

A risk assessment is not a mechanical exercise wherein a cannabis business simply lists out all the risks it may face, however. All risk is not created equal. Risk assessments should zero in on the most serious risks and their likelihood of occurring and associated punishment or other exposure. To get the ball rolling, the following five questions should be considered:

1. Who will be responsible for implementing and monitoring the compliance program?
2. Which cannabis license(s) will the business hold and what is the associated regulatory landscape?
3. Is it a private or public company?
4. How many employees?
5. Does the intended location present any unique safety and/or security issues?

After a business considers risk from a high level, it should consult state and local cannabis regulations. While regulations typically have sections devoted to individual license types, entrepreneurs should read through regulations in their entirety since there are often sections that apply to all licensees. Businesses also should search far and wide for any disciplinary guidelines published by state or local regulators. Disciplinary guidelines are typically either included within a jurisdiction’s regulations or published as a stand-alone document. 

Compliance inspection checklists should also be requested at the state and local level in an effort to prioritize compliance concerns. State and local inspectors will often be provided with a checklist that outlines what an inspector should be on the lookout for when inspecting a licensee’s operations. While they are not always available, inspection checklists can be invaluable in assessing risk.

Risk assessments are skipped all too often by companies attempting to craft cannabis compliance programs. Do not be one of them. Think of risk assessments in the same way a writer thinks about organizing and outlining key points and issues before they start writing a book or article. And most of us (Author included) have personally experienced the positive impact that this approach can have: think about the difference in work product when comparing a research paper written the night before it was due vs. a paper that was thought through before pen was put to paper. Similarly, taking time to assess risk before putting a compliance together will result in businesses receiving a better “grade” from state and local compliance inspectors in the long term.

Compliance Binders

A compliance binder is an organized compilation of documents that are critical to ensuring a cannabis business’s strict compliance with all relevant law. It should be maintained in both digital and hard copy form. While printing the documents out may seem overboard, the ability to simply hand a compliance inspector a binder with all the documents they are looking makes for a much smoother experience for both your business and the inspector.

Which documents should be included within a compliance binder? Compliance binders should contain all documents that an inspector may ask to review. To determine which documents qualify, consider taking the following three steps:

1. Research your jurisdiction’s disciplinary guidelines. Disciplinary guidelines typically describe regulatory violations and associated punishments. The list of violations and punishments may shed light on your jurisdiction’s enforcement priories, as well as documents that you’ve overlooked.
2. Request a copy of the inspection sheets used by state and local inspectors. While some jurisdictions are resistant, many are willing to provide the checklist used in site inspections. Much like researching the disciplinary guidelines, an inspection checklist will provide insight into what your binder should emphasize.
3. Consult your jurisdiction’s record keeping requirements. These requirements should describe which documents should be maintained by a licensee, and for how long. Records related to taxes, inventory, transport, sales, security, employees, etc. should typically be maintained. Make sure to research both state and local requirements to make sure that you aren’t overlooking any local wrinkles.

Inspections

Compliance inspections may be minimal with everything going on with COVID-19, but rest assured that cannabis inspections will ramp up once restrictions are lifted. Let’s talk about how to prepare for inspections:

1. Review your compliance binder and update it, if necessary. Make sure any COVID-19 SOP changes are included, and double check whether said changes need to be disclosed to regulators. Double check your jurisdiction’s disciplinary guidelines to make sure all your bases are covered.
2. Perform mock inspections. Put yourself in an inspector’s shoes and conduct a mock inspection, including a walk through of the licensed premises. Inspectors commonly utilize checklists when performing inspections. Reach out to the entity that issued your license and ask if you can get your hands on one.
3. Be prepared. Make sure all documentation required by your jurisdiction is organized and easily accessible to your client so that it isn’t a mad scramble when an inspector shows up