Creating a cannabis compliance program is only the first step in ensuring that your business is compliant—the program must also be systematically implemented. Existing compliance content does a nice job of explaining the “what” by outlining what cannabis regulations “say”, but it often fails to explain the “how.” How does a business go about implementing a compliance program?
The worst thing a company can do is to distribute copies of its compliance program to employees and hope that they figure it out from there. Individual or individuals must be empowered by company leadership to implement and enforce the program. Before a compliance program is implemented, a business must decide who will be responsible for implementing and overseeing the program. Ideally, the individual or individuals chosen will have played a role in creating the program.
Regardless of who is chosen, the individual or individuals must be empowered by company leadership to not only implement the program, but to also assess and modify the program where necessary. Anyone involved in overseeing the compliance program must also ensure it is presented and maintained in an organized fashion.
Understanding the Role of Technology Providers
There are a number of technology solutions that offer compliance services that should be utilized to bolster existing compliance programs. Technology solutions are not a substitute for creating and implementing a compliance program, however. Automation and other technology solutions are undoubtedly the future when it comes to cannabis compliance. Just think about Microsoft Word/Excel and the difference in productivity when you started picking up on all the bells and whistles both programs offer. While compliance technology solutions provide helpful workflows and templates, operators should not solely rely on technology providers to develop or implement their compliance program. Business owners must independently ensure that their compliance program is tailored to their jurisdiction’s regulations and the business’ specific set of circumstances.
Three Step Process
Implementation can be broken down into a three-step process:
- Train
All employees must be trained on all policies and procedures in the binder upon getting hired, and at regular intervals (weekly, monthly, quarterly, etc.). Only training employees when they are first hired is a recipe for disaster. With how heavily regulated the industry is, it is unrealistic to expect an employee to retain all of the policies and procedures relevant to the business in a single training. Provide employees with compliance training as frequently as necessary and gradually decrease the amount of training sessions as employees become more comfortable with their role. - Monitor
It is impossible to create a compliance program that anticipates every issue that may confront a cannabis business. Grey areas will inevitably arise while operating, particularly when interpreting the cannabis regulations that govern a licensee’s business. A cannabis business must monitor its program, including its employee’s overall understanding of it, by maintaining an open dialogue with employees and seeking out feedback on challenges that are coming up in operations. Daily, weekly, bi-weekly, or monthly compliance calls should be considered. The frequency of the calls should be directly related to the “age” of the business—the “younger” the business, the more frequent the calls ought to be. A confidential reporting mechanism for employees to report compliance concerns should also be established. A business must also monitor changes in the law. Keeping up with regulatory updates can be challenging, particularly if you practice in multiple jurisdictions. Here are some tips to make sure you’re up to date: 1) Subscribe to the newsletter of any federal, state, or local agency that regulates your business. Regulatory bodies regularly send out help notices about proposed regulations and other important updates that may impact operations. 2) Join cannabis-related groups on Facebook, Linkedin, and Clubhouse. Members of these groups not only share helpful regulatory updates that you may have missed, but operators in these groups often share operational insight that may be helpful to a cannabis client as an added bonus.
- Reassess & Modify
Compliance programs are not static and should be reviewed/updated on a weekly, monthly, or quarterly basis. Have any regulatory changes occurred that impact a business? Has there been any internal changes to the business that need to be documented and possibly reported to a licensing agency? These questions need to be considered at a regular cadence to avoid slip ups.
Compliance binders (discussed further in Chapter 3) should be reviewed and updated on a monthly basis, or at the very least, on a quarterly basis. When reviewing the binder, a business should consider whether any changes have been made to relevant regulations or to business. For example, if a new employee has come on board since the last review, their information will in all likelihood need to be added to the binder and maintained (and possibly reported to state and local licensing agencies). Be sure to also consider whether any SOP has changed, and be sure to document the operational change (and potentially disclose it) accordingly.