RegTalk: The Challenge Of Assessing And Mitigating Risk In The Cannabis Industry

The fact that cannabis is illegal under federal law is not the only reason why the industry is high risk. The vertical nature of the cannabis industry means that a business may perform activities in multiple sub-industries such as agriculture, pharmaceutical manufacturing and testing, food manufacturing, distribution, transport, retail, and medical sales. Each of these industries poses unique risks to a business. So how is a cannabis business supposed to understand and assess its risk?

Understanding risk is key to establishing an effective risk and compliance framework that protects the organization and its shareholders. A business must understand where the land mines are hidden, and ensure that they fail to detonate.

This involves assessing the organization’s daily activities and processes to determine the types of events, that if they occurred, would stop business operations, prompt regulators to investigate, cause unfavorable headlines, or make consumers avoid your brand.

Senior leaders in the organization should be familiar with these issues and articulate them to operations or compliance so that mitigating controls or processes can be implemented. This risk assessment process can be documented, and controls can be aligned with the associated risks to ensure completeness.

Rigorous controls should be designed for the highest areas of risk, and the controls should be tested on a periodic basis. By testing the controls, the company can ensure that they are well designed and work as intended.

Risk and control frameworks can help protect an organization from catastrophic consequences of a data breach, product or food recall, internal fraud or other events that happen in every type of an organization. An organization should consider how it will respond if something does happen. Incident response plans can help the firm practice how it will manage the situation rather than reacting to the situation.

In the end, belts and suspenders can create good practices that protect an organization and its shareholders. If something does happen, knowing how the company will respond can help the company navigate the stormy waters to a full recovery.

Susan Ameel is a co-founder and partner at Global Regulatory Risk Advisors.

Related Story: RegTalk: Oregon Adopts Final Hemp Regulations – Has Your CBD Been Tested?