Seven Best Practices For Effective Cannabis Compliance Programs

As most of us know, regulations differ between states and municipalities, and licensed cannabis businesses are also required to meet various federal regulations. This includes, but is not limited to Health Information Portability and Accountability Act (HIPAA), Federal Communications Commission (FCC), and Occupational Health and Safety Administration (OSHA) requirements. Most cannabis businesses have focused on state and local regulations because we’ve seen the most attention from those regulatory agencies up until this point.

However, as the industry grows and is further legitimized, other regulatory agencies are starting to pay more attention, making it important for business owners to focus on various other layers of compliance.

Because of the sheer number of regulations we’re required to follow and the fact that they are constantly changing, businesses can find it extremely difficult to manage compliance while maintaining resilience in the face of various challenges. Some of the hurdles we commonly face in the cannabis industry include, but are not limited to:

  • High employee turnover

  • Accessing capital

  • Constantly-changing regulations

Putting the right operational or workflow systems in place to develop effective compliance programs will help your business stay strong in the face of these challenges and others while helping you meet or exceed compliance requirements.

When designing and implementing a compliance program, there are several best practices to follow in any state or municipality—regardless of the specific requirements in place—that will help to build resilience and run a business with adherence to compliance at the forefront.

Understand the Spirit of the Law


At the end of the day, most regulatory agencies have the same main priority: public safety. If you view the types of requirements we must meet through this lens, the priority of public safety starts to become clear. For example, most facility security requirements are in place to prevent diversion of product. This includes outside theft, as well as diversion by employees and consumers.

Preventing or mitigating the risk of theft helps reduce crime locally and also helps keep consumers and industry workers safe. Likewise, state-mandated seed-to-sale tracking systems and inventory management requirements are also in place to detect and prevent the diversion of product by both employees and non-employees. In addition, advertising and many labeling and packaging requirements are meant to prevent children from accessing or being exposed to cannabis. Again, each of the aforementioned regulatory areas are meant to directly address and protect public safety.

Now let’s pick one of these examples apart a bit more to further understand what we mean about “Understanding the Spirit of the Law”:

  • Washington and Oregon licensees are prohibited from advertising cannabis in a manner that is appealing to minors.

  • In addition, both states require a warning statement on product labels instructing consumers to keep it away from minors.

Regulatory agencies in both states have made it abundantly clear that the safety of children is a top priority for them by requiring not just one, but a number of different regulations that meet the same end.

Understanding the spirit of the law and the reasons behind specific regulations helps us see that this is an area that deserves extra attention. Once you comprehend that, the boundaries of what may and may not be done in your facility become clear—which will help you meet or exceed various compliance requirements and avoid costly penalties.

Create Redundancy


Most of us are aware that when it comes to finances, it’s never a good idea to give any one person too much control, as that opens the door to fraud and potentially very expensive mistakes. The same concept applies to compliance programs.

First, allowing a single individual to manage the inventory without oversight is extremely risky. Many would-be thieves haven’t spent time figuring out a way to steal, but may take advantage of an opportunity when it is presented. In addition, most theft in the cannabis industry is perpetrated internally. Businesses should never rely on a single employee to manage inventory, no matter how trusted that person is. Doing so not only increases the chances that you will lose valuable inventory to theft, mismanagement of the inventory could result in serious repercussions from state or local authorities. If regulatory agencies can demonstrate that a business is not responsibly managing its inventory by building checks and balances into its procedures, that business could face penalties or potentially be denied future licenses.

Similar to having a store manager verify the cash drawer count from each budtender at the end of a shift, rotate between staff members so that multiple individuals count and manage inventory. If that is not possible, at the very least a manager should perform random inventory spot-checks to ensure that the numbers being reported are correct. Doing so not only mitigates the risk of product diversion, but it also may uncover mistakes that could be exacerbated and made even more costly over time.

In addition, compliance itself can be tricky and sometimes the regulations aren’t crystal clear. Instead of attempting to read the regulations and implement procedures based on your sole understanding of them, have more than one person review the requirements so they can be discussed among team members to ensure full comprehension. If the regulations still aren’t clear, pull in a compliance expert to help you understand what is required and how to effectively meet those requirements.

Perform Regular Audits


Do not wait for a regulatory agency to perform an inspection to learn what you’re doing wrong—because by then it may be too late and you may face steep penalties. Businesses should perform regularly scheduled audits to ensure that all issues are resolved before an infraction or violation occurs. This includes facility audits and, in some states, documentation audits as well.

Businesses should also build redundancy into their compliance audit program. If only one person is running through the same audit checklist over and over again, chances are that that individual will miss important details because he or she is too familiar with the process. In addition, if employees performing the audit are not well-trained, they may misunderstand the requirement and how to meet it.

Therefore, it is important to bring in a fresh set of eyes periodically, preferably from a third party, to double-check the work that has been completed by employees. Third party audits are also a great way to ensure that new and updated regulations are being met. We recommend that businesses self-audit approximately once a month and bring in a third party to complete the process quarterly to ensure that nothing is missed.

Maintain Organized And Compliant Documentation


Every state and many local municipalities require licensed businesses to maintain specific types of documentation. Not doing so may result in costly penalties. However, it’s not enough to merely ensure that each item is present; each item must contain the information required by the regulations and be current, and everything must be well-organized.

Similar to inventory management and audits, you want to build redundancy into a compliance documentation plan. Not only should documents be secure and backed up with duplicates, more than one employee must know how and where to access each item, if needed. It’s not uncommon to find situations where all business documents are managed by a store or general manager, and when that individual leaves the company, owners and remaining staff members have to scramble to figure out where everything is. At the very least, ensure that at least two employees are trained on how everything is organized. We love digital document management for many reasons but, primarily, having everything organized in digital form makes documents easy to organize and manage, while ensuring that key individuals have access.

Having everything well-organized is also extremely important for several other reasons. First, when employees spend excess time looking for specific items, valuable time and money are wasted. Although it may be cumbersome to organize everything on the front end, it will save loads of time in the long run. In addition, if a regulatory agency asks to see a specific item, you want to demonstrate to them that you are running your business in an organized fashion. Not only does the inability to locate specific items look bad, in some cases it could result in costly penalties.

In addition, maintaining transparency with regard to documentation is a key means of demonstrating a track record of compliant business operations. If you are seeking investment capital or attempting to sell the business, the valuation of your business will substantially increase when those with deep pockets are able to examine the inner workings of the company by reviewing well-managed documentation.


Educate Yourself and Stay Current

As wonderful as compliance consultants and lawyers are, they are expensive. Don’t put your business in a position where it is completely dependent on the assistance of third parties to manage compliance. Good consultants and lawyers have an interest in keeping a business out of trouble and will help to manage compliance well so that the business succeeds and you can continue working together over time. The best consultants and lawyers will not only make recommendations on where a business can improve on compliance, they will show how to make those improvements and provide effective training on how to manage some aspects of compliance.

For example, with each of our services, Trax Team Solutions provides extensive training for businesses so they can perform various compliance tasks internally, reducing the need to bring us in more frequently. In addition, we offer live, on-demand, and customized webinars for businesses that want to ensure that key employees are trained at an affordable rate. In all cases, we provide a suite of workflow tools that can be used to ensure that compliance is accounted for within each internal procedure. We’re passionate about empowering businesses when it comes to compliance. We believe that one of the best ways to promote industry growth is to help business run their operations responsibly and compliantly. If we do so together, other states and local governments will be more open to allowing licensed cannabis businesses to operate in their jurisdictions, thus moving the industry forward.

Of course, regulations change often and keeping up with everything is difficult. It is important that the management team stays current by signing up for regulatory email updates and regularly reviewing agency websites. Once again, redundancy is important in this area. All owners, compliance directors, managers, and key employees should keep up on the regulations for each layer of compliance to ensure nothing is forgotten.

Adequately Train Staff and Follow Up

It’s incredibly important to train all employees the same way and empower them with the same information to avoid diluting the message that is being communicated to them. The last thing a business owner wants is for employees to play the “telephone game” when it comes to compliance—as individuals tend to put their own spin on things, whether on purpose or not.

Also, be sure to follow up periodically to ensure standard procedures are well-understood and are being followed. This can be accomplished by performing random audits in specific areas, bringing in secret shoppers, or employing pop quizzes. Using more than one of these methods will help ensure that nothing is being missed.


Use Technology Wisely

Cannabis software has come a long way over the years. By all means, use it to your benefit, but never forget that technology can fail. Design backup processes for Internet and server outages, among other failures. In other words, have a plan of action that can be implemented if you’re not able to effectively rely on the chosen software. That plan should be well-documented and all employees must be adequately trained on what to do should that occur. For example, if your point-of-sale system goes down, you will likely want to stay open so the business doesn’t lose revenue. Employees who are required to work under such adverse conditions tend to be stressed and may get frustrated or make costly financial and compliance mistakes if they aren’t properly trained on how to deal with that situation ahead of time.

Most cannabis software can now communicate with other key pieces of software via an application programming interface (API). For example, all major point-of-sale software options use an API to communicate daily sales to state seed-to-sale tracking systems. This saves businesses a significant amount of money because they no longer need to pay an employee to upload that information manually.

However, at times, the API doesn’t work correctly and sales aren’t accurately reported. At least one individual should perform periodic audits to ensure that the system is working the way it should. At the end of the day, the state doesn’t care whether or not your software is working properly; their main concern is that information is reported as required.

As you can see, implementing the right procedures and systems by keeping these best practices in mind when developing a compliance program will not only help you excel in regard to compliance, it will help the business achieve resiliency—which is of the utmost importance in our industry considering the many challenges we face.

Author Bio: Amber Bacca is the CVO/Founder of Trax Team Solutions, which provides Innovative Compliance and Workflow Solutions to the cannabis industry. Amber has been involved in the industry for over 8 years and has held a variety of positions, allowing her to create valuable services and products for licensed cannabis businesses. She is also currently the lead dispensary & compliance consultant for NoBo Partners and the lead facilitator for cannabis trainers.