Look Before You Leap
Aligning Compliance with Growth Strategy in Cannabis
The cannabis industry is at a unique historical crossroads. The veritable floodgates are open, and over the last several years cannabis enterprises and investors have been pouring money into aggressive expansion and consolidation strategies. Yet as an emerging industry with a fraught and tenuous legal status (at least in the U.S.), cannabis operators and investors often find themselves “building the plane in flight,” developing operational and financial policies while their company grows and evolves on a daily basis.
In this fast-paced environment, aggressive growth plans can easily outpace more “burdensome” internal initiatives, like establishing proper financial and compliance controls and corporate governance policies. In the race for market share, these internal activities appear to do little for supporting bottom line growth. In the worst circumstances, they can be treated as onerous hurdles to be overcome.
But in the highly-regulated cannabis industry, there is simply no room for fudging over the details. A spate of scandals related to corporate malfeasance has already rocked the industry, and the clear and present dangers of failing to comply with regulations are being demonstrated with the on-going fallout from the CannTrust Holdings, Inc. fiasco.
What We’ve Learned about the Importance of Regulatory ComplianceThe lesson provided by CannTrust’s missteps is simple: the drive to expand a cannabis business cannot outweigh the responsibility of adhering to regulatory compliance demands. CannTrust’s troubles began when regulators observed grow rooms operating without licenses. The rooms were built to regulatory standards and the licenses were approved at a later date, but the rooms were operational for at least six months prior to being licensed.
To a casual observer, this may appear as nit-picking on the side of the regulators. But the seeming simplicity of the transgression only underlines the importance. Even small missteps can have cataclysmic outcomes for a business.
Just as cannabis businesses are “building the plane in flight,” cannabis regulators are caught in a similar dilemma. Industry regulations are also their infancy and there have been delays and other issues with licensing in nearly every legal cannabis market. While licensing delays are frustrating to a company ready to expand, they are no excuse for defying compliance.
The Strategic View: Incorporating Compliance into Corporate GovernanceCorporate governance policies broadly establish a company’s stance toward risk, ethics and business practices. Effective policies establish control mechanisms that facilitate the execution of high-level directives throughout an organization; enable feedback and the flow of communication between levels; and balance and protect the interests of employees, stakeholders, investors and the rest of the business’ ecosystem.
In a worst-case-scenario, compliance activities are one of many “low-priority” control functions, siloed from broader governance policies and considered an onerous duty of “checking boxes” to meet compliance demands. This attitude is not recommended for ANY kind of business, but is absolutely a red flag and non-starter for operation in the highly-regulated cannabis industry.
The ideal alternative is to elevate compliance in the hierarchy of corporate governance and make it central to business strategy. Compliance can be considered the tactical execution of strategic governance policies. Rather than a “second thought,” compliance should be among the primary considerations when planning and enacting business activities. Whether launching new cultivation or retail spaces, executing an M&A deal, or raising capital, the feasibility and timeliness of attaining and maintaining regulatory compliance should be a primary consideration. If issues related to compliance stand in the way, they must be respected and addressed, or an enterprise risks losing…everything.
Tactical View: Structuring Effective Regulatory ComplianceWhile aligning compliance activities with the overall philosophy of an organization is a good start, putting this idea into practice requires a tactical approach to creating and staffing the compliance functions. Following are key steps that empower regulatory compliance as a priority for cannabis businesses:
Staff a Dedicated Regulatory Compliance Officer: The inconsistent legal status of cannabis across jurisdictions, plus the multitude of rules governing every aspect of the cannabis supply chain and finances, make for a very complex regulatory environment. Ensuring compliance enterprise-wide must be a dedicated role for a qualified professional at the executive level. They should have oversight into all relevant areas and direct communication with C-Suite executives, the Board of Directors, and other relevant stakeholders.
Build a Functional Compliance Team: Your appointed officer will be responsible for compliance activities, but they will most likely need support from throughout the organization. Ideally, a staff member in each major area will be responsible for reporting up to the compliance officer and also executing directives under their purview. Most enterprises will not have the ability to have dedicated compliance staff, but it should be included among responsibilities to lower level management. Creating a clear, identifiable chain of command will facilitate communication and make compliance activities more efficient and effective.
__Empowering Your Compliance Team: __Unfortunately, it is not uncommon to have a compliance team in name only. Without the ability to communicate with the Board of Directors, company leadership, and other stakeholders, a compliance officer’s effect is muted. It is important to empower your compliance officer, involve them in strategic planning initiatives, and give them the platform to regularly update stakeholders on progress and risks.
Preparing for Change: Regulatory compliance is not a “set it and forget it” function. The cannabis industry regulatory landscape is constantly changing at state/province and local levels. Proper corporate governance must include regular tests of controls, subsequent updates, and on-going employee training on regulatory demands.