This post first appeared on Risk Management Magazine. Read the original article.
The U.S.
legal cannabis industry has been booming as more states legalize medical and/or
recreational use. In its U.S. Cannabis Report 2019 Industry Outlook,
cannabis research firm New Frontier Data found that total legal sales will have
a compound annual growth rate of 14% in the next six years, totaling almost $30
billion in 2025.
But with this growth comes serious operational risks
throughout the industry. Cannabis businesses need to ensure that they are
complying with relevant regulations and that consumers are getting a safe
product and accurate information when making a purchase. However, the complex
regulatory landscape and relatively uncharted territory of legal cannabis make
compliance significantly more difficult than in other industries.
As of January 1, when legalization officially went into
effect in Illinois, cannabis was legal for recreational and medical use in 11
states, while 33 states and Washington, D.C., have legalized cannabis solely
for medical use. However, the federal government still classifies marijuana as
a Schedule I drug, putting legalization on legally shaky ground and leaving
states to sketch out their own regulatory frameworks.
Regulations and Violations
Cannabis industry regulations address every aspect of the
“seed-to-sale” process, including growing, dispensing, lab testing and
marketing. They are also inconsistent from state to state. For example,
Colorado, Washington, Oregon and Alaska all prohibit using cartoon characters
to market cannabis products, but unlike the other three states, Colorado does
not require health warnings on advertisements. Likewise, of those four states,
only Colorado and Oregon prohibit products containing additives like nicotine
and alcohol.
Product testing requirements also vary wildly between
states, and often are implemented or strengthened after product recalls.
According to cannabis information website Leafly, Colorado requires that
cultivators submit their products for testing for potency and numerous
contaminants and conditions, including fungi and pesticides. Alaska does random
testing of products, screening for contaminants as well as potency. Other
states, like Connecticut, mandate only self-policed testing by producers.
Arizona does not currently require any testing, but recently decided to start
mandatory testing in November 2020.
Falling afoul of regulators can have major consequences for
legal cannabis producers and the businesses that depend on them, including
supply chain disruption and reputation damage. Violations can mean hefty fines
as well as the risk of losing licenses—a significant sunk cost totaling tens of
thousands of dollars in some states.
Dispensaries are routinely fined for violations. In 2019,
Massachusetts cannabis company Cultivate agreed to pay a $75,000 fine after a
surprise inspection showed 3,000 improperly labeled products. The products
examined reportedly did not include required labels stating that they contained
THC, that they were not safe for children, or showing serving size,
identification numbers and directions for use.
Labs also face tough consequences for not meeting regulatory
requirements. In November, a Nevada lab was closed after the state accused it
of inflating THC level results by up to 10%, as well as failing to maintain
adequate security surveillance, and not keeping seed-to-sale product tracking
or waste logs. The lab settled the suit, paid $70,000 and reopened, avoiding
the $107,500 fine and license revocation the state originally threatened. The
same lab was previously closed in December 2017 for similar violations, which
the owners blamed on confusion over relatively new regulations. In 2018, after
discovering that a California-based lab falsified its pesticide test results
for four months, the state revoked the lab’s business license and told 29
companies to recall cannabis products, reportedly costing those businesses tens
of millions of dollars in sales.
Quality control also poses risks for cannabis businesses. In
November, Colorado warned consumers that several batches of medical and
recreational cannabis were contaminated. The state’s Department of Public
Health and Environment blamed the “microbial contamination” on a computerized
tracking system called Metrc, which a dozen states use to track legal cannabis.
Similarly, in February, Nevada’s Department of Taxation warned the public about
20 cannabis products it said were contaminated with various types of mold or
bacteria. In this case, the state blamed a Las Vegas lab for failing to catch
the contaminations and advised consumers not to purchase the affected products.
Nikolas Komyati, who advises cannabis industry clients as a
principal at Bressler, Amery & Ross, noted that cannabis businesses face
the risk of being labeled a “bad producer” for any type of mishap or scandal,
which will “tarnish your brand forever.” He explained, “You don’t want to be
seen as low-brow. You can work to get the license, you can do everything, and
then one bad thing in the paper and people are going to steer clear of your
product.”
As legalization expands, Komyati predicted, “you are going
to see more uniformity among states as far as what the controls are, and I
think that you are going to see more of a move towards everything being FDA
compliant.” He recommended that cannabis businesses strive for
“compliance-plus,” doing more than the bare minimum to ensure that they are not
playing catch-up with regard to regulations.
Standardization of compliance rules is inevitable for the
cannabis industry, according to Rocco Petrilli, board chair and COO of the
2,500-member National Cannabis Risk Management Association. However, he
stressed that this standardization would be better coming from the industry
itself, rather than the federal government. “On the surface, a governing body
at the federal level and a national standard for quality all make a lot of
sense, as long as it’s executed properly,” Petrilli said. “I just don’t have a
lot of confidence that it would be at this point.” He said many cannabis
business owners fear over-regulation, which could cut profits and increase
prices, driving customers back to the black market.
Managing the Risks
Testing products can significantly help manage operational
risks. Komyati stressed “making sure that your facilities don’t have mice,
mildew and mold, and that your product is not tainted.” He added, “It’s not
intended to be any kind of burden on the industry or the producer, but it’s
really intended to be something that ensures that the customer is getting
exactly what they’re supposed to be.”
Additionally, Petrilli emphasized the importance of
independent product testing, recommending that businesses “always have testing
done outside of your internal quality control with accredited laboratories,
because it creates gospel in terms of being able to defend your product.”
Because of the variations among state regulations and the
possibility of national regulations in the future, cannabis businesses may want
to hold themselves to higher standards than their home state mandates. One way
to do this is to enlist compliance experts from the pharmaceutical industry,
given the comparable product safety and FDA requirements in that sector.
For Jason Thomas, CEO of Precision Quality & Compliance, a multi-state cannabis quality control, audit and risk management organization, compliance is a much bigger issue than ensuring the product is safe and the supply chain transparent. “It really goes through the entire value chain, because quality control goes beyond the supply chain, like a third party managing your data somewhere. Your quality process is really only as strong as its weakest link.” Addressing these risks can include general risk management practices, like providing adequate training and institutional knowledge to staff, implementing systems to prevent disgruntled employees from contaminating products, and ensuring that a business’s IT infrastructure, including that of third-party partners, is safe and secure.