Why the Cannabis Industry Needs Internal Audit

Imagine that an exciting, thriving industry — one filled with multi-billion-dollar companies, far-reaching growth potential, and fascinating risks — offered you a wide-open door to build better processes and lay your wisdom at its feet. Imagine being consistently viewed as a trusted advisor, and not a checkbox or roadblock.

This opportunity is real: The cannabis industry has gone mainstream, and it needs risk and internal audit professionals.

As of publication, medical cannabis is legal in 37 states, and recreational cannabis is legal in 19. A 2022 CBS News/YouGov poll found two-thirds of Americans supporting federal legalization; a 2021 Pew Research Center survey found 91% in favor. Cannabis is booming, with analysts predicting the industry could be worth between $57B and $100B by 2030.

When I left PricewaterhouseCoopers to join cannabis multi-state operator (MSO) and public company Jushi as Head of Internal Audit in 2021, people thought I was crazy — but I saw the value I could add. Jushi’s leadership had the foresight to create an internal audit department to focus on internal controls, going beyond compliance to improve the business. Yet most cannabis businesses lack risk management maturity and resources, and the door is open for internal audit to move the industry forward.

Key Challenges in the Cannabis Industry and How Internal Audit Can Help

After cannabis was deemed “essential” during the early days of COVID and the prospect of federal legalization, investors piled on and top organizations grew. In 2021, many of the top organizations which are publicly listed on foreign exchanges such as the Canadian Securities Exchange (CSE) surpassed the SEC’s financial reporting exemptions, making them subject to new requirements including, Sarbanes Oxley (SOX).

Against this backdrop, cannabis remains federally illegal. Most big banks and credit card networks still won’t work with the sector (though credit unions and state banks are stepping up). The Big Four are very involved in Canada, but not in the US — and some large technology vendors Oracle and SAP still hesitate to engage. Since cannabis businesses lack access to the services, guidance, and technologies other large businesses take for granted, it’s not surprising that they’re identifying material weaknesses in their internal controls. The industry needs internal audit to help navigate the key challenges below.

1.   Focus on Regulation, Less on Broader Risk Management— and an Imminent Need to Address Risk

Challenge: The industry has grown so rapidly that it hasn’t had time to mature its risk management processes, tools, or technologies. Despite heavy regulation, risk management has been primarily reactive, with businesses opting for “right-now” solutions that often lack efficiency and effectiveness.

How Internal Audit Can Help:

• Be trusted advisors. Executing a proper risk assessment, for enterprise and or for internal audit’s plan. Collaborating with management for not only you, but for them to understand questions like: What are their key risks and potential blind spots, and how should they be thinking about them? What mitigation strategies should they consider? How should they prioritize?
• Provide a big-picture point of view on risk. Cannabis regulations, written for lawyers, don’t offer implementation guidance. Internal audit can help management understand that processes can be designed not only to satisfy regulators, but also to support business objectives.

2. Fast Growth, Immature Processes — Heavy Local Regulations That Lack Standardization

Challenge: Beyond complying with federal laws applicable to any industry, cannabis businesses face weighty state and local regulations. Each jurisdiction has different regulations, levels of specificity, and interpretations. Businesses may do the same task six ways to satisfy six separate regulators, leading businesses to rely on checklist-driven approaches that are labor-intensive to create and update. For instance, standardizing and automating the three-way match — a common, simple-to-implement control for auditors — is uncommon. Many businesses manually examine millions of dollars worth of transactions.  

How Internal Audit Can Help:

• Find standardization opportunities. Internal audit can help management understand requirements and implement controlled practices that drive business benefits.
• Identify enabling tools/technologies. Jushi uses AuditBoard to reduce manual tracking, streamline workflow, and ensure accountability. We’re also controlling costs, reducing administrative work, and improving resource management.

3. Need for Controls Around Vendors and People

Challenge: Cannabis workers and vendors are a mix of people who’ve grown up in the industry and those who’ve migrated to it. They often lack experience in large company environments and don’t understand common expectations large companies have of third-party service providers (e.g., ERP systems, SOC reports). This heightens the need for controls.

How Internal Audit Can Help:

• Assess gaps and make recommendations. As risk and control experts, internal audit can quickly assess process design gaps and provide recommendations on maturing the control environment.
• Bring internal audit’s lens of process, technology, and people to find solutions. We can help build more mature processes, adopt enabling technologies, and educate about third-party risk management and controls.

4. Minimal Guidance on Internal Controls

Challenge: Existing industry guidance focuses on regulation. Almost no literature exists on cannabis risk management, internal controls, and best practices. With mergers and acquisitions of MSOs nearly doubling from 2020 to 2021, there’s a constant need to train new people on what controls are needed and how they should operate.

How Internal Audit Can Help:

• Collaborate with other internal audit professionals to build out guidance. Our experience can translate into best practices and guidance (e.g., helping management understand minimum benchmarks for acquisitions).

Make an Impact

The cannabis industry is a blank canvas for internal audit. Businesses are eager to hear how they can reduce and manage risk, improve efficiency, and better support their business strategies. Internal audit immediately has a seat at the table, providing valued perspectives, ideas, and advice. When thinking about where to spend your valuable time and talents as you advance your career, consider investing your energy in making an impact that helps an entire industry move forward.