Canada Releases Regulations for Ingestible Cannabis Products

The cannabis industry is and has been for decades an incredibly high-risk business, but that hasn’t been enough to keep investors away as medical and adult-use markets are developed around the country. While any investor in the space should know that returns cannot be guaranteed (and the laws regulating the very business they intend to fund are subject to the whims of legislators), there are valuable routes to mitigate the risks of the legal market.

Areas of risk management that are often overlooked by investors and business owners are cyber protection, patent litigation and business disruption coverage, all of which could take a burgeoning cannabis company out and leave investors holding the bag.

“Risk management is all about the appraisal of the risks and opportunities associated with the business, or a subset of the business, and looking to see what sort of risk mitigation processes and hedges you can put in place to protect that asset,” says Al Fine, director of risk management at Emergent Risk.

Fine works with cannabis industry clients to customize solutions that meet the business’s risk management needs. Risk management is especially important in the cannabis space because businesses that fail to protect the core business value are particularly vulnerable in this highly competitive landscape.

“In some cases you will find there are risks inherent to the business and there really isn’t much you do, but at least all the stakeholders, including investors, know that risk up front and have made the conscious decision to move forward. The question then becomes one of what is your risk tolerance, as an investor?” Fine asks.

While he says there are no one-size-fits all solutions for all businesses operating in the cannabis space, working with a risk manager will help the business determine, at its size, what an acceptable amount of risk is and what sort of risk management measures are essential.

Intellectual Property

One of the most valuable assets a business has, especially in the cannabis space, is its intellectual property. Identifying and securing protections is a good first step in mitigating the risk of the business’s core value and branding being lost or stolen to copycats, patent trolls, competitors or even disgruntled former employees.

Fine says businesses should protect these physical assets well in addition to legal protections; maintain sseed stock in multiple places in case of fire and make sure trade secrets absolutely remain a secret.

“Don’t go out on the Internet and Facebook talking about stuff without putting adequate protections in place,” Fine says.

Get Ahead of Cyber Liability

“If a CEO or the venture capital group has a mindset right out of the gate of investing in security tools as a business practice, all levels of the organization will be more secure and reduce their cyber liability. The challenge is when a business thinks of their IT as an …operational overhead to be minimized, that’s where we see compromises that lead to individual issues,” says Robert Gillette.

Gillette is an IT specialist with Berkeley, California-based Endsight, an outsourced IT provider that currently works with hundreds of businesses in the Bay Area, including some in the cannabis industry.

According to Martin Fox-Foster, director of claims at Emergent Risk, the cannabis industry is “woefully underinsured” when it comes to cyber liability.

“Not enough companies are purchasing cyber insurance. Simple as that. They either don’t think about it, treat it as a luxury or have never been educated by their broker on it. Cyber coverage will respond to a breach of data, a ransomware attack, a breach of payment card industry data and phishing scams,” Fox-Foster says.

Fox-Foster points out that large cannabis companies have already experienced breaches in cyber security, including delivery service Eaze and seed-to-sale tracking and point-of-sale software company MJ Freeway, which has been breached twice.

Fox-Foster suggests implementing a defensive IT strategy to protect the company from breaches, but more importantly, purchasing an insurance policy that can cover legal costs and business interruption costs that could incur due to a breach.

“Not enough companies are taking cyber security seriously. For those that do, they aren’t considering insurance despite the fact there is broad coverage with minimal cost. Cannabis businesses could fall victim to numerous breaches and need brokers that understand placing good coverage and providing risk management beyond this,” he said.

IP Litigation Insurance

There are two core insurance policies, enforcement and defense, that mitigate the risk of a business being bankrupted by litigation costs to enforce a patent owned by the company or protecting the company from costly litigation if they infringe on a patent, even unknowingly.

Enforcement policies reimburse litigation expenses to help the policyholder enforce intellectual property rights in the form of trademarks, patents, copyrights and trade secrets. Enforcement policies level the playing field by deterring frivolous infringement and helping the policyholder get through the litigation on the merits of the case not on who has the deeper pockets. It reduces the pressure to settle a case and the risk of entering into undesirable licensing agreements with an infringing party from the position of financial weakness.

“Litigation is expensive, and many don’t have the funds to hire litigating attorneys to help them protect their IP rights. $2.8 million [the average cost of litigation in a patent suit] is really eye opening, and very difficult for a small and midsize company to sustain,” says Gil Shaheen, vice president of sales and marketing at Kentucky-based Intellectual Property Insurance Services Corporation (IPISC).

He says in addition to enforcement policies, investors should look to companies that also have defensive policies, if appropriate. A defensive policy will cover any entity that makes, uses or sells, offers for sale or affords product services and commerce if they are taken to court for infringement.

Kirk Miller is a VP of Risk Management and the Cannabis Practice Leader at Emergent.  Kirk is a proven compliance, risk analysis and business strategy leader with more than 20 years of cannabis consulting and insurance industry experience.