Keeping Your CA Cannabis License: Get a Compliance System

Cannabis businesses must demonstrate they have the capability to be legally compliant as a condition to issuance of their state and local licenses.  That compliant moment is only a glimpse of the business’s life, but it cannot be a fleeting thing, as periodic inspections can make or break your business. 

Depending on the license type, the cannabis business can be inspected at any time by the Bureau of Cannabis Control (BCC), the California Department of Food and Agriculture (CDFA) or the California Department of Public Health (CDPH).  Cal. Code Regs. tit. 16, § 5800.  Inspections by one or more of those licensing agencies can occur unexpectedly and often, which means the business must strive to maintain compliance at all times to avoid any operational stoppages, expenses associated with resolving notices to comply and other citations, and ultimately failure. 

The cannabis industry shifted from operating under the loose laws of the Compassionate Use Act to a detailed set of regulations under the Medicinal and Adult-Use Cannabis Regulation and Safety Act (the “Regulations”), requiring compliance throughout the entire supply chain.  Following the relatively new and detailed Regulations is understandably difficult, and that difficulty is compounded with the struggle to navigate the Regulation’s ambiguities. 

To mitigate the compliance difficulties, cannabis businesses are required to adopt and follow “standard operating procedures” (SOPs), a term used in the Regulations.  Cal. Code Regs. tit. 16, § 5700. Some SOPs are treated as mere paperwork that is submitted and ignored, or as impediments that fail to mesh with actual operations. 

Instead, SOPs should be built to allow successful implementation and concurrent continual improvement of the SOPs.  Below is an example of a compliance system:

Although the example system components are shown separately, the components are carried out concurrently.  The cyclical system continually improves the SOPs and the associated processes.  Additionally, the employees must be educated on the SOPs to strengthen the interlocking of the SOPs and operational processes, with a monitoring system in place to ensure adherence.

• Study and Test Current Processes for Feasibility

If there is a beginning and end to the above compliance system, this is it.  The company processes must first work.  Once a process works, it should be continually tested and evaluated for feasibility and adjusted as better methods to accomplish tasks, new situations or needs are identified.    

• Draft SOPs Compliant with Law and Cohesive with Current Processes

Properly drafted SOPs should, (1) include, and require compliance with, the processes required by law, (2) maintain flexibility to allow for situations not contemplated by the Regulations or cannabis businesses, (3) be customized to match the unique aspects of each cannabis business and help guide the processes to achieve the most efficient and effective result, and (4) be relatively straightforward and easy to understand.

• Refine Processes to Match SOPs

Occasionally, the SOPs can accommodate the unique aspects of the current processes of the business; however, if the items in the SOPs that are required by law (as opposed to a discretionary item) are inconsistent with the current processes, the processes must be modified to meet legal requirements.  In order to optimize SOP effectiveness and expedite the implementation of a solid compliance system, it is crucial that during the first three stages above, the employees carrying out the processes work closely with counsel in drafting and revising the SOPs.

• Educate Employees on SOPs

The importance of maintaining compliance with state and local law as a cannabis business cannot be stressed enough.  Falling out of compliance can result in fines, imposition of required corrective measures, license suspension or revocation, and removal of any potential state protection from federal enforcement.  The foregoing enforcement actions could end a business and all of the jobs it created. 

Management should emphasize that no single person in the business is responsible for all compliance; everyone in the business has compliance responsibility to some degree. Therefore, employees must be regularly educated and reminded of the importance of compliance—their job is dependent upon it.  At minimum, the education should be conducted (1) upon any legislative change affecting the SOPs, (2) as part of any internal SOP update, (3) as part of the employee onboarding process, and (4) on a regular schedule (we recommend at least every six months).

• Implement Systems to Monitor Compliance with SOPs

Audits by licensing agencies are occurring with more regularity.  The more vigilant the compliance, the less chance the cannabis company has of failing an audit.  Compliance monitoring systems can include internal audits in preparation for inspections.  We recommend internal audits be conducted monthly, with each audit focusing on a particular aspect of the business.

In addition, a reporting system should be implemented that causes any irregularity to be identified and brought to the attention of management.  The report should quickly funnel up to counsel or the compliance manager to ensure it is addressed correctly and as quickly as possible.  Lingering issues create situations that can be cited by the inspecting governmental agency.

In sum, the cannabis compliance system should be developed as a foundation upon which a company can grow with the goal of being a “living” system.  Continual improvement, and the ability to adapt to changing laws and processes, should be built-in.  Every cannabis business will encounter adverse compliance issues during its life; those businesses with proper systems will mitigate the adverse compliance effects and continue to thrive.

Republished from Orange County Business Journal with permission of Stuart Kane LLP.