Who’s in CONTROL of Your Cannabis Company?
Auditors may ask you for your internal controls procedures, and we don’t want that to be the first time you hear the term.
Internal controls are essentially the written processes and procedures that you and your employees will be required to follow to show that you have control over your business. Not only will a robust system of internal controls keep you from being robbed (a.k.a. embezzled), but it will establish credibility with state and federal auditors.
In our industry, we need to have controls related to the buying, handling, and management of inventory. This starts with controlling the processes that move your marijuana inventory from intake to the floor, including receiving product, retaining of receipts and manifests, scanning of documents (preferably to the cloud), storage and preparation of cannabis products, security of products, security of cash, security of the facility, expense management, reimbursements, daily cash count, payroll, management of contractors, reconciling accounts, and an entire laundry list of accounting processes.
You will need to have a system in place to ensure regulatory reports are made, federal, state and local tax filings are done, cannabis taxes are paid, 1099s are issued, IDs are copied to records, etc. Working with your accountants, you will want to establish written internal controls procedures that are strictly enforced. These controls should set the overall tone of the organization. They determine who has authority, who is responsible and accountable for what, and the consequences of failing to adhere to them. Some duties are segregated to minimize the potential for a breakdown in any aspect of control.
In a larger organization, internal controls originate with human resources policies and practices related to recruitment, orientation, training, evaluating, counseling, promoting, compensating, and remedial activities. Routine training and regular staff meetings should reinforce expectations – these sessions should be documented and should communicate standards mandated by SOPs (Standard Operating Procedures) and company policies.
Managers of a cannabis business should routinely seek to identify risks. Risks are typically the result of changes, such as new personnel, changes in regulatory or operating environment (laws), new or updated information systems (seed to sale, POS), rapid expansion of operations, new business models, products or activities, corporate restructuring, expansion or acquisition, and changes in procedures (SOPs or Accounting). In addition, anything that could affect your financial statements should be assessed, such as the ability to initiate, authorize, record, process, and report financial data. Once you identify risks, you will be burdened with considering the costs and ramifications of either accepting the risk or working to eliminate it.
Even if you are a very small operation, you will want to possess and adhere to a solid set of internal controls.
Auditors are interested in your accounting information processes as they pertain to financial reporting. They should be able to track items from the initiation of a transaction to the inclusion in your financial statements and see that appropriate disclosures are made in those financial statements (including the use of footnotes). In cannabis, there will be an emphasis on how you make estimates or track items that are allocated to your Cost of Goods Sold (COGS). Your accounting system should capture all significant events, accounting records, supporting information and should identify the parties involved in initiating, authorizing, recording, processing, and reporting transactions.
Management is responsible for developing, monitoring and evaluating the control activities and should establish an internal audit function to identify strengths and weaknesses as well as areas for improvement. Some routine control activities include the prenumbering of documents to assure that all transactions are recorded, and no transactions are recorded more than once, authorization of certain transactions, independent checks made to maintain asset accountability including verification of work by others (i.e., review of bank reconciliations, comparison of subsidiary records to control accounts, and comparison of physical counts of inventory to perpetual records).
Documentation should be maintained to provide evidence of transactions to be recorded. Performance reviews should compare actual performance to budgets, forecasts, and prior periods, and compare financial and non-financial information (i.e., evaluating cannabis prices vs. customer activity).
Safeguarding assets is a necessity in the cannabis industry, and physical controls are a means to achieve this. Physical segregation and security of assets can be accomplished with safes or protective devices. Consider authorizing access to assets and records (such as through computer access codes, prenumbered forms, and required signatures on documents for the removal or disposition of assets), and periodic counting and comparison of actual assets with amounts shown in accounting records. One example would be having door locks re-keyed quarterly or when an employee with a key is terminated for any reason. In cannabis, we suggest a daily check that no secured area or secured storage or vault is unlocked and that security cameras are operational, for example.
Segregation of duties ensures that individuals do not perform incompatible duties. Duties should be segregated so that the work of one individual provides a crosscheck on another’s work. Assigning different people to the responsibilities of authorizing transactions, recording transactions, and maintaining custody of the related assets reduces the opportunities for any individual to both perpetrate and conceal errors or fraud in the normal course of duties. An example is to have one employee review POS systems and cross-check with another employee to cash received. Similarly, one employee may verify the weight of product on hand at the end of the day while another cross-checks the seed to sale tracking system.
In closing, internal controls not only prevent fraud but show investors and auditors that you are running a tight ship. Even if you are a very small operation, you will want to possess and adhere to a solid set of internal controls.
