Comply...or die.

The world of compliance might seem about as unsexy, dry and boring as you can get, but I think it’s actually quite fascinating. The impacts of non-compliance have an amazing ripple-effect on businesses and their communities. Often, all it takes is one, seemingly small and benign action or a misinterpretation to set off a chain-reaction of events that result in major consequences, exposing a business, its employees and customers to significant legal, regulatory, financial and reputational risks.

Having worked in two heavily regulated environments, healthcare and finance, I have witnessed the consequences of non-compliance and how easy it can be to cross the compliance line. Being out of compliance can reach far beyond paying fines and legal fees. In healthcare, non-compliance can, and sadly often does, result in patient death.

Watching the cannabis industry emerge and grow around the country, it's interesting to see how various states’ legislation and regulations are evolving. The cannabis industry is under sharp scrutiny and will likely be for many years to come. Each player in this emerging industry is an example and when one trips and stumbles, all eyes are watching.  If there was to be an industry more heavily regulated than healthcare or finance, then cannabis is it. From tracking systems that can reconcile seed to finished edible, to strict waste disposal mandates, the cannabis industry is being held accountable. To make matters more challenging, state cannabis regulations are changing nearly daily, making it arduous for organizations to keep pace. Yet, by failing to maintain compliance, the trust and legitimacy that we strive to instill is whittled away.

The fall-out from non-compliance can be devastating. Leadership is essential, having clearly documented policies and procedures is critical. But perhaps more importantly, it is accountability that matters most. Accountability is the willingness to accept responsibility for doing the right thing, for ensuring corrective actions are taken and for holding oneself and others responsible for complying with regulations. There is no margin for complacency or error in this ever-changing industry. Next to producing top-quality product, complying with state regulations is THE most important aspect of everyone’s work, regardless of role. It could be that one misunderstanding, that one tiny mistake that will cost you your licenses, your livelihood, your employees’ jobs, and your customers’ access to safe and reliable marijuana products, leaving your business dead in the water.

A Few Case Studies

Denver’s Sweet Leaf, which held 26 medical and recreational business licenses, is a stark example of the seriousness for maintaining regulatory compliance. Sweet Leaf lost its licenses in July 2018, after it was found to have violated Colorado state-mandated sales limits (no more than one ounce sold to a customer on the same day). By not following regulations, the Sweet Leaf brand reputation has been tarnished and millions of dollars in potential earnings are forever lost. Bigger than that, Sweet Leaf executives face jail time and fines, employees lost their livelihoods, medical and recreational customers lost their trusted source, and vendor suppliers lost their customer. The situation at Sweet Leaf was egregious and went far beyond a missed step or mistake; it remains as a shining example of the consequences for failing to comply with state regulations.

Another case is EVIO, Inc., a marijuana testing lab formerly based in Bend, OR. The company was found to have violated Oregon state laws by allowing employees to take home unused testing material. As a result, in early February 2019 the company voluntarily surrendered its two testing licenses, which allowed it to test product in Bend and Eugene, OR. In December 2018, EVIO received a provisional license from the Massachusetts Cannabis Control Commission to operate as an independent testing lab in Framingham, MA.

Recently, MCR Labs in Framingham, MA, has come under scrutiny for failing to comply with state requirements for proper disposal of lab waste containing marijuana.  This is not the first time the company has come under regulatory scrutiny regarding testing samples. MCR Labs is one of only two labs in Massachusetts that is licensed to test product for both medical and recreational marijuana. This violation puts the lab at risk of losing its testing license, which puts producers, dispensaries and consumers at risk as well. It would be interesting to see the root cause analysis (or failure mode effects analysis), to understand why and how the process failed, and what actions would prevent the risks of a repeat event.

What to do?

Start by immediately assessing your processes, work flows and policies. Do they adequately satisfy regulatory requirements? How strong is the audit trail? Can you easily show that your organization does what it says, and says what it does? Are your processes 100% black and white or are there gray areas? Do you have a robust system of checks and balances in place? Is your organization updating its policies and procedures when the regulations change? How are those changes communicated to employees? Gather the troops and start assessing…you can’t afford not to!

Mistake-proofing. Look at your processes through a magnifying glass, understand where the gaps are, where communication breaks down and begin to redesign processes to make it impossible (or next to impossible) to be non-compliant. This might mean changing a step in the process, modifying a piece of equipment, or changing the number of hands involved in a particular process. Here’s a mistake-proofing example to get your creative problem-solving juices flowing. Ever tried to put diesel into your gasoline-fueled car? You can’t, because the pump manufacturers redesigned the diesel nozzle such that it can’t fit into the gasoline port.

Visualize it. When you onboard new hires, how easy is it to train them in your processes? How hard is it for them to remember each step and nuance? How easy is it for employees to unwittingly take an action that would put your company at risk for non-compliance? How easy is it for you or anyone in your company to see a defect, error, omission or anything else that would make your company non-compliant? We cannot leave everything to memory—we are frequently interrupted, we multi-task, and we have wandering minds. Break your processes down to their simplest steps, standardize and document those steps, and use photos to convey the key steps in a where the work is performed, don't hide it away in a binder.

Final Thoughts

When processes, polices and work flows aren’t clear or regulations aren’t built in, disaster can and will strike. Too often, we look to blame someone instead of examining theprocesses. By seeing the gaps where things go wrong and mistakes happen, we have an opportunity to tighten up processes—to make them mistake-proof. It’s in these opportunities that we are able to weave in regulatory requirements and make them a part of the daily work, making it easier to do the right thing and much harder to do the wrong thing.  It’s also a time to have open dialogue about creating cultures of safety and accountability. 

Most people want to do the right thing and want to do good work. But there are a small few who don’t. When someone willfully chooses to act out of accordance with company polices and state regulations, it’s a totally different conversation and appropriate action must be taken immediately to prevent further harm. Regardless of industry, you have the power to weave quality and compliance into the tapestry of your organization’s daily work and culture. Everyone has a shared responsibility to vigilantly ensure their company is in compliance with state regulations. Make compliance part of each process and work flow; don’t make it an after-thought. In other words, comply with the regs…or risk corporate death.