Internal Controls for Cannabis Companies

By Michael Blood and Joseph Nguyen

Landscape for Cannabis/Internal Controls

Internal controls are the mechanisms, rules, and procedures implemented by a company to ensure the integrity of financial and accounting information, promote accountability, and prevent fraud. In addition to these objectives, promoting compliance with laws and regulations and preventing employees from stealing assets or committing fraud, internal controls can also help improve operational efficiency and the accuracy and timeliness of financial reporting.¹ For cannabis companies’ internal controls are often overlooked, as many businesses are in the early stages of growth and maturity and becoming a viable and profitable long-term business. Most cannabis companies are focused primarily on scaling their operations, and there are few established government-imposed regulations that require or encourage the implementation of internal controls for private cannabis companies. For these reasons, many cannabis companies are missing an opportunity to safeguard and protect their assets and streamline their operations, by implementing an internal controls framework. The consistent application of a few key internal controls could yield a major benefit to the soundness of operations and security of companies’ processes throughout the entire cannabis industry.

When considering implementing internal controls, a primary area of focus should be a cost-benefit analysis, especially for cannabis companies who are struggling to maintain profits in the current inflationary environment. There are several controls that can be implemented across information technology and business processes; however, some can be more costly and time-consuming to implement and operate than others. There are, however, several low-cost controls that can be implemented quickly at little cost that can result in an immediate benefit for the business.

Key Controls to Mitigate Risk

The first recommended control is a physical audit of inventory. Often the legalized recreational marijuana industry requires companies to use state software to track cannabis in its inventory from “seed to sale”. In many states, accurate inventory usage is linked to licensure, and cannabis companies could potentially lose their licenses due to a material misstatement of their inventory. Additionally, an area of emphasis for the IRS this year has been verifying the cost of goods sold. Under IRC Sec. 280e, the only deductible expense available for cannabis companies is cost of goods sold.² It is, therefore, extremely important for cannabis companies to accurately represent their COGS and inventory balances on the financials, otherwise the business can incur significant penalties, fees and fines. As physical audits of inventory become a standard procedure in the organization, employees will become accustomed to the internal auditor’s procedures and will become more efficient in the process.

Another key control applicable to cannabis companies is monthly trial balance reconciliations. These help to tie out key accounts correctly and can assist in discovering any potential accounting errors made in the past. Balance sheet accounts such as shareholder’s equity and fixed assets are reliant on previously closed accounting periods, and this monthly review ensures that no material misstatements were made. Another major benefit of monthly reconciliations, especially for cannabis companies, is that management can measure the accuracy of the allocation of depreciation schedules for fixed assets. Depreciation is an extremely important expense to recognize as a tax write-off. In the cannabis industry, companies can only recognize depreciation on assets designated as “non-cannabis”. Monthly reconciliations give management visibility into the assignment of “cannabis” and “non-cannabis”³  fixed assets, enabling the maximization of the depreciation expense.

The final control that all cannabis companies should consider is a three-way match. A three-way match is a preventative control which serves to validate goods received and governs the accounts’ payable function, reducing the opportunity for theft and fraud to occur. The control involves three primary documents: purchase order, packing slip and vendor invoice. Accounts payable should not release a vendor payment unless it can match the three separate documents and validate that the goods received match what was ordered. Many cannabis companies do not have a three-way match as they simply don’t have the staff to handle the workload. However, in a cash-centric business, this control is a necessity and should always be implemented where possible.

Summary

Internal controls are not meant to be burdensome processes that impede operations or dictate over people, but rather act as a means to measure that a specific process occurs and/or errors are avoided and minimized. The risk does not solely lie in finance, however. The three main controls outlined here are ones we consider to be most fundamental and key; they are as follows:

• Physical audit of inventory,
• Monthly trial balance reconciliations, and
• Three-way matching.

Keep in mind that controls featured in this article are not comprehensive as they do not constitute the full implementation of an internal control framework; however, they are a sound and easily implementable set of controls to help address some noted (and pressing) control gaps in many cannabis companies’ operations. In order to secure a cannabis company or maintain a safe posture, a wide array of controls to manage different areas of the business would be necessary.

Automation can also play a big role in protecting from risks ! This will be covered in our next upcoming piece.
As always, consult with your professional advisors as you build and implement any controls.

¹https://www.investopedia.com/terms/i/internalcontrols.asp
²https://www.greenbookscpa.com/blog/three-internal-controls-every-cannabis-company-should-have
³https://www.greenbookscpa.com/blog/three-internal-controls-every-cannabis-company-should-have