By Lawrence Baye, CMC, CISA and Mark Bednarz, CPA, CFE, CISA

Cannabis has been in the headlines again as voters in many parts of the country approved its availability for recreational use during the last election cycle. Attention has shifted to the states that are developing rules and regulations governing licensing, operation, testing and reporting, as well as determining the responsible agencies or authorities that will monitor these activities. Simultaneously, local governments are grappling with the question of whether their communities are willing to have these businesses operate in their neighborhoods. While new businesses and/or the expansion of existing ones spur job creation and local construction and can also provide a welcome stream of new tax revenue, they also raise concerns about the potential for more crime, traffic accidents due to driving under the influence, attracting people from other neighborhoods solely to buy the product and other undesired outcomes.

While these issues should be top-of-mind of cannabis business owners and operators, investors and Board members who may seek to capitalize on this new opportunity should also be mindful of other risks and challenges and have a robust plan of action in place to address them:

1. The inability to apply, secure, retain and comply with state licenses, local permits and meet reporting requirements, including those related to health, safety (e.g., capital projects) and the environment (e.g., wastewater, chemical or biological disposals, energy conservation, climate change) could lead to a forced shutdown of operations. Further, the failure to properly prepare complex applications and supporting information that are state-specific (e.g., evidence that site is secured, financing, architectural drawings, security measures, ownership/management background checks) by set dates may jeopardize timely regulatory approval. State delays in approving license transfers may affect the closing of an acquisition unless an interim arrangement can be worked out. States, as well as local governments, may have multiple agencies involved with licensing and permits, use differing terminology, require background checks for directors and/or executives and impose fees on different aspects of the business, such as cultivation, testing or transport.
2. Since product from one state cannot be transported to another state, there may be no means to address inventory shortages (due to a poor outdoor growing season or higher than expected demand) by simply borrowing excess inventory from a nearby state. In addition, an owner/operator must have sufficient funds to replicate facilities in another state and this may be difficult for capital-intensive vertically-integrated businesses that are engaged in cultivation, manufacturing different product formulations (e.g., cream, edibles) and dispensing.
3. A company’s image, brand name and reputation take years to build but easily can be tarnished by an investigation, threatened litigation, unexpected attack by a special interest group or adverse media coverage. In the cannabis sector, these types of incidents may include allegations of fraud, product recalls due to microbial contamination or pesticide contamination, improper dosing or labeling, unsubstantiated claims of health benefits or unauthorized treatment advice given by non-medical personnel.
4. As long as federal laws continue to remain restrictive, many financial institutions, service providers (e.g., payroll, insurers), suppliers and other third parties will likely avoid doing business with cannabis businesses. As a result, limited access to federally-chartered banks, for example, may prevent a company from accepting credit cards as a form of payment, maintaining bank accounts, securing loans and lines of credit at attractive rates, force the business to operate mostly with cash and incur higher fees dealing with state-chartered institutions and credit unions. There is no single national relationship that covers all the states for cash sweeps, transfers and other functions typically available to companies of comparable size in other industries. Also, Tier II institutions may not offer the array of technology-enabled services and security (e.g., key FOBs, positive pay) that are essential for cash management, electronic funds transfer and other functions that Tier I banks provide to their customers.
5. The inability to track, trace and report on seed-to-sale and inventory movement, perform quality testing and demonstrate proper handling of solid and liquid waste may impair a company’s ability to meet its regulatory reporting requirements, detect inventory shrink and rapidly locate, remove/recall contaminated or mislabeled product. Counterfeit or defective products like the vape crisis in 2019 could threaten cannabis businesses even if its products were not affected. Failure to comply with state-specific requirements may result in additional costs (e.g., notifying customers, retesting, handling product returns and disposal), loss of patient and customer confidence in the company and its products and trigger enforcement actions or possibly termination of licenses. Seed-to-sale reporting systems and testing (e.g., moisture content, heavy metal) methods and equipment vary by state and the absence of a recognized certifying body to validate tests may lead to calibration differences among company, state and third-party laboratories.
6. The relative newness of the cannabis industry and limited access to reliable market data (including the activity of parties engaged in the illicit market) may hinder a company’s ability to accurately forecast demand (e.g., customer preferences/demographics, geographic potential, competitor positioning), analyze trends for production planning and enable decision-making. Further, while the overall cannabis industry has performed well during the pandemic and the growth rate in the United States is expected to remain in double digits, a business’ year-over-year increase in existing markets may be constrained if these markets become saturated and/or states decide to either grant more licenses to existing or prospective competitors.
7. The impact of federal legalization is unclear because it might increase sales and profits but lead to product commoditization if new players can readily enter the market. A state may elect to impose limits on the number of licenses any entity or person may own, the types of licenses available, restrict operations to a specific part of the state and/or oppose multi-state operators or vertical integration to encourage small business operators. Also, alcohol, tobacco and consumer products companies with substantial capital may decide to enter the market if federal legalization appears likely; many have deep pockets for investment and are positioned to buy market share.
8. Staying abreast of rules and regulations is difficult. Without a robust compliance function and quality standards, it may be difficult to demonstrate with sufficient documentary support that the business follows the latest guidance.
9. A business must proactively manage their cash burn rate or else they may be forced to seek other sources of funding (e.g., private lenders that charge higher interest rates, sale-leaseback arrangements with long-term tenant payment obligations) to sustain its operations and fund capital projects while satisfying their debt covenants. Prolonged cash shortages could lead to insolvency. In addition, related party transactions that involve obtaining funds from creditors (non-bank sources), doing business (e.g., acquiring companies, buying materials, loans, guarantees, gifts, management overrides, providing or receiving services) with companies that are owned by directors or executives and/or employees might not be properly disclosed or completed as arms-length transactions or viewed as questionable or money laundering activities. Failure to disclose such relationships could create legal, reputational and/or financial exposures.
10. A company may fail to provide appropriate safeguards to prevent workplace injury or criminal acts involving the handling of controlled substances, cash and/or specialized equipment. In addition, the improper treatment of chemicals, waste and other contaminants could result in skin or eye sensitivity, poisoning or respiratory issues and expose the company to lawsuits, investigations, fines, penalties and enforcement actions. In addition, the collection of patient, customer and employee data as well as intellectual property (e.g., information about seeds/plants and growing conditions, product price lists, formulations) may make the company a target of cybersecurity attacks.
11. Absent a uniform Enterprise Resource Planning system that covers the entire business, the company may find it difficult to fully understand their cost structure, quantity and value their biological assets and other inventory and how each stage/activity (e.g., cultivation, manufacturing, dispensing) contributes to overall profitability. Also, the business may not be able to adjust prices to pass on additional costs associated with commodity (e.g., seed, packaging) inflation as well as freight and utility (e.g., energy, water) price and labor increases.
12. The failure to properly interpret and calculate allowable costs under Section 280E of the IRS Code due to complexity, lack of technical expertise and proper oversight and/or compute and remit taxes across multiple jurisdictions may expose the cannabis business to penalties and liabilities. The federal tax rules impose a higher effective tax rate than comparably sized businesses in other industries where a deduction for certain operating costs and administrative expenses is permitted. Some states follow federal codes and others have their own rules. Also, the pandemic and recession-related budget shortfalls may drive states to increase their examinations as they pursue additional tax revenues.

About the Co-Author

Mark Bednarz is a Partner in PKF O’Connor Davies Risk Advisory Group. He combines more than twenty years of public accounting and Fortune 500 experience and an expertise in attestation and consulting services for a variety of financial service clients including banks, broker-dealers, hedge funds, fund of funds, family offices, fund administrators and registered investment advisors.

Mark’s extensive experience includes internal audit, business reengineering, forensic accounting, Oracle implementations, FINRA, NFA, and SEC compliance, Sarbanes-Oxley consulting, IT audits and governance, service organization control reporting (SOC) attestations and risk assessments.

He is a frequent presenter and training evaluator for several professional organizations related to Governance, Risk and Compliance. He has also served as an author and contributing editor to articles that appear newsletters and publications as well as conducted webinars.