Improving Cannabis Risk Management Tools Using Business Transaction Data

Washington voters legalized recreational use of marijuana in 2012, joining Colorado as one of the first two states to do so. Seven other states have since followed. They hope to learn from our experiences in this new industry.

In Washington, the LCB administers cannabis business licenses, enforces relevant laws, and creates regulations related to the production, processing and sale of cannabis. The state forecasts that excise taxes collected on retail sales will total $740 million in the 2017-19 biennium.

This performance audit examined how LCB could build and automate risk management tools to ensure a tightly regulated cannabis market and the most efficient and effective use of its internal audit and enforcement staff. LCB management welcomed the audit’s analysis, as it informed their decisions in how best to use the industry data it collects to identify areas of risk.

We completed this audit (published in August 2018) amid a number of changing events in the regulatory environment, both at the federal and state level. First, the audit took place during a federal policy reversal about the legalization of marijuana. In January 2018, the U.S. Department of Justice rescinded its previous policies on how it would enforce federal laws in states that had legalized cannabis.

Before the audit, LCB began replacing its existing data tracking system. It did this in part because it wanted greater data analysis capabilities. During the audit, LCB began implementing the new system. LCB faced multiple challenges as it did, including an incident in February 2018 when someone gained unauthorized access to the system. The audit did not address these events other than to recognize their presence.

Because Washington was one of the first states to legalize marijuana, LCB had to create its regulatory structure before risk-management standards existed for the marijuana industry. With the previous data tracking system, LCB audit staff reviewed marijuana transaction data periodically by manually generating and reviewing data reports. Enforcement staff typically responded to unusual activity brought to their attention by outside complaints.

LCB created a data tracking system to record all cannabis inventory and transaction data from production through final retail sale. The system requires licensees to enter data at each step of cannabis production, distribution and revenue collection. The system was designed to meet enforcement priorities outlined in a 2013 U.S. Department of Justice memo written by Deputy Attorney General James Cole, which related to state-legal cannabis operations, and to ensure that all taxes owed are collected.

LCB began rolling out the new data tracking system in February 2018. Since then, the agency has been continuing to work on the system, its functionality and its implementation. Agency management said the system would ultimately provide more flexibility and reporting capabilities. With the new system in place, management said the agency plans to incorporate an automated risk assessment strategy.

LCB audit and enforcement staff plan to use risk management tools to alert them to issues, such as non-compliant businesses, through the identification of irregular data entries by licensees. Using risk management tools that automatically alert agency staff to irregular entries in the agency data tracking system made by licensees reporting on their production, processing or retail processes can greatly improve LCB’s regulatory efficiency – in both audit and enforcement efforts – while maximizing tax revenue for the state.

The audit identified three activities in the production and sale of cannabis that pose a higher risk for potential diversion of product, when cannabis might disappear from the regulated market. These occur when:

1. Licensees adjust cannabis quantity or weight. LCB said its new data tracking system allows producers, processors and retailers to adjust quantities of cannabis product at virtually any point in the process where data could be entered. Large adjustments could signal a data entry error or that licensees are diverting product.
2. Product changes form, such as when producers harvest plants or cure flower. Licensees use many different methods to extract useful substances and create end products. Low reported yields when processors convert cannabis to intermediate products (such as plant material to oil), or when they convert intermediate products to end products (such as oil to an edible candy) may signal possible diversion.
3. Cannabis changes hands. This includes when retailers sell products to customers and, where it is allowed, donate medical marijuana.

Establishing reasonable ranges at higher-risk steps can help LCB identify data entry errors that show possible diversion of product.

By developing tools that automatically notify staff of irregular data at high-risk points, the agency can focus its resources on specific, high-risk transactions and businesses. Reasonable data ranges can be calculated using standard statistical methods. Examples of these types of indicators include unusually large adjustments on data entries or abnormally high amounts of waste. Appendix D in the audit report describes methods for calculating reasonable ranges.

LCB’s original data tracking system captured a lot of critical information from cannabis licensees, but it was not designed with any automated tools to identify unusual transactions. By calculating reasonable data ranges for high-risk transactions, LCB staff will be able to pinpoint irregular data. Automated notifications that alert staff to irregular data can allow them to be more efficient in selecting licensees for audits or enforcement. In addition, such notices can help minimize data errors or diversion of marijuana products, ensuring maximum tax revenues are collected.

To help improve efficiency and more comprehensively review licensee activity, we
recommend that LCB complete its plans to:

1. Develop reasonable ranges for data at the higher-risk transactions
   of the cannabis production, processing and retail processes
2. Establish automatic notifications into its new tracking system
   that will alert staff when data at those higher-risk transactions fall
   outside established ranges, indicating potential data entry errors
   or product diversion

These maps provide detailed information about each transaction that the three types of licensees — producers, processors and retailers — conduct, and the data that they are required to provide in LCB’s data tracking system. For each data entry, icons provide information about how the data is represented in the system (for example, number of items or weight), whether the data can be further broken down into smaller units, and whether the data entry can include an adjustment value.