Evaluating Oversight of the Cannabis Industry -- Follow-up issues

Washington’s cannabis regulations have three essential goals: Prevent diversion to illegal distribution, ensure products are safe and collect taxes.

LCB’s responsibilities for cannabis regulation require it to:

• Grant three types of licenses to businesses that grow, process and sell cannabis products
• Enforce state laws and agency rules when licensees violate them, and ensure licensees know how to comply
• Monitor and inspect licensed businesses for compliance

The agency’s monitoring activities include requiring licensees to load certain business data into an LCB data system; staff then compare licensee data to lab processes and onsite inventory observed during inspections to help ensure compliance.

It has established two internal teams to help ensure its rules are properly followed:

• Cannabis enforcement and education division, which includes law enforcement officers and compliance consultants
• Finance division audit team, which audits licensees to confirm they have paid all necessary taxes

Consistent leadership helps ensure agency goals and project plans are executed as intended with minimal disruption or changes in vision. Between July 2018 and July 2023, LCB saw turnover in a half dozen executive positions, including people in roles that were responsible for LEAF, the cannabis-tracking software that replaced BioTrack.

Such turnover often contributes to diminished organizational performance and can directly affect specific project performance. In the case of LCB, leadership changes took place after the procurement of LEAF, during that software’s troubled period as the agency’s primary cannabis tracking tool, and long after decisions had been made about plans to update overarching agency systems.

The negative consequences of leadership turnover were far-reaching. In some cases, current leadership could only continue on paths determined by previous management, for example regarding which IT projects to prioritize. In other cases, new leaders indicated they were not made aware of the existence of the previous performance audit and a lessons learned report from a past project that would have been helpful information to consider during current project planning.

Our 2018 performance audit did not examine LCB’s procurement for the new cannabis tracking software, known as LEAF, or the contract LCB concluded with the vendor. However, Washington’s Office of the Chief Information Officer (OCIO) did discuss the LEAF implementation with LCB employees involved in the project, and issued a detailed lessons learned report in 2020. It described multiple failings at many points in the procurement and implementation of LEAF. Among the project management shortcomings the OCIO’s report outlined were:

• Expedited procurement
• Insufficient expertise
• Lack of scope buy-in from users and subject matter experts
• Focus on deadlines over deliverables
• Lack of accountability and contract management issues

Each of the five issues individually could derail a major software purchase and rollout. Taken together, they contributed to more than three years of insufficiencies in LCB’s primary cannabis tracking tool, LEAF. In the end, that software ultimately did not fulfill any of the audit recommendations.

Agency leaders at the time abandoned attempts to implement improvements in LEAF. Instead, they considered an entirely different approach to recording and tracking cannabis data. The agency devised an interim data warehouse, with few if any analytical or reporting features. Known as CCRS, it proved unable to deliver this essential function without staff taking manual steps to review additional documentation from licensees. But its limitations go further, and affect almost all aspects of LCB’s cannabis tracking responsibilities. Among the current software’s most significant problems:

• Enforcement officers lack real-time tracking information
• Limited data input protections offer little assurance licensees’ self-reported data is accurate
• Licensees cannot easily access or correct their data after they upload it
• The lack of a single identification number makes it difficult to track products for quick product recalls

Each of these four issues presents real barriers to LCB’s efforts to manage its regulatory responsibilities.

LCB has improved how it prioritizes enforcement, but additional alerts and updating policies can advance the agency’s efforts.

Recent steps, such as regularly conducting proactive “premises checks,” have helped the agency more strategically address risks. For example, the agency updated its processes for prioritizing complaints. Complaints that involve the most threat to public health and safety are addressed first, while those that are regulatory in nature are managed by compliance consultants instead of enforcement officers. However, if compliance consultants identify a prioritized threat, they elevate the complaint and an enforcement officer will investigate further.

During the current audit, LCB was in the process of instituting some new automated alerts in CCRS, to notify LCB staff if certain conditions exist in the data. The alerts include when certain licensees do not report any activity and for failed lab tests. While the alerts will help LCB focus its enforcement work, they do not fully address both the risks of lost tax revenue and diversion identified in the 2018 performance audit.

The audit made a series of recommendations to LCB to help it improve licensee data, ensure likelihood of future project success through addressing project management issues, and improve its efforts to prioritize and tend to risks in cannabis transactions.