High Risk Compliance Assessment

Overview

Simplifya’s High Risk Compliance Assessment (HRCA) is a streamlined assessment that focuses on the areas of a cannabis business that carry a higher level of risk. “Risk” is defined as the potential to incur penalties, up to and including license suspension or revocation. The HRCA is not a comprehensive audit of all requirements of federal, state, and local laws and regulations.

For Licensed Operators

For cannabis businesses, the HRCA provides a more efficient, risk-based approach to compliance. It focuses on the areas of the business that carry the highest risk. All businesses are resource-constrained. The HRCA allows operators to apply effort where it is most beneficial.

For Service Providers

For financial institutions, insurance companies, and other service providers to cannabis businesses, the HRCA is a cost-efficient risk mitigation tool. Conducting on-site audits of the entire client base is prohibitive in cost and time. In contrast, the HRCA can be used to engage the whole client base, saving valuable time for both parties and allowing for on-site audits to be used more selectively.

The assignment of risk is based on Simplifya’s experience with operators, regulators, third-party compliance consultants, financial institutions, and insurance companies. The HRCA also incorporates Cole Memo priorities as well as trends in health and safety enforcement. It expressly does not cover all areas of a cannabis business’s operations, and should not be used to establish 100% compliance.

HRCA versus Comprehensive State Audit

The HRCA differs from Simplifya’s comprehensive state-specific audits in several ways:

• The HRCA is universal and generally applicable. Operators in California are subject to the same questions as operators in New York, Illinois, Colorado, or any other state. As such, the questions do not have accompanying citations pulled from state laws or regulations. This may lead to some questions that do not apply to your specific operations. If that is the case, mark the question as "Not Applicable".
• HRCA questions are not license-specific. Retailers will be subject to the same questions as cultivators, manufacturers, or any other licensees. As such, this may lead to some questions that do not apply to your specific operations. If that is the case, mark the question as "Not Applicable".
• Some HRCA questions require you to upload materials as proof of compliance. Examples include corrective action plans, hazard analysis reports, or ATM service agreements.
• The Business Profile category of the HRCA does not contain compliance requirements. All of the questions in this category are applicability questions to help financial institutions, insurance providers, and other stakeholders assess the level of risk your cannabis business carries. For these questions, there is no “correct” compliance answer.

To ensure comprehensive compliance with cannabis-specific state requirements, please refer to your specific state laws, regulations, and statutes. Simplifya offers comprehensive state-specific audits for a monthly fee. Please contact [e-mail] for more details.