Driving SOX Compliance: Cannabis Licensed Operators Embarking on a SEC Compliance Journey

The cannabis industry is a rapidly growing sector that has experienced significant growth in recent years. However, the industry faces unique challenges in terms of regulation and compliance, which can have a significant impact on the success of cannabis businesses. For Operators that have taken their companies public or are considering going public, one of the most important regulations they must comply with, or plan for, is the Sarbanes-Oxley Act (SOX), which sets out requirements for corporate governance and financial reporting.

The Need for Strong Governance

One of the key requirements of SOX is the need for strong corporate governance. This includes the establishment of an effective board of directors, as well as the implementation of policies and procedures that promote transparency and accountability. In the cannabis industry, which is subject to significant regulatory oversight, strong governance is essential to ensure compliance with local and federal laws. While many believe that SOX is predominantly a financial reporting and accounting function, it will ultimately fail without it being supported as an enterprise-wide change with support and buy-in at all levels, including the correct “tone at the top.” This is particularly important given the unique challenges that cannabis businesses face, such as the complexities of a regulated industry, the immaturity of controls and the lack of strong Enterprise Resource Planning (ERPs) technology.

Establishing Policies and Procedures Documentation

Another important requirement of SOX is the need for comprehensive policies and procedures documentation. This includes the development of internal controls that are designed to prevent and detect errors in a company’s financial reporting process, as well as the establishment of procedures for disclosures. This is particularly important given the complexity of the industry, which requires a nuanced understanding of the various laws and regulations that govern cannabis businesses. At times, when coupling regulatory requirements with financial reporting requirements, companies may determine that some may contradict and may create potential exposure. This step is critical and likely a large-scale effort, as most Cannabis License Operators will require some process redesigns to ensure proper risk mitigation.

Developing Employee Training and Education

SOX also requires businesses to provide training to their employees on the policies and procedures that are in place. This includes training on financial reporting and disclosure, as well as on the importance of compliance with local and federal regulations. In the cannabis industry, where the rules and regulations are constantly evolving, regular employee training is essential to ensure that businesses remain in compliance with the latest requirements, in addition to understanding the controls which are required for SOX. This is particularly important given the potential consequences of non-compliance, which can include significant fines and penalties, legal fees and damage to the reputation of the business.

Navigating the Challenges of Immaturity of Controls

One of the challenges that cannabis businesses face when implementing SOX compliance is the immaturity of controls. This is particularly true for businesses that are still in the startup phase and  may not have the resources or expertise to implement comprehensive internal controls that align with current Public Company Accounting Oversight Board (PCAOB) standards. Documenting and implementing (D&I) controls is a large-scale effort as most Cannabis License Operators can have more than 100 controls (including IT General Controls). As documentation requirements of a public company are much greater, even in areas where cannabis regulation requires controls, it is likely that Cannabis License Operators will have to adjust in order to satisfy PCAOB standards. It is essential for Cannabis License Operators to prioritize the development of effective controls to ensure compliance with SOX and other regulatory requirements. As an example, in a Risk & Accounting Advisory podcast published last year, our team covered inventory challenges and the need for inventory audits and counting.

Overcoming the Lack of Strong ERP Strategy and Technology Enablement

Finally, many cannabis businesses face a lack of strong ERP strategy and technology, which can make it difficult to implement and maintain SOX compliance. This is particularly true for smaller businesses that may not have the resources to invest in expensive ERP systems. However, the lack of strong technology should not be seen as a barrier to compliance. Instead, businesses can work to identify affordable solutions that can help them to meet their SOX compliance requirements.

The Implementation Journey

As public company Cannabis License Operators phase out of the “Foreign Private Issuer” (FPI) status, which waived prior certain SEC requirements of compliance including SOX, Operators will have to quickly pivot towards focusing on internal controls to avoid increased legal and audit fees, as well as potential fines and penalties that may come from material weaknesses in their internal controls.

This implementation is typically a significant overtaking for most public companies throughout a two-year period; however, in Cannabis, it could be even more challenging as accounting and finance functions may also be dealing with other factors such as:

• Potential Adoption of GAAP from IFRS
• SEC Registration
• Potential Change in External Auditors

Expected SOX timeline for new issuers, which qualify with definition of Emerging Growth Company (EGC):

*SOX Lite is considered the minimal effort management can implement during a year requiring compliance with Sarbanes Oxley Act Section 404(A); prior to having to comply with Sarbanes Oxley Act Section 404(B) when the external auditor would have to provide an opinion on internal controls.

Non-Compliance With SOX and Penalties

• Remediation and Potential Restatements: A dispensary and delivery services company recently reported multiple material weaknesses in their 10-Q related to impairments and several of their disclosures in the financial statement. The impairment material weakness caused a material misstatement on the financial statement. The company is now required to implement a series of remediation plans to fix these material weaknesses.
• Data Breaches: Specific to IT SOX Compliance, a point-of-sale solution provider leaked over 85,000 customer files containing personal information. Names, date of births, sensitive medical information and even ID scans were exposed. They are now subject to reputational impacts and financial penalties.
• Negative Publicity: Cannabis company trading at $7.3X, announced on a public conference call that materials weaknesses were expected to be reported alongside their annual 10-K. The stock tumbled by 33% over the next month to $4.8X.

How We Can Help
We understand the industry’s unique needs, including the delicate balance between growth and control. We help companies manage compliance risk, financial reporting risk and operational risk to help protect company assets, drive compliance and increase stakeholder confidence.

Our specialized professionals can help Cannabis companies in a variety of ways including:

• Accounting Services (outsourced and co-sourced accounting, staff augmentation, virtual CFO / controllership, project-specific transaction processing),
• Initial Public Offering Readiness
• IFRS to GAAP Conversions
• Accounting Department Optimization and Transformation
• Technical Accounting
• SOX Readiness Assessment
• Internal Controls Testing
• Enterprise Risk Management Services

Reach out to your Cherry Bekaert advisor, or our Risk & Accounting Advisory practice to learn more about our SOX for Cannabis services and experience the difference with industry-driven insights on the latest trends and regulatory compliance matters.

Additional Resources:
Article: Right-sizing the Cost of Compliance in the Highly Regulated Cannabis Industry
Article: Capitalizing on Risks & Returns: Risk Management Considerations for Cannabis Banking
Podcast: 5 Key Issues Affecting the Cannabis Industry in 2022
Podcast: Federal Income Tax Rules for Cannabis Businesses

Questions? Contact Us