Cannabis entrepreneurs face many risks in running their businesses, but no single risk looms as large as compliance issues. Internal audits can help make sure you don’t fall afoul of laws and regulations such as Cannabis Act and its Regulations, Safe food for Canadians and other provincial Regulations. Internal audit is an organization-wide process designed to obtain reasonable assurance about the effectiveness of risk management, control, and governance processes.
According to the institute of internal auditors
“The role of internal audit is to provide independent assurance that an organization’s risk management, governance, and internal control processes are operating effectively.”
In this article we will Discuss:
An organization’s culture, policies, and procedures can be better understood through the use of internal auditing, which also assists boards of directors and management in their oversight responsibilities by verifying the organization’s internal controls, such as operational effectiveness, risk mitigation controls, and compliance with any applicable laws or regulations. An additional purpose of internal auditing is to assist in formulating new rules and procedures.
Internal Audit prepares the organization for surprise and scheduled regulatory audits and saves them from recalls and critical observations from Regulatory bodies like Health Canada and other provincial audits.
As more cannabis companies come to the scene, compliance will become an issue for more of them. In fact, many cannabis companies are already experiencing it. You’ll need to have a compliance program in place to provide a safe product to your consumers.
Good Production Practices (GPPs) guidelines from Health Canada are helpful tools to determine what could lead to recalls or why your company can’t keep up with its records or training. With an effective audit program that involves both management and employees, departments—like supply chain or quality assurance—collaborate better and promote open communication across the entire organization.
Internal audits are mandatory to stay compliant with the GMP regulations. When making GMP cannabis products, your first priority is to ensure your product is safe for consumers. With government regulation coming into play, companies need a strict compliance program in place. Good manufacturing practices (GMP) is a set of standards for ensuring that products are consistently produced and controlled according to quality standards. Failure to comply with GMPs can lead to recalls or other serious consequences.
In most companies, there is a department dedicated to overseeing compliance. In smaller operations, one person may wear multiple hats and act as both employee and auditor. Either way, internal auditors are responsible for monitoring your company’s compliance with regulatory guidelines such as Good Production Practices (GPP) or Good Manufacturing Practices (GMP) in case of a GMP-compliant facility.
If it sounds like your job description just got a lot more complicated, you’re right. There’s no denying that overseeing these practices can be time-consuming for even an audit pro. For example, if you produce cannabis oil or vape cartridges containing CBD or THC, you must ensure each product is properly sealed before being placed on store shelves.
Fortunately, there are ways to get ahead of compliance issues before they become a major problem for your business. One method is through self-audits. Not only do these allow you to identify any problems quickly, but they also give you a chance to fix them before someone else does.
Another option is through third-party audits. While it might seem like paying another organization to oversee compliance would add another expense to your bottom line, in many cases, third parties offer discounted rates when compared with hiring an in-house auditor full-time. A well-designed system will use both self and third-party methods to ensure your compliance efforts never fall behind schedule.
Basically, they are responsible for ensuring your company is meeting any regulatory requirements. They may also assess management systems, controls, risk management practices and policies to ensure compliance with international standards and other regulations.
Part of their role is to evaluate what measures a company has in place to stay compliant. So, you can be sure that if you need your cannabis facility to be compliant with Good Production Practices (GPP), or any other regulations or internal policies for that matter, then you need an internal auditor on staff who can advise your production team on how best to meet those GPPs.
In addition to its independent role, internal audit is also closely tied to your other compliance activities. Building strong internal controls will help you formalize and structure several different processes, particularly when it comes to ensuring that all employees follow government regulations and rules.
Before preparing for a major audit or inspection, many organizations formalize their own process for conducting an audit by creating a checklist and template that can be used in each situation. This makes it easier for everyone involved—not just auditors—to get things right the first time, every time.
The same goes for any analysis reports created after an audit has taken place; they should be able to be used over and over again with minimal adjustment so they’re easily reproducible. All these procedures need to be well documented as part of an ongoing management tool and as evidence if something goes wrong. Having a documented audit plan also helps prevent legal issues from arising if there’s ever a dispute about what happened during one.
In order to understand your risk exposure on all fronts, audits are conducted throughout the year at regular intervals rather than waiting until end-of-year reviews.
As part of these ongoing efforts, an internal audit will conduct frequent interviews with employees across different departments. These interviews can be structured or unstructured but they’re important in getting a feel for how things are going and what areas need extra attention during future audits. If you’re ever asked to participate in an interview with an internal audit as part of your organization’s compliance program, don’t worry—they aren’t interrogations! There won’t be any gotcha questions or trick statements; instead, it should be more like a conversation between two people trying to get better insight into an area that requires improvement.
Audits are conducted by certified individuals who understand how cannabis should be produced and handled. They ensure proper documentation is available to back up every claim made on product labels.
Auditors may visit your facility at any time during business hours, but they usually do so during peak times like harvest or trimming season.
6.1) They Understand GPP/ GMP Requirements And Have Knowledge Of Your Business Model
Every auditor should have a solid understanding of GPP/GMP requirements as well as their client’s business model before starting work on an assignment. If they don’t, they may not be able to identify problems or areas that need improvement. If you suspect your auditor doesn’t understand your company, ask them to explain how they would correct issues if they were found during an audit.
6.2) They Are Prompt In Their Responses To Questions Or Concerns
An experienced cannabis industry professional will be prompt in responding to questions or concerns from clients, regulatory bodies or auditors. If you are waiting for a response for more than 24 hours, it could mean there is something wrong with your relationship with your auditor and you should consider finding someone else who can better serve your needs.
6.3) They Have A Strong Understanding Of Production Methods And Procedures
As mentioned above, an auditor’s ability to accurately identify problems and recommend solutions relies heavily on their understanding of production methods and procedures. Ask them how they would handle issues such as pest control or mold prevention if they were found during an audit.
6.4) They Understand The Regulatory Environment And Requirements
Having a thorough understanding of Health Canada regulations, Good Production Practices (GPP), security requirements, client contracts and other relevant legislation is essential when conducting cannabis audits. If your auditor doesn’t understand these requirements, they may not be able to effectively identify potential problems that could result in fines or corrective action being required by Health Canada regulators.
6.5) They Are Able To Communicate Effectively With Your Management Team
A good cannabis industry professional will have an easy time communicating with their clients and regulatory bodies. In addition, they should also communicate well with management staff who are responsible for production procedures at your facility.
6.6) They Have Experience Working With Other Cannabis Companies
If you are looking for someone to conduct internal audits at your facility, make sure you hire someone who has experience working with cannabis companies. This will ensure they are familiar with GPP requirements as well as any unique challenges faced by licensed producers in Canada today.
Contact the MFLRC team for your Compliance and Regulatory Audits, we can:
