On July 7, New York State Governor Andrew M. Cuomo signed into law a bill that allows marijuana to be used for medicinal purposes by patients with serious health conditions. The legislation creates new opportunities but, at the same time, new risks for businesses connected to the industry. Colorado State Auditor Dianne E. Ray a CPA, knows this all too well—last year, she completed the first ever performance audit of her state’s medical marijuana regulatory structure and got a close-up look at this burgeoning sector. (In 2000, Colorado legalized the use of marijuana for medicinal purposes; in 2012, while Ray and her team were working on their audit, it became one of the first states to approve the drug for recreational use.) Her work has been recognized by the National Association of State Auditors, which presented Ray with an Excellence in Accountability Award this past June. Ray, along with Nina Frant, an audit manager for the state, spoke with The Trusted Professional about what New York can learn from Colorado’s experience.
What was your reaction when medical marijuana was legalized in your state? Similarly, how did you react to the more recent approval of recreational marijuana?
Ray: I didn’t have a big reaction when the medical marijuana measure passed. In our state, though it was legalized back in 2000, nothing much really happened until 2009, which is when the Obama administration issued the “Ogden memo,” advising federal prosecutors not to focus their federal drug enforcement resources on individuals complying with state medical marijuana laws. At that point, things really started taking off and a number of dispensaries opened. The Department of Revenue created the Medical Marijuana Enforcement Division to regulate the dispensaries and, as a result, this sector came to the attention of our audit team. It was a new area, with higher risks, and when we started looking at it we found a lack of internal controls.
We were in the middle of doing the performance audit when recreational marijuana was legalized. Early on, we had a discussion with the team about what to do if it passed or didn’t pass, and we decided that we would take a wait-and-see stance. Then, when recreational marijuana did pass, our governor announced that he was putting together a task force to address the regulatory scheme for it. Our team decided it made sense to put out our report at the same time the task force would be making its recommendations, so we could bring things into alignment. We ended up having a really active role in discussions about the legislation for recreational marijuana.
How did you prepare for the performance audit? What was your approach to looking at the state’s medical marijuana industry?
Ray: We approached it as a kind of licensing program. The uniqueness about medical marijuana is that it’s an illegal activity under federal law, but the licensing and processing, in our minds, should be similar to other programs, so it wasn’t unique in that aspect.
Nina Frant: In terms of planning for the audit, as Dianne mentioned, we approached it like any licensing program—thinking, ‘What are the risk areas?’—and planned accordingly. In terms of dealing with the federal questions, we talked a lot about that as a team. In our office, we conduct Yellow Book audits, so our standards require us to report on illegal activity. The manufacture and distribution of a federally controlled substance is an activity we would want to report, but we live in a state where the citizens passed an initiative to make it a legal activity. So we asked ourselves, ‘How can we report on this illegal activity in a way that is meaningful to our state and policy makers?’ In the end, we included an audit recommendation to ask the state department to get additional federal guidance on any risks there may be to state employees involved in regulating the industry.
Were there any technical accounting challenges with the audit?
Ray: Our financial auditors went in and looked at the Medical Marijuana Enforcement Division at the Department of Revenue and, from a purely financial audit perspective, they found a lot of gaps in the internal controls. This raised a lot of concerns, so we included that in the performance audit. Performance audits typically don’t focus on accounting issues, though there may be compliance or statutory issues, or effectiveness and efficiency issues that could be translated into accounting issues.
Frant: We were trying to provide a very easy-to-understand snapshot of the challenges this enforcement division was facing at the time of the audit. The division had experienced a cash flow problem leading up to the audit, where they collected lots of revenue but ran out of money and had to lay off some staff, including those responsible for monitoring licenses, and so this was a problem we talked about quite a bit.
What was most surprising thing you found in your audit?
Frant: There had been a general understanding at the time that our medical marijuana industry was well regulated in such a way as to be seed-to-sale—meaning that from the time a grower puts a seed in the ground to the time a finished product leaves the dispensary, we know exactly where that product has been, and the state is tracking it. The most surprising thing we discovered through our work was that the regulatory system at that degree of specificity did not exist—the monitoring that would be required was not in place and the inventory tracking system that the state had planned to put into place was not in place. So, at a fundamental level, seed-to-sale did not exist.
Ray: I would add that when Amendment 64—the ballot initiative that allowed marijuana use recreationally—was on the table, there was this basic thought among the citizens of Colorado that there were effective controls in place on the medical marijuana side that could easily translate to the recreational side—no problem. And so, when we found things like what Nina described, the general public had not known this. They generally thought these controls were in place.
Do you think the failure of that system was a product of the right idea not being given enough resources, or was it a matter of the wrong ideas being implemented?
Ray: In general, I would say the division had not fully set up all of the elements that would be required to fully establish a seed-to-sale system. The plant tracking system is one example—they had a contract for developing it, but they ran out of money to finish paying for it, so at the time of the audit, we didn’t have this system in place. They ran out of money and laid off staff, so the auditing function they had at some point went away. So it was major components that were missing.
From a regulatory standpoint, in what ways is the medical marijuana industry in Colorado like any other business? In what ways is it different?
Ray: I think at the end of the day, the regulation of medical marijuana is like licensing any other process. The same with recreational marijuana. One of the components that makes it challenging is that both medical and recreational are cash-based businesses. Because banking is federally regulated, and because the marijuana industry is illegal federally, they cannot get banking services. That means when you audit, you have no bank records to look at.
How comparable would the audit of medical marijuana be to an audit of recreational marijuana?
Ray: We’re not planning to do an audit of recreational marijuana at this time. Typically what we like to do is wait a few years and let the dust settle so we have records we can look at: I would give it maybe three years or so. However, the Department of Revenue does do sales tax audits, and these are conducted the same as any other business.
New York state recently legalized medical marijuana. What advice would you give to Albany, considering what you’ve learned about the industry in Colorado?
Ray: Your state is structured a little differently from ours, in that the state auditors reside with the comptroller, but my advice to other states that have medical marijuana is to get out there and look at the system that’s in place. Recreational marijuana could be on the ballot some day and if you don’t have a good regulatory scheme in place it could set you back. Also, I would say if you’re a CPA with clients that are dispensaries, one of the challenges is that cash basis I mentioned and making sure things are well documented. Have good financial information so everything is aboveboard and everything is being regulated appropriately.