As operators tread through the miles of red tape and perilous regulatory landscapes that make up the U.S. cannabis industry, many confront questions and concerns as they plot their futures, especially when it comes to putting together a public offering of their company.
Abaca recently sat down with cannabis accounting expert Curtis Winar, CPA/CFF, CVA with Frost, PLLC. to talk about implementing internal controls, the best time to start conducting internal controls, inventory concerns, raw materials issues, and much more.
If you want to take your cannabis business public or want to learn more about the expectations and requirements within Sarbanes-Oxley Section 404 (“SOX 404”), you’ll find direction here.
We began by asking Winar to give his overview of Sarbanes-Oxley and SOX 404 compliance, while also asking: why should cannabis companies care?
“SOX 404 is a part of the Sarbanes-Oxley rule that does internal controls and is required for most publicly traded companies, but not all,” Winar explained. “There are some exceptions, but the majority are required to have internal control compliance. Companies need to make sure they have their internal controls in place, focusing on all items required to meet a SOX 404 audit. An auditor will come in and pressure-test your controls, so your management team needs to identify and test internal controls before the audit.”
“One of the toughest decisions for cannabis operators is determining whether to initiate internal controls for their businesses in the event of possible SOX 404 compliance. For Winar, the answer is complicated.
“It really depends. If you’re looking to be a publicly traded company, start looking at requirements. You’re probably already doing audited financial statements, but you’re probably not including any SOX 404 compliance issues or internal controls. Know what those compliance and internal control requirements are so you can plan. Many folks will skip testing internal controls because it’s costly, but it is highly beneficial. If a privately held cannabis company hopes to be acquired by a publicly traded company, it should invest in testing and implementing these controls, because the publicly traded companies will certainly expect internal controls when reviewing financial statement audits as it relates to financial reports. Many mistakes, from IT processes to inventory management, can affect the integrity of the financial statements, and auditors will catch that. Internal controls will help identify and correct these mistakes before reputational risks that can kill the deal arise.”
For privately held companies on the verge of acquisition or going public, Winar advises beginning SOX compliance now rather than planning it out. “It’s smart to be thinking about putting internal controls in place before you go public. If you are faced with an IPO process or an acquisition, you’re going to have to prove or show that you have those internal controls in place. If it’s a publicly held company that’s acquiring you, they’re going to have to put those in place, too. If you have something in place and you can show those internal controls, you probably add value to your company.”
For those looking for best practices on internal controls for cannabis companies, Winar suggests a dual approach: technology-related and physical controls for assurance of compliance. “Cannabis companies are cash intensive, so looking at both technology-related and physical controls, like segregation of duties in cash collections, accounting and sales, would be a good starting point. How is your cash getting to the bank? Are you using banking technology for internal controls? I’ve seen clients take in less cash and use a banking service, like Abaca, to help mitigate some of the controls that may fail with handling a lot of cash. And it’s not just cash … it’s a high value inventory, too. Most states have requirements for seed-to-sale tracking systems that can help improve your internal controls. Using technology to know where everything in inventory is moving, from raw material to finished product, how well it is being tracked, and any potential shrinkage or waste is imperative to track. Make sure your policies and procedures are in place to track those.”
“When it comes to internal controls, one may wonder how that looks in practice at a dispensary. With multiple differing regulations concerning customers and payments, it could be a particularly complicated and sensitive process to navigate. However, Winar states that he recently experienced a seamless distribution process that he found to be a great practice. “I was in a facility recently that implemented a fulfillment model with internal controls for how to distribute products to the customer. The products are never touched by the customer or the individual budtender. Just on the other side of the wall in the dispensary is a fulfillment center. The order is received via app in the fulfillment center and the fulfillment center employees bring the product through a window in a sealed bag for the customer to pick up. That’s an example of a good internal control for both the collection of funds and the control of the product that comes in and goes out. Payment is made electronically via the app and the fulfillment center ensures proper product distribution via a sealed bag. A great example of both technology-based and physical segregation of duties.”
For those looking to learn more about SOX compliance, Winar suggests getting in touch with a qualified CPA firm to ensure compliance and a much less stressful experience than winging it on your own. “Find a qualified CPA firm. Frost has a group that specializes in SOX 404 work with publicly and non-publicly traded companies. Not all accounting firms and not all auditors understand the function. It is a very detailed process; it’s costly, but may be worth it. Our partners at Frost who work with publicly traded companies and deal with the SOX 404 can really get into the details of what it takes to start implementing it. See what it takes to put in place on a consulting level before you get to a point where you need it with your financial statement audits.”
It’s also a good idea to understand your cash management and identify any cost or operational savings that may arise through leaning more on technology and compliant banking, like those services offered from Abaca. Abaca’s new Treasury Management system is a great option for multi-location operators, allowing you to view and aggregate your current cash position and take control of your corporate treasury, enterprise-wide.
“It really depends. If you’re looking to be a publicly traded company, start looking at requirements. You’re probably already doing audited financial statements, but you’re probably not including any SOX 404 compliance issues or internal controls. Know what those compliance and internal control requirements are so you can plan. Many folks will skip testing internal controls because it’s costly, but it is highly beneficial. If a privately held cannabis company hopes to be acquired by a publicly traded company, it should invest in testing and implementing these controls, because the publicly traded companies will certainly expect internal controls when reviewing financial statement audits as it relates to financial reports. Many mistakes, from IT processes to inventory management, can affect the integrity of the financial statements, and auditors will catch that. Internal controls will help identify and correct these mistakes before reputational risks that can kill the deal arise.”
For privately held companies on the verge of acquisition or going public, Winar advises beginning SOX compliance now rather than planning it out. “It’s smart to be thinking about putting internal controls in place before you go public. If you are faced with an IPO process or an acquisition, you’re going to have to prove or show that you have those internal controls in place. If it’s a publicly held company that’s acquiring you, they’re going to have to put those in place, too. If you have something in place and you can show those internal controls, you probably add value to your company.”
For those looking for best practices on internal controls for cannabis companies, Winar suggests a dual approach: technology-related and physical controls for assurance of compliance. “Cannabis companies are cash intensive, so looking at both technology-related and physical controls, like segregation of duties in cash collections, accounting and sales, would be a good starting point. How is your cash getting to the bank? Are you using banking technology for internal controls? I’ve seen clients take in less cash and use a banking service, like Abaca, to help mitigate some of the controls that may fail with handling a lot of cash. And it’s not just cash … it’s a high value inventory, too. Most states have requirements for seed-to-sale tracking systems that can help improve your internal controls. Using technology to know where everything in inventory is moving, from raw material to finished product, how well it is being tracked, and any potential shrinkage or waste is imperative to track. Make sure your policies and procedures are in place to track those.”
“When it comes to internal controls, one may wonder how that looks in practice at a dispensary. With multiple differing regulations concerning customers and payments, it could be a particularly complicated and sensitive process to navigate. However, Winar states that he recently experienced a seamless distribution process that he found to be a great practice. “I was in a facility recently that implemented a fulfillment model with internal controls for how to distribute products to the customer. The products are never touched by the customer or the individual budtender. Just on the other side of the wall in the dispensary is a fulfillment center. The order is received via app in the fulfillment center and the fulfillment center employees bring the product through a window in a sealed bag for the customer to pick up. That’s an example of a good internal control for both the collection of funds and the control of the product that comes in and goes out. Payment is made electronically via the app and the fulfillment center ensures proper product distribution via a sealed bag. A great example of both technology-based and physical segregation of duties.”
For those looking to learn more about SOX compliance, Winar suggests getting in touch with a qualified CPA firm to ensure compliance and a much less stressful experience than winging it on your own. “Find a qualified CPA firm. Frost has a group that specializes in SOX 404 work with publicly and non-publicly traded companies. Not all accounting firms and not all auditors understand the function. It is a very detailed process; it’s costly, but may be worth it. Our partners at Frost who work with publicly traded companies and deal with the SOX 404 can really get into the details of what it takes to start implementing it. See what it takes to put in place on a consulting level before you get to a point where you need it with your financial statement audits.”
It’s also a good idea to understand your cash management and identify any cost or operational savings that may arise through leaning more on technology and compliant banking, like those services offered from Abaca. Abaca’s new Treasury Management system is a great option for multi-location operators, allowing you to view and aggregate your current cash position and take control of your corporate treasury, enterprise-wide.
Do you own a hemp, CBD, dispensary, marijuana, or cannabis business and need a business bank account? We’ve validated over $8 billion dollars in cannabis-related funds since 2015. Bank with confidence. Bank with Safe Harbor Financial today.
Open Your Account