Cultivating Compliance: Self-Reporting Incidents to Regulators

In any business, the cover-up is often worse than the crime. Cannabis operators face scrutiny and high expectations as one of the most highly regulated emerging industries in the United States. However, regulators are often limited in their capacity to monitor and enforce within each state’s regime.

To shift some of the burden, operators are required not only to demonstrate robust internal controls and ethical governance but also to report issues directly to regulators. Understanding when and how to self-report can mean the difference between a manageable issue and a regulatory crisis.

Regulatory Requirement and Best Practice

Self-reporting is the act of voluntarily notifying a regulatory agency that a licensed business may have witnessed or committed a potential violation. A violation can range from inventory discrepancies and deviations from standard operating procedures (SOPs) to security breaches, product contamination, theft, or employee misconduct.

While self-reporting may seem counterintuitive, especially if the issue can be remedied internally without compromising the safety of employees, patients, or customers, it is an essential part of maintaining the integrity of the regulated cannabis industry nationwide. Self-reporting is not just about damage control; it is about building trust with regulators and the public and demonstrating that you’re running a responsible, ethical, and compliant operation.

Common Mistakes to Avoid

Waiting Too Long:

Do not delay reporting while waiting to fully understand or investigate the incident. Most regulations specify a tight timeframe within which an incident must be reported, oftentimes 24-48 hours after discovery, depending on the severity. Some regulatory schemes mandate immediate reporting, especially in cases of theft or diversion. It is better to report what you know promptly, even if the facts may not be fully developed, than risk running afoul of reporting deadlines.

If needed, supplement the report later with corrections to the initial report and details regarding the investigation, such as disciplinary actions imposed internally, employee training, updates to SOPs, or equipment changes. The consequences of failing to report promptly can be severe, adding yet another violation on top of what may have already occurred, leading to license suspension or revocation, fines, and reputational damage.

Underreport or Downplay:

Each regulatory body independently defines what constitutes a reportable incident. When submitting a self-report, be honest and transparent about the scope and severity. It may be instinctual to minimize an incident to avoid causing alarm or scrutiny, but, ultimately, it is better to over-disclose initially and later demonstrate how existing protocols contributed to mitigating an incident.

Consider where an incident is situated on the scale of severity: Was this an isolated and discrete incident, or a pattern or systemic failure? Was it an unavoidable accident, or could it have been avoided with better SOPs?

Showing proactive accountability demonstrates that you take compliance seriously. Concealment is an indicator of systemic issues, not just a one-time lapse. Regulators may uncover the full story through audits, investigations, or whistleblowers, leading to more serious consequences.

Lack of Documentation:

Operators often learn more from mistakes than from successes. Avoid repeating mistakes by maintaining thorough records of each incident to ensure your organization continues to grow in the right direction, especially when the “corporate memory” can be wiped out by the fast pace of the industry or employee turnover.

Regulators want to see detailed documentation of incidents and responses, including timelines, investigations, corrective actions, employee interviews, and SOP revisions. Keep a master record of all administrative actions, violations, and fines for all licenses, as these may need to be reported to regulators when applying for new licenses or changes in ownership.

Recommended Actions

Clear Incident Response Plan:

Develop a written procedure that outlines what rises to the level of a reportable incident, how to document the event, who is responsible for notifying the regulator or emergency and public safety personnel, and what relevant timelines apply.

Building systems that help your team identify, report, and respond to incidents quickly and honestly will not only protect your license but also enhance your reputation as a responsible operator.

Train Your Team:

A policy is only as good as its implementation. Enhance your internal accountability by ensuring all staff members are trained on your procedures. It is important to appreciate the priorities of your state’s program and clearly communicate these to your team. Some regulators may be particularly sensitive to advertising violations or patient confidentiality.

Other types of incidents are of common interest among all regulators: product recalls or contamination, such as pesticide residue, labeling errors, mold, failures in child-resistant packaging, or security breaches or employee misconduct showing evidence of diversion, theft, or loss.

Regulators are interested in whether your operation has the appropriate internal controls, which cannot exist only in the abstract; all employees must be encouraged and empowered to detect and report incidents.

Consult Legal Counsel Early:

Engaging with legal and compliance advisers can not only help create the infrastructure to prevent incidents but also assess whether an incident is reportable and how best to frame the disclosure. Partner with a lawyer with expertise in the industry to ensure the language used in the report does not inadvertently imply greater culpability than necessary. Thoughtful language and complete documentation can help mitigate risk and liability.

Operators or their attorneys should also be proactive in maintaining a good, ongoing working relationship with regulators. Inconsistent and opaque interaction with regulators may give the impression of a pattern of compliance issues. Conversely, familiarity with your operation can support an argument that an incident is discrete and give confidence in the operation’s ability to remediate and prevent the issue from happening again.   

Be Prepared for an Investigation and Penalty:

Unfortunately, self-reporting an incident does not inoculate an operator from the consequences of the underlying incident. Conducting a thorough internal investigation demonstrates your commitment to compliance, but regulators may still conduct their own investigations into the incident and assess a penalty in the form of fines, suspension, or revocation.

Maintain the perspective that self-reporting avoids adding severity to the consequences, and failure to report can be treated as an aggravating factor in assessing penalties, even if the underlying incident was relatively minor. Sometimes, but not always, self-reporting can prevent revocation for an offense that would have otherwise resulted in revocation.

Final Thoughts

When in doubt, disclose. You may not avoid a penalty, but you’ll almost always put your business in a better position than if you try to hide the problem. Transparency, accountability, and proactive compliance are keys to long-term success in any industry, but especially in the cannabis industry, which fights every day to legitimize its position.