Audit  Audit of the Cannabis Control Commission

1.  CCC should improve its internal processes around the administration of prorated fees to ensure that all money owed to CCC, and therefore the Commonwealth, is collected appropriately, consistently, and equitably.
2. CCC should conduct a full reconciliation to identify the total population of all uncollected license extension fees.
3. CCC should implement a standardized, written procedure for administering license extensions to ensure equity and compliance with applicable regulations.
4. CCC should prioritize adequate staffing, oversight, and automation of the billing process for license extension fees.
5. CCC should update its procedures to ensure that they are demonstrably fair, equitable, and transparent to help increase the public’s trust and prevent the appearance of potential impropriety.

1. CCC should establish, document, and follow specific timelines for the assessment and collection of fines throughout all phases of its inspection process.
2. CCC should designate a hearing officer pursuant to its regulations.

Noncompliant HCAs put undue financial burdens on small businesses in a burgeoning industry.

We identified 11 new marijuana establishments that were required to make large payments to the municipality before making their first sale—one of these establishments was required to pay over $100,000. This practice is in violation of applicable regulations and creates an environment in which only the largest businesses, often multi-state operators, can thrive and further incentivizes municipalities to show preferential treatment to large businesses capable of providing more funding.

Given the nature of the cannabis industry, this disfavors smaller Massachusetts-based entrepreneurs in favor of non-Massachusetts businesses that have existing cannabis operations in other states, and, therefore, greater financial means to afford such payments. We also identified HCAs in municipalities that had unequal terms between different marijuana establishments of the same license type, even though the establishments were in the same municipality. For example, one marijuana establishment in Brookline had a mandated charitable donation of $975,000, while another in Brookline had no such requirement.

1.  CCC should develop, document, and implement a policy related to employee settlement agreements in accordance with CTR’s guidance.
2. CCC should refrain from using employee settlement agreements that contain non-disclosure, non-disparagement, or similarly restrictive clauses and should implement a policy regarding the use of employee settlement agreements to promote a transparent and equitable process.

CCC’s breakdown of management structure and role consolidation will lead to several additional negative consequences, such as the following:

• CCC’s increasing reliance on external legal counsel resulted in higher operational expenditures and reduced capacity for internal improvements to CCC’s legal team. While specialized external support can be necessary in certain cases, the absence of sufficient internal legal staffing could limit CCC’s ability to maintain consistent legal administration and oversight. Furthermore, resources used for external counsel could instead support internal staffing or training to enhance long-term legal and compliance capabilities within CCC.
• Poor segregation of duties and the assignment of multiple high-level responsibilities to individual staff members increases the likelihood of operational bottlenecks and miscommunications. These conditions could create opportunities for error, mismanagement, employee conflict, and/or conflicts of interest.
• Staff members carrying excessive workloads and holding overlapping responsibilities may struggle to provide timely administrative decisions and services. Prolonged strain could lead to burnout, disengagement, and/or additional resignations, further compounding staffing issues.
• Frequent leadership changes, combined with ongoing legal challenges, may undermine public and stakeholder confidence in CCC. A lack of continuity in key roles could also impair long-term planning and disrupt the consistent execution of strategic initiatives.
• Employees placed in dual executive roles may lack the specific expertise or qualifications necessary to effectively fulfill both sets of responsibilities. The loss of experienced leadership, particularly when internal policies and procedures are undocumented, could result in the erosion of institutional knowledge and increased reliance on informal or inconsistent practices.
• The absence of documented controls over the areas reviewed during our audit may indicate broader organizational risks, particularly given CCC’s wide range of statutory responsibilities in regulating the cannabis industry in the Commonwealth.

1. CCC should ensure that it has a succession plan to effectively administer general and executive staff member turnover.
2. CCC should ensure that there is segregation of duties among all CCC executive staff members.
3. CCC should refrain from using external legal counsel to perform core functions.

This inadequate internal control environment contributed to several operational and financial risks, including:

• absence of control activities, which resulted in inconsistent practices, a lack of clearly documented procedures, and diminished organizational accountability;
• deficient oversight in licensing, HCA reviews, and management of the MRF, as evidenced by missing documentation of final approvals and unreconciled financial activity raising concerns about transparency, fairness, and regulatory reliability; and
• lack of a fully compliant internal control plan, which leaves CCC unprepared to address emerging risk posed by an unstable organizational structure.

1. CCC should ensure that controls around the review processes for both the MRF and HCAs operate effectively.
2. CCC should develop a fully compliant internal control plan and conduct a risk assessment annually.

The failure to implement adequate financial controls resulted in several risks and inefficiencies, including the following:

Financial Misstatements and Reporting Inaccuracies

• The commingling of revenue codes undermines accurate revenue tracking, which can distort financial reports, impact budgetary decision-making, and lead to noncompliance with state financial reporting requirements.

Erosion of Public and Stakeholder Trust

• The inability to identify and prevent duplicate payments exposes licensees to potential financial harm, raising concerns about CCC’s credibility, financial integrity, and regulatory oversight capacity.
• Without proper revenue categorization and duplicate payment detection, there is an increased risk of undetected financial mismanagement, revenue loss, and/or fraud.

Operational Inefficiencies

• The absence of systematic safeguards delays the resolution of discrepancies, which may delay financial reconciliations and impair CCC’s overall fiscal management.

1. CCC should implement automated system controls and validation procedures to monitor and prevent duplicate payments.
2. CCC should assign unique revenue codes to different revenue types.
3. CCC should perform regular reconciliations to detect or prevent duplicate transactions.
4. Until CCC implements a reliable system that detects or prevents duplicate transactions, CCC should make licensees aware of potential duplicate fees so that they may safeguard against improper charges by CCC.