Audit of the Cannabis Control Commission Objectives, Scope, and Methodology

An overview of the purpose and process of auditing the Cannabis Control Commission

Overview

In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of certain activities of the Cannabis Control Commission (CCC) for the period January 1, 2019 through December 31, 2020.

We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Below is our audit objective, indicating the question we intended our audit to answer, the conclusion we reached regarding the objective, and where the objective is discussed in the audit findings.

Objective

Conclusion

Does CCC ensure that recreational marijuana products sold meet the safety standards required by Section 15(a)(1) through (3) of Chapter 94G of the General Laws; Section 500.160(1) through (4) and (10) of Title 935 of the Code of Massachusetts Regulations, which was in effect during the audit period; and CCC’s “Protocol for Sampling and Analysis of Finished Medical Marijuana Products and Marijuana-Infused Products for Massachusetts Registered Medical Marijuana Dispensaries”?

No; see Findings 1 and 2

 

To achieve our objective, we gained an understanding of CCC’s internal control environment related to the objective by reviewing applicable policies and procedures, as well as by interviewing CCC and Metrc employees and management, three independent testing laboratories (ITLs), a marijuana cultivator and product manufacturer, and a marijuana industry advocacy group. To obtain sufficient, appropriate audit evidence to address our audit objective, we performed the procedures described below.

 

 

• Using SQL Server Management Studio,⁴ we accessed the Metrc database and identified 25 pesticide tests where the use of a prohibited substance was detected at two marijuana establishments (MEs). To ensure that the MEs submitted a proposed plan of action to destroy the plant material and assess the source of contamination as required by regulation, we reviewed CCC investigation records and found 4 additional pesticide tests for the same MEs. We cross-referenced each occurrence with CCC records, which included emails and internal incident reports from MEs, to determine whether MEs and ITLs reported positive pesticide test results to CCC within 72 hours, as required by regulation.
• We examined marijuana contaminant testing and sales data in Metrc to determine whether all products sold during the audit period were tested in compliance with protocols determined by CCC in accordance with Section 15(a)(2) of Chapter 94G of the General Laws. Specifically, using SQL Server Management Studio, we accessed Metrc and identified 246,433 production packages composed of tested and untested materials that were directly associated with a product sold during the audit period (i.e., packages containing materials from which these sold products were made). Sales of products made from these packages totaled $1,131,462,496, and consisted of 98,741 pounds of marijuana flower, totaling $661,913,668, and an additional 11,576,180 individual products containing marijuana, totaling $469,548,828. We traced the production history to identify steps where production packages were combined and cross‑referenced the packages to the laboratory test data to determine whether each production package was completely tested for all 21 contaminants, as required by CCC protocols.
• Using SQL Server Management Studio, we accessed Metrc and identified all 160,625 completely tested production packages that were directly associated with a product sold during the audit period. Sales of products made from these packages totaled $721,017,945, and consisted of 84,697 pounds of marijuana flower, totaling $565,736,408, and an additional 3,512,289 individual products containing marijuana, totaling $155,281,537. We then traced the production history for those packages to determine the date of the final contaminant test. We compared the final test date to the sale date of the product to identify any marijuana products that were sold more than one year after their final contaminant tests were completed.

Data Reliability Assessment

We assessed the reliability of the data obtained from Metrc by reviewing System and Organization Control reports⁵ that covered the audit period and ensured that certain information system control tests had been performed (see Finding 3). We also interviewed officials from CCC and Metrc about the system.

To determine the completeness and accuracy of laboratory testing records in Metrc, we selected a random sample of 40 testing records from Metrc and traced them to hardcopy certificates of analysis. We also randomly selected 40 hardcopy certificates of analysis and traced them back to the Metrc data. In addition, we compared the total number of laboratory testing records in Metrc to those found in the ITLs’ laboratory information management systems from the audit period.

Based on the data reliability procedures described above, we determined that the data obtained for our audit period were sufficiently reliable for the purposes of our audit work.

4.    SQL Server Management Studio is a software application used to recreate databases and perform analytical procedures.

5.    These reports review the effectiveness of internal controls over a service organization’s information systems and are conducted by independent certified public accountant or accounting firms.

Date published:	September 26, 2023