Audit of the Cannabis Control Commission Objectives, Scope, and Methodology

An overview of the purpose and process of auditing the Cannabis Control Commission.

Overview

In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of certain activities of the Cannabis Control Commission (CCC) for the period July 1, 2022 through June 30, 2024. When designing the audit plan for examining CCC’s employee settlement agreements, we extended the audit period to January 1, 2019 through December 31, 2024.

We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Below is a list of our audit objectives, indicating each question we intended our audit to answer; the conclusion we reached regarding each objective; and, if applicable, where each objective is discussed in the audit findings.

Objective	Conclusion
Did CCC administer the calculation, collection, and accounting for fees and fines collected in the marijuana regulation fund (MRF) on an equitable basis and in accordance with Sections 5 and 13 of Chapter 94G of the General Laws and Sections 500.005(1)(d) and 500.360(2) and (3) of Title 935 of the Code of Massachusetts Regulations (CMR)?	No; see Findings 1, 2, 6, and 7
Did CCC review, approve, and certify host community agreements (HCAs) and Community Impact Fees (CIFs) in accordance with 935 CMR 500.180(2)–(4)?	No; see Findings 3 and 6
Did CCC follow a process—dating back to January 1, 2019—that was in compliance with the Office of the Comptroller of the Commonwealth’s (CTR’s) “Settlements and Judgments Policy” when determining whether to enter into, and when reviewing and finalizing, employee settlement agreements?	No; see Finding 4 and 5

To accomplish our audit objectives, we gained an understanding of CCC’s internal control environment relevant to our objectives by conducting interviews and walkthroughs with management. Additionally, we reviewed CCC’s internal control plan, employee handbook, strategic goals, and applicable policies and procedures, including standard operating procedures and information technology safety guidelines. As part of our assessment of CCC’s control environment, we performed control testing in key operational areas, which included testing whether commissioner approval was obtained for all MRF fines issued during the audit period, whether reconciliations of revenue were completed and reviewed in a timely manner, and whether required documentation was maintained for background checks and final licensing checklists.

Note that, while performing our due diligence on CCC’s control environment, we identified certain issues within the control environment. See Findings 5, 6, and 7 for issues we identified with CCC’s control environment.

In addition to these actions, in order to obtain sufficient, appropriate evidence to address our audit objectives, we performed the procedures described below.

MRF

To determine whether CCC administered the calculation, collection, and accounting for fees and fines collected in the MRF on an equitable basis and in accordance with Sections 5 and 13 of Chapter 94G of the General Laws and Sections 500.005(1)(d) and 935 CMR 500.005(1)(d) and 935 CMR 500.360(2) and (3), we first interviewed knowledgeable CCC staff members and performed walkthroughs of key procedures related to the administration of the MRF. Additionally, we performed the procedures described below.

Fees

We identified a population of 69,645 fee transactions that occurred during the audit period. We split the population into the following two groups:

• transactions with moderate volume and high dollar values, which came to 2,948 transactions with average values of $10,238, and
• transactions with high volume and low dollar values, which came to 66,697 transactions with average values of $164.

From the two population groups described above, we selected the following samples:

• We selected a random, statistical⁶ sample of 60 transactions out of the total population of 2,948 high-dollar-value transactions, using a 95% confidence level,⁷ a 0% expected error rate,⁸ and a 5% tolerable error rate.⁹
• We selected a random, statistical sample of 30 transactions out of a total population of 66,697 low-dollar-value transactions, using a 95% confidence level, a 0% expected error rate, and a 10% tolerable error rate.

We determined whether the fees from our sample were calculated accurately; were collected in accordance with effective due dates; and were recorded completely and accurately in accordance with CCC guidelines, policies, and procedures by comparing records from the Massachusetts Management Accounting and Reporting System (MMARS) for each fee transaction to the records in CCC’s Massachusetts Cannabis Industry Portal (MassCIP). We also determined whether each fee was subject to proration and whether the proration was calculated, billed, and collected in accordance with CCC guidelines, policies, and procedures and applicable regulations.

For this aspect of our objective, we found certain issues during our testing. See Finding 1 for more information.

Fines

To determine whether the fines were calculated and levied in accordance with 935 CMR 500.360 and CCC’s policies and procedures, we identified the population of five fines for regulatory violations that were levied by CCC against noncompliant marijuana establishments during the audit period. We then performed the following procedures:

• We reviewed hardcopy documentation for each of the five fines levied and compared those records with MMARS records to determine whether the hardcopy documentation agreed with the corresponding fine amount billed to and collected from the applicable license.
• We compared each amount of the five fines levied to the corresponding amount of the agreed-upon fine within the Stipulated Agreements signed by each licensee.
• We compared certain information (i.e., the types of violations and the dollar values for each of the levied fines based on the type of violation noted, the number of violations, the length of time the violation(s) remained open, and the amount of the fine) between hardcopy documentation for each fine and reporting MMARS records.
• We compared the length of time it took CCC to administer the fine process for each of the levied fines with CCC’s standard operating procedures.

For this aspect of our objective, we found certain issues during our testing. See Finding 2 for more information.

Prorated Fees

To gain an understanding of CCC’s process for administering prorated license fees and license extensions, we interviewed knowledgeable CCC employees. Additionally, we took the actions described below.

CCC’s Prorated Fee List

We obtained a list of all prorated licensing fees that CCC identified and charged during the audit period, which contained 161 extensions, valued at $555,671. To determine whether these extensions were administered in accordance with applicable regulations, we took the following actions:

• We reviewed the list of prorated fees calculated, charged, and collected from licensees that extended their license expirations (161 extensions valued at $555,671). This list contained 136 unique license numbers.
• We compared the contents of CCC’s prorated fee list to the contents of a list of prorated fees from the MassCIP and determined that 114 out of 136 unique license numbers appeared on both CCC’s prorated fee list and the MassCIP list.
• We selected a judgmental, nonstatistical¹⁰ sample of 35 unique license numbers from the population of 114 unique license numbers included in CCC’s prorated fee list and recalculated the dollar value of the prorated fees.

MassCIP List

We obtained a summary of all extensions processed through MassCIP. This list contained 942 extensions processed during the audit period. To determine whether these extensions were administered in accordance with applicable regulations, we took the following actions:

• We reviewed a list of extensions from MassCIP to determine whether additional licenses should have been included on the list of prorated fees.
• We sorted the MassCIP list of license extensions to ensure that it only included those extensions that occurred during the audit period (942 extensions for 487 unique licenses).
• We compared the contents of the MassCIP list to the contents of CCC’s prorated fee list.
• For the manual extensions processed during the audit period (942 extensions for 487 unique licenses), we sorted these extensions into two groups: records contained in CCC’s prorated fee list (114) and records not included in CCC’s prorated fee list (373).
• We selected a judgmental, nonstatistical sample of 40 license numbers from the population of 373 license numbers not included in CCC’s prorated fee list and determined whether CCC identified the extensions by interviewing knowledgeable employees and reviewing fee documentation for the extensions.

For this aspect of our objective, we found certain issues during our testing. See Finding 1 and the Other Matters section for more information. 

HCAs

To determine whether CCC reviewed, approved, and certified HCAs and CIFs in accordance with 935 CMR 500.180(2)–(4), we took the following actions. First, we interviewed knowledgeable CCC staff members and performed walkthroughs of key procedures related to the HCA review process. CCC conducted two different review processes during the audit period.

HCA Review Process Effective Through February 29, 2024

CCC did not collect or review HCAs before March 1, 2024 and instead collected attestation agreements reached and submitted by host communities and individual marijuana establishments. CCC was not able to provide us a complete list¹¹ of HCAs from this period, so we reviewed the population of 14 counties in Massachusetts and found that 13 counties had municipalities that uploaded their HCAs onto their municipal websites, which were available publicly. (We excluded Nantucket County because its HCAs were not available publicly.) From these 13 counties, we then selected HCAs from the following municipalities: Boston, Brookline, Dartmouth, Douglas, Dudley, Greenfield, Holyoke, Newton, Northampton, Plymouth, Provincetown, Salisbury, Sandisfield, Somerville, and Tisbury. We ensured that we selected at least one municipality from each of the 13 counties. We then selected 2 HCAs from each county, totaling 26 HCAs. We inspected the HCAS and determined whether they contained a CIF of 3% or lower, contained no mandated donations to charity, and no mandated donations to the municipality (on top of the CIF).

HCA Review Process Effective Starting March 1, 2024

To determine whether CCC administered its HCA review process that was effective starting on March 1, 2024 in accordance with 935 CMR 500.180(2) and (3), we selected a random, nonstatistical sample of 35 newly reviewed HCAs out of a total population of 139 newly reviewed HCAs. We inspected the HCAs to determine whether they contained a CIF of 3% or lower, contained no mandated donations to charity, and no mandated donations to the municipality (on top of the CIF).

For this objective, we found certain issues during our testing. See Finding 3 for more information.

Employee Settlements

To determine whether CCC followed a process—dating back to January 1, 2019—that was in compliance with CTR’s “Settlements and Judgments Policy” when determining whether to enter into, and when reviewing and finalizing, employee settlement agreements, we first interviewed knowledgeable CCC staff members. Additionally, we inspected hard copies of legal invoices that CCC encumbered for the extended audit period and determined which were related to employee settlements.

During the extended audit period, CCC executed two employee settlement agreements, totaling $97,969.75. CCC used private, external legal counsel to handle these employee settlement agreements. CCC does not have a standard process for approving settlement agreements with employees; they are handled and approved on a case-by-case basis.

For this objective, we found certain issues during our testing. See Finding 4 for more information.

We used a combination of statistical and nonstatistical sampling methods for testing, and we did not project the results of our testing to any corresponding populations.

Data Reliability Assessment

Fines

To determine the reliability of the list of fines provided to us by CCC management, we checked the list for invalid records, duplicate records, and dates outside the audit period. Then, we selected all five items on the list and traced the license numbers and licensee names to MassCIP. We also traced the monetary amounts of all fines to the signed stipulated agreements used to levy the fines. In addition, we traced the monetary amounts of all fines to cash receipt records or to accounts receivable records if the amounts were uncollected or not yet due to be paid.

Fees

To determine the reliability of the list of fees, including prorated fees, from MMARS that CCC management provided to us, we relied on the 2022 assessment of MMARS performed by Office of the State Auditor. That assessment focused on testing selected system controls (access, security awareness, audit and accountability, configuration management, identification and authentication, and personnel security). As part of this audit we interviewed CCC employees who were knowledgeable about MMARS, which CCC used for accounting and depositing cash receipts into the MRF. In addition, we tested certain general information system controls, including security management (i.e., we obtained and reviewed cybersecurity awareness and training policies and procedures, personnel screenings/Criminal Offender Record Information background checks, and cybersecurity training certificates of completion) and access controls (i.e., supervision and review of user access to MMARS).

Further, we checked the list for invalid records, duplicate records, and dates outside the audit period. Then we selected a random sample of 20 fee transactions from the list and traced the dates, license numbers, and monetary amounts to MassCIP. Additionally, we selected a random sample of 20 fee transactions from MassCIP and compared the transaction data to the information recorded on the list of fees, including dates, license numbers, and amounts.

HCAs

To determine the reliability of the list of HCAs provided to us by CCC management, we checked the list for invalid or unusual data in the license number, license type, and licensee name fields. We also checked the list for dates outside the audit period and duplicate records. Then we selected a random sample of 20 license records from the list and traced the license numbers, licensee names, and establishment locations to MassCIP. Additionally, we selected a random sample of 20 license records from MassCIP and traced the license numbers, licensee names, and establishment locations to the HCA list.

Active Licensees

To determine the reliability of the MassCIP list of active licensees, including licensees with processed extensions, we checked the list for invalid or unusual data in the license number, license type, and establishment location fields. We also checked the list for duplicate records. Then, we selected a random sample of 20 license records from the list and traced the license numbers, licensee names, and establishment locations to MassCIP. Additionally, we selected a random sample of 20 license records from MassCIP and traced the license numbers, names, and establishment locations to the list of active licenses.

Legal Invoices

To determine the reliability of the hardcopy legal invoices provided to us by CCC management, we checked each invoice for invalid or unusual data and duplicate records. Additionally, we compared the total sum of the legal invoices provided by CCC to CCC’s legal spending reported in CTHRU, the Commonwealth’s statewide spending open records system, for the extended audit period, January 1, 2019 through December 31, 2024.

Additionally, we reviewed MassCIP system controls for access control, configuration management, contingency planning, segregation of duties, and security management.

Based on the results of the data reliability assessment procedures described above, we determined that the information we obtained during the course of our audit was sufficiently reliable for the purposes of our audit.

6.    Auditors use statistical sampling to select items for audit testing when a population is large (usually over 1,000) and contains similar items. Auditors generally use a statistics software program to choose a random sample when statistical sampling is used. The results of testing using statistical sampling, unlike those from judgmental sampling, can usually be used to make conclusions or projections about entire populations.

7.    Confidence level is a mathematically based measure of the auditor’s assurance that the sample results (statistic) are representative of the population (parameter), expressed as a percentage.

8.    Expected error rate is the number of errors that are expected in the population, expressed as a percentage. It is based on the auditor’s knowledge of factors such as prior year results, the understanding of controls gained in planning, or a probe sample.

9.    The tolerable error rate (which is expressed as a percentage) is the maximum error in the population that is acceptable while still using the sample to conclude that the results from the sample have achieved the objective.

10.    Auditors use nonstatistical sampling to select items for audit testing when a population is very small, the population items are not similar enough, or there are specific items in the population that the auditors want to review.

11.    We acknowledge that a complete list of HCAs may not be practical in the strictest sense. While easily accessible under public records law, it may not be practical for CCC to catalog HCAs that were entered into between a marijuana establishment and a host community, where that marijuana establishment never sought licensing from CCC. We do believe, however, that it is reasonable, achievable, and advisable to compile a complete listing of HCAs for all marijuana establishments that were or are licensed to conduct business in Massachusetts.

Date published:	August 14, 2025