Cannabis Control Commission - Finding 2

The Cannabis Control Commission violated state regulations and applicable policies by failing to ensure that fines were assessed and collected within reasonable timeframes and by not designating a hearing officer to oversee related hearings.

Overview

CCC did not consistently administer its fine process within the timeframes established by its own policies and applicable regulations pertaining to the completion of the notice of deficiency issued phase of the inspection process within 48 hours (see the image and table below for more information). In all five fines assessed by CCC during the audit period, key procedural steps, including the issuance of deficiency notices, the initiation of enforcement actions, and the finalization of stipulated agreements, were significantly delayed. Additionally, CCC did not have a designated hearing officer throughout the entire audit period, further impeding the inspection process.

The image below shows the workflow for CCC’s established inspection process. Note that the average number of days between each milestone was calculated based on the five fines levied during the audit period.

	Notice of Deficiency Issued	Enforcement Action Initiated	Letter of Enforcement Issued	Agreement Reached
Timeline Required by Regulation/Policy	48 Hours After Inspection	Not Specified	Not Specified	Not Specified
Actual Average Time	24 days	176 days	408 days	266 days

Fines

Fines Identified	Violation Summary			Assessed Amount
Fine 1	Exceeding cultivator tier limit Disregard for authority Compromise of public trust			$   22,275
Fine 2	Application of illegal pesticide Failure to maintain sanitary conditions			10,000
Fine 3	Failure to maintain sanitary conditions Failure to promote workplace safety Failure to mitigate environmental impact during cultivation			200,000
Fine 4	Failure to record sale of product Failure to report inventory discrepancy Failure to follow standard operating procedures Failure to cooperate with investigation			60,000
Fine 5	Failure to follow standard operating procedures Failure to maintain training records Failure to process products safely Failure to implement policies and procedures Submission of inaccurate information			350,000
Total				$ 642,275

Inspection and Notice of Deficiency

During the audit period, there were five inspections that had notices of deficiency resulting in fines. We determined that, for each of the five inspections resulting in a fine, a notice of deficiency was not delivered to the marijuana establishment within 48 hours of the date of inspection, in accordance with CCC’s Notice of Deficiency process document. We determined the following:

• In three of the five cases, the notice of deficiency was delivered between 5 and 10 days after the inspection.
• In the two remaining cases, the notification of deficiency was delivered over one month after the inspection.¹⁴

Enforcement Action Notification

We determined that, for each of the five fines tested, CCC notified the marijuana establishments that enforcement action would occur following alleged failures by the marijuana establishment to remediate identified deficiencies. We determined the following:

• In one case, it took 14 days for CCC to notify the marijuana establishment of enforcement action.
• In the four remaining cases, it took over 60 days for CCC to notify the marijuana establishments of enforcement action.
  • In one of these four cases, it took over 400 days for CCC to notify the marijuana establishment of enforcement action.

Letter of Enforcement Issued and Agreement Reached

We determined that, after enforcement action was initiated, it took an average of 408 days for CCC to issue a letter of enforcement to the marijuana establishment and an average of 266 days after the letter of enforcement was issued for both parties to reach a stipulated agreement.

Overall Process

Overall, it took an average of 873 days from the initial inspection date to the date that a stipulated agreement was reached.

CCC’s enforcement process was marked by significant delays. Additionally, the absence of a designated hearing officer further disrupted the timely processing of enforcement appeals.

While regulations and policies do not specify a timeline for all subsequent steps of the inspection process, they do require that enforcement action be initiated and carried out in a reasonable time.¹⁵

Hearing Officer

During the audit period, CCC did not have a designated hearing officer to oversee administrative hearings related to fines, sanctions, and/or other enforcement actions taken against marijuana establishments.¹⁶ The hearing officer position became vacant at the beginning of the audit period in July 2022 and remained unfilled through June 2024. (See Finding 5 for more information regarding staffing issues.) As a result, CCC was unable to conduct timely administrative hearings or facilitate the appeals process for licensees.

The absence of both timely enforcement and a hearing officer may have allowed unresolved compliance issues at marijuana establishments to persist or worsen. Delays in enforcement undermine regulatory effectiveness by adversely impacting CCC’s ability to enforce applicable laws and regulations and may create an inequitable situation, especially for establishments that lack the resources to independently navigate prolonged enforcement processes. Lengthy timeframes, especially around enforcement action, put customers at potential risk either of purchasing and consuming contaminated or expired marijuana products or of being exposed to other public health risks. Additionally, the lack of a hearing officer may have compromised due process rights for licensees subject to fines and enforcement actions.

Authoritative Guidance

CCC’s Notice of Deficiency Process states,

A Notice of Deficiency (NOD) must be cited for every violation identified at the time of inspection. Even if the licensee corrects the deficiency at the time of inspection, the lead Investigator (INV) or Compliance Officer (CO) must proceed with the issuance of an NOD.

1. The lead INV or CO drafts the NOD using the approved template found in the Teams folder labeled Templates & Forms.

The NOD must be sent to the licensee within 48 hours of the inspection unless the INV/CO provides justification for sending it after that timeframe.

CCC’s Breakdown of Investigations & Enforcement Process states,

• If noncompliance is found during the inspection, the lead Investigator or Compliance Officer (“Lead”) will draft a Notice of Deficiency (NOD), which outlines each regulatory violation in detail. . . . The NOD is then sent to the Licensee. This begins the NOD/Plan of Correction (POC) process (“NOD/POC Process”). . . .
  • Once the NOD is received the Licensee, it then has 10 business days to draft and submit a POC that outlines how the Licensee plans on bringing their facility or operation back into compliance with the regulations. . . . This must include “specific corrective steps to be taken, a timetable for such steps, and the date by which compliance will be achieved.” 935 CMR 500.320(2) and 501.320(2). The Commission has considered and approved extensions to the 10-day deadline on a case-by-case basis if requested by the Licensee.
  • If the POC satisfies the above requirements, the Lead will accept the POC and notify the Licensee. . . . The Lead will also request proof of corrective actions taken by the Licensee.
  • If the POC does not satisfy those requirements, the Lead will notify the Licensee that the POC has been rejected and the reasons for that rejection. . . .
  • A POC may be rejected or accepted in whole or in part. . . .
  • After the Licensee receives a notice of rejection, it then has 5 business days to amend and resubmit a satisfactory POC. . . .
  • During this time, the Lead may conduct further inspections in order to ensure that the Licensee is complying with/meeting the milestones laid out in their POC.
  • If an adequate POC cannot be submitted, or the Licensee is otherwise unable to bring their operation into compliance with the regulations, Investigators will then begin an investigation to examine the Licensee’s noncompliance and to determine if the violation is ripe for an enforcement action. Even if the Licensee has submitted an accepted POC, this does not preclude the Commission from conducting further investigation. . . . This is a fact dependent determination.

According to 935 CMR 500.320,

(1) A Marijuana Establishment or Host Community shall submit to the Commission a written plan of correction for any violations cited in the deficiency statement issued pursuant to 935 CMR 500.310, within ten business days after receipt of the statement.

(2) A plan shall state, with respect to each deficiency, the specific corrective step(s) to be taken, a timetable for such steps, and the date by which compliance will be achieved. The timetable and the compliance dates shall be consistent with achievement of compliance in the most expeditious manner possible.

(3) The Commission shall review the plan of correction and shall notify the Marijuana Establishment or Host Community of either the acceptance or rejection of the plan or any component of the plan.

(4) An unacceptable plan shall be amended and resubmitted within five business days after receipt of such notice.

(5) The approval of a plan of correction shall not preclude the Commission from issuing an order for further corrective action fixing a reasonable time for correction of the violation, assessing an administrative fine, or taking any other administrative action authorized under the Commission’s regulations.

(6) A Marijuana Establishment or Host Community shall notify the Commission once the plan of correction has been fully implemented and completed.

According to 935 CMR 500.360,

1. Notice of Fines or Sanctions. The Commission or a Commission Delegee shall send written notice of the action taken against a Licensee, Registrant, or Host Community and the basis(es) for that action which shall include, but not be limited to, the following information:
   1. The Commission’s statutory and regulatory authority, including its jurisdiction over the subject matter and its authority to issue the order with regards to the License, registration, or HCA;
   2. The factual basis(es) of the order;
   3. The alleged violation(s) of law;
   4. An assessment of an administrative fine of up to $50,000 per violation, or an order for corrective action fixing a reasonable time for correction of the violation or both; and
   5. Notice to the Licensee, Registrant, or Host Community that they may request a hearing in accordance with 935 CMR 500.500.

According to 935 CMR 500.500,

(4)  Hearing Request. The hearing request shall be submitted in a form and a manner determined by the Commission or a Commission Delegee including, but not limited to, the request shall be made no later than 30 days after the effective date of the notice. A request for a hearing is filed on the date the request is received by the Commission.

1. A timely request for a hearing shall specifically identify each issue and fact in dispute and state the position of the Licensee, Registrant, or Host Community, the pertinent facts to be adduced at the hearing, and the reasons supporting that position. The Commission’s statutory and regulatory authority, including its jurisdiction over the subject matter and its authority to issue the order with regards to the License, registration, or HCA;
2. The failure to timely file a request for a hearing or to state the basis of the hearing request will result in dismissal of the challenge to the findings set forth in the notice of violation(s) or action(s).
3. If a timely request for an hearing is made, the Licensee, Registrant, or Host Community may also seek to stay any action until there has been a final agency action pursuant to 935 CMR 500.500(7) or (12); provided, however, that if the Commission issues an order or notice on the basis of information that ongoing operations pose an immediate or serious threat to the public health, safety or welfare, and that operations without restrictions during the pendency of the administrative appeal could reasonably be expected to endanger the health, safety or welfare of the public, there will be no stay.
4. Nothing in 935 CMR 500.500 shall preclude the Commission or a Commission Delegee from issuing a stay.

(5)  Hearing Officer. The Commission shall designate a Hearing Officer or delegate this designation to the Executive Director. . . .

(7) Commission’s Authority to Review, Approve or Reject Informal Dispositions. At any time, the Commission or a Commission Delegee may, in its discretion, review, approve or reject an informal disposition, but only on a showing that the alleged violations have been corrected, and a submission of a written waiver of its right to judicial review.

(8) Hearing Notice. If a hearing is requested in a timely manner under 935 CMR 500.500(4) the Hearing Officer shall provide notice and a hearing within a reasonable time after that request, or as soon as is practicable, or at a time mutually agreed by the parties.

1. The hearing notice should comply with [Section 11(1) of Chapter 30A of the General Laws].
2. Prior to the commencement of a proceeding, a Hearing Officer may conduct conference(s) and refer or require the parties to participate in settlement negotiations. If the parties reach a settlement, the Hearing Officer shall suspend the proceedings pending Commission consideration of the matter under 935 CMR 500.500(7).

(9) Conduct of the Hearing

1. To the extent that a Hearing Officer conducts a proceeding, it shall be conducted pursuant to [Chapter 30A of the General Laws] and the Standard Adjudicatory Rules of Practice and Procedure, which includes 801 CMR 1.01: Formal Rules, 801 CMR 1.02: Informal/Fair Hearing Rules, and/or 801 CMR 1.03: Miscellaneous Provisions Applicable to All Administrative Proceedings.
2. In the case of an Order to Show Cause why a License should not be suspended or revoked, the hearing shall be conducted pursuant to [Sections 10, 11, and 12 of Chapter 30A of the General Laws].
3. If after the commencement of the hearing, the parties reach a settlement, the Hearing Officer shall suspend the proceedings pending Commission consideration of the matter under 935 CMR 500.500(7).

Reasons for Issue

CCC moved the hearing officer to a different position within CCC and did not fill the hearing officer position after this staffing change because, CCC stated, there was minimal hearing activity at the time. CCC’s Investigation and Enforcement Counsel relied on negotiated settlements rather than the hearing process, resulting in lengthy enforcement periods.

Based on our review, existing regulations and CCC’s current standard operating procedures do not establish specified timelines for enforcement actions to be completed.

Recommendations

1. CCC should establish, document, and follow specific timelines for the assessment and collection of fines throughout all phases of its inspection process.
2. CCC should designate a hearing officer pursuant to its regulations.

Auditee’s Response

CCC’s Recommendation 1 response was as follows:

The [Office of the State Auditor’s (SAO’s)] finding misapprehends the Commission’s Investigations and Enforcement process and misapplies the applicable rules and regulations to reach a conclusion that fails to acknowledge the case-specific nature of each enforcement action. The calculations of the average time for each step of the investigation and enforcement process are overly simplistic and fail to consider important parts of the process.

As a general matter, Investigations related to routine matters of non-compliance are often addressed within weeks of discovery after providing the Licensee with a Notice of Deficiency and an opportunity to provide the Commission with acceptable Plan of Correction. Some complaints that are received by the Commission may not fall within the agency’s jurisdiction; these matters are resolved quickly through referrals to other agencies (e.g., [the Office of the Attorney General or the Massachusetts Commission Against Discrimination]) or law enforcement when appropriate. Additionally, some matters and inquiries are resolved within weeks of initiating an investigation without further administrative or enforcement action. More complex investigations may take months, or in some instances years, depending on the specific matters of noncompliance, which are at times egregious in nature, and in some instances requires collaboration with other agencies that share jurisdiction (e.g., [Department of Public Health], [Massachusetts Department of Agricultural Resources (MDAR)], [Occupational Safety and Health Administration], U.S. Coast Guard, [Drug Enforcement Administration], etc.).

First, it is important to note that a referral from Investigations to Enforcement Counsel should not be considered the “initiation of an enforcement action.” In some instances, a referral may result in no further action, or identify the need for additional investigative steps. The majority of enforcement actions reviewed by the SAO were initiated via a Letter of Enforcement Intent, which is an informal notice to the Licensee indicating that the Commission intends to take formal enforcement action—in these cases, because they were resolved via a stipulated agreement, no formal enforcement action was initiated.

Second, the SAO seems to conflate issuance of a Notice of Deficiency (NOD) with the start of an investigation. Instead, NODs are a routine compliance tool used to notify a licensee of any observed or discovered deficiencies. NODs are issued following regular compliance examinations or through focused investigative inspections and interviews. Equally important as the NOD is the Plan of Correction (POC), a process by which the licensee is responsible for identifying its proposed corrective steps to address areas of non-compliance outlined in the NOD. This process is completely left out of the SAO’s analysis.

Third, the SAO criticizes the Commission for issuing NODs more than 48 hours after inspection. However, pursuant to the process on NODs makes clear, there are situations in which the 48-hour turnaround is neither expected nor appropriate. Numerous factors contribute to when an NOD is issued, including whether additional follow up is needed to substantiate the NOD, the Investigator/[Compliance Officers] additional workload, as well as to accommodate internal review processes. The 48-hour rule is not a regulatory expectation or requirement, it is a self-imposed goal contained in a [standard operating procedure].

Finally, contrary to the SAO’s conclusion that lengthy enforcement actions may subject the public to health and safety risks, the Commission routinely takes steps to ensure public health and safety in instances where Marijuana or Marijuana Products may be contaminated or present a risk to public health or safety. These include Administrative Holds, Summary Suspension Orders and Quarantine Orders, to name a few. Moreover, in instances where pesticide contamination is detected, the Commission coordinates with MDAR as the primary authority relative to regulation of application and use of pesticides in the Commonwealth. MDAR routinely requires products to be held and/or destroyed following an unauthorized pesticide detection.

CCC’s Recommendation 2 response was as follows:

Pursuant to CCC regulations (935 CMR 500.500(5)), the Commission has designated a Hearing Officer. The Hearing Officer began working with the Commission on October 20, 2024. All matters before the Hearing Officer are current and there is no backlog.

Auditor’s Reply

1. For testing, we isolated the parts of the fine process that are administered by CCC itself, not those that are completed by the licensees. Even if the regulation does not mandate a specific enforcement timeline, CCC internal policies do establish a timeline, and CCC failed to meet them. We acknowledge that the 48-hour turnaround for notices of deficiency is not a regulatory requirement, however it is a requirement of CCC’s Notice of Deficiency Process—“The [Notice of Deficiency] must be sent to the licensee within 48 hours of the inspection” (emphasis added). It was communicated to us during interviews that the Notice of Deficiency Process was being followed by CCC personnel. However, as CCC itself acknowledges in its response, that is not the case, even though CCC itself set this timeline to govern its own activities. We find it concerning that CCC is defending its consistent violation of its own standards and policies rather than acknowledging its failure to meet them. If CCC disagrees with its own policies, it is within the Commission’s authority to modify them.

   Our finding is that fines were not assessed and collected in established timeframes. We would expect to see established timeframes set for the administration of fines, regardless of their complexity, and in the event that timeframes cannot be adhered to, a process to document these challenges and assign new timeframes. Furthermore, the lack of a designated hearing officer meant that CCC had no formal process for holding timely and independent hearings of disputes, which contributed to the timeliness issues with the stipulated agreements that CCC relied on during the audit period. In this instance and others highlighted in this report, the lack of documentation during the audit period has created multiple risks for CCC, the public, and the industry regulated by the agency.

2. CCC stated that it designated a hearing officer who began to work with the Commission in October 2024. While this occurred after we highlighted this issue as part of our audit, we applaud this change and will follow up on this matter in approximately six months as part of our post-audit review process.

14.    For one of the fines tested, CCC noted a process exception that would have reduced the number of days used to calculate our test results. This process exception was not communicated to us during the audit, and even if we had adjusted the values accordingly, CCC would still be in noncompliance.

15.    CCC uses the term reasonable time in 935 CMR 500.360 and does not define it further.

16.    For the notices of deficiency issued during the audit period, CCC used fines as its only enforcement mechanism and did not use sanctions or other enforcement actions.

Date published:	August 14, 2025