Who’s watching the weed? Everyone on your team plays a role in internal controls for your cannabis business.
Because when you’re operating in a high-risk, cash-heavy, and compliance-driven industry, hoping nothing goes wrong isn’t a strategy. It’s an invitation for fines, shutdowns, or worse.
I’ve seen the damage poor internal controls can do—especially in cannabis. So let’s break down what internal controls really mean, and how to make them work, even in small or scrappy teams.
From METRC reporting to seed-to-sale tracking to the piles of cash still moving through dispensaries and grow ops, the stakes are too high to leave internal controls as an afterthought.
What Internal Controls Are (and Why Cannabis Businesses Can’t Afford to Ignore Them)
Internal controls are the systems, checks, and processes that prevent errors, reduce fraud, and keep your business compliant.
Whether your business is large or small, solid internal controls will help you navigate the A-Z of your business, including:
- Federal illegality + state regulation
- High cash volumes
- Limited banking access
- Complex inventory tracking requirements
Wondering what they look like? Most internal controls fall into three main categories:
- Preventive: Access controls, approval workflows, role separation
- Detective: Audits, reconciliations, activity monitoring
- Corrective: Issue response plans, exception reviews, updated procedures
Your First and Strongest Line of Defense is Separation of Duties
One of the most important—and most overlooked—controls is Separation of Duties.
It’s pretty straightforward and means exactly what it sounds like — that no single person should be responsible for an entire transaction or process, especially when it comes to purchasing or invoicing. It introduces accountability and oversight by dividing critical tasks between team members.
Here’s why this matters so much:
We once worked with a company where the same person was responsible for both entering bills and paying them. Over time, she started paying her own mortgage and utilities—disguised as vendor expenses. No one caught it until we stepped in and untangled the mess.
In cannabis, this is often where operators struggle. Small teams, lean staffing, and rapid growth lead to shortcuts like one person handling inventory, sales reporting, and METRC entries. And while it can be challenging, there are a few ways to insert checks and balances
Smart separation of duties practices in cannabis might look like this:
- Cash management: Where possible, Mmore than oneteam member counts cash, another deposits, a third reviews the reconciliation.
- Inventory oversight: Physical counts by one employee, reconciliation and approval by a supervisor.
- METRC compliance: Staff enters data, but a manager or outside controller reviews entries for accuracy.
And if you’re thinking, “but we’re too small to divide things up,” here are a few suggestions. Too small to divide roles?
- Use tech: Set up system permissions, audit logs, and alerts.
- Outsource it: A fractional CFO, bookkeeper, or controller can create separation even in a 3-person team.
- Rotate duties: Shift roles periodically to avoid long-term control by a single person.
METRC and Seed-to-Sale Tracking: Compliance Is Not Optional
METRC might be required, but how you use it determines your risk exposure. By now you probably know what can go wrong — late or inaccurate entries, unreconciled inventory, inconsistent POS integration, and even overly broad access (everyone logs in as “admin”).
There are a few simple practices we always recommend putting in place, which usually include:
- User-specific logins and permissions
- Daily or weekly reconciliation between physical inventory, POS, and METRC
- Dual review of key changes or adjustments
- Documented SOPs for intake, adjustments, destruction, and transfers
When auditors or inspectors show up, sloppy METRC data is one of the first red flags they’ll catch. And if your reports aren’t accurate, that’s a great way to ensure auditors and inspectors WILL show up.
Cash Handling & Banking Workarounds
Most cannabis businesses still operate with large amounts of cash. That increases theft risk—from inside and out. Whether or not you have banking access, there are ways to control what you can to mitigate your risk. Some of our to recommendations include:
- Use cash recyclers to reduce touchpoints and human error
- Require dual counts and signed logs
- Store cash in limited-access vaults or safes with audit logs
- Use armored transport services when possible or required
- Separate duties: the person who handles the cash should not be the one entering it into the books
If you are working with a cannabis-friendly bank, layer your controls:
- Limit who can initiate vs. approve transfers
- Reconcile cash and POS daily
- Review debit settlements and reconcile to POS. Be sure that fee revenue for debit processing is properly recorded
The Risk Isn’t Just Compliance—It’s Your License, Reputation, and Cash Flow
Internal controls aren’t just about satisfying regulators. They’re about preventing theft, avoiding penalties, protecting your license, and improving cashflow. Plus, I always see clients gaining operational clarity and a true understanding of their bottom lines.
After all, even simple control improvements can lead to faster audits, cleaner books, and fewer compliance headaches and more profit.
Next Steps: Strengthen Your Internal Control Strategy
If your current internal controls are nonexistent or depend on one key employee not screwing up, it’s probably time for a reset.
Take some time to audit all of your processes and start streamlining and separating the duties—starting with key financial ops. And if you’re looking for support, we’d love to chat with you about what working together might look like.
In cannabis, where the rules are evolving, the risks are high, and the margins are tight, it pays to build a business that’s hard to break.
0 Comments