Not a 404 Error: Understanding SOX 404, How it Works, and How it Affects Your Cannabis Business

As many cannabis companies tread through the miles of red tape and changing business landscapes that make up the U.S. cannabis industry, many of their business owners and their investors are faced with questions and deep concerns as they explore which direction to grow their ventures, especially when it comes to going public.

CBE Contributor Dan Roda, CEO of Abaca, sat down to discuss Sarbanes-Oxley (SOX) Section 404,

one of the many regulations facing publicly-traded cannabis companies in an ever-changing and often confusing industry, with cannabis accounting expert Curtis Winar, CPA/CFF, CVA with Frost, PLLC.

Sarbanes-Oxley (SOX) Section 404 is part of a framework that requires public companies to implement and maintain controls and processes that protect enterprise and investor value. According to the U.S. Securities and Exchange Commission, Section 404 of the Sarbanes-Oxley Act “requires public companies’ annual reports to include the company’s own assessment of internal control over financial reporting, and an auditor’s attestation.”

Remember Enron? After multiple major scandals concerning fraudulent accounting practices by companies such as Enron itself, Tyco, and WorldCom, the Sarbanes-Oxley Act of 2002, more commonly referred to as SOX or Sarbox, was created and passed in the U.S. to protect investors from fraudulent accounting activities by corporations. This act requires all publicly-traded companies in the United States to follow strict guidelines concerning more transparent financial disclosures in an effort to reduce accounting fraud and protect those companies’ investors.

Sarbanes-Oxley also regulates accounting firms that perform auditing services for any U.S. public company, requiring that internal accounting controls are implemented, functional, and effective. In our discussion,we talk about implementing internal controls, the best time to start conducting internal controls, inventory concerns, raw materials issues, and much more. For those looking to take their cannabis business venture public or who want to learn more about the expectations and requirements within SOX 404, read our thoughtful discussion with Winar that is sure to answer questions concerning SOX 404.

Roda: What is a high-level overview of Sarbanes-Oxley and SOX 404 compliance and why should cannabis companies care?

Winar: SOX 404 is a part of the Sarbanes-Oxley rule that does internal controls and is required for most publicly traded companies, but not all. There are some exceptions, but the majority are required to have internal control compliance. 

Companies need to make sure that they have their internal controls in place, focusing on all the items that are required to meet a SOX 404 audit. An auditor will come in and pressure-test your controls, so your management team needs to identify and test internal controls before the audit.

Roda: When should a cannabis operator be thinking about getting their internal controls together, anticipating SOX 404 compliance? 

Winar: That’s a tough question. It really depends. If you’re looking to be a publicly traded company, start looking at requirements. You’re probably already doing audited financial statements, but you’re probably not including any SOX 404 compliance issues or internal controls. Know what those compliance and internal control requirements are so you can plan. Many folks will skip testing internal controls because it’s costly, but it is highly beneficial.

If a privately held cannabis company hopes to be acquired by a publicly traded company, it should invest in testing and implementing these controls, because the publicly traded companies will certainly expect internal controls when reviewing financial statement audits as it relates to financial reports. Many mistakes, from IT processes to inventory management, can affect the integrity of the financial statements, and auditors will catch that. Internal controls will help identify and cure these mistakes before reputational risks that can kill the deal arise.

Roda: If you’re a privately held company and you’re looking to get acquired or go public, should you start SOX compliance now or just have a game plan?

Winar: It’s smart to be thinking about putting internal controls in place before you go public. If you are faced with an IPO process or an acquisition, you’re going to have to prove or show that you have those internal controls in place. If it’s a publicly held company that’s acquiring you, they’re going to have to put those in place, too. If you have something in place and you can show those internal controls, you probably add value to your company.

Roda: What are best practices or ways a cannabis company may get a better handle on internal controls? 

Winar: Cannabis companies are cash intensive, so looking at both technology-related and physical controls, like segregation of duties in cash collections, accounting and sales, would be a good starting point. How is your cash getting to the bank? Are you using banking technology for internal controls? I’ve seen clients take in less cash and use a banking service to help mitigate some of the controls that may fail with handling a lot of cash.

And it’s not just cash … it’s a high value inventory, too. Most states have requirements for seed-to-sale tracking systems that can help improve on your internal controls. Using technology to know where everything in inventory, from raw material to finished product, is moving, how well it is being tracked, and any potential shrinkage or waste is imperative to track. Make sure your policies and procedures are in place to track those. 

Roda: What might these internal controls look like in practice at a dispensary?

Winar: I was in a facility recently that implemented a fulfillment model with internal controls for how to distribute products to the customer. The products are never touched by the customer or the individual budtender. Just on the other side of the wall in the dispensary, there’s a fulfillment center. The order is received via app in the fulfilment center and the fulfillment center employees bring the product through a window in a sealed bag for the customer to pick up. That’s an example of a good internal control for both the collection of funds and the control of the product that comes in and out. Payment was made electronically via the app and the fulfillment center ensures proper product distribution via a sealed bag. A great example of both technology-based and physical segregation of duties.

Roda: If someone wants to learn more about SOX compliance, where do you suggest they turn?

Winar: Find a qualified CPA firm. Frost has a group that specialize in SOX 404 work with publicly and non-publicly traded companies. Not all accounting firms and not all auditors understand the function. It is a very detailed process; it’s costly, but may be worth it. Our partners at Frost that work with publicly traded companies and deal with the SOX 404 can really get into the details of what it takes to start implementing it and seeing what it takes to put in place on a consulting level before you get to a point where you need it with your financial statement audits, and try to get ahead of it and you do it on a consulting basis.

The post Not a 404 Error: Understanding SOX 404, How it Works, and How it Affects Your Cannabis Business appeared first on Cannabis Business Executive - Cannabis and Marijuana industry news.