Cannabis operators are used to scrutiny. Licensing, inventory tracking, cash constraints, tax complexity, and state-by-state requirements already demand attention.

But a different kind of scrutiny appears as a business grows: auditors, lenders, investors, boards, strategic partners, and public-market stakeholders begin asking whether the financial reporting process is reliable, not just whether the company is licensed and compliant.

That is where many otherwise capable organizations feel friction.

The issue is rarely that the team does not care or that no controls exist. More often, the real process lives across spreadsheets, system workarounds, email approvals, institutional knowledge, vendor reports, and reviews that are performed but not consistently documented. The business may be producing the right answer, but it cannot quickly show how the answer was produced, who reviewed it, what evidence supports it, or what happens when something goes wrong.

Controls readiness means fixing those operating gaps before an outside party is waiting for the evidence.

Key Takeaways

• Strong internal controls improve audit readiness, investor confidence, and operational scalability.
• Inventory, financial reporting, cash management, and system access deserve early attention before outside scrutiny begins.
• Good documentation allows another qualified person to understand and reproduce financial processes.
• Automation improves efficiency but still requires governance, review, and accountability.
• Controls readiness creates long-term operational leverage, not just audit preparedness.

What Is Cannabis Controls Readiness?

Cannabis controls readiness is the process of ensuring that financial workflows, approvals, reconciliations, system permissions, reviews, and supporting evidence can withstand scrutiny from auditors, lenders, investors, boards, and other outside stakeholders.

Start With the Real Process, Not the Policy

A policy can describe how a process is supposed to work. Readiness depends on understanding how it actually works.

Take inventory and cost of goods sold. The written process may say that inventory records are reconciled monthly. The real process may involve a seed-to-sale platform, an ERP or general ledger, a cultivation or production workbook, manual journal entries, and a reconciliation that only one person fully understands.

The most useful readiness question is not "Do we have a reconciliation?" It is:

Can another qualified person follow the process from source data to the financial statements, understand the differences, see who reviewed them, and reproduce the conclusion?

That question exposes the difference between a control that exists informally and one that can withstand scrutiny.

Five Internal Control Areas Every Cannabis Operator Should Review

1. Inventory and Cost of Goods Sold

Inventory is often where operational complexity and financial reporting collide.

Operators should be able to explain how quantities and costs move from operational systems into the general ledger, how transfers and adjustments are approved, how physical counts are evaluated, how unusual variances are investigated, and how costing judgments are reviewed.

Common warning signs include unexplained differences between operational and financial systems, manual adjustments without a consistent approval trail, reconciliations that depend on one employee's knowledge, inconsistent treatment across locations or entities, and review evidence that shows a signature or email but not what was actually checked.

The goal is not to eliminate judgment. It is to make the judgment, inputs, ownership, and review visible.

2. Close and Financial Reporting

A fast close is not necessarily a controlled close.

Readiness requires a clear close calendar, assigned ownership, defined review expectations, support for journal entries, and a reliable method for resolving exceptions. If a deadline moves or a key employee is unavailable, the process should not become unknowable.

Focus first on the entries and reconciliations that are most material, complex, or manual. Ask whether the reviewer has enough information to challenge the work, not merely approve it. A strong review leaves evidence of what was evaluated, which differences were investigated, and why the final conclusion was reasonable.

3. System Access, Integrations and Automation

Finance teams increasingly rely on data that passes through multiple platforms before reaching the financial statements. That creates risk at the handoffs.

Operators should know who can create, change, approve, and post transactions; how access is granted, changed, and removed; which integrations are automated and which depend on manual uploads; how failed interfaces or incomplete data transfers are detected; and who reviews system changes that could affect financial reporting.

Automation and AI can reduce manual work, improve consistency, and help teams identify exceptions more quickly. But they do not remove the need for controls. They shift the control question toward data quality, access, change management, review design, documentation, and accountability.

An automated process is not automatically a controlled process. Someone still needs to understand what the system is doing, what could fail, and how the organization would know.

4. Cash, Treasury and Payment Workflows

Cannabis businesses often operate with unusual banking and payment constraints. That makes clarity around cash movement even more important.

Key controls should address who can initiate and approve payments, how bank account changes are verified, how cash activity is reconciled, how unusual transactions are escalated, and how duties are separated when staffing is lean.

When perfect segregation of duties is not practical, management should identify and document compensating reviews rather than assume the limitation is understood.

5. Evidence and Review Discipline

Many control issues are not failures to perform the work. They are failures to retain enough evidence to show that the work occurred and that the review was meaningful.

"Reviewed" should answer three questions:

• What did the reviewer examine?
• What exceptions or questions were identified?
• How were those items resolved?

Evidence should be understandable without relying on the memory of the person who prepared it. That is especially important when the process includes spreadsheets, exported reports, screenshots, email approvals, vendor-generated data, or AI-supported workflows.

Don't Overlook Spreadsheets and Third-Party Reports

Spreadsheets often become part of the financial reporting system even when nobody formally calls them that.

If a workbook drives an accrual, allocation, reconciliation, valuation, or journal entry, the organization should understand who owns it, which inputs are used, how formulas and changes are reviewed, and how the final version is retained.

The same applies to reports produced by vendors or applications. A report's professional appearance does not prove that it is complete or accurate for the intended purpose. Teams should understand the report parameters, source data, period covered, and any manual changes made after export.

A Practical Way to Begin

Readiness does not have to start with a company-wide controls project.

Choose one process that is financially important, highly manual, dependent on a key person, frequently adjusted, or often questioned. Then map it from beginning to end:

• Identify the source data and systems.
• Document the actual steps and handoffs.
• Name the preparer and reviewer for each critical activity.
• Identify what could go wrong.
• Confirm which control addresses each risk.
• Inspect the evidence retained for one recent period.
• Record the gaps, owner, priority, and target date.

This exercise usually reveals practical improvements quickly: unclear ownership, duplicate work, missing review criteria, fragile spreadsheets, inconsistent evidence, system handoffs that nobody actively monitors, or automation that lacks a clear human review layer.

Why Controls Readiness Creates Operating Leverage

Controls work is sometimes treated as a documentation burden that begins when an auditor or transaction demands it. That is too late, and it misses the business value.

Clear ownership, reliable reconciliations, disciplined review, better evidence, and responsible automation make it easier to scale, onboard employees, integrate systems, answer diligence questions, and make decisions with confidence. They also reduce the number of issues that become urgent simply because an outside party is waiting.

The best time to strengthen a process is before the scrutiny arrives. The second-best time is when the team recognizes that the current process depends too heavily on memory, heroics, or trust.

Start there.

Frequently Asked Questions About Cannabis Internal Controls

Q: What are internal controls in a cannabis business?
A: Internal controls are the processes, approvals, reconciliations, reviews, system permissions, and evidence that help a cannabis business operate reliably and support accurate financial reporting. In practice, controls help answer questions like: who can approve transactions, how inventory and cash are reconciled, how exceptions are investigated, and what evidence shows the work was reviewed.

Q: Why are inventory controls especially important for cannabis operators?
A: Inventory controls are critical because cannabis inventory is operationally complex, highly regulated, and directly connected to cost of goods sold, margins, compliance reporting, and financial statements. Differences between seed-to-sale systems, operational records, spreadsheets, and the general ledger can create audit friction if the company cannot explain and support how quantities and costs were reconciled.

Q: When should a cannabis company prepare for an audit?
A: A cannabis company should start preparing before an audit, financing event, uplisting, acquisition, or institutional diligence process is already underway. Ideally, teams should evaluate key controls several reporting periods in advance so they have time to document the process, remediate gaps, operate improved controls, and retain evidence before an outside party asks for it.

Q: Can a smaller cannabis operator improve controls without a large finance team?
A: Yes. Smaller operators can strengthen controls by focusing on the highest-risk areas first, such as inventory, cash, close, journal entries, system access, and key spreadsheets. When staffing is lean, the goal is not to create unnecessary bureaucracy. The goal is to clarify ownership, document review expectations, preserve evidence, and add compensating management reviews where full segregation of duties is not practical.

Q: Does automation eliminate internal-control risk?
A: No. Automation can reduce manual work and improve consistency, but it does not eliminate control risk. It changes the risk. Teams still need to understand the source data, access permissions, system logic, exceptions, change management, and review process. A well-designed automated workflow should include human accountability, documentation, and a clear way to detect and resolve errors.

Need Help Assessing Your Internal Controls?

Bricks Advisory helps cannabis operators strengthen internal controls, improve finance operations, prepare for audits and institutional diligence, and modernize financial processes through practical advisory services.

Bricks Advisory is a proud Cannabis LAB Corporate Member. View Alyssa's CLAB directory profile here.

About the Author

Alyssa Clarcq, CPA is the founder and principal consultant of Bricks Advisory, an independent advisory firm helping finance leaders strengthen internal controls, prepare for SOX and audit scrutiny, and modernize finance operations through practical process improvement, automation, and responsible AI adoption.

For cannabis operators, Alyssa focuses on controls readiness across inventory and COGS, cash, close and reporting, system and data handoffs, evidence, management review, vendor reports, and spreadsheet-dependent workflows.

Learn more at bricksadvisory.com/cannabis-sox

This article is provided for informational purposes only and should not be considered legal, accounting, tax, audit, regulatory, investment, or business advice. Readers should consult qualified professionals regarding their specific circumstances.