You’re a licensed producer under the Access to Cannabis for Medical Purposes Regulations (ACMPR) and already being inspected by Health Canada.
So what do you need more risk management for?
First, what you are doing for Health Canada is not risk management. It’s compliance. The distinction is as follows: Organizations comply with regulations because they HAVE to while organizations manage risks because they WANT to; doing so creates measurable business value.
Although inspectors can come at any time to audit your physical security, record-keeping, or production practices, the uncertainties related to these are only some of your enterprise risks. What’s more, inspectors or auditors look at events after the fact while risk management is proactive and part of your daily operations.
Risk means different things to different people. When I ask anyone in an organization to tell me about their risks, most people respond with a prescribed list of potential hazards which are not always strategic risks nor the most important ones.
The universe of enterprise risks facing a Canadian medical cannabis company licensed under ACMPR is greater than the ones audited by Health Canada. These unknown risks must be identified, assessed and managed at an enterprise level in conjunction with a company’s regulatory requirements.