Cannabis companies have a big problem when it comes to banking, or rather, the lack thereof. As long as cannabis remains listed as a schedule 1 drug most banks will not allow canna companies access to their services. This creates a multitude of issues for these business owners as they have to process all transactions with cash.
Cash is inherently the most risky asset to maintain on your balance sheet simply because it can be easily stolen. When your entire business has to run on cash and revenues can be in the tens-of-thousands daily, you want to ensure you have put the appropriate internal controls and processes in place to know that your revenues are not walking out the door. The following are some key internal controls that, at minimum, should be implemented to mitigate fraud risks:
Separation of Duties
The concept of separation of duties (SoD) is simple: no one person should have the ability to perform certain incompatible job duties. For cash, this means the same person shouldn’t be able to handle cash (custody function), have the ability to adjust accounting or POS records (recordkeeping function), authorizing the use funds (authorization function), and reconciling the bank accounts to accounting records (reconciliation function). The purpose of these controls is to prevent an employee from stealing cash then subsequently covering it up by altering records.
Example: Bob works as a cashier for a retail dispensary and also performs the monthly book to bank reconciliation. Bob steals $5,000 of cash during the month and then adjusts sales records in the POS system to make the monthly total appear correct. This causes the POS reports to match what is shown on the bank statements. Without a separate analysis by another party the theft will go undetected. A separate employee should be performing the monthly reconciliation and reviewing any changes made to the POS system.
Receipts for All Transactions
Require your employees to provide a receipt to customers for every transaction. Put a customer-facing sign that states employees are required to provide a receipt and to inform them if they don’t. This prevents skimming schemes where employees pocket cash without recording a transaction.
Daily Register Balancing
At the end of each shift or each time a till is closed out the cash received should be counted by at least two employees, usually the cashier and a supervisor. Perform the count in an area that is only accessible by employees so customers can not see amounts being counted. The amount received should reconcile to the register report from the POS system. Both employees should sign the daily balancing slip to indicate they are accountable for their counts. The daily balancing reports should be maintained for recordkeeping and review purposes. A copy of the report should be provided to the bookkeeper or accountant so they can perform a daily review. This way, discrepancies will be quickly detected and corrected. An over/short log should be maintained for each employee during the month so over/short patterns can be analyzed. Employees with large patterns of over/shorts should be coached and retrained to minimize future errors.
Safeguarding of Cash
Cash should be maintained in a safe or vault where access is limited only to authorized individuals. Cashiers and bookkeeping staff should not have access to the vault without the aid of security or another authorized individual. Two people should deposit cash in the vault who did not prepare the daily register reconciliation. Locks should be changed periodically with the combination known only to authorized employees. If your company does have some kind of access to banking services consider using a third-party armored carrier to take funds for deposit. If an employee deposits the funds make sure they do not have access to any recordkeeping or accounting functions.
Also make sure you have sufficient security coverage of your operation. Cameras should be positioned to record cashier operations, cash counting, and on the safe/vault.
Ideally, a POS system will require a supervisor’s credentials or at least a second authorization before allowing a transaction to be voided. There should also be some form of audit trail that can be queried from the system to show every void that was performed for a particular day. This isn’t always the case depending on the system or software used. If the POS can provide a report it should be reviewed daily and reconciled to daily collections. Reasons for each void should be documented either within the system or on a manual slip signed by the voiding cashier and a reviewer. The slips should be maintained with the daily register balancing documentation.
This one should be a no brainer. Make sure you are vetting your staff prior to hiring them. If someone has been convicted to stealing from a former employer or theft in general, you don’t want them touching your cash.
A Word on Collusion
Internal controls can be used to minimize the risk of fraud but can never reduce the risk to zero. If you have employees engaging in collusion, or working together to perpetrate a fraud, it is very unlikely the internal controls implemented will stop them. As a business owner, be aware of this possibility and remain vigilant. Sometimes your gut will tell you when something isn’t right.
In conclusion, make sure you are implementing proper safeguards into your business. Taxes are already a killer on cannabis company margins. Don’t exacerbate that by allowing funds to simply walk out the door. If you have questions about your current procedures or would like help implementing new controls you can always reach out to us at Olympus CPA. We have the expertise necessary to review your current practices and help you implement best practices so you can have piece of mind over your operations.
David E. Lewis, CPA