Previously this month, the Oregon Secretary of State’s workplace unveiled a official audit report (“Report”) of the Oregon Liquor Manage Commission’s (OLCC) information and facts technological know-how techniques as they relate to Oregon’s recreational hashish regulatory enforcement. The Report, titled “Oregon Liquor Manage Commission: Hashish Information Techniques Appropriately Functioning but Monitoring and Security Enhancements are Needed“, centered on two independent but connected problems: 1) the OLCC’s Marijuana Licensing Process (MLS) and Hashish Tracking Process (CTS), and 2) common IT security fears and catastrophe recovery techniques. The Report and the OLCC’s official composed reaction (“Response”) paint a image of an underfunded company executing its greatest to create appropriate techniques and procedures in the confront of a special rising market, unforeseen need for licenses, stringent statutory deadlines, an an at any time-transforming regulatory framework. It is also obvious that the Secretary of Condition and the OLCC worked very well alongside one another for the duration of the audit course of action, as just about every celebration enhances the other on transparency, professionalism, and frequent courtesy.
The audit was initiated to ascertain whether or not:
- the OLCC has ample technical controls in place to assure that the MLS and CTS are supporting powerful regulation of the recreational hashish market and
- the OLCC has applied ample security techniques to protect towards recognised technical and physical threats.
Nowadays we will aim only on problems lifted relating to the MLS and CTS.
Marijuana Licensing Process (MLS) and Hashish Tracking Process (CTS)
The Report and the Reaction provide an interesting seem at how these two impartial but connected techniques came to exist. When Oregon handed Measure 91 and then HB 3400 (2015), the OLCC was charged with generating and implementing a regulatory framework for an totally new market with restricted deadlines and inadequate means. The OLCC moderately made a decision that the only useful answer was to retain the services of third-celebration contractors to provide Software package as a Service (SaaS) methods. The OLCC hired the corporation that designed Colorado’s seed-to-sale tracking process to customize Colorado’s process to provide Oregon’s requires, ensuing in the CTS, an on the web portal that enables OLCC licensees to enter data about harvests, sales, and so on. The OLCC hired a independent corporation to build its license software and renewal program, the MLS.
Following choosing these distributors, OLCC was pressured to consistently overhaul these techniques in reaction to extensive legislative rewrites to the recreational system in 2015, 2016, and 2017. In recognition of these complications, the OLCC requested funding for a total time Main Information Officer in the 2017 legislative session, but was denied. The Report and the Reaction the two highlight the worth of filling this posture, and the OLCC will be inquiring for more funding from the legislature again this session.
In a nutshell, the CTS is Oregon’s licensee portal the place licensees are required to self-report information and facts about inventory, transfers and sales. The MLS is the OLCC’s on the web process for tracking license applications and licensee position.
We recognized various weaknesses linked with OLCC’s new IT techniques used for cannabis licensing and tracking. They contain data integrity and maturity problems, and inadequate procedures for taking care of cannabis pc courses and distributors. Till these problems are settled, the company might not be in a position to detect noncompliance or illegal action transpiring in the recreational cannabis system. – The Report
The Report identifies five common weaknesses in the CTS and connected enforcement:
- the CTS relies on self-described data that is inherently susceptible to inaccuracies
- the CTS enables people to enter measurements in both metric or imperial ensuing in more problems
- present licensees are likely abusing a policy that enables new licensees to introduce hashish into the recreational regime from any supply
- inadequate data excellent hampers the OLCC’s potential to watch the Oregon marketplace as a entire
- the OLCC lacks ample qualified staff for normal on-web-site inspections.
Even with the more staff, OLCC might not be in a position to assure an appropriate quantity of scrutiny for cannabis firms. Equally Alaska and Nevada have roughly 1 inspector for each and every 18 recreational cannabis licenses. At present, Oregon only has 1 inspector posture for each and every 83 recreational cannabis licenses. – The Report
The Report also notes that the OLCC does not consider ample ways to watch their third-celebration SaaS suppliers, has inadvertently saved test data in the active MLS databases, and has inadequate controls above consumer accounts. At last, the Report notes that the MLS and CTS are not set up to automatically update just about every other. For illustration, a licensee with revoked position in MLS could however have active position in CTS.
In its Reaction, the OLCC commonly agrees with all of the Report’s findings and states that, subject to acquiring more funding from the legislature, it will do the job diligently to put into practice the Report’s tips. The OLCC refers to the MLS and CTS as “state-of-the-artwork imperfection” and notes that although problems exist, the CTS process has now recognized 1000’s of discrepancies that have led to investigative and enforcement steps, and that even negative data is meaningful.
Citizens and policy makers want to know that as essential as the problems recognized in this audit are, the OLCC is not dependent on the CTS process by itself to establish licensees that are trying to use the point out process as a deal with for diversion. The CTS process is 1 essential tool for prosperous enforcement and compliance . . . the audit tips aim on strengthening the all round usefulness of the process which the audit acknowledges is appropriately working. – The Reaction
The consider away here is that the CTS process is not damaged. It is now aiding to restrict diversion and promote general public basic safety, but like any process, it can and need to be enhanced. On the entire, the general public and licensees need to assume that the OLCC will be applying normal, random on-web-site inspections to assistance the CTS, and refining the CTS process to do away with prospects for confusion or deliberate deception. With any luck , the legislature will figure out the worth of a sturdy and technically powerful OLCC to the market as a entire, and will provide the OLCC with ample funding to retrofit its techniques and retain the services of a Main Information Officer.