JLARC I-900 Subcommittee - Public Hearing
(November 6, 2024)

Here are some observations from the Wednesday November 6th Joint Legislative Audit and Review Committee I-900 Subcommittee (JLARC I-900 Subcommittee) Public Hearing.

My top 4 takeaways:

• The Office of the Washington State Auditor (WA SAO) was authorized through Initiative 900 to conduct agency performance audits and make recommendations; staff brought those suggestions to legislators, the Washington State Liquor and Cannabis Board (WSLCB), and the public at Joint Legislative Audit and Review Committee I-900 Subcommittee meetings.
  • The first WA SAO performance audit of legal cannabis regulation was presented in 2018, titled “Improving Cannabis Risk Management Tools Using Business Transaction Data.” WA SAO framed their work as advising WSLCB to “develop and automate risk management tools that could use existing tracking data to identify potentially illegal transactions.”
    • WA SAO staff also noted they would “consider the obstacles the agency encountered in” establishing automated risk management tooling, and “how it currently ensures efficient, targeted, industry regulation to minimize criminal activity. In particular, the audit will evaluate how LCB prioritizes its enforcement and audit activities to minimize illegal production and diversion of cannabis products to the black market.”
  • Auditors undertook a second, follow-up audit of WSLCB use of traceability and data reporting platforms—the subject of the presentation and public hearing on Wednesday November 6th—to ascertain agency progress towards implementing the WA SAO recommendations from 2018.
  • JLARC staff had been previously tasked to review expenditures from the dedicated cannabis tax revenue account and would be undertaking an analysis of cannabis production capacity.
    • On January 4th, JLARC staff presented a final report on “Appropriations and Expenditures of the Dedicated Cannabis Account,” building on a preliminary presentation in November 2023.
    • SB 5080, signed into law in May 2023, instituted many changes to the social equity licensing program and specifically instructed JLARC staff to determine “whether current levels of cannabis production align with market demand and capacity, including the impact of any additional cannabis producer licenses granted under the legislation.” A final report was due by June 30, 2025.

• WA SAO staff presented their follow-up report on the WSLCB traceability performance audit, including barriers identified and actions taken by regulators.
  • WA SAO Senior Performance Auditor Emily Cimber, who led the effort, contextualized the performance audit evaluating Washington state oversight of the cannabis industry (audio - 3m, video - TVW, slidedeck).
    • Cimber noted this was a follow-up to the 2018 audit intended to determine “what if any barriers has the Liquor and Cannabis Board faced in implementing effective risk management methods to reduce risks identified during our previous audit, and what methods has the agency used to ensure it effectively prioritizes its enforcement activities.”
    • Cimber noted the audit found WSLCB was “still limited in its ability to efficiently address risks” such as product diversion—which traceability regulations had been specifically designed to prevent—along with fundamental activities such as “collect[ing] taxes and ensur[ing] product[s are] safe for the public.”
    • According to Cimber, there had been significant leadership turnover at the WSLCB since the previous audit, and “its current executives have inherited many of the ongoing issues that we’ll discuss.”
  • Performance Auditor Jolene Stanislowski discussed barriers the agency faced implementing recommendations from the 2018 performance audit (audio - 8m, video - TVW).
    • The 2018 audit report recommended WSLCB staff “devise methods for leveraging their data system through automated alerts to better manage risk and help enforcement efforts,” Stanislowski said. However, she stated the agency encountered several barriers, including “difficulties in both project and vendor management limitations with the current cannabis data system and resource constraints due to” the ongoing systems modernization project (SMP).
    • Stanislowski explained that the board was forced to quickly find a replacement for its previous traceability platform—BioTrack—in 2018. The second vendor, MJ Freeway, “suffered a number of project management and implementation issues,” she acknowledged, making reference to a 2020 report from the Washington State Office of the Chief Information Officer (WA OCIO) and through interviews with LCB staff who worked on the project.
      • Glossed in the WA SAO report, a Contingency Reporting System (CRS) was developed and deployed by WSLCB staff as an emergency data reporting solution during the transition between BioTrack and MJ Freeway. In 2021, staff developed that system into the Cannabis Central Reporting System (CCRS).
    • Stanislowski identified issues with the MJ Freeway vendor relationship including:
      • “Expedited procurement”
      • “Insufficient expertise”
      • “Lack of scope buy-in from users and subject matter experts”
      • “A focus on deadlines over deliverables and accountability”
      • “Contract management issues”
    • After LEAF Data Systems, WSLCB “deployed a stop gap system known as CCRS, to at least gather licensee data,” Stanislowski said. The platform was intended to be temporary, she noted, but remained “LCB’s only data system to track cannabis.” CCRS had been updated since first being deployed at the end of 2021, but she claimed the system still had limitations such as a lack of real time data, the inability for licensees to view or correct uploaded data. She alleged CCRS couldn’t track cannabis from “seedling to the product on the shelf.”
    • Additionally, Stanislowski remarked that CCRS had “limited data input safeguards to prevent erroneous data entry.” She explained the limitations resulted in unreliable data for enforcement staff and made conducting product recalls “cumbersome.” Along these lines, Stanislowski mentioned advice from the U.S. Government Accountability Office which recommended government systems have controls to help ensure the accuracy of input data and “facilitate timely resubmission of corrected data.”
    • The SMP at WSLCB—at publication time in its third iteration—was taking priority, and Stanislowski had been told that a CCRS replacement was not expected to be fully operational until 2031. Surfacing similar project management problems as the LEAF system, she noted there had been poorly defined scope and incomplete vendor management plans for the SMP. She credited WSLCB steps to improve project management, but claimed CCRS suffered from an absence of “agency wide project management guidance” and staff had “not yet defined requirements of what’s needed in a new tracking system.”
    • Stanislowski argued another challenge at WSLCB was “consistent leadership” given significant turnover among senior ranks in the preceding several years, which would presumably help to “ensure agency goals and project plans are executed as intended.” She said the WSLCB experienced turnover in more than a half dozen executive positions, including those “responsible for the LEAF project,” and claimed their successors had indicated they were not made aware of the 2018 performance audit nor the WA OCIO lessons learned report regarding the LEAF project failures.
      • Enforcement and Education Director Chandra Wax resigned the same day as the JLARC I-900 Subcommittee public hearing after nearly four years at the agency.
  • Cimber then described WSLCB efforts to address risks identified in the 2018 audit, including steps the agency had taken to be more proactive in its enforcement approach and the development of automated alerts (audio - 4m, video - TVW).
    • Cimber said agency leadership had made some improvements to its enforcement processes, but were “still limited in their ability to address risks as efficiently as it could.” After the initial audit, she relayed that WSLCB changes had been made to help ensure complaints that posed the greatest risk to public safety were addressed first, while “those that are more regulatory in nature can be managed by compliance consultants.” Cimber told lawmakers WSLCB had also begun to use compliance consultants when conducting premises checks to confirm businesses met requirements, and to “identify possible signs of diversion.”
    • Moreover, other organizational changes were made to facilitate proactive enforcement, such as emphasizing prevention and education with licensees and moving data specialists known as examiners to the Enforcement and Education division. She also credited the agency with making a more automated approach to identifying risk, stating WSLCB had started to develop automated alerts following years of struggling to put the 2018 audit recommendations in place. Available alerts notified staff in the event licensees do not report any activity or when there are failed lab tests, but “don’t address most of the risks our earlier audit identified.” Cimber claimed the thresholds used in the new alerts were “arbitrarily chosen” while policies and procedures had not yet been developed around the alerts, which rely on data that “is not consistently accurate.”
    • Cimber suggested general agency enforcement efforts were “constrained” by high staff turnover and reduced staffing in enforcement officer positions. She reported that the average annual turnover for cannabis enforcement officers in 2022 and 2023 was about 50%, and a third of those positions were vacant in November 2023 resulting in the LCB not meeting some of its internal performance goals.
    • Based on audit findings, Cimber commented recommendations had been made in four categories:
      • Ways to improve CCRS
      • Project management improvements
      • Formalization of project management guidance
      • Development of more formal guidance for prioritizing risk and using 2018 audit recommendations to develop future alerts
    • Cimber told the subcommittee members that the WSLCB hadn’t been able to implement a robust cannabis tracking system for the past 12 years, the recreational market continued to change, and the audit report “really is a framework that leaders such as yourselves can use to engage with LCB to establish clear goals for ensuring accountability in the recreational cannabis system.”
  • Senator Shelly Short asked if the challenges the agency faced with its cannabis tracking system were more pronounced with the recreational market than the commercial market. Cimber responded that, “I would say it's the same for both” (audio - 1m, video - TVW).
  • Representative Gerry Pollet was curious “what's the obstacle to implementing something much more soon” than 2031, and did “licensees pay for this system?” Cimber deferred to WSLCB panelists (audio - 1m, video - TVW).

• WSLCB panelists explained where they agreed with the WA SAO recommendations and acknowledged Cannabis Central Reporting System (CCRS) limitations, but said agency staff had other tools to regulate the cannabis industry before describing efforts to improve project management and plans to procure a new traceability system.
  • WSLCB Board Chair David Postman said he agreed with some of the State Auditor’s Office recommendations, but cautioned he believed auditors were "conflating shortcomings with one tool we use with a failure to regulate cannabis” (audio - 6m, video - TVW).
    • “Our concern is that readers of this audit report may incorrectly infer that the agency [had] not prioritized the traceability or regulatory functions that are enacted in law. This could not be further from the truth,” Postman read from the official agency response to the audit. He also referred to an editorial about the audit headlined “State falls short in promise to regulate cannabis” as being “very, very far from the truth.”
    • Postman conveyed that while he wished CCRS was more robust, its limitations did not mean the WSLCB hadn’t enforced cannabis regulations. “Since the 2018 audit, we’ve issued more than 150 administrative violation notices for traceability noncompliance [which] vary in terms of severity and importance, but clearly we have tools that are working, and we’re able to enforce the regulations and move towards compliance,” he said. Postman reported how the agency approach to enforcement changed after 2019 in response to legislation that emphasized compliance and education with greater focus on public safety violations. This adjustment in enforcement brought about a “major shift.” In 2019, 82% of violation notices were related to public safety and that proportion was raised to 90% in 2023.
    • At the August 14th meeting of the WSLCB Executive Management Team (EMT), Enforcement and Education Manager Matthew McCallum gave a presentation describing how his team and other divisions had been working to identify “suspicious activity” and investigate it. Postman lauded the presentation as “a great example of the really detailed, innovative, and even handed public safety focused investigative work that we do.”
    • Postman also asserted WSLCB was making changes to CCRS, and one of the things he’d learned from the audit was how the examiners, Enforcement and Education team, and IT team maintained “a running list” of ways to make that system more usable. He contrasted this with the 2018 recommendations, which he said focused on a system that “just doesn’t exist today.” He disagreed with the sentiment that WSLCB leaders chose not to implement prior recommendations, stating “the situation changed so quickly after that, that those recommendations were on something that we didn’t have in front of us anymore.” His view was that WSLCB switched to a new system where the vendor's performance contributed to overall issues. Nonetheless, WSLCB had made “major changes in our management of projects” like traceability, argued Postman
    • In response to a prompt from committee Chair Mark Mullet, Postman said money, personnel, and the SMP were the main constraints preventing the implementation of a new tracking system before 2031. He emphasized having a 2031 timeline “doesn’t mean we’re going to do an RFP in 2030.” As agency leaders continued to improve CCRS, Postman regarded the input of auditors as a sign there should be “clearly a renewed effort” to make changes around cannabis traceability. He predicted agency officials would “do serious stakeholder work,” ahead of issuing a request for information (RFI) for a new system (audio - 3m, video - TVW).
    • As WSLCB attempted to be “nimble” in response to the Legislature’s direction about enforcement and changes to the cannabis industry, Postman framed the audit as helpful in understanding the history of the project. He appreciated the professionalism of the auditors even as he had concerns over their evaluation of the agency’s enforcement work since 2018. He still regarded WSLCB as having one of the “better systems working in the country” (audio - 1m, video - TVW).
  • WSLCB Director of Legislative Relations Marc Webster offered similar criticisms of the WA SAO report’s conflation of “traceability with regulation”(audio - 2m, video - TVW).
    • “We have a comprehensive system of regulation and enforcement, and we need and are working on a better traceability platform, but that overarching system does remain robust while we do so,” Webster said. He pointed out that the agency regulatory work involved “not only CCRS, it's the examiners, the chemists, the education team, the enforcement officers, finance auditors outside of the division that regulates that market very well… including using CCRS to highlight potential discrepancies and spur investigations.”
    • Webster stated that although the timeline for implementing a new tracking system was pushed out to 2031, it didn’t mean the agency wasn’t prioritizing that effort. “We got directives and funding from the legislature to do [SMP], and I think that's because the legislature saw the value in replacing some very, very outdated systems that go into licensing,” he said. Webster added that the WSLCB was thankful for the recommendations and was working to implement some of them.
  • WSLCB Chief Financial Officer Rachel Swanner described WSLCB efforts to improve project management and implement enhancements to the CCRS system before procurement of a new traceability system (audio - 5m, video - TVW).
    • While WSLCB was “a small agency” and had already been working on several WA SAO recommendations regarding project management—which Swanner noted included operating procedures and a central project management office—she disagreed with the audit’s description of a “failure in project management” at the agency. Swanner indicated the main issue was the vendor MJ Freeway who did not implement the WSLCB’s requirements correctly and made changes to the system without the agency’s approval. She told lawmakers this led agency leadership to implement CCRS to maintain regulation even if it wasn’t “the best system in the whole world.” Regardless, she said staff had “been implementing a lot of enhancements to the system and working on those alerts that the auditors described.”
    • Swanner relayed that WSLCB had a list of at least 20 alerts staff were working to implement in phases. The Director had hired a project manager to oversee traceability who was involved in meetings about potential CCRS enhancements. She also noted a Request for Information (RFI) had been issued, and an updated RFI would be issued in the future. In reference to a graphic about misreported sales, Swanner stated that the erroneous data had been first caught by WSLCB financial analysts and the agency hadn’t disclosed invalid information in their annual reporting. “I think there’s checks and balances in place,” Swanner argued, while acknowledging “they may not be as modern as some of the newer ERP [enterprise resource planning] systems around that are catching some of these within the system, instead of using manual analytics.”
    • Swanner concluded her remarks by thanking the State Auditor’s Office for “all the good field work, and it’s really going to help us get forward to a new system that’s going to allow us some real technology to better regulate and…to better audit the system.”

• Two members of the public offered testimony related to the performance audit and a cannabis trade association submitted written remarks.
  • Cannabis Observer Founder Gregory Foster provided context on prior WSLCB efforts to engage stakeholders in the cannabis industry on traceability and offered recommendations to improve the CCRS system (audio - 6m, video - TVW, written comments).
    • Foster shared his background in computer science and noted he’d participated in three traceability work groups at WSLCB, encouraging members to review the proceedings of the Traceability 2.0 Work Group which met between September 2019 and March 2021. He noted that March 2021 had been a tumultuous month when WSLCB leaders committed to updating the prior Contingency Reporting System into CCRS, setting aside the work and recommendations of the agency staff and stakeholders who had labored in the group. However, these insights remained helpful for any future traceability platform procurement as “a lot of that [stakeholder] work's already been done, a lot of those conversations have already been had, and it's already known.”
    • Foster assumed they were “stuck with CCRS until 2031,” and recommended the agency implement an API interface to their system so real time data ingestion, feedback, and analysis could occur as recommended by the auditors. He also encouraged the agency to leverage the data exchange standards created by the Washington Cannabis Integrators Alliance in the absence of a centralized traceability platform to gather validated data including product lab testing results.
    • “And finally, one thing that’s really kind of lost in all of this, when the decision was made to move away from BioTrack and go with another vendor, the apparently successful bidder announced by the agency” had been Metrc, yet “they didn’t get the contract,” Foster said. He called for the committee to investigate the reasons why Metrc was not awarded the contract in 2017 and determine if those reasons were still valid.
  • Jim MacRae, Straight Line Analytics Principal, criticized agency efforts to implement a cannabis tracking system, saying they had a history of removing data and capabilities that shed light on shortcomings while deflecting blame for failing to implement the recommendations from the 2018 audit (audio - 7m, video - TVW).
    • MacRae conveyed he was impressed with the 2018 audit report and recommendations to utilize traceability data to make enforcement more efficient and effective. MacRae mentioned having testified at the earlier public hearing on that report, having warned the agency to get risk management planning in place because there was a strong possibility the LEAF system would fail.
    • MacRae said of the 2024 audit report: “It is a very good, feel good document where one can blame others, one can blame staff turnover, none of which presumably was surprising.” He alleged any “functioning organization” would have transition plans in place when retirements were coming, especially for key project oversight roles.
    • MacRae claimed the WSLCB had a history of removing data resources and capabilities when that information could lead to scrutiny of the agency, noting the agency had previously published a data dashboard on cannabis which was removed mid-2017. He stated the data from the BioTrack system that was being displayed on the dashboard showed production levels in the industry were exceeding sales levels in the regulated system, which he indicated suggested diversion.
      • 2024 legislation, HB 2182, “Creating a data dashboard to track use of regulated substances,” proposed statutory language to require a new data dashboard by WSLCB. The bill was passed by the Washington State House of Representatives (WA House), but not the State Senate.
      • On August 7th, the WSLCB Research Program hosted a closed focus group for public health and prevention representatives to gather their input on the creation of data dashboards by agency staff. The team released a data dashboard development plan and gave a live preview of a prototype during a presentation to health officials on September 4th. The staff notes and Research Program presentation from the quarterly—and again closed—Public Health and Prevention Roundtable on October 21st also included an update on the dashboard project.
    • MacRae claimed that the WSLCB, the Washington State Office of the Attorney General, and the federal government all stated that seed-to-sale traceability was an integral part of a well-regulated cannabis market, and yet “LCB has really fallen flat on its face on all of those things.” Feeling that committee members should be put off by the agency’s failure to deliver an outlier assessment capability in six years, MacRae regarded leadership linkage of SMP with traceability as a deflection, stating, “This agency does not manage public funds well, they do not manage projects well…you may see that there are some dangers of that even being done by 2031, it's certainly falling behind.” He concluded, “With all due respect, I think you've basically been lied to today.”
  • In written comments shared with the subcommittee, The Cannabis Alliance Executive Director Caitlein Ryan wrote that CCRS was inadequate and recommended enhancing the system through comprehensive data aggregation (written comments).
    • Ryan stated her group had been engaged with traceability changes since the beginning, serving on work groups and acting as both organizers and participants in industry-led solutions during times of transition. She said the latest audit brought to light that CCRS was unable to meet Washington's regulatory needs effectively. "Although the audit suggests that CCRS was intended only as a stopgap and that failure to implement a permanent solution reflects project management challenges, [WSLCB] initially presented CCRS as a self-reporting system that, with incremental improvements, could fulfill long-term tracking requirements," Ryan wrote.
    • According to Ryan, Cannabis Alliance members strongly recommended focusing on enhancing the current system through comprehensive data aggregation rather than pursuing a costly, high-risk vendor contract. "A data aggregation model within CCRS could address many of the key issues identified by recent audits and provide an efficient, state-owned solution tailored to Washington’s unique needs," Ryan wrote.
    • Ryan commented this approach within CCRS could improve data accuracy, reduce dependence on third-party software, minimize operational downtime, reduce the burden on licensees, and allow for immediate incremental improvements. She indicated comprehensive data aggregation into CCRS would allow “Washington State to maintain control over critical data infrastructure, supports industry compliance, and upholds public safety, all while avoiding the high costs and long timelines associated with external vendors," Ryan wrote.