Organization: | Office of the State Auditor |
---|---|
Date published: | September 26, 2023 |
Executive Summary
In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of the Cannabis Control Commission (CCC) for the period January 1, 2019 through December 31, 2020. The purpose of our audit was to determine whether CCC ensured that recreational marijuana products sold met the safety standards required by the following:
- Sections 15(a)(1) through (3) of Chapter 94G of the General Laws;
- Section 500.160(1) through (4) and (10) of Title 935 of the Code of Massachusetts Regulations, which was in effect during the audit period; and
- CCC’s “Protocol for Sampling and Analysis of Finished Medical Marijuana Products and Marijuana‑Infused Products for Massachusetts Registered Medical Marijuana Dispensaries.”
Below is a summary of our findings and recommendations, with links to each page listed.
Finding 1 |
CCC did not identify all products considered expired and prevent their sale to consumers before they were retested. |
Recommendation |
CCC should develop and implement monitoring controls to identify all products with materials that were last tested more than one year ago and prevent the sale of those products to consumers. |
Finding 2 |
CCC did not ensure that marijuana establishments (MEs) and independent testing laboratories (ITLs) properly reported marijuana products that tested positive for pesticides. |
Recommendations |
|
Finding 3 |
CCC did not provide cybersecurity awareness training to its employees. |
Recommendation |
CCC should ensure that all new employees receive initial cybersecurity awareness training and that all employees complete annual cybersecurity awareness training thereafter. |
Table of Contents
- Abbreviations
- Overview of the Audited Entity
- Audit Objectives, Scope, and Methodology
-
- The Cannabis Control Commission Did Not Identify All Products Considered Expired and Prevent Their Sale to Consumers Before They Were Retested
- The Cannabis Control Commission Did Not Ensure That Marijuana Establishments and Independent Testing Laboratories Properly Reported Marijuana Products That Tested Positive for Pesticides
- The Cannabis Control Commission Did Not Provide Cybersecurity Awareness Training to Employees