Why Workforce Risk is Real and What it Means

Every conversation about cannabis risk follows the same script: Regulatory uncertainty, 280E, capital access, and maybe interstate commerce, depending on the room. None of that is wrong, and operators dealing with those pressures daily don’t need me to tell them they’re real.

But after more than a decade working inside this industry, watching companies scale, stumble, and sometimes collapse, I’ve come to believe the industry is looking in the wrong direction. The risks getting the most airtime are not the ones most likely to take a healthy cannabis company down. The risk that actually keeps me up at night is quieter, and it’s been there the whole time.

It lives on the floor of your dispensary, in your cultivation facility at shift change, and at the moment a new hire decides to skip a step because no one told them why it mattered. The cannabis industry has built compliance programs. It has not built compliance cultures. And that gap is about to get a lot more expensive.

The Policy Problem

Over the past several years, cannabis operators have invested heavily in what looks like compliance: SOPs, legal counsel, documentation frameworks, and licensing strategy. Those investments made sense. In the early days, getting and keeping a license was the whole game.

But here’s what I’ve watched happen over and over: a company builds out a solid policy framework, puts it in a binder, and then hires thirty people in ninety days to open a new market. The training program becomes whatever the most experienced employee on shift decides to show the new person. Two locations run the same process differently, and somewhere between the SOP binder and the actual shift, the gap opened up without anyone noticing. The person carrying out the policy matters as much as the policy itself, sometimes more.

Cannabis built its workforce fast, under pressure, in markets that were still figuring out their own rules. Getting licensed was survival. Everything else got scheduled for later. For a lot of operators, later still hasn’t arrived, and the environment they’re operating in now is considerably less forgiving than the one where those habits formed.

Where the Risk Actually Lives

Let me get specific, because “workforce risk” is the kind of phrase that sounds important and then gets ignored.

The first place it shows up is inconsistent training. Not every location runs the same onboarding. Many operations rely on shadow training:  a new hire follows a veteran around for a day and absorbs whatever that person happens to do, shortcuts and all. When a company has two or three locations, that’s a manageable problem. Across twenty locations, those inconsistencies have quietly been compounding for months before anyone realizes how far they’ve spread.

The second place is role ambiguity. In a busy retail or production environment, compliance steps get diffused across a team in a way that’s easy to miss from the outside. Ask any budtender who’s responsible for a specific compliance step, and they’ll name someone else. Ask that person, and they’ll name a third. Nobody’s being dishonest; the accountability was never clearly assigned in the first place, so the task gets passed around invisibly until a regulator walks in and asks to see something nobody thought to keep.

Third is the absence of real-time oversight. Most managers find out a process broke down the same way they find out anything went wrong; someone tells them, or a regulator does. Silence reads as confirmation, and small process failures get absorbed into the daily rhythm until an examiner gives it a name and puts it in writing.

And finally, documentation gaps. I’ve sat with operators who ran genuinely clean operations for years and still got burned during an audit because they couldn’t prove what they did. In cannabis, if it isn’t documented, it didn’t happen.  

Why the Industry Let This Slide

There’s a reason this problem persisted without much pressure to fix it. For most of cannabis’s regulated history, the threat profile was external: regulators, banks, legislators. Internal execution quality only mattered when something went wrong publicly, and plenty of operators got through their early years without that happening.

The growth phase made things worse. Hiring consistently outpaced the infrastructure needed to support it. I’ve watched operators open four new markets in a year and call it momentum,  and they weren’t wrong; it was momentum. What it wasn’t was sustainable. 

The training shortcuts taken in month one, the role ambiguities that never got resolved, the documentation habits that never got standardized,  those decisions tend to surface as audit findings two or three years down the road, long after the people who made them have moved on.

As operations spread across multiple states, the compounding effect becomes harder to ignore. A training inconsistency at one location is a correctable problem. The same inconsistency running quietly across twelve locations is a systemic pattern, and that’s a different conversation entirely, one that regulators and, increasingly, investors are starting to initiate.

The Stakes in the Next Phase

Two things are coming that will put a premium on operational maturity in ways the industry hasn’t fully absorbed yet.

The first is federal normalization. Whether that takes the form of rescheduling, expanded banking access, or something more comprehensive, broader federal involvement means more agencies paying closer attention to how cannabis businesses actually operate,  not just whether they hold a valid license. Labor compliance, operational consistency, and documentation standards will all face a higher bar than most operators are currently meeting, and the gap between where companies are and where they’ll need to be is wider than the industry tends to acknowledge.

The second is institutional capital. Sophisticated investors don’t underwrite revenue alone; they underwrite systems. Founders who’ve been the institutional memory of their own company for years tend to discover this late. An investor wants to see a business that runs on systems, not on whoever happens to know where the bodies are buried.

Auditability means the process exists independent of the people, that compliance is documented, ownership is clear, and nothing critical lives exclusively in someone’s head because they’ve been around since the beginning. A company running on tribal knowledge and informal processes will have a hard time surviving that level of scrutiny regardless of how clean the financials look, and the operators who haven’t built the infrastructure to demonstrate operational maturity will find themselves at a significant disadvantage when that capital starts moving.

What the Shift Actually Requires

The mental model has to change, and that’s harder than updating a policy document.

Real compliance isn’t a document you point to during an audit — it’s what happens on a Tuesday afternoon when nobody’s watching. 

The person hired last week either knows what to do and why, or they don’t. The manager either checked or assumed. Location seven either runs the process the same way location one does, or it runs something that drifted into place over six months of shadow training, and nobody caught it. Closing that gap means building training that holds regardless of who’s running the shift, assigning ownership over compliance tasks clearly enough that nothing gets quietly passed off, and connecting the systems that track workforce activity to the ones that track compliance outcomes before an auditor makes that connection for you.

None of that happens through a single initiative. It accumulates through decisions made during the hiring, onboarding, and daily operational stages, and it is built into how the business actually runs rather than layered on top of it when an audit approaches. The companies that develop this kind of operational discipline won’t just carry less risk. They’ll be more legible to institutional capital, more resilient when regulators come through, and genuinely easier to scale because the foundation doesn’t crack when new locations are added.

The industry spent its first decade doing whatever it took to get open. The operators who define the next decade will be the ones who built organizations disciplined enough to stay open, grow without breaking, and prove to the outside world that cannabis can be run like the serious business it has always been.

The post Why Workforce Risk is Real and What it Means appeared first on Cannabis Industry Journal.