Keep your Cannabis Business in Compliance – Mark Slaugh – CEO of iComplycannabis

Mark Slaugh

Many cannabis business owners focus only on the bottom line, serving their customers and generating revenue. But just as important as making money is mitigating risk. Mark Slaugh, CEO of gives us a brief on staying in compliance with regulators.

Click Here to Read Full Transcript

Matthew: I'd like to welcome to the show Mark Slaugh, CEO of iComply in Colorado. Mark, are you in Denver or Colorado Springs? I'm not sure.

Mark: Well, actually, I have offices in both cities. They are first and second largest markets in Colorado, and I'm kind of following where the business is. But we extended our Denver office in February.

Matthew: Can you give listeners a little bit of background on what I iComply does?

Mark: Yeah. I started iComply back in the year 2011, when I saw the need for commercial cannabis regulations and someone to really help hone in these businesses. Believe it or not a lot of marijuana operators kind of came from a different background than a regulated, licensed, and strictly controlled marketplace. So if all of the nuances ñ the rules that we have here in Colorado, we started our business with the understanding that with regulations naturally comes regulatory enforcement, and that if we want to keep violating federal law legally, we have to show compliance with state law.

Matthew: And how do individuals in the cannabis business demonstrate compliance?

Mark: Well, I mean, the biggest way is certainly by not getting in trouble. But that's the simple answer I think. More realistically how we show compliance in the long run is by showing that we're working the world of mitigation. In the laws here in Colorado, we have about 500 pages of rules. It's actually more regulations, I think, than even oil and gas. I often joke it's easier regulatorily speaking to frack in Colorado than it is too grow the hemp plant. But anyway you look at it, we have seed to sale tracking, and we have regular inspections by enforcement.

So certainly with our tracking software especially, which tends to be a hallmark of the industry regulations here in Colorado, and it's something that other states are looking at. We literally track every gram that is grown down to every dollar that is sold from the seed through the cultivation, through the harvesting, through the packaging and processing all the way until it reaches the point of sale. That entire process has various points of data that are collected, and this statewide system has to be used by every operator out there. So the system itself is a regulatory tool for enforcement so that they can analyze metadata from these operations and be able to tell when someone is out of compliance.

So in terms of the ability when you're being watched 24/7 on camera, those cameras record up to a period of a month and a week or 40 days, all of these business have faced intense scrutiny and can be caught at any moment if doing the wrong thing. Of course, all it takes is one employee not knowing what that one thing is. And so, that's where we really help work in the world of mitigation by training them up front, by ensuring the (indiscernible) was off, that their compliance was on, and can build a history of that compliance success over time, and that they have standard operating procedures that take into account compliance protocols so that they can operate in a fashion that is compliant an ensure that all their employees adhere to those SOPs.

Matthew: That's good to know. One thing listeners should understand is that Mark is talking largely about Colorado, but all these regulations in some fashion are coming to states where there's medical marijuana is legal or adult use, so this is very apropos to those other states outside of Colorado as well to kind of get a sense of what regulation looks like even though some of the details will be different for whatever state you're in. Now digging back into Colorado a little bit, I think it was 30 new regulations that were released a couple of weeks ago. Can you give us a little background on what those are exactly or what the highlights of those are?

Mark: Definitely. The few rules that were released a couple of weeks ago were just from the rule-making process. And as you get in regulations, no matter where you are in the county, and you can see sort of out here in Colorado rules coming out every month or every two months. So it's a pretty rapidly moving target and it changes pretty often. What they changed from a 30,000 level view are some pretty important areas: things like 30-day patient registration rule, which actually determines plant count in medical marijuana here in Colorado. For some odd reason the constitution limit 20, we tie our patient plant count to the number of patients that are registered with the center. So many other places operate in a similar model of cooperatives and that sort of thing.

The rule has changed so that those folks are now being tracked through the inventory compliance system known as METRIC. So the regulators have a really good understanding if patients are registered to multiple locations at the same time. And they're cracking down on that and reining that in, which of course on the production side reduces the amount of plants that any facility is able to grow, if they have patients that are registered to multiple facilities. That's a pretty big change.

Other things that we've seen come in this rule update deal with labeling and packaging. They're even debating now possibly color strips, stamping, shaping, and making edibles look at certain way and recently had a proposed edibles ban come out from the Colorado Department of Public Health and Environment, which we were successful in sort of beating back.

But here's the reactionary force to legalization that I think everyone really has to pay attention to. Some of the rules were really around production and inventory control systems for regulators. So not only can they control price through taxation and determining what supply and demand is, keeping a close eye on that, now they have mechanisms to also determine the overall capacity of production of each type and essentially now have the power to reign that in at any given point, and that operators aren't allowed to expand that in terms of their capacity for retail marijuana unless they can prove a running three-month period of selling at least 85 percent of what they had cultivated. So they really want to be able to warrant the demands of the marketplace not being by an oversupply of new market entrants and people growing and benefiting from the economy of scale. So we're starting to see the med put in regulatory tools to control supply and demand and inevitably price. The goal is to put out the black market, but at the same time ensure that we're not encouraging black-market, but such low prices that we incentivize out-of-state sales and diversion to minors.

Matthew: Just rewinding a little to what you said about edibles and beating efforts to ban edibles, was there some sort of other suggestion about making edibles look very distinct so there was absolutely no confusion about, hey, what you're about to eat is confused with THC? I heard some rumors about that, but I was wondering if you had any more details.

Mark: Yeah. We're just about to have a meeting here about 30 minutes to talk about industry groups out here. But we did on Friday have recommendations come to the enforcement agency and the regulators from the Colorado Department of Public Health and Environment. And one of the folks over there sort of blind-sided some of his colleagues by recommending that all edibles either be lozenges or tinctures, period. No more cookies, no more brownies, no more candies, no more soda pops, no more drinks, with the concern around the Halloween fear that somehow kids are not going to be able to tell the difference. We have hashed this out before having dealt with the public CDPHD and the Colorado Department of Public Health and Environment. As well as Children's Hospital here in Denver really focused around how do we prevent accidental ingestions or people not being able to tell the difference between a regular candy and a marijuana candy. And so, there's where the policy discussion lies and really the most effective solutions are the things we've done already, which is child resistant packaging, labeling, and education.

And our packages actually have to be okayed so they can't even see the gummy bears inside the bottle for example. It would look like any other pill bottle. So the concern from sort of the traditional prohibition is from the CDPHE recommendation were really in the realm of getting rid of getting rid of all those other products so that there as no confusion, and there simply would lozenges and simply be tinctures for every business model out there. So some questions whether or not that's constitutional and certainly whether or not it's even effective public policy is in the realm of accidental ingestion. You have between a million, a million and a half, two million products, be issued here in Colorado since the start of retail marijuana in January. And during that time, we've only had nine children end up in the hospital.

If you look at the rate of accidental ingestion to the number of products that could potentially be eaten accidentally, I think we're having a better track record than prescription pills, probably cleaning supplies in people's homes, let alone anything else a kid can tend to pick up and put in their mouth. So far the question really then, I think, becomes how much more effective is regulation like that banning cookies or drinks or going to be in preventing such a low accidental ingestion rate anyway? And we have to look at that in the context of people's ability to operate in the market place and also what consumer demand is. Cookies and candies aren't just for children. Seventy-five percent of adults consume candy. So where do we draw that line? How do we make that distinction beyond what we've already done when sort of the reactionary force to a kid ending up in the hospital for eating a gummy bear tends to be a lot more extreme than other industries that maybe facing some more challenges than accidental ingestion.

Matthew: Can you give and overview of what responsible vendor training is, and how iComply can help with delivery of that for people who have no idea ñ I know responsible vendor training exists in other industries besides cannabis but just give an overview of what that term means, and then what kind of training is given for people in the cannabis industry to satisfy the responsible vendor training?

Mark: Absolutely. It does exist in other industries. A lot of people know it from the alcohol industry as sort of the TIPS program. But it's essentially training for frontline bud tenders, owners, and managers of the dispensaries. It teaches them the overall view of what cannabis is, what it's effects are, and how to educate people at a standard level that is not just compliant with the rules and regulations. There are some components and compliance there that is also in the realm of responsibility. So just like we would teach a bartender not to over serve, or not to not serve to intoxicated persons, or how to check IDs, we're doing very similar training for the workers in the field.

With the influx and demand for labor since retail has exploded in business, we don't want a lot of qualified persons out there. So we have been extremely busy at iComply doing our responsible vendor training. We've actually had a course in place around compliance since around 2012. So we've been there for a little while in terms of training and certification. So we have a comprehensive compliance course that's sort of our flag ship bread and butter that a lot of people know us for and love us for. And then we also have our responsible vendor training program which is MITS and the new rules that they just came out with a couple of weeks ago in the process of developing approval programs around.

Matthew: Okay. Is that primarily ñ does that mitigate the risk of the business owner again back to that point? So an employee takes the responsible vendor training, something ends up happening down the road, and you could say, look, we did take the steps required to ensure this employee had all the information they needed. It's just that a mistake was made somehow?

Mark: Yeah. Exactly. There's some state statutes on the books since about 2012 that have really outlined this process program as something that can mitigate those offenses. So it will be a lot smaller slap on the wrist if an owner or bud tender or someone under them mistakenly or even on purpose secondly has a violation of any sort. And so, yes, it does kind of provide that for a of line defense for the business as well. And it reduces product liability and other factors that might be outside of the regulatory regime.

Matthew: And so, a new employee comes on. Let's say a bud tender, how long does the owner ñ business owner have before that employee needs the training?

Mark: Yeah. They have a 90-day window to get that employee trained. We hold our supplementary courses once a month, so there are at least two opportunities there get that particular employee up to speed.

Matthew: What do you think the biggest mistake is that owners make in the compliance arena?

Mark: I think it's assuming they won't be caught. Lots of times we're coming from a mentality that's hard to change. I think the biggest mistake is instilling a mentality of irresponsibility and sort of hiding from the law. I don't mean to say that about everybody out there. I think the industry is certainly becoming a lot more professional and growing up very quickly. But there tends to be an old school mentality certainly in places without a lot of robust regulation and certainly even here in Colorado where we've had to mature very quickly. I still see in particular operations biggest mistake being we can do this, this one time. And we can kind of get away with this. And don't worry, they're never going to come through and catch us. And so, you get a little bit lax over time because you're really worried about patients and plants and all of the operational things that go into running a business.

Compliance tends to be an extremely important detail that gets overlooked. And when you're starting to sow a culture of non-compliance because of excuses or rationale around it, that's often times, I think, that's the most fatal mistake owners can make. And I've seen some very drastic action be taken by regulators. They catch these folks with their pants down. And if you don't really understand the realm of what that compliance world looks like, there's a lot of risk being run in terms of non-compliance, and the costs involved in that are pretty hefty. I think that tends to be the biggest mistake is guys just assuming they know what they're doing.

If it's ñ we have a running joke that every grower is the best grower and every owner is 100 percent compliant. We've never walked into a facility that's been 100 percent compliant. It's always something. There's always some detail. And with as many regulations as we have, it's no surprise. It's all these new markets coming up. It's really important that they design and implement their systems, and their process, and their procedures, and their people into that keeping compliance in mind not as the last detail, but as the most important detail up front.

Matthew: Right. So I'm hearing you need a good offense, but also a good defense. I mean, a lot of business owners are really good at the offense, the cultivation or the dispensary piece, but they're not looking at the defense part, and that's just as big a part of the game. And by ignoring it doesn't mean it's not there, it's just you're exposed even if you're not aware of it. So those are good points.

Mark: Exactly. And no matter how good your product is, how awesome you people are, how many awards you win, all of that is at risk and can go away because somebody didn't know what they are doing or because there's some misunderstanding or some detail got missed. The entire world is helping manage those details and organize those structures so that compliance becomes something that is instilled as a culture within the organization and everybody holds each other accountable because not a single person can be responsible for the amount of compliance we have to deal with.

Matthew: Where do you see compliance and compliance training in the next two to three years? I mean, it's changing very quickly, but what's your best estimation of where we're be?

Mark: I think it's an absolutely necessity. It's just a question of whether or not owners recognize it. And those that are out ahead of the curve and see where the puck is going to be played are going to be in a better position to manage it and to take it seriously. But when you're monitored on cameras all the time just like in the casino world, you don't see 1,000 different casino operators. You see a very select few know how to handle it and do it right. And so, I think in a lot of ways compliance can be a bit of a threat to those folks out there that can't make that paradigm shift . And it really is a market that's starting to consolidate into medium and large-scale players.

I think training becomes an absolute necessity. The more businesses you have, the more employees you have, the higher turnover rate you have, the more transactions you have going on, the more risks you're running. And if you really understand the defense part of that, you begin to mitigate the risk and make sure that you have systems in place to handle that, and remediate it. There is no non-compliance. All of that becomes the realm of this new highly regulated industry. Besides, I think it will be a pretty big business in terms of training because it's going to be necessary for everyone coming in. If you're going to play the game, you've got to know the rules to the game.

Matthew: Do owners of infused products businesses have more or different kind of risk in general that's not as well understood compared to cultivators or other ancillary businesses?

Mark: Oh yeah, absolutely. In the extraction realm especially when you're dealing with solvents and flammable solvents, in dealing with bomb-proof rooms that are dictated by Denver Fire, there's a lot of compliance that goes into what it takes to extract using butane, propane, CO2 under heavy pressure. So there's a lot of regulations that go especially into the extraction realm just around safety. And there's also a lot of regulations that go into the food processing realm just around safety.

So marijuana-infused product manufactures in Colorado have to take Serve Safe Training. It's required, where it's optional in restaurants. They have to have inspections. They have to be OSHA compliant. There's a lot of other regulatory agencies that overlook them like health and safety in Denver and fire departments to ensure that they're not going to explode like we've seen a lot of hash explosions out there. So everyone has to have a separate enclosed room that they extract in. It has to be bomb-proof and rated that way. It also has to meet up to physical engineer certified industrial hygienist standards locked in the facility. All the equipment has to be enclosed loop extraction. It has to be UL listed or ETL listed. So there's a whole lot that goes into that whole realm to protect workers.

There's training programs that have to be instilled, documentation that has to be kept that everyone is adequately trained. There's a lot that goes into just the infused-products manufacturing realm that I don't think a lot of people are thinking about right now. In California and Washington there's a big learning curve there. There's quite a bit of expense that goes into it, and a lot of nuances especially when you're tracking production batches from your harvest batches. And in terms of how that comes out, I know Colorado is rolling out testing results as well. So you have contaminate testings and potency testing. If you fail your testing, you're destroying your entire batch, so your product is at risk of being completely lost, which is another big concern that bolt pros and MITS serve products are going to have to be aware of.

Matthew: Mark, as we close, how can listeners find out more about iComply?

Mark: You're welcome to visit our website. It's You can also send me an email at We're happy to answer any questions and take a look at sort of what the next horizon might be for those listeners out there.

Matthew: Thanks so much, Mark, for the brief today. We really appreciate it.

Mark: Thanks for taking the time. We look forward to doing it again.